Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No-JavaScript Fingerprinting

noscriptfingerprint.com

Post reply on HN
Print view View original

81–90 of 107 posts

Re: No-JavaScript Fingerprinting

#81

Post by farias0 »

twhitmore wrote: post #66
zaik wrote: post #57

I wonder how unique this fingerprint really is. Getting the same fingerprint every time is only half of what makes a good fingerprint. Fennec on Android: cdec914cb91d1a88fbd3e7834b7968c8

Agreed. It's not a "fingerprint" at all as in most cases, it won't be remotely unique. For example: every user in the world with the same screen size, browser & platform will get the same result. For desktop it's window size rather than screen, but coarsely bucketed. Thousands or millions will share the same fingerprint. It seems somewhat unrealistic to ascribe much advertisement or tracking value to this.

But this are not the only info. OS language, dark mode preferences, fonts installed, all this stuff goes a long way in helping pinpointing you.

Re: No-JavaScript Fingerprinting

#82

Post by [deleted] »

cookiengineer wrote: post #48

Note that among a sea of tracked browsers, the untrackable browser shines like a bright star. Statistical analysis of these values over time (matched with client hints, ETags, If-Modified-Since, and IPs) will make most browsers uniquely identifiable. If the malicious vendor is good, they even correlate the size and order of requests. Because that's unique as well and can identify TOR browsers pretty easily. It's like…

[deleted]

Re: No-JavaScript Fingerprinting

#83

Post by danuker »

With the latest Tor Browser (11.0.4 based on Mozilla Firefox 91.5.0esr) on Arch Linux, I get the following:

* 9dfe9b69a9f18ef1c0d313aa4c013b52 in regular windowed mode

* 0fa96aa3ae2698bc2d1187f39b79db36 in fullscreen mode (F11).

Does anyone else get any of these fingerprints? If so, that is evidence that Tor Browser is well-designed. If not, that is evidence of some details overlooked.

Re: No-JavaScript Fingerprinting

#84

Post by 3pt14159 »

shp0ngle wrote: post #43

The actual blogpost is here https://fingerprintjs.com/blog/disabling-javascript-wont-sto... basically they use CSS trickery together with server-side stuff. It's pretty clever. @font-face { font-family: 'Helvetica'; src: local('Helvetica'), url('/signal/(token)/fontHelvetica') format('truetype'); } to detect font (which detects OS), and @media (featureX: value1) { .css_probe_42 { background: url('/signal/(token)/feat…

Eh. It's been pretty easy to fingerprint browsers for a while now, including those types of CSS hacks. The real feat is doing so without looking like you're doing it and for it to be durable (survive OS upgrades, reboots, etc).

Re: No-JavaScript Fingerprinting

#85

Post by mrob »

I am unpleasantly surprised that Firefox's "ui.prefersReducedMotion" preference is detectable from CSS. I expected a preference starting with "ui" to only affect the UI. It should be possible to reduce (or ideally remove) UI animations without affecting web pages.

Re: No-JavaScript Fingerprinting

#86

Post by ChicagoBoy11 »

mrob wrote: post #85

I am unpleasantly surprised that Firefox's "ui.prefersReducedMotion" preference is detectable from CSS. I expected a preference starting with "ui" to only affect the UI. It should be possible to reduce (or ideally remove) UI animations without affecting web pages.

I'd figure most web-apps have UI-like interfaces (contrasting with just static pages), so I can see why it might be useful for sites to be able to minimize transitions/effects/motion/etc. that may exist on their page.

Re: No-JavaScript Fingerprinting

#87

Post by XCSme »

mrob wrote: post #85

I am unpleasantly surprised that Firefox's "ui.prefersReducedMotion" preference is detectable from CSS. I expected a preference starting with "ui" to only affect the UI. It should be possible to reduce (or ideally remove) UI animations without affecting web pages.

Isn't the main point of the user preference flag to allow the website developer to serve a reduced-motion version of the site?

Re: No-JavaScript Fingerprinting

#88

Post by mrob »

XCSme wrote: post #87
mrob wrote: post #85

I am unpleasantly surprised that Firefox's "ui.prefersReducedMotion" preference is detectable from CSS. I expected a preference starting with "ui" to only affect the UI. It should be possible to reduce (or ideally remove) UI animations without affecting web pages.

Isn't the main point of the user preference flag to allow the website developer to serve a reduced-motion version of the site?

AFAIK, all the other ui.* preference affect the Firefox UI, not websites, so it's a misleading name. And I have already disabled web page animations in userContent.css[0], which is the correct place for modifying CSS. I shouldn't have to choose between allowing annoying UI animations and allowing fingerprinting.

[0]To disable web page animations, in Chrome/userContent.css in your Firefox profile directory:

  @namespace url(http://www.w3.org/1999/xhtml);
  *, :before, :after {
    transition: none !important;
    animation-delay: 0ms !important;
    animation-duration: 0ms !important;
  }
This also requires setting toolkit.legacyUserProfileCustomizations.stylesheets to true in about:config

Re: No-JavaScript Fingerprinting

#90

Post by redbell »

shp0ngle wrote: post #43

The actual blogpost is here https://fingerprintjs.com/blog/disabling-javascript-wont-sto... basically they use CSS trickery together with server-side stuff. It's pretty clever. @font-face { font-family: 'Helvetica'; src: local('Helvetica'), url('/signal/(token)/fontHelvetica') format('truetype'); } to detect font (which detects OS), and @media (featureX: value1) { .css_probe_42 { background: url('/signal/(token)/feat…

Nice read though..

I was surprised by the amount of CSS tricks used for fingerprinting all while having js disabled.

A few days ago, I came across this "GPU fingerprinting" called "DrawnApart" => https://blog.amiunique.org/an-explicative-article-on-drawnap...

and was thinking that this must be the most advanced fingerprinting approach so far but after reading your article, I have to reconsider!

Post reply on HN