Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

zdnet.com

Post reply on HN
Print view View original

71–80 of 216 posts

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#71

Post by blotter_paper »

tedunangst wrote: post #27
CharlesColeman wrote: post #25

Earlier quoted context omitted.

> Apps need it to determine where to place elements. Could they hide the actual window dimensions from website javascript by only allowing a special kind of sandboxed function to access it? The website's code only really needs to do arithmetic on those values, so the browser could deny access to the actual values and force the code to manipulate them symbolically.

Are you also going to download every resource listed in every @media section of the CSS regardless of screen size?

That part doesn't seem too unreasonable to me, but you could also just go with the largest available size and then scale it as necessary on the client.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#72

Post by SquareWheel »

darkpuma wrote: post #64
shakna wrote: post #16

Earlier quoted context omitted.

It can decimate useability for the average user. Every time you see a Captcha, you may have to do four or five to be considered "human" because the system struggles to determine who you are.

> "because the system struggles to determine who you are. " Is the tile fade-in also the system struggling to figure out who you are? No, it's vindictive. Punishment for not browsing the web the way google wants you to.

Or maybe it's to make it obvious that a tile has changed...

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#73

Post by pmoriarty »

oftenwrong wrote: post #65
tedunangst wrote: post #27

Earlier quoted context omitted.

Are you also going to download every resource listed in every @media section of the CSS regardless of screen size?

The browser could pick a fake screen size, and behave in a way that is consistent with that fake screen size. This would probably break many sites, but it would mitigate fingerprinting if a common size was used.

This solution is just begging for side-channel attacks.

Firefox had better make sure its timing is not affected by such shenanigans, for instance.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#74

Post by darkpuma »

SquareWheel wrote: post #72
darkpuma wrote: post #64

Earlier quoted context omitted.

> "because the system struggles to determine who you are. " Is the tile fade-in also the system struggling to figure out who you are? No, it's vindictive. Punishment for not browsing the web the way google wants you to.

Or maybe it's to make it obvious that a tile has changed...

No, sorry but that's nonsense. reCAPTCHAv2 doesn't do the tile fade in unless your v3 score is low. The fade in I'm talking about can take one to five seconds per tile, plainly designed to annoy the user.

Here is a video of the fade-in in action: https://youtu.be/zGW7TRtcDeQ?t=89

(Note that you do not need to be on a shared IP to experience this. Merely using firefox with resist fingerprinting and a adblocker is enough to trigger this behavior on an IP google normally 'trusts' when using chrome.)

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#75

Post by SquareWheel »

darkpuma wrote: post #74
SquareWheel wrote: post #72

Earlier quoted context omitted.

Or maybe it's to make it obvious that a tile has changed...

No, sorry but that's nonsense. reCAPTCHAv2 doesn't do the tile fade in unless your v3 score is low. The fade in I'm talking about can take one to five seconds per tile, plainly designed to annoy the user. Here is a video of the fade-in in action: https://youtu.be/zGW7TRtcDeQ?t=89 (Note that you do not need to be on a shared IP to experience this. Merely using firefox with resist fingerprinting and a adblocker is enou…

>Here is a video of the fade-in in action

Okay, I agree that's punitive. I've never seen a fade that slow, so it must be at the lowest levels of trust.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#76

Post by missblit »

blotter_paper wrote: post #71
tedunangst wrote: post #27

Earlier quoted context omitted.

Are you also going to download every resource listed in every @media section of the CSS regardless of screen size?

That part doesn't seem too unreasonable to me, but you could also just go with the largest available size and then scale it as necessary on the client.

Scaling down the largest size isn't always appropriate (though would probably work in most cases).

One example might be a set of images where the smaller images wrap text more agressively to work better on a screen that's not as wide.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#77

Post by missblit »

manigandham wrote: post #45
ehsankia wrote: post #28

Earlier quoted context omitted.

I don't get it. Don't the majority of people browse at full screen, on common devices which all have the same fullscreen dimensions? Who out there browses to a size, resizes there window, then browses to another website, then resizes again and so on? That makes no sense.

Yes. I'm in adtech. 60% of browsers are mobile/tablet which are already fixed. The rest are almost always fullscreen. Maybe 2% have non-standard sizes.

Fixed except when the user enables android split-screen mode! I believe split-screen mode implies the height of the browser window can change at runtime (in a JS visible way), but haven't looked at it recently.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#78

Post by blotter_paper »

missblit wrote: post #76
blotter_paper wrote: post #71

Earlier quoted context omitted.

That part doesn't seem too unreasonable to me, but you could also just go with the largest available size and then scale it as necessary on the client.

Scaling down the largest size isn't always appropriate (though would probably work in most cases). One example might be a set of images where the smaller images wrap text more agressively to work better on a screen that's not as wide.

Good point, I've seen comparable use cases in the wild but it slipped my mind!

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#79

Post by mLuby »

lxe wrote: post #68

Why not simply allow the user to control the js apis that are available/enabled, kind of like the camera/mic permissions? If sites simply cannot use the mouse events or window size events, they won’t be able to fingerprint. This grey box alternative seems like a complicated hack.

The problem is this will straight up crash many important sites. In the battle between usability and privacy, usability wins. Just try disabling javascript or cookies and see how long you last.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#80

Post by hedora »

godelski wrote: post #50
newscracker wrote: post #37

Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online), and I found this [1] confirming my guess (emphasis mine): > Since we don't believe it's feasible to provide some mode of Chrome that can truly prev…

> guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online I would actually think the opposite. Wouldn't it be better because then only Google would have that information? Only Google would be able to fingerprint. This is of course under the assumption (which is currently accurate) that Google has the majority share of browsers. But maybe it wouldn't be, because i…

There’s been a lot of press recently about shady data brokers selling information to Facebook. I would be genuinely surprised if those same data brokers don’t sell to google.

(In addition to full time data brokerage firms, there are third party phone app api’s that slurp data and feed it to advertisers. Facebook has at least one. Presumably google does too...)

Post reply on HN