4 ms·

So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular

by pmlnr 10y ago

So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular" browser fingerprinting. Is anyone aware of the existence of one?

TazeTSchnitzel 10y ago
I think Tor Browser tries to do this for some types of fingerprinting.
- brador 10y ago
  The things you block and don't block could also be used to help form a fingerprint.
- pmlnr 10y ago
  The Tor Browser does not send misinformation; it just blocks. A solution would probably be a browser where every version, on every platform reports the exact same things, always the same way.
  - TazeTSchnitzel 10y ago
    That's not true, Tor Browser does sometimes lie, see what englehardt linked.
  - neerdowell 10y ago
    > The Tor Browser does not send misinformation; it just blocks. No, it doesn't. TB sends all kinds of misinformation, from the user agent string (always reports itself as being its base version of Firefox running on 32-bit Windows 7) to rounding javascript timing functions to reduce the precision. > A solution would probably be a browser where every version, on every platform reports the exact same things, always the same way. That's exactly what Tor Browser does.
    - pmlnr 10y ago
      The last time I tried it this wasn't always the case; however, my information could easily be outdated, and in that case, I'm sorry.
  - dredmorbius 10y ago
    Or a browser which randomly permutes canvas values.
- englehardt 10y ago
  The Tor Browser folks have done some excellent work to reduce the fingerprintability of the browser. See "Specific Fingerprinting Defenses in the Tor Browser" here: https://www.torproject.org/projects/torbrowser/design/#fingerprinting-linkability https://www.torproject.org/projects/torbrowser/design/#finge.... For Firefox and Chrome there are canvas fingerprint blockers [1] and [2]. These are heuristic based, so you'll likely see a bit of false positives. uBlock Origin includes an option to prevent the leakage of local IP addresses [3]. [1] https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/ https://addons.mozilla.org/en-US/firefox/addon/canvasblocker... [2]https://chrome.google.com/webstore/detail/canvasfingerprintblock/ipmjngkmngdcdpmgmiebdmfbkcecdndc?hl=en-US https://chrome.google.com/webstore/detail/canvasfingerprintb... [3]https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-leaking-local-IP-address https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...
- cm3 10y ago
  I wish there was a Tor Browser without Tor but just things like fingerprinting fixes.
madeofpalk 10y ago
The problem here is Canvas fingerprinting - that's what I found the most surprising and interesting. How do you prevent that, apart from working on 'fixing' browsers to create pixel-perfect renders across different browsers/platforms/configurations. Would that even be possible? Edit: > Tor Browser notifies the user for canvas read attempts and provides the option to return blank image data to prevent fingerprinting. Huh. I guess that's one attempt, but being able to read pixel data out of a canvas is completely reasonable.
- Freak_NL 10y ago
  > […] but being able to read pixel data out of a canvas is completely reasonable. Not for every website. Most websites don't need canvas at all. One option would be to ask users to activate canvas support for a website that does need it, so users can judge for themselves if the request is legitimate. This is how the geo-location API works after all. I am not convinced that this will work very well though.
  - madeofpalk 10y ago
    Seems like just another vector to fingerprint that browser by :)
    - Freak_NL 10y ago
      It is! But a disabled setting has a much lower entropy in terms of identifying bits than the hash generated with an active canvas.
- robmcm 10y ago
  Disable canvas rendering from 3rd part domains? Prompt to enable canvas support for each domain?
- boomlinde 10y ago
  If the "fingerprint" really is a checksum/crypto hash, an ever so slight random element in rendering output could help. Of course, together with other techniques, it might just identify your somewhat obfuscating browser.

by pmlnr 10y ago

TazeTSchnitzel 10y ago

I think Tor Browser tries to do this for some types of fingerprinting.

brador 10y ago
The things you block and don't block could also be used to help form a fingerprint.
pmlnr 10y ago
The Tor Browser does not send misinformation; it just blocks. A solution would probably be a browser where every version, on every platform reports the exact same things, always the same way.
- TazeTSchnitzel 10y ago
  That's not true, Tor Browser does sometimes lie, see what englehardt linked.
- neerdowell 10y ago
  > The Tor Browser does not send misinformation; it just blocks. No, it doesn't. TB sends all kinds of misinformation, from the user agent string (always reports itself as being its base version of Firefox running on 32-bit Windows 7) to rounding javascript timing functions to reduce the precision. > A solution would probably be a browser where every version, on every platform reports the exact same things, always the same way. That's exactly what Tor Browser does.
  - pmlnr 10y ago
    The last time I tried it this wasn't always the case; however, my information could easily be outdated, and in that case, I'm sorry.
- dredmorbius 10y ago
  Or a browser which randomly permutes canvas values.
englehardt 10y ago
The Tor Browser folks have done some excellent work to reduce the fingerprintability of the browser. See "Specific Fingerprinting Defenses in the Tor Browser" here: https://www.torproject.org/projects/torbrowser/design/#fingerprinting-linkability https://www.torproject.org/projects/torbrowser/design/#finge.... For Firefox and Chrome there are canvas fingerprint blockers [1] and [2]. These are heuristic based, so you'll likely see a bit of false positives. uBlock Origin includes an option to prevent the leakage of local IP addresses [3]. [1] https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/ https://addons.mozilla.org/en-US/firefox/addon/canvasblocker... [2]https://chrome.google.com/webstore/detail/canvasfingerprintblock/ipmjngkmngdcdpmgmiebdmfbkcecdndc?hl=en-US https://chrome.google.com/webstore/detail/canvasfingerprintb... [3]https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-leaking-local-IP-address https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...
cm3 10y ago
I wish there was a Tor Browser without Tor but just things like fingerprinting fixes.

madeofpalk 10y ago

The problem here is Canvas fingerprinting - that's what I found the most surprising and interesting. How do you prevent that, apart from working on 'fixing' browsers to create pixel-perfect renders across different browsers/platforms/configurations. Would that even be possible? Edit: > Tor Browser notifies the user for canvas read attempts and provides the option to return blank image data to prevent fingerprinting. Huh. I guess that's one attempt, but being able to read pixel data out of a canvas is completely reasonable.

Freak_NL 10y ago
> […] but being able to read pixel data out of a canvas is completely reasonable. Not for every website. Most websites don't need canvas at all. One option would be to ask users to activate canvas support for a website that does need it, so users can judge for themselves if the request is legitimate. This is how the geo-location API works after all. I am not convinced that this will work very well though.
- madeofpalk 10y ago
  Seems like just another vector to fingerprint that browser by :)
  - Freak_NL 10y ago
    It is! But a disabled setting has a much lower entropy in terms of identifying bits than the hash generated with an active canvas.
robmcm 10y ago
Disable canvas rendering from 3rd part domains? Prompt to enable canvas support for each domain?
boomlinde 10y ago
If the "fingerprint" really is a checksum/crypto hash, an ever so slight random element in rendering output could help. Of course, together with other techniques, it might just identify your somewhat obfuscating browser.