4 ms·

Just enable privacy.resistFingerprinting in about:config, no addons needed

commoner 7y ago
privacy.resistFingerprinting is even better since it covers more than just canvas fingerprinting, but anyone who uses it should be aware of all of the side effects. https://wiki.mozilla.org/Security/Fingerprinting https://wiki.mozilla.org/Security/Fingerprinting For example, new Firefox windows will no longer open maximized, and users who prefer maximized browser windows would need to maximize them manually.
- inetknght 7y ago
  That shouldn't be necessary if the browser didn't report accurate window sizing information
  - iudqnolq 7y ago
    Exposing the window size is needed for many festures. CSS media queries change what's displayed based on the screen size, and pure css can cause effects that can be independently measured (set a css property and the read it with JS and log the result, or have the css load a background image with tracking data embedded in ths url). Webapps that manually position elements using JavaScript use the API as well. It's also he extremely hard to prevent any way of getting at it. For example, I could measure if a line of text overflows and by how much.
    - shakna 7y ago
      CSS media queries don't get handled by anything that has the capability to send that information back, so window size reporting isn't needed for that. The only place that needs it, are those JS apps that manually position items. Measuring text overflow is only possible by the APIs exposed by the CSSOM set [0], which also happens to include the window sizing elements. If we only allowed a subset of that group, all those problems might evaporate or become extremely difficult to successfully use. [0] https://www.quirksmode.org/dom/w3c_cssom.html https://www.quirksmode.org/dom/w3c_cssom.html
      - gilfillan9 7y ago
        CSS media queries themselves don't have the capability to send any tracking information back, but the effects they cause absolutely do. Consider: @media (min-width: 600px) { .pixel { background-image: url("/pixel?width=600"); } } @media (min-width: 700px) { .pixel { background-image: url("/pixel?width=700"); } } You could add as many of these media queries as you like to increase the resolution of your tracking. Combine this with the min-height media query and you can get the absolute size of the view port.
        shakna 7y ago
        That's still more finite than what JS can report, and can be easily broken by browser prefetching. (And could have performance implications that could drive users away.) Whilst it's better-than-nothing fingerprinting, it is still far less effective than JS having access to the window and height properties directly.
      - Xeanort 7y ago
        False: it is possible with just CSS [1][2] to track screen resolution, browser engine, fonts, mouse movements and inputs. [1] https://github.com/jbtronics/CrookedStyleSheets https://github.com/jbtronics/CrookedStyleSheets [2] https://github.com/maxchehab/CSS-Keylogging https://github.com/maxchehab/CSS-Keylogging
        shakna 7y ago
        Both those methods rely on the browser not prefetching certain resources, which they are absolutely allowed to prefetch. So if a browser changes the prefetching algo, the method is immediately broken. (For example enabling network.predictor.enable-prefetch in Firefox). It isn't an inherent weakness of CSS itself.
- Nas808 7y ago
  The only side effect I really notice in everyday browsing with privacy.resistFingerprinting enabled is time. It spoofs the system time zone as UTC which makes it a bit confusing looking at things like sports and TV schedules.
- quotemstr 7y ago
  I'm using a 1920x1080 monitor with default panel sizes. So are tens of millions of other people. I totally understand fingerprint resistance, but the maximization restriction is silly in a lot of cases and should be controllable separately.
driverdan 7y ago
Unfortunately this sets the timezone to UTC which breaks calendar alerts and all timestamps.
codedokode 7y ago
But it disables per-site zoom which is inconvenient.

privacy.resistFingerprinting is even better since it covers more than just canvas fingerprinting, but anyone who uses it should be aware of all of the side effects. https://wiki.mozilla.org/Security/Fingerprinting https://wiki.mozilla.org/Security/Fingerprinting For example, new Firefox windows will no longer open maximized, and users who prefer maximized browser windows would need to maximize them manually.

inetknght 7y ago
That shouldn't be necessary if the browser didn't report accurate window sizing information
- iudqnolq 7y ago
  Exposing the window size is needed for many festures. CSS media queries change what's displayed based on the screen size, and pure css can cause effects that can be independently measured (set a css property and the read it with JS and log the result, or have the css load a background image with tracking data embedded in ths url). Webapps that manually position elements using JavaScript use the API as well. It's also he extremely hard to prevent any way of getting at it. For example, I could measure if a line of text overflows and by how much.
  - shakna 7y ago
    CSS media queries don't get handled by anything that has the capability to send that information back, so window size reporting isn't needed for that. The only place that needs it, are those JS apps that manually position items. Measuring text overflow is only possible by the APIs exposed by the CSSOM set [0], which also happens to include the window sizing elements. If we only allowed a subset of that group, all those problems might evaporate or become extremely difficult to successfully use. [0] https://www.quirksmode.org/dom/w3c_cssom.html https://www.quirksmode.org/dom/w3c_cssom.html
    - gilfillan9 7y ago
      CSS media queries themselves don't have the capability to send any tracking information back, but the effects they cause absolutely do. Consider: @media (min-width: 600px) { .pixel { background-image: url("/pixel?width=600"); } } @media (min-width: 700px) { .pixel { background-image: url("/pixel?width=700"); } } You could add as many of these media queries as you like to increase the resolution of your tracking. Combine this with the min-height media query and you can get the absolute size of the view port.
      - shakna 7y ago
        That's still more finite than what JS can report, and can be easily broken by browser prefetching. (And could have performance implications that could drive users away.) Whilst it's better-than-nothing fingerprinting, it is still far less effective than JS having access to the window and height properties directly.
    - Xeanort 7y ago
      False: it is possible with just CSS [1][2] to track screen resolution, browser engine, fonts, mouse movements and inputs. [1] https://github.com/jbtronics/CrookedStyleSheets https://github.com/jbtronics/CrookedStyleSheets [2] https://github.com/maxchehab/CSS-Keylogging https://github.com/maxchehab/CSS-Keylogging
      - shakna 7y ago
        Both those methods rely on the browser not prefetching certain resources, which they are absolutely allowed to prefetch. So if a browser changes the prefetching algo, the method is immediately broken. (For example enabling network.predictor.enable-prefetch in Firefox). It isn't an inherent weakness of CSS itself.
Nas808 7y ago
The only side effect I really notice in everyday browsing with privacy.resistFingerprinting enabled is time. It spoofs the system time zone as UTC which makes it a bit confusing looking at things like sports and TV schedules.
quotemstr 7y ago
I'm using a 1920x1080 monitor with default panel sizes. So are tens of millions of other people. I totally understand fingerprint resistance, but the maximization restriction is silly in a lot of cases and should be controllable separately.

driverdan 7y ago

Unfortunately this sets the timezone to UTC which breaks calendar alerts and all timestamps.

codedokode 7y ago

But it disables per-site zoom which is inconvenient.