3 ms·

> WebGL Renderer Wait, any website knows what sort of graphics card I have?! Or how many CPUs? That's just ridiculous! No wonder folks can write and target

by cnst 7y ago

> WebGL Renderer Wait, any website knows what sort of graphics card I have?! Or how many CPUs? That's just ridiculous! No wonder folks can write and target exploits so perfectly nowadays! If it's an integrated graphics, you have the processor family, easy. Wow. Why would any random site need to know this sorts of information when all I'm trying to do is read text and view images?

segfaultbuserr 7y ago
> when all I'm trying to do is read text and view images? Often, the "images" on the web are increasingly becoming 3D graphics dynamically generated and rendered by OpenGL on-the-fly, perhaps real-time ray-tracing is coming soon... You can see a lot of applications of in-browser 3D graphics on data visualization websites, for example. And naturally, the program needs these information to render graphics, but it can be repurposed as a tracking tool. I disable WebGL manually, and use it only when it's necessary. There are a few plugins that allow you to manage it as well, for example, NoScript, but it's overkill to use it just for this single task. I think the solution should be an opt-in option. WebGL shouldn't be activated unless the user gives the permission to a specific, first-party website.
- cnst 7y ago
  Thanks for the idea, I just toggled the "webgl.disabled" switch in about:config; we'll see what difference it makes; I would only assume that my browsing will become faster now and will crash less frequently. Is there a list of these useless things that any sane user should disable? I already have had fonts disabled with "gfx.downloadable_fonts.enabled" toggled away from the default; any other useless attack vectors with buffer overflows could likewise be disabled?
  - mirimir 7y ago
    Yeah, I always disable WebGL. I was really freaked to discover that all Debian family VMs on a given VirtualBox host have the same WebGL fingerprint. Same for all Windows VMs, all Red Hat family VMs, etc. But then you can't see all the cool WebGL stuff that gets posted here.
- FreakyT 7y ago
  > I think the solution should be an opt-in option. WebGL shouldn't be activated unless the user gives the permission. More permission dialogs just train users to click "yes" on every permission dialog, so it really isn't a solution (remember Windows Vista?). I'd prefer it if there were some way to make browsers respond to WebGL queries in a similar predictable way to mitigate fingerprinting.
  - segfaultbuserr 7y ago
    Using a "not enabled until clicked" approach is better - The popup won't be showed unless the user clicks the otherwise missing video - but if the Flash object is a tracker, most users won't even notice it, and the tracker is blocked. It's not perfect, but works reasonably well and has successfully protected a large number of users from Adobe Flash trackers.

by cnst 7y ago

segfaultbuserr 7y ago

> when all I'm trying to do is read text and view images? Often, the "images" on the web are increasingly becoming 3D graphics dynamically generated and rendered by OpenGL on-the-fly, perhaps real-time ray-tracing is coming soon... You can see a lot of applications of in-browser 3D graphics on data visualization websites, for example. And naturally, the program needs these information to render graphics, but it can be repurposed as a tracking tool. I disable WebGL manually, and use it only when it's necessary. There are a few plugins that allow you to manage it as well, for example, NoScript, but it's overkill to use it just for this single task. I think the solution should be an opt-in option. WebGL shouldn't be activated unless the user gives the permission to a specific, first-party website.

cnst 7y ago
Thanks for the idea, I just toggled the "webgl.disabled" switch in about:config; we'll see what difference it makes; I would only assume that my browsing will become faster now and will crash less frequently. Is there a list of these useless things that any sane user should disable? I already have had fonts disabled with "gfx.downloadable_fonts.enabled" toggled away from the default; any other useless attack vectors with buffer overflows could likewise be disabled?
- mirimir 7y ago
  Yeah, I always disable WebGL. I was really freaked to discover that all Debian family VMs on a given VirtualBox host have the same WebGL fingerprint. Same for all Windows VMs, all Red Hat family VMs, etc. But then you can't see all the cool WebGL stuff that gets posted here.
FreakyT 7y ago
> I think the solution should be an opt-in option. WebGL shouldn't be activated unless the user gives the permission. More permission dialogs just train users to click "yes" on every permission dialog, so it really isn't a solution (remember Windows Vista?). I'd prefer it if there were some way to make browsers respond to WebGL queries in a similar predictable way to mitigate fingerprinting.
- segfaultbuserr 7y ago
  Using a "not enabled until clicked" approach is better - The popup won't be showed unless the user clicks the otherwise missing video - but if the Flash object is a tracker, most users won't even notice it, and the tracker is blocked. It's not perfect, but works reasonably well and has successfully protected a large number of users from Adobe Flash trackers.