Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

zdnet.com

Post reply on HN
Print view View original

81–90 of 216 posts

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#81

Post by beatgammit »

ehsankia wrote: post #28
burtonator wrote: post #24

Earlier quoted context omitted.

Apps need it to determine where to place elements. If it wasn't you would still be able to reverse engineer it by sticking elements outside the viewport and seeing if they're hidden or not. Turns out anonymity is super freaking hard. :-/

I don't get it. Don't the majority of people browse at full screen, on common devices which all have the same fullscreen dimensions? Who out there browses to a size, resizes there window, then browses to another website, then resizes again and so on? That makes no sense.

Even if they do, there's variation in what "full screen" means. Some people have the bookmarks toolbar enabled, others don't. Some have compact icons, others don't. Some keep a sidebar open, others don't. Some use a theme that changes the size of toolbars. Some have a dock/taskbar always visible, some have differently sized taskbars, etc.

This all leads to a huge variation between users of even the same screen size (e.g. 1920x1080), since the portion of the screen available to the page is different.

The Tor browser fixes this by having the window always be the same size on all machines, regardless of screen resolution. This is a bit annoying because it means you have less stuff on the page visible at a time, but since it makes you look the same as every other user, it's worth it for privacy conscious users.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#82

Post by beatgammit »

cimmanom wrote: post #60
renholder wrote: post #34

Earlier quoted context omitted.

> Apps need it to determine where to place elements. This determination can't be done client-side? In other words, if I resize the window, it's going to send the new size to determine where to place the elements in the "new" area?

Yes, but how do you keep the client from then sending that data to the server?

You can't. Even if you block JavaScript, they can still get it from CSS media queries, where the can say which file to download given a certain screen size.

The best solution is to use the same screen size as everyone else so you don't stand out. And that's what this does.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#83

Post by beatgammit »

MagicPropmaker wrote: post #30
meruru wrote: post #19

Earlier quoted context omitted.

reCAPTCHA is a Google thing so it gets blocked in my browser already anyway (by uMatrix). If I need to load it to see a website, I close the tab immediately and go somewhere else.

You need reCAPTCHA to log into HN (or at least I do when I'm working from some parts of the middle east)

I use a mobile app and have gotten errors saying I need to solve a captcha. Since I can't do that on this app, it just means I'll stop commenting for a couple days until HN decides to stop bothering me.

That's happened twice, and it really hasn't been a big deal. I've never actually done a captcha for HN, it's just not worth it to me.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#84

Post by kabacha »

pera wrote: post #15
meruru wrote: post #13

I recommend the privacy.resistFingerpriting about:config mentioned. It's been available for a while and does other things too, like changing your user agent.

I've been using privacy.resistFingerprinting for a while and also recommend it, but there is one major "side effect": your reCAPTCHA score will drop to 0.1 making many websites really tedious to use. It's a price I'm willing to pay though...

Just another one of 10 thousand reasons why reCAPTCHA is utter cancer on the web. I've been traveling a lot for the past few years and public wifi combined with a bunch of other things makes _my_ reCapatcha ask me to answer multiple queries every single time.

By this point if I see reCaptcha I just close the window unless it's something _really_ important.

Also reCaptcha isn't any more secure than any other recent captcha solution when it comes to bot protection FYI.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#85

Post by tyingq »

hedora wrote: post #80
godelski wrote: post #50

Earlier quoted context omitted.

> guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online I would actually think the opposite. Wouldn't it be better because then only Google would have that information? Only Google would be able to fingerprint. This is of course under the assumption (which is currently accurate) that Google has the majority share of browsers. But maybe it wouldn't be, because i…

There’s been a lot of press recently about shady data brokers selling information to Facebook. I would be genuinely surprised if those same data brokers don’t sell to google. (In addition to full time data brokerage firms, there are third party phone app api’s that slurp data and feed it to advertisers. Facebook has at least one. Presumably google does too...)

Google does buy data for sure. One example: https://www.bloomberg.com/news/articles/2018-08-30/google-an...

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#86

Post by commoner »

beatgammit wrote: post #83
MagicPropmaker wrote: post #30

Earlier quoted context omitted.

You need reCAPTCHA to log into HN (or at least I do when I'm working from some parts of the middle east)

I use a mobile app and have gotten errors saying I need to solve a captcha. Since I can't do that on this app, it just means I'll stop commenting for a couple days until HN decides to stop bothering me. That's happened twice, and it really hasn't been a big deal. I've never actually done a captcha for HN, it's just not worth it to me.

Which HN app are you using? Materialistic (Android) and Hackers (iOS) have worked for me with no CAPTCHA issues, even with a VPN.

https://github.com/hidroh/materialistic

https://github.com/weiran/Hackers

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#87

Post by newscracker »

3pt14159 wrote: post #59
newscracker wrote: post #37

Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online), and I found this [1] confirming my guess (emphasis mine): > Since we don't believe it's feasible to provide some mode of Chrome that can truly prev…

There is a way to stop fingerprinting. That way is serving pages via distributed network (over a WoT or torrent-like thing). All these other ways do is give people the illusion that they're safe from being tracked, when the reality is that they're tracked just the same, but by fewer people so the data is more valuable. This means that the money is centralizing around the actors with the most inexplicable methods of t…

> In the long run this will either be solved one way or another, and all these online surveillance capitalism companies will crash and burn.

I sincerely hope that happens without causing more harm to people. It also seems to be a long way away.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#88

Post by kabacha »

baroffoos wrote: post #66
SquareWheel wrote: post #21

Earlier quoted context omitted.

Changing your user agent will do terrible things to captchas. I actually change my user agent specifically to test the fail state of captchas. I'd suggest only turning that on if you know what you're doing.

Which means its working well because captcha is a tracking tool.

Remember when first iteration of recaptcha was designed for to help digitize books?

https://www.youtube.com/watch?v=PQ-xzwj_p_4

Now it's used for tracking and training proprietary road image recognition for some mega corporation that had a slogan of "do no evil", which is quite hysterical really.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#89

Post by scottlocklin »

3pt14159 wrote: post #59
newscracker wrote: post #37

Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online), and I found this [1] confirming my guess (emphasis mine): > Since we don't believe it's feasible to provide some mode of Chrome that can truly prev…

There is a way to stop fingerprinting. That way is serving pages via distributed network (over a WoT or torrent-like thing). All these other ways do is give people the illusion that they're safe from being tracked, when the reality is that they're tracked just the same, but by fewer people so the data is more valuable. This means that the money is centralizing around the actors with the most inexplicable methods of t…

I'm pretty sure sticking it on a distributed network is potentially much worse unless it is specifically designed to prevent tracking.

Re: Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

#90

Post by baroffoos »

kabacha wrote: post #88
baroffoos wrote: post #66

Earlier quoted context omitted.

Which means its working well because captcha is a tracking tool.

Remember when first iteration of recaptcha was designed for to help digitize books? https://www.youtube.com/watch?v=PQ-xzwj_p_4 Now it's used for tracking and training proprietary road image recognition for some mega corporation that had a slogan of "do no evil", which is quite hysterical really.

There is no doubt in my mind that recaptcha data will be used to kill people in the future. Its all very useful for drones.
Post reply on HN