I tried it on Opera and it detected no apps installed. (On Edge however, it detects all the ones I do indeed have installed).
This is interesting since I didn't really expect Opera to care about this kind of thing.
Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
51–60 of 213 posts
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#52Earlier quoted context omitted.
I guess (and just that), that this can happen if there are overlaps in the scheme handlers. I.e. there are some schemas which lets say XCode handles but which also some other program handles.
Yeah makes sense if it's the schema handlers. I'd just not be as assertive if I was them that something was installed if there was overlap.
It also doesn't work at all under Chromium for Linux no idea why but the result is complete garbage.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#53Worked perfectly on Firefox 88.0.1 on Windows. Great to know despite my efforts to balance privacy and anonymity, there is another metric that I'm unique in. Fingerprinting is just insidious.
Browsing in a VM is really one of the only safe ways to go on the modern web for privacy. So many sites break without JS, and having it enabled is an accident waiting to happen. When you need privacy, always browse in a VM or a Tails boot.
Even in a VM you have to carefully ensure that memory deduplication is disabled, and/or some form of mitigation against Rowhammer is in place. Else you will be vulnerable to Flip Feng Shui cross-VM attacks.
https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events...
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#54I tried it on Opera and it detected no apps installed. (On Edge however, it detects all the ones I do indeed have installed). This is interesting since I didn't really expect Opera to care about this kind of thing.
Thanks for testing this on Opera, we only tested on these browser/OS combinations: https://github.com/fingerprintjs/external-protocol-flooding#...
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#55This appears to depend on user interactivity. How would you silently (and accurately) use this technique to fingerprint a system for cross-browser tracking?
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#56This seems wildly inaccurate for me. On firefox with resistfingerprinting it says I have 23 of the 24 applications installed (I don't, that's more incorrect than correct), and on tor browser it says 0 applications installed (also incorrect, I have a few installed).
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#57Earlier quoted context omitted.
Yeah, it gave me quite a list of programs, including xcode and itunes, which is fascinating on a Linux box... they list 20 programs they think I have installed, of which I actually have 2. I'm not sure why it would be so inaccurate, but I feel better...
> I'm not sure why it would be so inaccurate, but I feel better... I don't think you understood the core of the issue: it's not about identifying which applications you have installed, it's about always getting the same result for the same user. If all your browsers serve the same results, you are trackable, no matter if those results are good or not.
I think the implication is that this is far fewer bits of entropy than the authors indicate. Four bits (in isolation), are not a meaningful identifer.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#58This appears to depend on user interactivity. How would you silently (and accurately) use this technique to fingerprint a system for cross-browser tracking?
On Tor we show a fake captcha on the demo, which allows to collect multiple key presses and use each as a user-provided trigger.
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#59Anyone try this with tails/tor? how unique were they?
Re: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor
#60Worked perfectly on Firefox 88.0.1 on Windows. Great to know despite my efforts to balance privacy and anonymity, there is another metric that I'm unique in. Fingerprinting is just insidious.
Browsing in a VM is really one of the only safe ways to go on the modern web for privacy. So many sites break without JS, and having it enabled is an accident waiting to happen. When you need privacy, always browse in a VM or a Tails boot.
This won't work against fingerprinting unless you change the underlying hardware and / or external IP too when stating a new VM. If you don't have a unique external IP per VM you might as well not bother. It is like trying to hide from the police by changing clothes and cutting your hair but stil hold the same huge sign with your name and address in your hands.