7 ms·

Through the Tor Uplift Project,[1] Tor Browser's Fingerprinting Protection feature is now available in Firefox on desktop and Android. The feature makes Firefox

Through the Tor Uplift Project,[1] Tor Browser's Fingerprinting Protection feature is now available in Firefox on desktop and Android. The feature makes Firefox hide some pieces of identifying information from the sites you interact with, such as your timezone (which is set to UTC), some of your fonts, your keyboard layout/language, and parts of your user agent (for example, your browser version is set to the latest ESR version).[2] To enable Fingerprinting Protection in Firefox, go to about:config and set privacy.resistFingerprinting to true. Some Firefox forks enable Fingerprinting Protection by default, including LibreWolf[3] (desktop) and Mull[4] (Android). If you are on Android, the release version of Firefox does not include access to about:config, and you'll need to either switch to Firefox Beta/Nightly or use a fork like Mull, Fennec F-Droid, or Iceraven to take advantage of this feature. [1] https://wiki.mozilla.org/Security/Tor_Uplift https://wiki.mozilla.org/Security/Tor_Uplift [2] https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting https://support.mozilla.org/en-US/kb/firefox-protection-agai... [3] https://librewolf.net https://librewolf.net [4] https://f-droid.org/en/packages/us.spotco.fennec_dos/ https://f-droid.org/en/packages/us.spotco.fennec_dos/

dwighttk 5y ago
With all the things that end up being surprising settings that fingerprint me, why is there not an “absolutely no auto-playing video” setting?
6LLvveMx2koXfwn 5y ago
I just altered that setting and now Firefox resets my zoom level for every page I read to 100%. Makes HN unreadable as my default zoom for this site is 170% and having to set it every page I visit becomes old very quickly! Interesting side effect though.
- commoner 5y ago
  Yes, disabling site-specific zoom is one of the things that Resist Fingerprinting does.[1] If you want to use site-specific zoom while keeping Resist Fingerprinting enabled, the Zoom Page WE add-on[2] should allow this. I've just tried it and it worked for me. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1369357 https://bugzilla.mozilla.org/show_bug.cgi?id=1369357 [2] https://addons.mozilla.org/en-US/firefox/addon/zoom-page-we https://addons.mozilla.org/en-US/firefox/addon/zoom-page-we
  - chmars 5y ago
    Why does a website need to know my zoom level, i.e., why is this information even made available?
    - 3np 5y ago
      It’s been a while but IIRC as long as there’s JS it can be gotten implicitly by probing and comparing dimensions of elements and viewport on the page. We could question if that’s really necessary as well but the ship has kind of sailed on that one.
      - egeozcan 5y ago
        IMHO, even when sand-boxed, allowing a fully Turing-complete language with such a vast selection of available APIs to run on page load per default is what kills privacy. People should be trained to allow script execution only when they trust the site, and there should be levels: Zero, Fully Isolated, Trusted. OK now time to wait for someone to tell me this will be too much to ask from users. It wouldn't be an invalid point either, we can't even train people to have some common sense when in control of tons of steel going fast loaded with highly flammable liquids... So, there's that. I don't know.
        HWR_14 5y ago
        It's not even per page. I don't care if I trust that page, I don't want any FB scripts to run. There are so many external libraries included (loaded from a CDN they do not control) that I don't trust any developer to know with 100% certainty what their app includes.
      - CapsAdmin 5y ago
        Maybe something like randomizing the variables in a realistic way across many sessions where the real session is controlled and viewed directly by the user. I don't think it would work when there's a state across views or server though, but maybe that's something you avoid when using Tor anyway?
    - 5y ago
- deleted 5y ago
  [deleted]
summm 5y ago
The UTC cloaking has a lot of downsides. Websites displaying false times, but not reliably, as they are mostly not indicating the timezone, and you never know if they are displaying local time of the site's location or try to get clever and use the visitor's time. No privacy win if you are browsing on locally relevant web websites, because your timezone is implied anyway. e.g. most of Europe has the same one. All of this is justifiable for TOR use, but it is the single most annoying problem making it too inconvenient for regular use.
- sundarurfriend 5y ago
  Am utterly dumb downside is that the browser history - in your own local History window - has times shown in UTC.
karlzt 5y ago
There's also SmartCookieWeb Preview: https://github.com/CookieJarApps/SmartCookieWeb-preview https://github.com/CookieJarApps/SmartCookieWeb-preview

dwighttk 5y ago

With all the things that end up being surprising settings that fingerprint me, why is there not an “absolutely no auto-playing video” setting?

6LLvveMx2koXfwn 5y ago

I just altered that setting and now Firefox resets my zoom level for every page I read to 100%. Makes HN unreadable as my default zoom for this site is 170% and having to set it every page I visit becomes old very quickly! Interesting side effect though.

commoner 5y ago
Yes, disabling site-specific zoom is one of the things that Resist Fingerprinting does.[1] If you want to use site-specific zoom while keeping Resist Fingerprinting enabled, the Zoom Page WE add-on[2] should allow this. I've just tried it and it worked for me. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1369357 https://bugzilla.mozilla.org/show_bug.cgi?id=1369357 [2] https://addons.mozilla.org/en-US/firefox/addon/zoom-page-we https://addons.mozilla.org/en-US/firefox/addon/zoom-page-we
- chmars 5y ago
  Why does a website need to know my zoom level, i.e., why is this information even made available?
  - 3np 5y ago
    It’s been a while but IIRC as long as there’s JS it can be gotten implicitly by probing and comparing dimensions of elements and viewport on the page. We could question if that’s really necessary as well but the ship has kind of sailed on that one.
    - egeozcan 5y ago
      IMHO, even when sand-boxed, allowing a fully Turing-complete language with such a vast selection of available APIs to run on page load per default is what kills privacy. People should be trained to allow script execution only when they trust the site, and there should be levels: Zero, Fully Isolated, Trusted. OK now time to wait for someone to tell me this will be too much to ask from users. It wouldn't be an invalid point either, we can't even train people to have some common sense when in control of tons of steel going fast loaded with highly flammable liquids... So, there's that. I don't know.
      - HWR_14 5y ago
        It's not even per page. I don't care if I trust that page, I don't want any FB scripts to run. There are so many external libraries included (loaded from a CDN they do not control) that I don't trust any developer to know with 100% certainty what their app includes.
    - CapsAdmin 5y ago
      Maybe something like randomizing the variables in a realistic way across many sessions where the real session is controlled and viewed directly by the user. I don't think it would work when there's a state across views or server though, but maybe that's something you avoid when using Tor anyway?
  - 5y ago
deleted 5y ago
[deleted]

summm 5y ago

The UTC cloaking has a lot of downsides. Websites displaying false times, but not reliably, as they are mostly not indicating the timezone, and you never know if they are displaying local time of the site's location or try to get clever and use the visitor's time. No privacy win if you are browsing on locally relevant web websites, because your timezone is implied anyway. e.g. most of Europe has the same one. All of this is justifiable for TOR use, but it is the single most annoying problem making it too inconvenient for regular use.

sundarurfriend 5y ago
Am utterly dumb downside is that the browser history - in your own local History window - has times shown in UTC.

karlzt 5y ago

There's also SmartCookieWeb Preview: https://github.com/CookieJarApps/SmartCookieWeb-preview https://github.com/CookieJarApps/SmartCookieWeb-preview