4 ms·

Consider for example, that many pages use remotely loaded resources. I would think things like Facebook/Twitter like buttons or Google Fonts might make it to a

Consider for example, that many pages use remotely loaded resources. I would think things like Facebook/Twitter like buttons or Google Fonts might make it to assemble this history. Sites like FB are said to maintain "Shadow Profiles" of people, even when those people aren't using their service directly. I suppose in theory any sufficiently shared infrastructures such as AWS/Cloudflare could do so as well, but they are disincentivized to do so.

WilTimSon 6y ago
Would using Firefox's 'Containers' help prevent this? As far as I understand they quarantine the Facebook pages so they can't get data from other websites you visit.
- cma 6y ago
  DNS resolve measurement to see if it is cached by the OS can potentially breach that.
  - laumars 6y ago
    Can JavaScript measure DNS resolve time?
    - cma 6y ago
      I think only indirectly, but if they control the endpoint they can ping you back, subtract rtt from initial request response time and then the difference from that can tell them whether initial request was cached in dns or not.
      - laumars 6y ago
        Just so I understand correctly, does that mean you then need to control the end point of every site you want to use as part of fingerprinting? If so, wouldn’t that drastically reduce the effectiveness of using DNS resolve times as a work around for Firefox containers? Not trying to be argumentative here, just trying to understand how effective the sandboxing is, or whether I need to design more layers of indirection. :)
    - danielheath 6y ago
      It can measure response time. If you host your own dns and web server you can vary their response times and record from js.
- deleted 6y ago
  [deleted]
627467 6y ago
I've started using decentraleyes, hoping to mitigate this issue
- ffpip 6y ago
  Use LocalCDN. A fork of Decentraleyes with many more resources for cache. https://addons.mozilla.org/en-US/firefox/addon/local-cdn-webextension/ https://addons.mozilla.org/en-US/firefox/addon/local-cdn-web...
  - Tarq0n 6y ago
    You linked to local CDN, I think you wanted localCDN (no space).
    - heresie-dabord 6y ago
      https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork-of-decentraleyes/ https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork...
    - ffpip 6y ago
      Thanks! Don't know how I missed it, when the extension's icon is on the toolbar itself
  - ffpip 6y ago
    * Wrong link https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork-of-decentraleyes/?src=search https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork...
bleepblorp 6y ago
Have there been any indications that AWS broadly captures connection data between AWS tenants and their respective users for illegitimate purposes? Some AWS services (such as TLS-terminating load balancers) do have access to sensitive cross-site information that could be fed into the adtech panopticon but I wonder if it would be cost-effective for AWS to gather. I doubt it would be cost effective for AWS to do broad captures for all of its services, however. There's probably not much value in slurping up the IP and SNI data for all HTTPS requests to every EC2 instance, for instance.

WilTimSon 6y ago

Would using Firefox's 'Containers' help prevent this? As far as I understand they quarantine the Facebook pages so they can't get data from other websites you visit.

cma 6y ago
DNS resolve measurement to see if it is cached by the OS can potentially breach that.
- laumars 6y ago
  Can JavaScript measure DNS resolve time?
  - cma 6y ago
    I think only indirectly, but if they control the endpoint they can ping you back, subtract rtt from initial request response time and then the difference from that can tell them whether initial request was cached in dns or not.
    - laumars 6y ago
      Just so I understand correctly, does that mean you then need to control the end point of every site you want to use as part of fingerprinting? If so, wouldn’t that drastically reduce the effectiveness of using DNS resolve times as a work around for Firefox containers? Not trying to be argumentative here, just trying to understand how effective the sandboxing is, or whether I need to design more layers of indirection. :)
  - danielheath 6y ago
    It can measure response time. If you host your own dns and web server you can vary their response times and record from js.
deleted 6y ago
[deleted]

627467 6y ago

I've started using decentraleyes, hoping to mitigate this issue

ffpip 6y ago
Use LocalCDN. A fork of Decentraleyes with many more resources for cache. https://addons.mozilla.org/en-US/firefox/addon/local-cdn-webextension/ https://addons.mozilla.org/en-US/firefox/addon/local-cdn-web...
- Tarq0n 6y ago
  You linked to local CDN, I think you wanted localCDN (no space).
  - heresie-dabord 6y ago
    https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork-of-decentraleyes/ https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork...
  - ffpip 6y ago
    Thanks! Don't know how I missed it, when the extension's icon is on the toolbar itself
- ffpip 6y ago
  * Wrong link https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork-of-decentraleyes/?src=search https://addons.mozilla.org/en-US/firefox/addon/localcdn-fork...

bleepblorp 6y ago

Have there been any indications that AWS broadly captures connection data between AWS tenants and their respective users for illegitimate purposes? Some AWS services (such as TLS-terminating load balancers) do have access to sensitive cross-site information that could be fed into the adtech panopticon but I wonder if it would be cost-effective for AWS to gather. I doubt it would be cost effective for AWS to do broad captures for all of its services, however. There's probably not much value in slurping up the IP and SNI data for all HTTPS requests to every EC2 instance, for instance.