Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

zdnet.com

Post reply on HN
Print view View original

61–70 of 216 posts

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#61

Post by godelski »

commoner wrote: post #51
godelski wrote: post #46

What's the canvas fingerprinting one do? From what I (very poorly) understand, Tor returns a constant number for fingerprint requests. Can this be done for other requests?

It prompts the user to decline a site from accessing data from the Canvas API. This data can uniquely identify the user's computer. The Firefox feature is identical to the one from the Tor Browser. Screenshot: https://thehackernews.com/2017/10/canvas-browser-fingerprint... https://www.torproject.org/projects/torbrowser/design/ (see the "HTML5 Canvas Image Extraction" section) https://gitweb.torproject.org/tor-browser…

Thanks, those look like good reads. So I see in my version of FF that it is enabled as true but I don't recall ever seeing a prompt.

I would love to see a blog post about some of these features and why things are difficult.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#62

Post by baroffoos »

godelski wrote: post #50
newscracker wrote: post #37

Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online), and I found this [1] confirming my guess (emphasis mine): > Since we don't believe it's feasible to provide some mode of Chrome that can truly prev…

> guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online I would actually think the opposite. Wouldn't it be better because then only Google would have that information? Only Google would be able to fingerprint. This is of course under the assumption (which is currently accurate) that Google has the majority share of browsers. But maybe it wouldn't be, because i…

Yeah, with a google account and google login on every website they still can track everyone even without all these other methods.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#63

Post by jancsika »

tedunangst wrote: post #38
renholder wrote: post #34

Earlier quoted context omitted.

> Apps need it to determine where to place elements. This determination can't be done client-side? In other words, if I resize the window, it's going to send the new size to determine where to place the elements in the "new" area?

document.Write(" ")

That's a problem.

The W3C should probably create a new, rich spec hundreds of pages long so that frontend developers may instead declare images as a unitless set of point relationships to be rendered at any resolution without digital artifacts.

For example, instead of working on the pixel level, the developer would be free to simply declare, "an arc may exist in one of these four locations." Then, merely by declaring two further "flag" values, the developer can communicate to the renderer which three arcs not to draw, except for the edge case of no arc fitting the seven previously-declared constraints.

Just imagine-- instead of a big wasteful gif for something as simple as an arc animation, the developer would simply declare, "can someone just give me the javascript to convert from arc center to svg's endpoint syntax?" And someone on Stackoverflow would eventually declare the relevant javascript.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#64

Post by darkpuma »

shakna wrote: post #16
strombofulous wrote: post #14

Earlier quoted context omitted.

Is there any reason this isn't on by default? I don't know exactly how it works, but to my understanding anti fingerprinting tech generally works better when everyone uses it (otherwise you stick out as the "anti fingerprinting" browser)

It can decimate useability for the average user. Every time you see a Captcha, you may have to do four or five to be considered "human" because the system struggles to determine who you are.

> "because the system struggles to determine who you are. "

Is the tile fade-in also the system struggling to figure out who you are? No, it's vindictive. Punishment for not browsing the web the way google wants you to.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#65

Post by oftenwrong »

tedunangst wrote: post #27
CharlesColeman wrote: post #25

Earlier quoted context omitted.

> Apps need it to determine where to place elements. Could they hide the actual window dimensions from website javascript by only allowing a special kind of sandboxed function to access it? The website's code only really needs to do arithmetic on those values, so the browser could deny access to the actual values and force the code to manipulate them symbolically.

Are you also going to download every resource listed in every @media section of the CSS regardless of screen size?

The browser could pick a fake screen size, and behave in a way that is consistent with that fake screen size. This would probably break many sites, but it would mitigate fingerprinting if a common size was used.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#66

Post by baroffoos »

SquareWheel wrote: post #21
meruru wrote: post #13

I recommend the privacy.resistFingerpriting about:config mentioned. It's been available for a while and does other things too, like changing your user agent.

Changing your user agent will do terrible things to captchas. I actually change my user agent specifically to test the fail state of captchas. I'd suggest only turning that on if you know what you're doing.

Which means its working well because captcha is a tracking tool.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#67

Post by tedunangst »

jancsika wrote: post #63
tedunangst wrote: post #38

Earlier quoted context omitted.

document.Write(" ")

That's a problem. The W3C should probably create a new, rich spec hundreds of pages long so that frontend developers may instead declare images as a unitless set of point relationships to be rendered at any resolution without digital artifacts. For example, instead of working on the pixel level, the developer would be free to simply declare, "an arc may exist in one of these four locations." Then, merely by declaring…

The browser can also ship with a pretrained GAN, so the site just asks for a picture of a cat and then the GAN creates one as needed, but nobody will know exactly which cat you saw.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#68

Post by lxe »

Why not simply allow the user to control the js apis that are available/enabled, kind of like the camera/mic permissions? If sites simply cannot use the mouse events or window size events, they won’t be able to fingerprint. This grey box alternative seems like a complicated hack.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#69

Post by tyingq »

godelski wrote: post #50
newscracker wrote: post #37

Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online), and I found this [1] confirming my guess (emphasis mine): > Since we don't believe it's feasible to provide some mode of Chrome that can truly prev…

> guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online I would actually think the opposite. Wouldn't it be better because then only Google would have that information? Only Google would be able to fingerprint. This is of course under the assumption (which is currently accurate) that Google has the majority share of browsers. But maybe it wouldn't be, because i…

I suspect that's the biggest reason Google was so interested in "https everywhere". That removed detailed browsing visibility from a lot of entities, but not Google.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#70

Post by blotter_paper »

CharlesColeman wrote: post #25
burtonator wrote: post #24

Earlier quoted context omitted.

Apps need it to determine where to place elements. If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not. Turns out anonymity is super freaking hard. :-/

> Apps need it to determine where to place elements. Could they hide the actual window dimensions from website javascript by only allowing a special kind of sandboxed function to access it? The website's code only really needs to do arithmetic on those values, so the browser could deny access to the actual values and force the code to manipulate them symbolically.

If I'm allowed to query the position and/or size of anything else in the DOM I can figure out window size by aligning elements at the edges or making one 100vw x 100vh and querying the position/size of those, so you really can't let me access the position or size of anything. I might have elements styled based on media queries, or old-fashioned DOM queries, so if I'm allowed to change how a button looks based on window size I can then check something about this element that isn't directly related to size or position. For example it doesn't make since to have a "download the app" button on desktop, but if you let me make it invisible then you can't let me query the visibility of it. This is true of all styling, if you let me derive it from vh/vw then you can never let me query it after that, which makes a lot of things tricky. Trading functionality that relies on DOM/media queries for privacy is totally valid, I'm just saying that it will make some non-obvious things impossible for a developer to do, and there are sites today that people enjoy using that will have their core functionality broken if this is the future. Browser-based CAD tools were recently discussed on HN, and those are right out. Really, I think the future is both, but I'm not quite sure how they'll coexist.
Post reply on HN