5 ms·

Seems like they're just using a blacklist? Those seem to be able to be gamed pretty trivially.

rubbingalcohol 8y ago
Agreed. Setting up blacklists is just whack-a-mole. I'd be more interested in detection of actual fingerprinting techniques, such as system font enumeration using canvas, or WebGL GPU fingerprinting. It would be technically possible to detect the creation of WebGL or canvas contexts that aren't actually rendered in the layout and prevent data gathered from those contexts from being sent in any XHR payload. I'm sure that's a lot of work. Maybe it would be better to find the worst offending JS APIs and demand a user consent step similar to webcam or notifications in order for the scripts to run at all.
- drewmol 8y ago
  I couldn't help but read the headline and think to myself: This is great! I should probably jump right in to this .001 % bucket of Firefox nightly users. Combined this with my >1% OS, custom profile of barebones unsupported, blocked, not installed client technologies and then they'll really never get my fingerprints!
  - discreditable 8y ago
    If you enable resistFingerprinting, Firefox reports a "standard" user agent. Without that, your Nightly user agent probably makes you trivial to track.
- benmmurphy 8y ago
  Some sites are using these APIs as a way of providing positive data that the users environment is not a bot. I think if you ban this kind of thing you are going to break some important web apps.
walrus01 8y ago
One would think that the past 25 years of experience with SMTP RBLs would teach people that using predefined DNS based blacklists (or IP space range blacklists) is indeed a game of whack-a-mole.
- simias 8y ago
  The issue with emails is worse because spam is unsolicited and can be sent from anywhere. That means that basically anything can be used to send spam, from botnets to miss-configured SMTP servers. On the other hand your fingerprinting/mining JS has to be served by a website that people willingly browse. That's a much higher barrier of entry and means that you can't just change your server's domain every hour lest you manage to convince your partner websites to update their code as frequently (which in turn might end up blacklisting them instead).
  - walrus01 8y ago
    malicious advertising networks and advertising/JS botnet things have used fast flux DNS for a long time now. It's fairly standard practice for hostnames and IPs of things serving malicious content to have extremely low DNS TTLs, the malicious actors have scripted/automated their changes. https://www.welivesecurity.com/2017/01/12/fast-flux-networks-work/ https://www.welivesecurity.com/2017/01/12/fast-flux-networks...
    - simias 8y ago
      Right, but you still have to convince the target to load that code willingly (directly or indirectly) so it's still harder than email. I except these shady networks to be mostly used on shady websites, so you can block them "at the source" so to speak.
IshKebab 8y ago
Yeah this is a disappointing approach. At least for crypto mining it should be fairly easy to detect heavy computation and ask the user's permission to continue.
simias 8y ago
That's effectively how ad-blockers function and they seem to work pretty well. Buying a new domain to bypass the list is pretty easy but adding one line in the blocklist is even easier (and easily crowdsourced).
- lewiscollard 8y ago
  This is a good insight. Because Firefox is open-source, everything can be gamed. If they went for some more "intelligent" method, the kind that instinctively appeals to people like you and I and anyone posting on HN, the fingerprinters could see exactly what they were being tested on, and it would be faster to iterate their counter-measures (keep this particular activity just below threshold X on metric Y) than it would be to make new Firefox releases. And the counter-measures to these more smart kind of measures happen _in secret_, whereas counter-measures to the "bash the problem to death with simple rules" approach are public, are (if their fingerprinting is to have any point) widely distributed, and thus much more immediately picked up and remedied by the many wonderful people who work on the lists used by privacy tools like ad blockers. While we all like a cool and innovative solution, sometimes bashing the problem to death with dumb rules really is the best approach :) (edited for a clarification)

Agreed. Setting up blacklists is just whack-a-mole. I'd be more interested in detection of actual fingerprinting techniques, such as system font enumeration using canvas, or WebGL GPU fingerprinting. It would be technically possible to detect the creation of WebGL or canvas contexts that aren't actually rendered in the layout and prevent data gathered from those contexts from being sent in any XHR payload. I'm sure that's a lot of work. Maybe it would be better to find the worst offending JS APIs and demand a user consent step similar to webcam or notifications in order for the scripts to run at all.

drewmol 8y ago
I couldn't help but read the headline and think to myself: This is great! I should probably jump right in to this .001 % bucket of Firefox nightly users. Combined this with my >1% OS, custom profile of barebones unsupported, blocked, not installed client technologies and then they'll really never get my fingerprints!
- discreditable 8y ago
  If you enable resistFingerprinting, Firefox reports a "standard" user agent. Without that, your Nightly user agent probably makes you trivial to track.
benmmurphy 8y ago
Some sites are using these APIs as a way of providing positive data that the users environment is not a bot. I think if you ban this kind of thing you are going to break some important web apps.

walrus01 8y ago

One would think that the past 25 years of experience with SMTP RBLs would teach people that using predefined DNS based blacklists (or IP space range blacklists) is indeed a game of whack-a-mole.

simias 8y ago
The issue with emails is worse because spam is unsolicited and can be sent from anywhere. That means that basically anything can be used to send spam, from botnets to miss-configured SMTP servers. On the other hand your fingerprinting/mining JS has to be served by a website that people willingly browse. That's a much higher barrier of entry and means that you can't just change your server's domain every hour lest you manage to convince your partner websites to update their code as frequently (which in turn might end up blacklisting them instead).
- walrus01 8y ago
  malicious advertising networks and advertising/JS botnet things have used fast flux DNS for a long time now. It's fairly standard practice for hostnames and IPs of things serving malicious content to have extremely low DNS TTLs, the malicious actors have scripted/automated their changes. https://www.welivesecurity.com/2017/01/12/fast-flux-networks-work/ https://www.welivesecurity.com/2017/01/12/fast-flux-networks...
  - simias 8y ago
    Right, but you still have to convince the target to load that code willingly (directly or indirectly) so it's still harder than email. I except these shady networks to be mostly used on shady websites, so you can block them "at the source" so to speak.

IshKebab 8y ago

Yeah this is a disappointing approach. At least for crypto mining it should be fairly easy to detect heavy computation and ask the user's permission to continue.

simias 8y ago

That's effectively how ad-blockers function and they seem to work pretty well. Buying a new domain to bypass the list is pretty easy but adding one line in the blocklist is even easier (and easily crowdsourced).

lewiscollard 8y ago
This is a good insight. Because Firefox is open-source, everything can be gamed. If they went for some more "intelligent" method, the kind that instinctively appeals to people like you and I and anyone posting on HN, the fingerprinters could see exactly what they were being tested on, and it would be faster to iterate their counter-measures (keep this particular activity just below threshold X on metric Y) than it would be to make new Firefox releases. And the counter-measures to these more smart kind of measures happen _in secret_, whereas counter-measures to the "bash the problem to death with simple rules" approach are public, are (if their fingerprinting is to have any point) widely distributed, and thus much more immediately picked up and remedied by the many wonderful people who work on the lists used by privacy tools like ad blockers. While we all like a cool and innovative solution, sometimes bashing the problem to death with dumb rules really is the best approach :) (edited for a clarification)