Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser Fingerprinting Without JavaScript

fingerprintjs.com

Post reply on HN
Print view View original

91–100 of 124 posts

Re: Browser Fingerprinting Without JavaScript

#91

Post by marginalia_nu »

noduerme wrote: post #52
onion2k wrote: post #11

Browsers should limit every webpage to displaying a maximum of two fonts, and should silently ignore any font face rules after the first two. Maybe three if you're feeling generous. With variable fonts available in every browser it wouldn't impact typography much. It would stop this sort of privacy attack, and it'd have the additional benefit of making the web look a lot nicer.

That's just insane. Sites and apps I build these days usually include FontAwesome and/or another icon library, frequently along with a custom dingbat font for the company's unique logos and iconography (we bundle all relevant vector art as a font). Then you have primary and secondary brand fonts, along with sometimes readability fonts. Not to mention iframed forms coming off credit card gateways. I have no idea how a…

Why can't you design sites that degrades gracefully? Keep in mind that font loading in low-bandwidth areas can be atrociously slow. You may have to wait minutes before all the assets have loaded. Vanilla HTML has no such accessibility or compatibility problems and can be viewed in all browsers on any network. Whatever issues your sites have are issues you have added to them.

I know you're thinking "well I don't see any of that in my analytics so this seems unlikely". Consider then that your analytics needs to actually load before the visitor bounces for them to show up in the statistics.

Re: Browser Fingerprinting Without JavaScript

#92

Post by hansel_der »

ranger_danger wrote: post #64
robbedpeter wrote: post #56

Earlier quoted context omitted.

I can't tell if you're trying to say unrooted phones with stock carrier roms are somehow understood to be secure, or if rooting is mutually incompatible with security, or something else. Want to expound?

not OP but rooting is incompatible with security.

not rooting is incompatible with freedom

Re: Browser Fingerprinting Without JavaScript

#93

Post by hansel_der »

marginalia_nu wrote: post #91
noduerme wrote: post #52

Earlier quoted context omitted.

That's just insane. Sites and apps I build these days usually include FontAwesome and/or another icon library, frequently along with a custom dingbat font for the company's unique logos and iconography (we bundle all relevant vector art as a font). Then you have primary and secondary brand fonts, along with sometimes readability fonts. Not to mention iframed forms coming off credit card gateways. I have no idea how a…

Why can't you design sites that degrades gracefully? Keep in mind that font loading in low-bandwidth areas can be atrociously slow. You may have to wait minutes before all the assets have loaded. Vanilla HTML has no such accessibility or compatibility problems and can be viewed in all browsers on any network. Whatever issues your sites have are issues you have added to them. I know you're thinking "well I don't see a…

painfully true

thou it will be argued that it is a minority that is affected and it makes little economic sense to care.

Re: Browser Fingerprinting Without JavaScript

#94

Post by hyperstar »

anonypla wrote: post #29
southerntofu wrote: post #21

Being a fervent Tor Browser user, i just tried with it and of course the fingerprinting failed. Several copies of it give me the same fingerprints: e56952dba176a47af3c051b626b64ff3 (Safer mode) 632e305f8a939e5ba6afd24eced586f0 (Safest mode) That's because the Tor Browser, contrary to urban legend, is not just a browser that routes trafic through the tor network, but a firefox reworked (most of which is being upstream…

The "Safest" mode gives me different fingerprints each time. The "Standard" and "Safer" modes give the same fingerprint tho.

Safest gives me the same each time.

Re: Browser Fingerprinting Without JavaScript

#95

Post by hansel_der »

spicybright wrote: post #38
judge2020 wrote: post #35

Earlier quoted context omitted.

Obviously the browser must prompt users before displaying non-ascii characters as well. Who wants to do anything other than read mailing lists in their browser?

Every webpage should be a 640x480 jpg hosting exclusively through a CDN separate from the originating site. Why can't we make a better web like this that respects your privacy?

seriously, rendering websites to image formats is an option and some cdn (cf iirc) have products for this.

Re: Browser Fingerprinting Without JavaScript

#96

Post by hansel_der »

watermelon0 wrote: post #85
onion2k wrote: post #61

Earlier quoted context omitted.

Sure. This isn't coming to Chrome or Safari ever. There are other browsers though.

According to https://gs.statcounter.com/browser-market-share , Chromium-based/Safari browsers have 93% market share, so I wouldn't really count on other browsers that much.

thou privacy conscious users are vastly underrepresented in analytics.

