5 ms·

Being a fervent Tor Browser user, i just tried with it and of course the fingerprinting failed. Several copies of it give me the same fingerprints: e56952dba176

Being a fervent Tor Browser user, i just tried with it and of course the fingerprinting failed. Several copies of it give me the same fingerprints: e56952dba176a47af3c051b626b64ff3 (Safer mode) 632e305f8a939e5ba6afd24eced586f0 (Safest mode) That's because the Tor Browser, contrary to urban legend, is not just a browser that routes trafic through the tor network, but a firefox reworked (most of which is being upstreamed) explicitly to combat fingerprinting (some kind of digital black block if you will). Overall that's an amazing compilation of modern web fingerprinting vectors. I'm just a little disappointed they left screen size (and maybe other obvious avenues) out of the demo. That would be a really cool way to demonstrate how Tor Browser's window cutting (or whatever that's called) works [0]. I read somewhere (but i can't vet the claims) there's enough variance on TCP implementations across systems to be able to distinguish, and i'm curious how the Tor Browser deals (or doesn't) with that. Could be an idea for v2 demo. Thanks for the cool demo! I definitely enjoyed the script-like UX of the page. I wish more sites did stuff like that instead of defaulting to JS for every little animation or dynamic content. [0] Tor Browser enforces actual width and height of the web rendering part of the window to be multiples of certain numbers, so that websites can provide experience for smaller/larger screens while retaining limited fingerprinting (eg. your fingerprint will not be affected by a user-configured or desktop-dependent window border, scroll bar width, or anything such)

