4 ms·

Why can't a browser solve this (except for IP) by simply having an option to not leak any data? Make audio and GL calls constant time, and don't persist anythin

by rapind 7y ago

Why can't a browser solve this (except for IP) by simply having an option to not leak any data? Make audio and GL calls constant time, and don't persist anything past the tab / window / site? No fonts or cache reuse beyond the host? No referrers etc. What's the hard problem here that prevents major browsers from having an option like this?

cpeterso 7y ago
Firefox has an about:config preference called "privacy.resistFingerprinting" to enable some of Tor's mitigations against fingerprinting. Tor is based on Firefox code and Mozilla merges some of Tor's code changes into Firefox to make updating easier for the Tor team. More details in this ghacks article: https://www.ghacks.net/2018/03/01/a-history-of-fingerprinting-protection-in-firefox/ https://www.ghacks.net/2018/03/01/a-history-of-fingerprintin...
Etheryte 7y ago
The difficult bit is that your browser is programmable and browsers are different across vendors, devices and releases. This means whatever a bad guy can think of as a test can be sent back over the wire, and you can't realistically block sites from sending data back to servers. So long as there are different browsers etc, there will be tests that can differentiate between them. Currently canvas fingerprinting [1] is a popular option, but there's quite a lot of options for that next thing you can use. Even generic code execution time could be used to an extent. Realistically there is hope at the end of the tunnel, but it's a very long way to go given just how complex of a corner we've painted ourselves into with modern web standards. While it wouldn't stop purely malicious actors, I personally think it might be easier to address the whole situation on the legislation side rather than with technology. Imagine GDPR, except tracking would be illegal altogether: there will always be actors who will work to bypass it, but the majority would do their best to conform, lest they want to go bust with fines. [1] https://en.wikipedia.org/wiki/Canvas_fingerprinting https://en.wikipedia.org/wiki/Canvas_fingerprinting

by rapind 7y ago

cpeterso 7y ago

Firefox has an about:config preference called "privacy.resistFingerprinting" to enable some of Tor's mitigations against fingerprinting. Tor is based on Firefox code and Mozilla merges some of Tor's code changes into Firefox to make updating easier for the Tor team. More details in this ghacks article: https://www.ghacks.net/2018/03/01/a-history-of-fingerprinting-protection-in-firefox/ https://www.ghacks.net/2018/03/01/a-history-of-fingerprintin...

Etheryte 7y ago

The difficult bit is that your browser is programmable and browsers are different across vendors, devices and releases. This means whatever a bad guy can think of as a test can be sent back over the wire, and you can't realistically block sites from sending data back to servers. So long as there are different browsers etc, there will be tests that can differentiate between them. Currently canvas fingerprinting [1] is a popular option, but there's quite a lot of options for that next thing you can use. Even generic code execution time could be used to an extent. Realistically there is hope at the end of the tunnel, but it's a very long way to go given just how complex of a corner we've painted ourselves into with modern web standards. While it wouldn't stop purely malicious actors, I personally think it might be easier to address the whole situation on the legislation side rather than with technology. Imagine GDPR, except tracking would be illegal altogether: there will always be actors who will work to bypass it, but the majority would do their best to conform, lest they want to go bust with fines. [1] https://en.wikipedia.org/wiki/Canvas_fingerprinting https://en.wikipedia.org/wiki/Canvas_fingerprinting