4 ms·

Unique fingerprint due to 3-year-old bug in Firefox

69 points by ck2 10y ago

jdeibele 10y ago
The sample size is <very> small. I was the only person to use Safari Technology Preview beta 6 so I was "1 in 133,647". Having said that, I tested it with Firefox and found some unused plugins that I either removed (Google Talk) or set to never activate (Picasa - couldn't find how to remove it from Googling, Firefox or the Picasa app).
deleted 10y ago
[deleted]
ck2 10y ago
Extension which attempts to fix the problem https://addons.mozilla.org/en-US/firefox/addon/no-resource-uri-leak/ https://addons.mozilla.org/en-US/firefox/addon/no-resource-u... Bugzilla report https://bugzilla.mozilla.org/show_bug.cgi?id=863246 https://bugzilla.mozilla.org/show_bug.cgi?id=863246
tomglynch 10y ago
Has this just flown under the radar for three years? Why wasn't it noticed and fixed?
hartator 10y ago
I think that's not a news anymore, that Mozilla is too busy with IoT now.
baliex 10y ago
Does this affect TorBrowser?
- hartator 10y ago
  Yes > Information from resource:// is leaked, including the fact that I'm using Firefox, the platform, the browser's language (not just the content of the Accept-Language header), and whether or not I was using Tor Browser Bundle.
  - pfg 10y ago
    The fact that you're using Tor is obvious based on your IP address. I believe TBB uses the same set of defaults for the other parameters across all platforms (i.e. Linux, OS X and Windows users all appear to be using Windows 7), so that fingerprint would be the same for all TBB users (meaning it's not really much of a fingerprint).
    - makomk 10y ago
      TBB tries to conceal the actual OS you're using. Apparently this breaks that protection and makes it possible for website to detect the actual platform and that it's TBB. See https://trac.torproject.org/projects/tor/ticket/8725 https://trac.torproject.org/projects/tor/ticket/8725
      - pfg 10y ago
        Okay, that's pretty bad if it leaks the actual platform. My assumption was that that the way they spoof the platform (and related values) in windows.navigator and the user agent would apply here as well. If that's not the case, that fingerprint protection is pretty much useless.
zbjornson 10y ago
From the Reddit comments: apparently this is false, the "leak" is just showing FF's defaults.
- appleflaxen 10y ago
  Maybe, but panopticlick is still able to fingerprint me to the point where I'm unique.... over 17 bits of identity in my browser (means you can identify me in a pool of up to 2^17th people). Try it yourself. https://panopticlick.eff.org/ https://panopticlick.eff.org/ (click "Test me" then "show full results"
  - ec109685 10y ago
    You are overstating the power of the fingerprint. It's only 2^17 if every bit of your entropy is random between you and other users of the browser. Likely many of those bits have very common settings shared by many users.
  - gsnedders 10y ago
    There's a few means of fingerprinting which are pretty much impossible to protect against, most obviously what fonts you have installed, which in combination with user agent and screen-size actually gets you a heckuva long way with fingerprinting. Hopefully we can try and vastly reduce the leakage from navigator.plugins, but that might be hard to do without breaking the web, sadly.
    - r721 10y ago
      I wish they would show the rarest fonts, so that I could contemplate their removal.
  - gr2020 10y ago
    I'm skeptical about that calculation. Went there with Safari on iOS, and it also showed 17 bits.
  - newman314 10y ago
    The problem I have with panopticlick is that it does not show you recommendations how to fix things.
cmdrfred 10y ago
is this the secret behind the FBI's apparent tor fingerprinting ability they have been parallel constructing around lately?
Twirrim 10y ago
This is utterly nonsense. The settings there are the defaults. It even says so on the website. "Default Preferences" Just a quick trivial check of my local preferences and those "exposed" on the site show stuff either missing or not as per my tweaks. In other words, this is exposing what the version of firefox you're running is.
appleflaxen 10y ago
So this information is in a reply, but it deserves a top level reminder: most browsers leak your identity. panopticlick is still able to fingerprint me to the point where I'm unique.... over 17 bits of identity in my browser (means you can identify me in a pool of up to 2^17th people). Try it yourself. https://panopticlick.eff.org/ https://panopticlick.eff.org/ (click "Test me" then "show full results")
- wlesieutre 10y ago
  They really overstate their statistics by pretending each variable is independent. 6 bits from my screen resolution. Another 2 from browser plugin details. 5 from my Http_accept headers. 5 from system fonts. It's an iPad. Every single iPad is going to match on every one of those variables. You don't get to just add them up and say "Yep, 100 bits of info, I can uniquely identify this device!" Similarly, the 10 bits of WebGL fingerprint and 7 of canvas fingerprint might narrow it down to a single model of iPad, but I doubt the "extra bits" of the canvas fingerprint tell you anything that the WebGL fingerprint didn't already.
0xcde4c3db 10y ago
This report is apparently invalid, but it is true that Firefox has a pretty huge number of old bugs, some of which probably have unexamined security implications. Some will be old enough to vote in a few years. Most are "obviously" minor, but I worry about interactions. Is there something like Metcalfe's law for defects?
haddr 10y ago
Not sure about it, I've tried with my FF Beta and it seems it can't fingerprint my browser in such details.
kkirsche 10y ago
Honestly why do we care? Yes Tor and stuff should have fixed this but honestly for 90% of users things like user agents give away versions anyway

