3 ms·
> Tor Browser in its default mode is starting with a content window rounded to a multiple of 200px x 100px to prevent fingerprinting the screen dimensions. The
by dddddaviddddd 7y ago
> Tor Browser in its default mode is starting with a content window rounded to a multiple of 200px x 100px to prevent fingerprinting the screen dimensions. The strategy here is to put all users in a couple of buckets to make it harder to single them out. That worked so far until users started to resize their windows (e.g. by maximizing them or going into fullscreen mode). Tor Browser 9 ships with a fingerprinting defense for those scenarios as well, which is called Letterboxing, a technique developed by Mozilla and presented earlier this year. It works by adding white margins to a browser window so that the window is as close as possible to the desired size while users are still in a couple of screen size buckets that prevent singling them out with the help of screen dimensions.
- dmix 7y agoHow often do people keep the same window size?
- zzo38computer 7y agoI think that perhaps they should have an option to report the height of the content window as Infinity, regardless of its actual height.
- Thorrez 7y agoThat would likely cause some sites to break. Also I wonder how it would interact with CSS. Also I wonder if there would be methods to detect the actual height (such as by testing if something is visible or not, or testing for mouse location, and seeing how many pixels it takes for the mouse to go off the edge).
- zzo38computer 7y agoI thought of that. Visibility testing would always report as visible, and testing the vertical scroll position would always report zero, and the user can configure in what cases mouse location can be tested and how. (Document scripts should actually be disabled by default I think, and what features are available (and in some cases, spoofed) depends on user settings which can be global or specific to URL patterns. For example, full mouse and keyboard events might be available only for activated <canvas> elements when quote mode is active, and other than that is only used to calculate form fields, perhaps.)
- alok-g 7y agoHmm. Then _every_ browser should do that. That will force website development to change over the time to a WYSIWYM approach to handling screen resolutions.
- Ajedi32 7y agoIMO they should whitelist a couple common resolutions. 1920x1080, for example, is extremely common and probably doesn't need to be letterboxed to avoid fingerprinting.
- tfha 7y agoNah sometimes you need to resize manually read a webpage. Gotta keep usability at least a little bit. Letterboxing I think is a good compromise
- Thorrez 7y agoI don't think Ajedi32 disagrees with you. I think Ajedi32 is saying that in addition to the all the resolutions that are a multiple of 200x100, a few more resolutions should be allowed, such as 1920x1080.