Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browserball

weareinstrument.com

Post reply on HN
Print view View original

61–70 of 77 posts

Re: Browserball

#61

Post by zodPod »

hashmymustache wrote: post #59
catmanjan wrote: post #32

Earlier quoted context omitted.

But they may be unique to you, making you more identifiable/trackable. The TOR browser warns you when resizing the window that it reduces privacy. Personally I don't care either, just thought you might want to know!

But just because it's unique, why does it make it trackable? The overwhelming majority of devices have one of a few common display resolutions, so what's there to link across sessions for identifying users?

The idea is not that your resolution is unique it's that the maximized window size is unique. They can then track that you have more than one monitor, what size that monitor is, and, probably with some easy math, a jist of how many you have. That setup is probably a lot more unique than expected. That plus possibly some canvas finger printing or something similar could probably keep pretty good tabs on you. I have 3 identical 21 inch monitors and I'm browsing on the left-most monitor. Anyone else have that same setup?

Re: Browserball

#62

Post by samirm »

detaro wrote: post #48
aidenn0 wrote: post #46

Earlier quoted context omitted.

You can get screen resolution from JS, so I don't see how maxing out the window makes any difference.

A screen resolution is less unique than the size of a maximized window.

How so? Wouldn't there just be a one to one mapping between resolution and maximized windows size? The only way to prevent this is to not maximize windows and instead have custom sized ones, but that just makes identifying you even easier.

Re: Browserball

#63

Post by barrkel »

beeboop wrote: post #44
anc84 wrote: post #36

Earlier quoted context omitted.

It's actually quite the opposite. Most sites will become lightning fast and distraction free.

I have use NoScript consistently for years and I disagree with you. Essentially the only thing NoScript does is make it so when you haven't visited a website before, it doesn't automatically trust it. For the most part every single website I go to needs to have JS enabled for anything to work beyond just reading content. And even then, I would say 70% of the time, some critical piece of content on a website does not…

I disable JS on my phone, and I disagree with you: the vast majority of the text content web is perfectly readable without JS.

If you want to watch video, you're out of luck. If you want to use a web app, you're out of luck. But if you just want to consume text content, the majority of the web just works, and a lot faster too.

(I've never been able to get NoScript to work right, it's always given me problems. Perhaps part of the problem is NoScript?)

Re: Browserball

#64

Post by detaro »

samirm wrote: post #62
detaro wrote: post #48

Earlier quoted context omitted.

A screen resolution is less unique than the size of a maximized window.

How so? Wouldn't there just be a one to one mapping between resolution and maximized windows size? The only way to prevent this is to not maximize windows and instead have custom sized ones, but that just makes identifying you even easier.

The laptop I'm using right now has a 1366x768 screen, a maximized browser window is 1306x768. I bet many other users of of that size are going to have browser windows that have the full 1366 px width, but then some height Custom sized ones make you easier to identify only if you don't change them.

Re: Browserball

#65

Post by softawre »

cyphar wrote: post #16

I remember playing with this at least 8 years ago. It's really scary that there's enough information disclosure in browsers that it's possible to do this.

> really scary

This is really scary to you? I get that you can do fingerprints, and honestly there's a LOT more than just browser window position/size in them, but "really scary"?

Maybe we need to stop exaggerating on this sort of stuff if we want people to take us seriously.

Re: Browserball

#66

Post by vesinisa »

ErikRogneby wrote: post #25
vesinisa wrote: post #19

Earlier quoted context omitted.

Just use NoScript if you are concerned. JavaScript allows a large number of other ways to identify you as well. Direct ways of course include cookies / local storage / Web SQL, but other indirect ways include localization preferences, OS / browser / plugin / extension fingerprinting, HID inputs, side channel profiling etc. etc. – some combination of these allows uniquely identifying at least 80% of web users.[1][2][3…

Might as well say don't use the web. Disabling javascript will break most sites with a few rare exceptions. (like HN)

NoScript is not about disabling JavaScript but allowing only white-listed domains to execute JavaScript. Generally, I trust the domains I visit frequently, and have them white-listed. I explicitly block domains of "analytics" and social networking services, since these do not offer me any value-added content.

However, if I follow a link to a domain I have never visited before, I will first see if the content is viewable without JavaScript. Most of the time, it actually is.

But sometimes the content does not render at all or the page layout is broken beyond recognition. Then I'll try "temporarily allowing" executing JS from the home domain of the site (I've noticed most sites these days bundle JS from 5+ domains, most of which are analytics and social networking services). For maybe 80% of those sites that do not work without JS, this fixes the issue and I am able to read the content. Takes maybe 2 secs to temporarily white-list and reload the page.

The rest are generally pages that make assumptions like that the analytics library is always present in the page JS scope and then crash when it is not, leaving the content unreadable because the JS layout code never runs. A quick peek at the JS console when the page is loading generally reveals what is the issue.

Sometimes I just ignore those pages, but if I really badly want to see the content, I can launch an one-off incognito window for the page and have the page execute with all the JS tracking and social network code allowed. This solves any issues for almost all remaining pages. If problems still persist, these are generally pages that are just simply broken – maybe the page only works with some specific browser, like Google Chrome (I use Firefox), to start with.

Re: Browserball

#67

Post by Pxtl »

tambourine_man wrote: post #43

This is amazing. Kind of like when I first dragged a window across multiple monitors in the 90s. We are so used to content being stuck in artificial containers that it's kind of crazy when it transcends them.

There was a clever game called Metal Marines back then that exploited this idea - the game was a 1v1 base-building RTS where each player's "base" was on its own map in its own window. When you fired missiles or launched APCs from one base into the other, the missile would fly out of your base window, over the desktop and into the other window to hit his base. The effect was jaw-dropping even though it was a simple and cartoony game.

Re: Browserball

#69

Post by lucideer »

vesinisa wrote: post #66
ErikRogneby wrote: post #25

Earlier quoted context omitted.

Might as well say don't use the web. Disabling javascript will break most sites with a few rare exceptions. (like HN)

NoScript is not about disabling JavaScript but allowing only white-listed domains to execute JavaScript. Generally, I trust the domains I visit frequently, and have them white-listed. I explicitly block domains of "analytics" and social networking services, since these do not offer me any value-added content. However, if I follow a link to a domain I have never visited before, I will first see if the content is viewa…

If you're using NoScript in the fine-grained manner you describe, and for privacy reasons (not just security), I wonder have you ever looked at uMatrix[0]. Same deal but a bit more performant, and also covers the whitelisting of other privacy-leaking aspects such as cookies, CSS, tracking pixels, iframes, etc.

[0] https://github.com/gorhill/uMatrix/wiki/FAQ

Re: Browserball

#70

Post by zyxley »

Pxtl wrote: post #67
tambourine_man wrote: post #43

This is amazing. Kind of like when I first dragged a window across multiple monitors in the 90s. We are so used to content being stuck in artificial containers that it's kind of crazy when it transcends them.

There was a clever game called Metal Marines back then that exploited this idea - the game was a 1v1 base-building RTS where each player's "base" was on its own map in its own window. When you fired missiles or launched APCs from one base into the other, the missile would fly out of your base window, over the desktop and into the other window to hit his base. The effect was jaw-dropping even though it was a simple an…

That game was amazing. I wish I'd gotten good enough at it to ever get past the first few levels.
Post reply on HN