8 ms·

Here's one they missed: do not resize your window! If you do, your browser instance has a potential to have a unique viewport size and hence, there's a probabil

by Jerry2 11y ago

Here's one they missed: do not resize your window! If you do, your browser instance has a potential to have a unique viewport size and hence, there's a probability you can be tracked. Whatever size window Tor opens, do not re-size it. I do not use Tor myself but few years ago I've analyzed an anonymized data site and was amazed how easy it was, with a high degree of probability, to track someone just based on screen resolution + viewport size (i.e. size of your browser window). Almost every viewport size was unique (when correlated with screen resolution).

x1798DE 11y ago
I think if you browse without JavaScript on, this information is not available to the sites you visit.
- storborg 11y ago
  Viewport width can be obtained via CSS, e.g. by using a media query for every screen width: @media (min-width: 400px) { .thing { background-image: url(size-400.png); } } @media (min-width: 401px) { .thing { background-image: url(size-401.png); } } You could combine this with pixel density for even more specificity.
  - adrusi 11y ago
    The tor browser bundle does have settings to disable media queries for this reason, but it is still conceivable to be identified by browser size unless you completely disable all embeded media (including images). Perhaps the browser delays loading images that aren't visible on the screen.
  - mistercow 11y ago
    This seems almost trivial for the browser to fix. Just load all CSS resources, regardless of media query matching.
    - ponyous 11y ago
      IIRC TOR is already slow. I am now sure you want to do this.
      - mistercow 11y ago
        Yeah, it's speed for anonymity, just like everything else about TOR.
  - J_Darnley 11y ago
    What idiots thought this was a good idea? I swear, sometimes it seems like browser writers, standard writers, and website writers are actively colluding with advertisers and spies to make it easier to uniquely track everyone.
    - schoen 11y ago
      There's kind of a long-term issue about the web platform changing in ways that increase trackability, often without people thinking about it (or maybe in a few cases without people admitting that they thought about it). There is a W3C TAG document that touches on this at http://www.w3.org/2001/tag/doc/unsanctioned-tracking/ http://www.w3.org/2001/tag/doc/unsanctioned-tracking/ One problem is that there are so many ways of tracking user-agents in the web platform today that it can be hard to convince anyone that addressing one of them will improve the situation. :-(
    - justJanne 11y ago
      Well, the idea was to do stuff like @media(max-size: 200px) { #container { background: url(tiny_mobile.png); } } @media(max-size: 400px) { #container { background: url(small_mobile.png); } } @media(max-size: 800px) { #container { background: url(medium_tablet.png); } } @media(max-size: 2000px) { #container { background: url(large_desktop.png); } } @media(min-size: 2000px) { #container { background: url(retina.png); } } Not always loading the same image is a good idea on mobile.
      - J_Darnley 11y ago
        See my reply elsewhere. Background images are bad meaning this isn't a very compelling argument.
        cbr 11y ago
        Often these aren't really background images, they're just using that to set image sources via CSS. These days you can do the same thing with srcset, which also allows someone to learn your screen resolution.
frankzinger 11y ago
> Here's one they missed: do not resize your window! Under the "Don't change settings if you don't know their consequences." section: For example removing a menu bar or using Full Screen in Tor Browser is recommended against. The latter is known to modify the screen size, which is bad for the web fingerprint. Also, the current version of the Tor Browser warns you when you resize the window.
- temp 11y ago
  >Also, the current version of the Tor Browser warns you when you resize the window. I believe it only warns you if you maximize the window, not if you resize it.
  - corin_ 11y ago
    Resizing it isn't a problem. It doesn't open at a magically untrackable size, the point of this advice is that if you are fullscreen you will be the same size always and therefore potentially trackable between sessions, if you are resizing it yourself even if you try to resize to roughly the same size as last time you won't be exactly the same. (Window management features like snapping to half screen instead of full screen of course would be the same as going full screen.)
    - IanCal 11y ago
      Interesting. I'd have thought custom sizing would be bad for between-site tracking as it's much more likely to be unique, whereas fullscreen wouldn't have been much of a problem since resolutions are pretty standardised.
      - corin_ 11y ago
        Hmm, my thinking was that Tor browser would randomly pick a size, but maybe it only has a certain number of options to make sure every user crosses with plenty of other users too? In which case resizing of any sort would make you more unique, just within the session. (I'm no expert on Tor/browser.)
ferongr 11y ago
Also, toolbar/dock/taskbar location matters. I'm aware that due to my vertical taskbar I have a rather unique viewport size. The usability improvements of not wasting limited vertical viewing area trump that though (and I don't use TOR).
swiley 11y ago
Or just disable JavaScript? Seriously: why would you brows for with JavaScript enabled?
- Karunamon 11y ago
  If you're setting up your browser to blend in, turning off JS, which nobody in the real world actually does, only serves to draw attention to yourself.
  - swiley 11y ago
    You're already on tor. JavaScript should be disabled by default in the tor browser bundle anyway.
    - d0ugie 11y ago
      That you are on Tor and that you are not using javascript are two unusual things that compound each other in making you uniquely identifiable. One reason that it is still relevant even though you are already using Tor is that there are many ways to slip up and expose yourself. And when you do, you've paired this additional one in a hundred identifier to yourself. Might as well just use lynx.
      - torboar 11y ago
        It's trivial to distinguish a tor user from a regular user on both ends of the connection. Hiding the fact that you are using tor is not the goal, making yourself indistinguishable from other tor users is the goal.