Re: Browser Fingerprinting Without JavaScript

#97

Post by southerntofu »

hyperstar wrote: post #88
southerntofu wrote: post #21

Being a fervent Tor Browser user, i just tried with it and of course the fingerprinting failed. Several copies of it give me the same fingerprints: e56952dba176a47af3c051b626b64ff3 (Safer mode) 632e305f8a939e5ba6afd24eced586f0 (Safest mode) That's because the Tor Browser, contrary to urban legend, is not just a browser that routes trafic through the tor network, but a firefox reworked (most of which is being upstream…

I tried this with Tor Browser on two different computers and got two different fingerprints, even in safest mode.

Interesting. Are you running different systems? If so, can you explain which (and which desktop environments) so we can (try to) reproduce?

Re: Browser Fingerprinting Without JavaScript

#98

Post by southerntofu »

0xdeadb00f wrote: post #55
southerntofu wrote: post #21

Being a fervent Tor Browser user, i just tried with it and of course the fingerprinting failed. Several copies of it give me the same fingerprints: e56952dba176a47af3c051b626b64ff3 (Safer mode) 632e305f8a939e5ba6afd24eced586f0 (Safest mode) That's because the Tor Browser, contrary to urban legend, is not just a browser that routes trafic through the tor network, but a firefox reworked (most of which is being upstream…

Did you see the spefific CSS hack they use to tell if you're using the Tor Browser as opposed to normal Firefox?

I did, but i personally don't care that everyone knows i'm using a tor browser. TBB is like a digital black block [0]: it is known i'm in there but nobody knows who i am in that crowd.

[0] https://en.wikipedia.org/wiki/Black_block

Re: Browser Fingerprinting Without JavaScript

#99

Post by marginalia_nu »

hansel_der wrote: post #93
marginalia_nu wrote: post #91

Earlier quoted context omitted.

Why can't you design sites that degrades gracefully? Keep in mind that font loading in low-bandwidth areas can be atrociously slow. You may have to wait minutes before all the assets have loaded. Vanilla HTML has no such accessibility or compatibility problems and can be viewed in all browsers on any network. Whatever issues your sites have are issues you have added to them. I know you're thinking "well I don't see a…

painfully true thou it will be argued that it is a minority that is affected and it makes little economic sense to care.

Are the majority affluent city-dwellers? Maybe in Luxembourg this is true, but in many parts of the world it just isn't.

But you get a sort of selection bias. Out of the people with money to buy the tech that can keep up with these sites and the network speeds to use these sites, out of those people, most people have modern tech and good metropolitan network access.

Re: Browser Fingerprinting Without JavaScript

#100

Post by southerntofu »

robbedpeter wrote: post #49
anonypla wrote: post #29

Earlier quoted context omitted.

The "Safest" mode gives me different fingerprints each time. The "Standard" and "Safer" modes give the same fingerprint tho.

So how crippled does regular web browsing become using Tor safest mode? I'm tempted to give it a whirl for a week. Root my phone, flash something secure, leave VPN always on, and limit web browsing to Tor to get a feel for how bad or good it is. The self inflicted contortions developers go through to justify the need to spy drive me crazy. Modern devices and bandwidth are more than sufficient to handle a vast majorit…

> So how crippled does regular web browsing become using Tor safest mode?

In my experience, not really much. There's occasionally a few articles i can't read because they require JS just to display their blogpost but outside of HN planet, it's not that common (most people use Wordpress themes or other decent HTML/CSS templates).

The real problem is Cloudflare and other gatekeepers who claim to protect from bots and attacks, but are more likely to block honest people. If you know people using Cloudflare, please insist that they don't. If you really need DDOS protection because you're repeatedly been a victim, please use a decent network-level mitigation (as provided by professional hosts like OVH/Hetzner) not some shitty invasive DPI solution that will have 99% false positives.

An interesting aspect of Safest mode i enjoy is the web is "read-only" again with it. Well you can still POST stuff via forms, but it's an explicit opt-in operation. TBB's Safest mode is closer to reading a newspaper than the modern web could ever be.

As a nice bonus, the Safest mode is really resource-efficient. I can have hundreds (thousands?) of tabs open for days without leaking memory, and CPU is only used to draw stuff (no tab mining coins on my behalf). I don't know a single browser with JS enabled who can keep many tabs open without rendering my machine utterly useless due to overusing CPU/RAM. Hell, i don't know a single browser with JS who can prevent a single tab from using all of my resources. TBB's Safest mode is really the only modern way i know to browse the web on low-resource hardware (lighter webbrowsers exist, but they usually don't implement modern CSS3 features).

EDIT: I should mention that the only useful service i can't use with Safest mode is Gitlab. Because Gitlab still does client-side rendering for some reason?!

Post reply on HN