5 ms·

What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful mode

What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's preferred language and claim en-US as your preference, and change the user agent string to blend in to the crowd). This is all assuming people don't run any third party plugins like Flash. Are browser vendors on track to figure out a solution to this problem that combines user friendliness with privacy? Or will anonymous browsing remain a privilege for those with the right amount of technical know-how? The problem it seems is that simply disabling JavaScript is not an option for normal web browsing, and even a requirement for interacting with the web services used by organisations you have a relation with (e.g., the government, insurance companies, banks, etcetera).

randomwalker 10y ago
Personally I think there are so many of these APIs that for the browser to try to prevent the ability to fingerprint is putting the genie back in the bottle. But there is one powerful step browsers can take: put stronger privacy protections into private browsing mode, even at the expense of some functionality. Firefox has taken steps in this direction https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-a-more-private-browsing-experience/ https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-... Traditionally all browsers viewed private browsing mode as protecting against local adversaries and not trackers / network adversaries, and in my opinion this was a mistake.
- avar 10y ago
  Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting: https://bugs.chromium.org/p/chromium/issues/detail?id=142214#c1 https://bugs.chromium.org/p/chromium/issues/detail?id=142214... Don't you think this sort of thing warrants a separate sort of browsing mode? A lot of people who use the likes of incognito mode just use it for e.g. browsing porn where they don't want the local history to be preserved. Turning that mode into one that's highly hardened against fingerprinting would in practice ruin the browsing experience for those users. Just look at what the Tor browser needs to do with fixed preset resolutions, no JavaScript etc.
  - benevol 10y ago
    > Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting Obviously. Google is in the business of destroying your privacy: Advertising revenue is maximized when the consumer is/remains completely tracked and profiled at all times. Other browser vendors which are not in the ad business could use this as an opportunity to differentiate themselves from Google: Introduce a 3rd browsing mode which kills fingerprinting (with the "cost" of reduced user friendliness).
    - Freak_NL 10y ago
      Or just let the user decide at the start of a private session. Firefox already does this with tracking protection. If Mozilla decides to improve tracking protection at the cost of usability (such as hiding you preferred language), than offering that as a toggle-able option on that page might be sufficient to empower the user to decide for on his own.
      - benevol 10y ago
        > offering that as a toggle-able option on that page might be sufficient Technically speaking yes. From a marketing/communication standpoint, I would separate this "feature" clearly from the 2 known browsing experiences. It not only clearly communicates to the user that a different browsing experience is about to start. By selling it as "the third browsing mode", it definitely also adds more perceived value to the product.
    - cwilkes 10y ago
      Google already has that info without these hacks. In fact it is in googles best interest to remove these security holes so other advertisers lose whatever minor advantage they can get.
  - chriswarbo 10y ago
    > Don't you think this sort of thing warrants a separate sort of browsing mode? A lot of people who use the likes of incognito mode just use it for e.g. browsing porn where they don't want the local history to be preserved. Think about it this way, would those using incognito mode for porn be OK with their normal browsing being peppered with ads claiming to "Improve your <fetish> with our range of <sexual implements>"? Whilst I think incognito mode's warnings about not hiding data from network operators should remain (i.e. your boss can find out what sites you were visiting at work), that doesn't mean efforts to prevent it shouldn't be made.
- hackuser 10y ago
  > there are so many of these APIs that for the browser to try to prevent the ability to fingerprint is putting the genie back in the bottle. I disagree. If there were billions to be made from this new tech, secure browsing, then the browser vendors would be moving rapidly toward it. Certainly, more difficult technical challenges are overcome regularly. Surveillance was implemented without users' knowledge and without public debate, presented as a fait accompli, and now the latest tactic is to say there's nothing that can be done about it. People accept that because they feel helpless, but I don't think we should be perpetuating this rhetoric of inevitiability. There's no technical reason it can't be done.
- lawnchair_larry 10y ago
  That's not effective, because very few people use private mode.
chris_wot 10y ago
What about time and date? I'm almost certain NetFlix uses this to detect geo-unblocking.
- Freak_NL 10y ago
  Netflix uses an up-to-date list of known VPN-endpoints in addition to a database of IP-ranges by country. They don't need to detect anything client-side. This list is constantly in flux though, so sometimes accessing Netflix via VPN works, sometimes it doesn't.
amluto 10y ago
The browser vendors could start taking the idea of asking for permission seriously. For WebRTC, browsers could block local addresses. uBlock Origin can do this on Firefox already. For battery: browsers could treat it like location and ask for permission. Why does the average site need to know my battery status? For fonts: browsers could standardize a list of system fonts available on each platform. It's 2016 already: web fonts are here, are widely supported, and no legitimate website should be relying on some oddball manually installed font. This problem is hard to solve, but the Tor browser has it mostly solved. Other browsers could learn from it.
- Freak_NL 10y ago
  > browsers could standardize a list of system fonts available on each platform. It would probably make sense to completely disable support for local fonts unless permitted by the user (for legacy websites that depend on it). All modern browsers support @font-face, and without @font-face you can always depend on the special keywords serif, sans-serif, and monospace; these will load the system's default font for that category.
  - Klathmon 10y ago
    I hope there is another way to solve it, as I have installed web-fonts to my PC to improve page loading speed for some common fonts I keep seeing (the most recent being the Roboto font stack from google). It would be a shame to have to keep re-downloading that every time.
    - Freak_NL 10y ago
      You don't have to. Fonts should be (and usually are) offered to the web browser with the instruction to cache them indefinitely. You will only have to re-download them when your cache is cleaned up (due to its size, private browsing, or manually cleaning it). Upcoming technology WOFF2 helps further compress them by a significant margin as well (I've seen up to 50% improvement in size over plain WOFF). The problem is that the behaviour you are describing is also one of the ways a fingerprinter gets its data on your fonts; by specifying an @font-face declaration that first tries for a local font, and only loads a remote font if that is not found. Do this for a short-list of popular but distinct fonts (such as Roboto), and you have a nice amount of bits of identifying data to add to the stack. Also, tricks like these exist (using rendering metrics to detect fonts): http://www.lalit.org/lab/javascript-css-font-detect/ http://www.lalit.org/lab/javascript-css-font-detect/
Frondo 10y ago
I think the answer isn't technical, but legal and cultural. Make it unacceptable in the court of public opinion for companies to misuse this data, and strengthen privacy laws. These two things, of course, go hand-in-hand, but us techies tend to look, I think, for the technical solution because that's the place where it's easiest to see how we could have any sort of impact. The other stuff is a lot of talking to and listening to people, consensus-building, being persuasive, etc.
- Freak_NL 10y ago
  Legislation and regulation are necessary, and they tend to help to keep the really big boys in check, but how can you actually tell if a company is actively engaged in compiling profiles on you or not? I can ask my browser to pass the Do-Not-Track header indicating my objection that practice, but why would a company specialised in tracking users respect that header? I have tried to convince the Dutch banks I use (ING and ABN AMRO, i.e., big banks) to stop employing tracking beacons and third party tracking services on their secured internet banking environments, but the responses I get range from 'yeah we need those to improve your customer experience' to 'you are welcome to block these trackers yourself' (I already do, thank you very much).
mtgx 10y ago
How about using the permission system? You don't have to disable WebGL by default, but you can ask users for permission when it's needed (usually in a game). Other stuff like GPS, camera, and microphone already require permission before being used.