by Jerry2 11y ago

x1798DE 11y ago

I think if you browse without JavaScript on, this information is not available to the sites you visit.

storborg 11y ago
Viewport width can be obtained via CSS, e.g. by using a media query for every screen width: @media (min-width: 400px) { .thing { background-image: url(size-400.png); } } @media (min-width: 401px) { .thing { background-image: url(size-401.png); } } You could combine this with pixel density for even more specificity.
- adrusi 11y ago
  The tor browser bundle does have settings to disable media queries for this reason, but it is still conceivable to be identified by browser size unless you completely disable all embeded media (including images). Perhaps the browser delays loading images that aren't visible on the screen.
- mistercow 11y ago
  This seems almost trivial for the browser to fix. Just load all CSS resources, regardless of media query matching.
  - ponyous 11y ago
    IIRC TOR is already slow. I am now sure you want to do this.
    - mistercow 11y ago
      Yeah, it's speed for anonymity, just like everything else about TOR.
- J_Darnley 11y ago
  What idiots thought this was a good idea? I swear, sometimes it seems like browser writers, standard writers, and website writers are actively colluding with advertisers and spies to make it easier to uniquely track everyone.
  - schoen 11y ago
    There's kind of a long-term issue about the web platform changing in ways that increase trackability, often without people thinking about it (or maybe in a few cases without people admitting that they thought about it). There is a W3C TAG document that touches on this at http://www.w3.org/2001/tag/doc/unsanctioned-tracking/ http://www.w3.org/2001/tag/doc/unsanctioned-tracking/ One problem is that there are so many ways of tracking user-agents in the web platform today that it can be hard to convince anyone that addressing one of them will improve the situation. :-(
  - justJanne 11y ago
    Well, the idea was to do stuff like @media(max-size: 200px) { #container { background: url(tiny_mobile.png); } } @media(max-size: 400px) { #container { background: url(small_mobile.png); } } @media(max-size: 800px) { #container { background: url(medium_tablet.png); } } @media(max-size: 2000px) { #container { background: url(large_desktop.png); } } @media(min-size: 2000px) { #container { background: url(retina.png); } } Not always loading the same image is a good idea on mobile.
    - J_Darnley 11y ago
      See my reply elsewhere. Background images are bad meaning this isn't a very compelling argument.
      - cbr 11y ago
        Often these aren't really background images, they're just using that to set image sources via CSS. These days you can do the same thing with srcset, which also allows someone to learn your screen resolution.

frankzinger 11y ago

> Here's one they missed: do not resize your window! Under the "Don't change settings if you don't know their consequences." section: For example removing a menu bar or using Full Screen in Tor Browser is recommended against. The latter is known to modify the screen size, which is bad for the web fingerprint. Also, the current version of the Tor Browser warns you when you resize the window.

temp 11y ago
>Also, the current version of the Tor Browser warns you when you resize the window. I believe it only warns you if you maximize the window, not if you resize it.
- corin_ 11y ago
  Resizing it isn't a problem. It doesn't open at a magically untrackable size, the point of this advice is that if you are fullscreen you will be the same size always and therefore potentially trackable between sessions, if you are resizing it yourself even if you try to resize to roughly the same size as last time you won't be exactly the same. (Window management features like snapping to half screen instead of full screen of course would be the same as going full screen.)
  - IanCal 11y ago
    Interesting. I'd have thought custom sizing would be bad for between-site tracking as it's much more likely to be unique, whereas fullscreen wouldn't have been much of a problem since resolutions are pretty standardised.
    - corin_ 11y ago
      Hmm, my thinking was that Tor browser would randomly pick a size, but maybe it only has a certain number of options to make sure every user crosses with plenty of other users too? In which case resizing of any sort would make you more unique, just within the session. (I'm no expert on Tor/browser.)

ferongr 11y ago

Also, toolbar/dock/taskbar location matters. I'm aware that due to my vertical taskbar I have a rather unique viewport size. The usability improvements of not wasting limited vertical viewing area trump that though (and I don't use TOR).

swiley 11y ago

Or just disable JavaScript? Seriously: why would you brows for with JavaScript enabled?

Karunamon 11y ago
If you're setting up your browser to blend in, turning off JS, which nobody in the real world actually does, only serves to draw attention to yourself.
- swiley 11y ago
  You're already on tor. JavaScript should be disabled by default in the tor browser bundle anyway.
  - d0ugie 11y ago
    That you are on Tor and that you are not using javascript are two unusual things that compound each other in making you uniquely identifiable. One reason that it is still relevant even though you are already using Tor is that there are many ways to slip up and expose yourself. And when you do, you've paired this additional one in a hundred identifier to yourself. Might as well just use lynx.
    - torboar 11y ago
      It's trivial to distinguish a tor user from a regular user on both ends of the connection. Hiding the fact that you are using tor is not the goal, making yourself indistinguishable from other tor users is the goal.