4 ms·
> There you go, the website will now see the same display resolution for everybody, right? Well, that’s unless the website does this: delete screen.width;
by ardy42 6y ago
> There you go, the website will now see the same display resolution for everybody, right? Well, that’s unless the website does this:
delete screen.width;
delete screen.height;
> And suddenly screen.width and screen.height are restored to their original values. Fingerprinting can now use two data points instead of one: not merely the real display resolution but also the fake one. Even if that fake display resolution were extremely common, it would still make the fingerprint slightly more precise.
> Is this magic? No, just how JavaScript prototypes work. See, these properties are not defined on the screen object itself, they are part of the object’s prototype. So that privacy extension added an override for prototype’s properties. With the override removed the original properties became visible again.
This seems like a flaw in the browser extension model. There should be a way of overriding these properties outside the page's javascript environment itself, before it's initialized, in a way that's immutable to anything that runs afterwards.
- kurthr 6y agoPut them in a VM... it's the safest easiest way to be sure.
- joe_the_user 6y agoThe overall challenge for this seems similar to the challenge of reproducible builds. How do you eliminate every single measure to deal with a system quirk and so get the same VM results everywhere? Basically, you want the VM to encapsulate everything and give the same result everywhere. You need a theoretical approach, a system of encapsulation and testing. But if you get that, the benefits would extend beyond anti-finger-printing, to privacy and also to making the platform reliable.
- gzer0 6y agoWhonix [1] attempts to achieve this, if I am understanding what you are saying correctly. The operating system consists of two virtual machines, a "Workstation" and a Tor "Gateway", running Debian GNU/Linux. All communications are forced through the Tor network to accomplish this. [1] https://www.whonix.org/wiki/About https://www.whonix.org/wiki/About
- h_anna_h 6y agoRegarding protecting screen width and height, on firefox you can use privacy.resistFingerprinting.letterboxing (the tor browser has that enabled by default)
- smichel17 6y agoWhere does one find out about these random about:config values that don't exist by default? Thought I'd enabled all privacy.resistFingerprinting.* settings, but it turns out there's at least one that I'd never heard of. How much other functionality does Firefox have that is completely undiscoverable?
- h_anna_h 6y agohttps://github.com/arkenfox/user.js/blob/master/user.js https://github.com/arkenfox/user.js/blob/master/user.js and search for [HIDDEN PREF]
- mrslave 6y agoI thought this could be solved with a privacy wizard-style add-on, but WebExtensions aren't allowed to modify Firefox settings.
- 0134340 6y agoSearch the addon store for "Privacy Settings", it does just that. It's a good way to quickly toggle privacy settings should they impact a site's functionality.