randomwalker 10y ago

Personally I think there are so many of these APIs that for the browser to try to prevent the ability to fingerprint is putting the genie back in the bottle. But there is one powerful step browsers can take: put stronger privacy protections into private browsing mode, even at the expense of some functionality. Firefox has taken steps in this direction https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-a-more-private-browsing-experience/ https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-... Traditionally all browsers viewed private browsing mode as protecting against local adversaries and not trackers / network adversaries, and in my opinion this was a mistake.

avar 10y ago
Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting: https://bugs.chromium.org/p/chromium/issues/detail?id=142214#c1 https://bugs.chromium.org/p/chromium/issues/detail?id=142214... Don't you think this sort of thing warrants a separate sort of browsing mode? A lot of people who use the likes of incognito mode just use it for e.g. browsing porn where they don't want the local history to be preserved. Turning that mode into one that's highly hardened against fingerprinting would in practice ruin the browsing experience for those users. Just look at what the Tor browser needs to do with fixed preset resolutions, no JavaScript etc.
- benevol 10y ago
  > Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting Obviously. Google is in the business of destroying your privacy: Advertising revenue is maximized when the consumer is/remains completely tracked and profiled at all times. Other browser vendors which are not in the ad business could use this as an opportunity to differentiate themselves from Google: Introduce a 3rd browsing mode which kills fingerprinting (with the "cost" of reduced user friendliness).
  - Freak_NL 10y ago
    Or just let the user decide at the start of a private session. Firefox already does this with tracking protection. If Mozilla decides to improve tracking protection at the cost of usability (such as hiding you preferred language), than offering that as a toggle-able option on that page might be sufficient to empower the user to decide for on his own.
    - benevol 10y ago
      > offering that as a toggle-able option on that page might be sufficient Technically speaking yes. From a marketing/communication standpoint, I would separate this "feature" clearly from the 2 known browsing experiences. It not only clearly communicates to the user that a different browsing experience is about to start. By selling it as "the third browsing mode", it definitely also adds more perceived value to the product.
  - cwilkes 10y ago
    Google already has that info without these hacks. In fact it is in googles best interest to remove these security holes so other advertisers lose whatever minor advantage they can get.
- chriswarbo 10y ago
  > Don't you think this sort of thing warrants a separate sort of browsing mode? A lot of people who use the likes of incognito mode just use it for e.g. browsing porn where they don't want the local history to be preserved. Think about it this way, would those using incognito mode for porn be OK with their normal browsing being peppered with ads claiming to "Improve your <fetish> with our range of <sexual implements>"? Whilst I think incognito mode's warnings about not hiding data from network operators should remain (i.e. your boss can find out what sites you were visiting at work), that doesn't mean efforts to prevent it shouldn't be made.
hackuser 10y ago
> there are so many of these APIs that for the browser to try to prevent the ability to fingerprint is putting the genie back in the bottle. I disagree. If there were billions to be made from this new tech, secure browsing, then the browser vendors would be moving rapidly toward it. Certainly, more difficult technical challenges are overcome regularly. Surveillance was implemented without users' knowledge and without public debate, presented as a fait accompli, and now the latest tactic is to say there's nothing that can be done about it. People accept that because they feel helpless, but I don't think we should be perpetuating this rhetoric of inevitiability. There's no technical reason it can't be done.
lawnchair_larry 10y ago
That's not effective, because very few people use private mode.

