4 ms·

JavaScript legitimately needs to know about it's runtime environment. The problem with fingerprinting is not the act of examining the environment itself, but ra

JavaScript legitimately needs to know about it's runtime environment. The problem with fingerprinting is not the act of examining the environment itself, but rather sending the results of that examination to the server as a form of identification. I would rather confront the second problem more directly with a "per tab Little Snitch" type solution that eliminates communication that is not in the user's interest, rather than eliminate fingerprinting, for precisely the reasons you give, slashink.

smolder 6y ago
Unfortunately web apps can defeat that by bundling unwanted telemetry type stuff in with other API calls, directly or by batching. So, it would need to be a complex tool to deal with that or suffer limited applicability. Perhaps if it stayed under the radar it could be effective in many cases without instigating countermeasures by site owners.
- javajosh 6y ago
  Let's not make perfect the enemy of good. Counter-measures like user-interactive, request specific firewalls (like Little Snitch) can always be defeated by a motivated malfactor willing to commmit resources. That does not mean it isn't worth doing. Consider that virtually all physical locks are trivial to pick by someone who knows how (see youtube.com/lockpickinglawyer), and yet we still use locks. Pickable locks improve security because they increase the cost to the attacker enough that it deters most attacks.
  - hnlmorg 6y ago
    The point is there isn't any extra cost nor difficulty in circumventing the checks you describe. You just run a library.
    - javajosh 6y ago
      I write webapps for a living. If a browser plugin wanted to selectively allow XHR/fetch calls based on payload, there is very little I could do about it. The implementation might be to have your plugin content script wrap the DOM XHR/fetch in a proxy. The proxy runs a predicate on the payload, and if true, lets it go through. The predicate would be something like "No PII", which would also imply that the traffic be unencrypted. An app could remove the proxy. But it seems to me that most people wouldn't bother. It's also possible that there are other mechanisms, for example a special Plugin IO API that cannot be changed by content scripts.
      - hnlmorg 6y ago
        > I write webapps for a living. I’d imagine most people in this thread do or have. Myself included. It’s a pretty massive industry :) What you’re missing is that whatever you do to remove fingerprints does itself add a unique metric to fingerprint. This is also compounded by how easy, cheap and legal it is to add fingerprinting tech to ones site. Literally the only way to break fingerprinting is if the majority of the web browsing population ran systems that randomised fake responses. But as it stands at the moment, it’s possible to: 1. Identify when a plug-in it overloading a builtin function 2. Identify which users are consistently doing so because so few are and there’s methods of fingerprinting that exist outside of your JS VM. I don’t have the link to hand but there’s a website that you can visit and it tells you how identifiable you are. I used to think it was possible to hide until I visited that site and then I realised just how many different metrics they collect and how a great many of them are literally impossible to block or rewrite without breaking the website entirely.
        emn13 6y ago
        You may have been thinking of this one: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/
        hnlmorg 6y ago
        It was this one: https://www.amiunique.org/fp https://www.amiunique.org/fp It goes into more detail than the EFF link where it breaks down your uniqueness per each metric (and how much entropy each metric adds) as well as giving you an overall uniqueness. It's a fantastic but also scary resource :)
  - athrowaway3z 6y ago
    uMatrix. It does what you describe and I always use it. But the solution isn't good per se. It provides a high level of granularity and it could theoretically provide even more granularity. But its already an advanced tool that an average user will never use.
    - kenniskrag 6y ago
      umatrix is end of life, not?
benatkin 6y ago
Not all JavaScript does, and the kind that does isn't neccessarily something I asked for. I would be plenty happy if GitHub and Stripe couldn't show their 3D globe animations until I request them, for the sake of privacy.
- zelphirkalt 6y ago
  After realizing the unbelievable CPU hog that the Github globe is, I simply added an element hiding rule for that crap. Not sure if element hiding rules help preventing fingerprinting from such sources.
make3 6y ago
how would that work, once js has information it can send it anywhere

smolder 6y ago

Unfortunately web apps can defeat that by bundling unwanted telemetry type stuff in with other API calls, directly or by batching. So, it would need to be a complex tool to deal with that or suffer limited applicability. Perhaps if it stayed under the radar it could be effective in many cases without instigating countermeasures by site owners.

javajosh 6y ago
Let's not make perfect the enemy of good. Counter-measures like user-interactive, request specific firewalls (like Little Snitch) can always be defeated by a motivated malfactor willing to commmit resources. That does not mean it isn't worth doing. Consider that virtually all physical locks are trivial to pick by someone who knows how (see youtube.com/lockpickinglawyer), and yet we still use locks. Pickable locks improve security because they increase the cost to the attacker enough that it deters most attacks.
- hnlmorg 6y ago
  The point is there isn't any extra cost nor difficulty in circumventing the checks you describe. You just run a library.
  - javajosh 6y ago
    I write webapps for a living. If a browser plugin wanted to selectively allow XHR/fetch calls based on payload, there is very little I could do about it. The implementation might be to have your plugin content script wrap the DOM XHR/fetch in a proxy. The proxy runs a predicate on the payload, and if true, lets it go through. The predicate would be something like "No PII", which would also imply that the traffic be unencrypted. An app could remove the proxy. But it seems to me that most people wouldn't bother. It's also possible that there are other mechanisms, for example a special Plugin IO API that cannot be changed by content scripts.
    - hnlmorg 6y ago
      > I write webapps for a living. I’d imagine most people in this thread do or have. Myself included. It’s a pretty massive industry :) What you’re missing is that whatever you do to remove fingerprints does itself add a unique metric to fingerprint. This is also compounded by how easy, cheap and legal it is to add fingerprinting tech to ones site. Literally the only way to break fingerprinting is if the majority of the web browsing population ran systems that randomised fake responses. But as it stands at the moment, it’s possible to: 1. Identify when a plug-in it overloading a builtin function 2. Identify which users are consistently doing so because so few are and there’s methods of fingerprinting that exist outside of your JS VM. I don’t have the link to hand but there’s a website that you can visit and it tells you how identifiable you are. I used to think it was possible to hide until I visited that site and then I realised just how many different metrics they collect and how a great many of them are literally impossible to block or rewrite without breaking the website entirely.
      - emn13 6y ago
        You may have been thinking of this one: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/
        hnlmorg 6y ago
        It was this one: https://www.amiunique.org/fp https://www.amiunique.org/fp It goes into more detail than the EFF link where it breaks down your uniqueness per each metric (and how much entropy each metric adds) as well as giving you an overall uniqueness. It's a fantastic but also scary resource :)
- athrowaway3z 6y ago
  uMatrix. It does what you describe and I always use it. But the solution isn't good per se. It provides a high level of granularity and it could theoretically provide even more granularity. But its already an advanced tool that an average user will never use.
  - kenniskrag 6y ago
    umatrix is end of life, not?

benatkin 6y ago

Not all JavaScript does, and the kind that does isn't neccessarily something I asked for. I would be plenty happy if GitHub and Stripe couldn't show their 3D globe animations until I request them, for the sake of privacy.

zelphirkalt 6y ago
After realizing the unbelievable CPU hog that the Github globe is, I simply added an element hiding rule for that crap. Not sure if element hiding rules help preventing fingerprinting from such sources.

make3 6y ago

how would that work, once js has information it can send it anywhere