anonypla 5y ago
The "Safest" mode gives me different fingerprints each time. The "Standard" and "Safer" modes give the same fingerprint tho.
- robbedpeter 5y ago
  So how crippled does regular web browsing become using Tor safest mode? I'm tempted to give it a whirl for a week. Root my phone, flash something secure, leave VPN always on, and limit web browsing to Tor to get a feel for how bad or good it is. The self inflicted contortions developers go through to justify the need to spy drive me crazy. Modern devices and bandwidth are more than sufficient to handle a vast majority of applications, but everything has to be cloud based rent-seeking-as-a-service.
  - 0xdeadb00f 5y ago
    Rooting your phone and it being secure are two completely different things my friend.
    - robbedpeter 5y ago
      I can't tell if you're trying to say unrooted phones with stock carrier roms are somehow understood to be secure, or if rooting is mutually incompatible with security, or something else. Want to expound?
      - ranger_danger 5y ago
        not OP but rooting is incompatible with security.
        hansel_der 5y ago
        not rooting is incompatible with freedom
        southerntofu 5y ago
        What's your threat model? Is it more secure that you as a user can execute root code? Or that your phone manufacturer can without asking for your permission? Modern smartphones are basically spyware distros. I would argue it's far more secure to run a decent distro (Lineage/Replicant) with root, than it is to run any SamWeiMi crapware without root. Oh yes, the manufacturer's crapware has system privileges whether you ask for it or not, and so does Google Play Services, Google's universal backdoor for Android. On paper, no root is better. In practice, even on a crap distro, rooting it will enable you to remove most crapware to reduce attack surface. Also related: if you're concerned about security, you should probably only use applications from F-Droid.org repos. Google Play Store (and others) are just full of spyware! See also the Exodus Privacy project tracking trackers via static analysis of APKs.
        ranger_danger 5y ago
- hyperstar 5y ago
  Safest gives me the same each time.
benmmurphy 5y ago
TCP fingerprinting TOR would fingerprint the exit node
- southerntofu 5y ago
  That's a fair interpretation! I'm not familiar with tor internals, but i assumed after removing the last encryption layer, the exit node would "expose" raw TCP trafic from the original requester. Otherwise, how does it work?
  - benmmurphy 5y ago
    TCP is a bidirectional stream so ignoring some of the edge cases you can just proxy it across any stream transport. in the case of TOR it sets up a bidirectional stream across its network and then bytes come into the exit node over the TOR stream and then the exit node just writes them out using the normal operating system write() method. bytes then come from the normal operating system read() method on the exit node and the TOR exit node just sends them back over the TOR stream. on the client node setting up the stream over the TOR network and receiving/sending is exposed as a SOCKS proxy but i guess you could also have something fancy which intercepted traffic transparently (https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TransparentProxy https://gitlab.torproject.org/legacy/trac/-/wikis/doc/Transp...). i haven't looked at the TOR project for a while but it looks like they are heavily pushing the TOR browser which I guess means the user is not exposed to any proxy setup and can't accidentally misconfigure things in a way that would break their anonymity.
0xdeadb00f 5y ago
Did you see the spefific CSS hack they use to tell if you're using the Tor Browser as opposed to normal Firefox?
- cute_boi 5y ago
  I guess they can easily identify tor vs normal firefox(Especially with tls fingerprinting probably used by cloudflare). But the goal of fingerprinting is mostly to distinguish user. There can be sane use like collecting fingerprint to stop bot attacks from registering. But as we know selfish society today they are mostly used to collect data and show ads. And egregious browser like chrome has no incentive to solve this problem.
- sudosysgen 5y ago
  What's the point? You can tell if someone is using Tor anyways from their IP.
  - southerntofu 5y ago
    Tor is not Tor Browser. Detecting outdated Tor Browser version would help you detect well-known vulns. Detecting non-TBB browser over Tor would suggest that side-channel attacks are available to defeat onion routing (eg. WebRTC leaks). If you want privacy, use Tor Browser. It's the only privacy-friendly browser out there. All others have many holes and leaks and very little intentions to close them. Although Firefox has a "Tor uplift" project upstreaming patches from Tor Browser into Firefox's strict privacy mode.
- southerntofu 5y ago
  I did, but i personally don't care that everyone knows i'm using a tor browser. TBB is like a digital black block [0]: it is known i'm in there but nobody knows who i am in that crowd. [0] https://en.wikipedia.org/wiki/Black_block https://en.wikipedia.org/wiki/Black_block
  - 0xdeadb00f 5y ago
    Tor's techniques also make it a monoculture. The smallest fuck up that makes you just a little bit more identifiable normally, makes you stick out like a sore thumb among TBB users.
oshiar53-0 5y ago
> window cutting The term you're looking for is letterboxing. https://www.zdnet.com/article/firefox-to-add-tor-browser-anti-fingerprinting-technique-called-letterboxing/ https://www.zdnet.com/article/firefox-to-add-tor-browser-ant...
hyperstar 5y ago
I tried this with Tor Browser on two different computers and got two different fingerprints, even in safest mode.
- southerntofu 5y ago
  Interesting. Are you running different systems? If so, can you explain which (and which desktop environments) so we can (try to) reproduce?
  - hyperstar 5y ago
    Yes, the one was on Void Linux (no desktop environment), the other on Kubuntu (KDE).
    - southerntofu 5y ago
      It's probably worth a bug report to the TBB team so that they can investigate why fingerprints would be different. Having a unique fingerprint across instances is the very goal of TBB.

anonypla 5y ago

The "Safest" mode gives me different fingerprints each time. The "Standard" and "Safer" modes give the same fingerprint tho.

robbedpeter 5y ago
So how crippled does regular web browsing become using Tor safest mode? I'm tempted to give it a whirl for a week. Root my phone, flash something secure, leave VPN always on, and limit web browsing to Tor to get a feel for how bad or good it is. The self inflicted contortions developers go through to justify the need to spy drive me crazy. Modern devices and bandwidth are more than sufficient to handle a vast majority of applications, but everything has to be cloud based rent-seeking-as-a-service.
- 0xdeadb00f 5y ago
  Rooting your phone and it being secure are two completely different things my friend.
  - robbedpeter 5y ago
    I can't tell if you're trying to say unrooted phones with stock carrier roms are somehow understood to be secure, or if rooting is mutually incompatible with security, or something else. Want to expound?
    - ranger_danger 5y ago
      not OP but rooting is incompatible with security.
      - hansel_der 5y ago
        not rooting is incompatible with freedom
      - southerntofu 5y ago
        What's your threat model? Is it more secure that you as a user can execute root code? Or that your phone manufacturer can without asking for your permission? Modern smartphones are basically spyware distros. I would argue it's far more secure to run a decent distro (Lineage/Replicant) with root, than it is to run any SamWeiMi crapware without root. Oh yes, the manufacturer's crapware has system privileges whether you ask for it or not, and so does Google Play Services, Google's universal backdoor for Android. On paper, no root is better. In practice, even on a crap distro, rooting it will enable you to remove most crapware to reduce attack surface. Also related: if you're concerned about security, you should probably only use applications from F-Droid.org repos. Google Play Store (and others) are just full of spyware! See also the Exodus Privacy project tracking trackers via static analysis of APKs.
        ranger_danger 5y ago
hyperstar 5y ago
Safest gives me the same each time.

