3 ms·
I have a few questions about finger printing. Why Tor sends window size to servers? If it has to, why it can't send closest multiple of 100 instead of real val
by shultays 10y ago
I have a few questions about finger printing.
Why Tor sends window size to servers? If it has to, why it can't send closest multiple of 100 instead of real value?
Why servers request size of client windows anyway? I assume so they can serve different resolution images to clients or maybe different layouts, is this correct? But then instead of sending 1920x1080, simply sending 1900x1100 would also work right?
Same goes for fonts, as soon as you install a few different fonts, you are pretty much unique now. Why does a browser has to send the fonts you have? Shouldn't it be possible to only send the fonts you have? Default fonts of OSes enabled by default, and new fonts are disabled?
- jerheinze 10y ago> Why Tor sends window size to servers? If it has to, why it can't send closest multiple of 100 instead of real value? It's not Tor that does so, by using JS one can determine canvas size. Worse, CSS alone can be used to extract.[1] You can take a look here for a live demo.[2] [1] : https://matt.traudt.xyz/p/YF4ciVY6.html https://matt.traudt.xyz/p/YF4ciVY6.html [2] : https://system33.pw/cssmediapoc https://system33.pw/cssmediapoc
- ryacko 10y agoactually common browser window sizes are divisible by 128, which means that you could just bitmask all but the last few digits to achieve the same result in a few cycles
- Walf 10y agoNo, you actually have to display the content inside a pane of a common size because there are many ways to get screen size indirectly from content that's occupying it. Think responsive mode of developer tools.
- Vinnl 10y agoThe browser needn't directly send info to the server; it simply has to be available to client-side Javascript. That can then, in turn, send that info to the server, which (I think) is really hard for browsers to detect.
- system33- 10y agoCSS alone can get window size https://news.ycombinator.com/item?id=13929211 https://news.ycombinator.com/item?id=13929211
- dtech 10y agoThis is all done client side with Flash/Javascript. For Tor it is recommended to disable JS, and I believe the Tor browser bundle comes with NoScript by default. Plugins should be disabled because they are very exploitable to de-tor someone.