Earlier quoted context omitted.
Are people doing online banking using Tor?
That would be rather dumb, I think, assuming the bank account is tied to you in meatspace
If your country blocks access to online banking, you would use tor.
Tor at the Heart: Firefox
71–77 of 77 posts
Re: Tor at the Heart: Firefox
#72[deleted]
Re: Tor at the Heart: Firefox
#73Earlier quoted context omitted.
A blank font list where? There's no way to get a direct list of fonts: you just try rendering text with a given font and look at the metrics of it versus the fallback. Font lists are done using side-channels (and you also therefore have to have a list of fonts to sniff in the first place). The only way to stop font-based side-channels is to limit the web to a fixed set of fonts: and that will horribly break the web i…
Disable looking at the metrics of text rendering results?
Get two block level elements, render some text in between, and calculate how far apart the two block level elements are, and you can already determine the height of the glyph.
So, yeah, to disable that you'd have to entirely disable the CSSOM, which would cause ridiculous amounts of breakage.
Re: Tor at the Heart: Firefox
#74[deleted]
Note that Google is not only in the browser business but also the fingerprinting business. They want a future where everything is on the web and where they have an acceptable way of seeing everything everyone is doing.
Realistically, most users use off the shelf hardware so for every machine there are millions that are specced exactly the same. That's not very useful for fingerprinting. It would be a good idea though to stop adding more discriminating features to browsers but as you imagine, that is not the direction Google wants to go to.
For every fingerprinting trick there is an obfuscation trick though. People just need to keep checking the fingerprinting scripts. A great advantage of the web is that you can in fact see the source code.
Also, we expect publishers to embrace the post-ad world. Why would it be easy to block ads so much they stop being viable, but impossible to stop fingerprinting?
Re: Tor at the Heart: Firefox
#75Earlier quoted context omitted.
User agent gives the browser version and platform version. Two macs with the same OS version and the latest version of Chrome will have the same user agent.
That's the point. With this feature, two computers with the latest version of Firefox would have the same font list.
Is that true? I thought the point of using the font list for fingerprinting is that it can vary widely from user to user.
Re: Tor at the Heart: Firefox
#76Earlier quoted context omitted.
It's a mix. Some patches are just getting rebased and landed. For others, the Firefox and Tor Browser teams are working together to re-implement the feature in a way that makes more sense in the broader Firefox architecture. For example, for First Party Isolation, we took the "origin attributes" feature that we built to support containers (user-specified tracking limitations) and reused it for isolation. In the conta…
Regarding your last sentence, does that mean that in the future I could open a link in a 'tor browser' container? That's awesome if so.
Speaking as someone who is familiar with some parts of the Firefox architecture or concepts thereof, but not the source code itself: If you were to implement per-container pref overrides, theoretically yes. AFAIK, prefs are global right now. I don't know if it's feasible to implement this in Fx or if that will leak through to the chrome (process).
But it's an interesting idea! Would you mind filing a bug at bugzilla.mozilla.org?
Re: Tor at the Heart: Firefox
#77[deleted]