benmmurphy 5y ago

TCP fingerprinting TOR would fingerprint the exit node

southerntofu 5y ago
That's a fair interpretation! I'm not familiar with tor internals, but i assumed after removing the last encryption layer, the exit node would "expose" raw TCP trafic from the original requester. Otherwise, how does it work?
- benmmurphy 5y ago
  TCP is a bidirectional stream so ignoring some of the edge cases you can just proxy it across any stream transport. in the case of TOR it sets up a bidirectional stream across its network and then bytes come into the exit node over the TOR stream and then the exit node just writes them out using the normal operating system write() method. bytes then come from the normal operating system read() method on the exit node and the TOR exit node just sends them back over the TOR stream. on the client node setting up the stream over the TOR network and receiving/sending is exposed as a SOCKS proxy but i guess you could also have something fancy which intercepted traffic transparently (https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TransparentProxy https://gitlab.torproject.org/legacy/trac/-/wikis/doc/Transp...). i haven't looked at the TOR project for a while but it looks like they are heavily pushing the TOR browser which I guess means the user is not exposed to any proxy setup and can't accidentally misconfigure things in a way that would break their anonymity.

0xdeadb00f 5y ago

Did you see the spefific CSS hack they use to tell if you're using the Tor Browser as opposed to normal Firefox?

cute_boi 5y ago
I guess they can easily identify tor vs normal firefox(Especially with tls fingerprinting probably used by cloudflare). But the goal of fingerprinting is mostly to distinguish user. There can be sane use like collecting fingerprint to stop bot attacks from registering. But as we know selfish society today they are mostly used to collect data and show ads. And egregious browser like chrome has no incentive to solve this problem.
sudosysgen 5y ago
What's the point? You can tell if someone is using Tor anyways from their IP.
- southerntofu 5y ago
  Tor is not Tor Browser. Detecting outdated Tor Browser version would help you detect well-known vulns. Detecting non-TBB browser over Tor would suggest that side-channel attacks are available to defeat onion routing (eg. WebRTC leaks). If you want privacy, use Tor Browser. It's the only privacy-friendly browser out there. All others have many holes and leaks and very little intentions to close them. Although Firefox has a "Tor uplift" project upstreaming patches from Tor Browser into Firefox's strict privacy mode.
southerntofu 5y ago
I did, but i personally don't care that everyone knows i'm using a tor browser. TBB is like a digital black block [0]: it is known i'm in there but nobody knows who i am in that crowd. [0] https://en.wikipedia.org/wiki/Black_block https://en.wikipedia.org/wiki/Black_block
- 0xdeadb00f 5y ago
  Tor's techniques also make it a monoculture. The smallest fuck up that makes you just a little bit more identifiable normally, makes you stick out like a sore thumb among TBB users.

oshiar53-0 5y ago

> window cutting The term you're looking for is letterboxing. https://www.zdnet.com/article/firefox-to-add-tor-browser-anti-fingerprinting-technique-called-letterboxing/ https://www.zdnet.com/article/firefox-to-add-tor-browser-ant...

hyperstar 5y ago

I tried this with Tor Browser on two different computers and got two different fingerprints, even in safest mode.

southerntofu 5y ago
Interesting. Are you running different systems? If so, can you explain which (and which desktop environments) so we can (try to) reproduce?
- hyperstar 5y ago
  Yes, the one was on Void Linux (no desktop environment), the other on Kubuntu (KDE).
  - southerntofu 5y ago
    It's probably worth a bug report to the TBB team so that they can investigate why fingerprints would be different. Having a unique fingerprint across instances is the very goal of TBB.