chris_wot 10y ago

What about time and date? I'm almost certain NetFlix uses this to detect geo-unblocking.

Freak_NL 10y ago
Netflix uses an up-to-date list of known VPN-endpoints in addition to a database of IP-ranges by country. They don't need to detect anything client-side. This list is constantly in flux though, so sometimes accessing Netflix via VPN works, sometimes it doesn't.

amluto 10y ago

The browser vendors could start taking the idea of asking for permission seriously. For WebRTC, browsers could block local addresses. uBlock Origin can do this on Firefox already. For battery: browsers could treat it like location and ask for permission. Why does the average site need to know my battery status? For fonts: browsers could standardize a list of system fonts available on each platform. It's 2016 already: web fonts are here, are widely supported, and no legitimate website should be relying on some oddball manually installed font. This problem is hard to solve, but the Tor browser has it mostly solved. Other browsers could learn from it.

Freak_NL 10y ago
> browsers could standardize a list of system fonts available on each platform. It would probably make sense to completely disable support for local fonts unless permitted by the user (for legacy websites that depend on it). All modern browsers support @font-face, and without @font-face you can always depend on the special keywords serif, sans-serif, and monospace; these will load the system's default font for that category.
- Klathmon 10y ago
  I hope there is another way to solve it, as I have installed web-fonts to my PC to improve page loading speed for some common fonts I keep seeing (the most recent being the Roboto font stack from google). It would be a shame to have to keep re-downloading that every time.
  - Freak_NL 10y ago
    You don't have to. Fonts should be (and usually are) offered to the web browser with the instruction to cache them indefinitely. You will only have to re-download them when your cache is cleaned up (due to its size, private browsing, or manually cleaning it). Upcoming technology WOFF2 helps further compress them by a significant margin as well (I've seen up to 50% improvement in size over plain WOFF). The problem is that the behaviour you are describing is also one of the ways a fingerprinter gets its data on your fonts; by specifying an @font-face declaration that first tries for a local font, and only loads a remote font if that is not found. Do this for a short-list of popular but distinct fonts (such as Roboto), and you have a nice amount of bits of identifying data to add to the stack. Also, tricks like these exist (using rendering metrics to detect fonts): http://www.lalit.org/lab/javascript-css-font-detect/ http://www.lalit.org/lab/javascript-css-font-detect/

Frondo 10y ago

I think the answer isn't technical, but legal and cultural. Make it unacceptable in the court of public opinion for companies to misuse this data, and strengthen privacy laws. These two things, of course, go hand-in-hand, but us techies tend to look, I think, for the technical solution because that's the place where it's easiest to see how we could have any sort of impact. The other stuff is a lot of talking to and listening to people, consensus-building, being persuasive, etc.

Freak_NL 10y ago
Legislation and regulation are necessary, and they tend to help to keep the really big boys in check, but how can you actually tell if a company is actively engaged in compiling profiles on you or not? I can ask my browser to pass the Do-Not-Track header indicating my objection that practice, but why would a company specialised in tracking users respect that header? I have tried to convince the Dutch banks I use (ING and ABN AMRO, i.e., big banks) to stop employing tracking beacons and third party tracking services on their secured internet banking environments, but the responses I get range from 'yeah we need those to improve your customer experience' to 'you are welcome to block these trackers yourself' (I already do, thank you very much).

mtgx 10y ago

How about using the permission system? You don't have to disable WebGL by default, but you can ask users for permission when it's needed (usually in a game). Other stuff like GPS, camera, and microphone already require permission before being used.