69 points by ck2 10y ago

The sample size is <very> small. I was the only person to use Safari Technology Preview beta 6 so I was "1 in 133,647". Having said that, I tested it with Firefox and found some unused plugins that I either removed (Google Talk) or set to never activate (Picasa - couldn't find how to remove it from Googling, Firefox or the Picasa app).

deleted 10y ago

[deleted]

ck2 10y ago

Extension which attempts to fix the problem https://addons.mozilla.org/en-US/firefox/addon/no-resource-uri-leak/ https://addons.mozilla.org/en-US/firefox/addon/no-resource-u... Bugzilla report https://bugzilla.mozilla.org/show_bug.cgi?id=863246 https://bugzilla.mozilla.org/show_bug.cgi?id=863246

tomglynch 10y ago

Has this just flown under the radar for three years? Why wasn't it noticed and fixed?

hartator 10y ago

I think that's not a news anymore, that Mozilla is too busy with IoT now.

baliex 10y ago

Does this affect TorBrowser?

hartator 10y ago
Yes > Information from resource:// is leaked, including the fact that I'm using Firefox, the platform, the browser's language (not just the content of the Accept-Language header), and whether or not I was using Tor Browser Bundle.
- pfg 10y ago
  The fact that you're using Tor is obvious based on your IP address. I believe TBB uses the same set of defaults for the other parameters across all platforms (i.e. Linux, OS X and Windows users all appear to be using Windows 7), so that fingerprint would be the same for all TBB users (meaning it's not really much of a fingerprint).
  - makomk 10y ago
    TBB tries to conceal the actual OS you're using. Apparently this breaks that protection and makes it possible for website to detect the actual platform and that it's TBB. See https://trac.torproject.org/projects/tor/ticket/8725 https://trac.torproject.org/projects/tor/ticket/8725
    - pfg 10y ago
      Okay, that's pretty bad if it leaks the actual platform. My assumption was that that the way they spoof the platform (and related values) in windows.navigator and the user agent would apply here as well. If that's not the case, that fingerprint protection is pretty much useless.

zbjornson 10y ago

From the Reddit comments: apparently this is false, the "leak" is just showing FF's defaults.

appleflaxen 10y ago
Maybe, but panopticlick is still able to fingerprint me to the point where I'm unique.... over 17 bits of identity in my browser (means you can identify me in a pool of up to 2^17th people). Try it yourself. https://panopticlick.eff.org/ https://panopticlick.eff.org/ (click "Test me" then "show full results"
- ec109685 10y ago
  You are overstating the power of the fingerprint. It's only 2^17 if every bit of your entropy is random between you and other users of the browser. Likely many of those bits have very common settings shared by many users.
- gsnedders 10y ago
  There's a few means of fingerprinting which are pretty much impossible to protect against, most obviously what fonts you have installed, which in combination with user agent and screen-size actually gets you a heckuva long way with fingerprinting. Hopefully we can try and vastly reduce the leakage from navigator.plugins, but that might be hard to do without breaking the web, sadly.
  - r721 10y ago
    I wish they would show the rarest fonts, so that I could contemplate their removal.
- gr2020 10y ago
  I'm skeptical about that calculation. Went there with Safari on iOS, and it also showed 17 bits.
- newman314 10y ago
  The problem I have with panopticlick is that it does not show you recommendations how to fix things.

cmdrfred 10y ago

is this the secret behind the FBI's apparent tor fingerprinting ability they have been parallel constructing around lately?

Twirrim 10y ago

This is utterly nonsense. The settings there are the defaults. It even says so on the website. "Default Preferences" Just a quick trivial check of my local preferences and those "exposed" on the site show stuff either missing or not as per my tweaks. In other words, this is exposing what the version of firefox you're running is.

appleflaxen 10y ago

So this information is in a reply, but it deserves a top level reminder: most browsers leak your identity. panopticlick is still able to fingerprint me to the point where I'm unique.... over 17 bits of identity in my browser (means you can identify me in a pool of up to 2^17th people). Try it yourself. https://panopticlick.eff.org/ https://panopticlick.eff.org/ (click "Test me" then "show full results")

wlesieutre 10y ago
They really overstate their statistics by pretending each variable is independent. 6 bits from my screen resolution. Another 2 from browser plugin details. 5 from my Http_accept headers. 5 from system fonts. It's an iPad. Every single iPad is going to match on every one of those variables. You don't get to just add them up and say "Yep, 100 bits of info, I can uniquely identify this device!" Similarly, the 10 bits of WebGL fingerprint and 7 of canvas fingerprint might narrow it down to a single model of iPad, but I doubt the "extra bits" of the canvas fingerprint tell you anything that the WebGL fingerprint didn't already.

0xcde4c3db 10y ago

This report is apparently invalid, but it is true that Firefox has a pretty huge number of old bugs, some of which probably have unexamined security implications. Some will be old enough to vote in a few years. Most are "obviously" minor, but I worry about interactions. Is there something like Metcalfe's law for defects?

haddr 10y ago

Not sure about it, I've tried with my FF Beta and it seems it can't fingerprint my browser in such details.

kkirsche 10y ago

Honestly why do we care? Yes Tor and stuff should have fixed this but honestly for 90% of users things like user agents give away versions anyway