6 ms·

Yes, disabling site-specific zoom is one of the things that Resist Fingerprinting does.[1] If you want to use site-specific zoom while keeping Resist Fingerprin

Yes, disabling site-specific zoom is one of the things that Resist Fingerprinting does.[1] If you want to use site-specific zoom while keeping Resist Fingerprinting enabled, the Zoom Page WE add-on[2] should allow this. I've just tried it and it worked for me. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1369357 https://bugzilla.mozilla.org/show_bug.cgi?id=1369357 [2] https://addons.mozilla.org/en-US/firefox/addon/zoom-page-we https://addons.mozilla.org/en-US/firefox/addon/zoom-page-we

chmars 5y ago
Why does a website need to know my zoom level, i.e., why is this information even made available?
- 3np 5y ago
  It’s been a while but IIRC as long as there’s JS it can be gotten implicitly by probing and comparing dimensions of elements and viewport on the page. We could question if that’s really necessary as well but the ship has kind of sailed on that one.
  - egeozcan 5y ago
    IMHO, even when sand-boxed, allowing a fully Turing-complete language with such a vast selection of available APIs to run on page load per default is what kills privacy. People should be trained to allow script execution only when they trust the site, and there should be levels: Zero, Fully Isolated, Trusted. OK now time to wait for someone to tell me this will be too much to ask from users. It wouldn't be an invalid point either, we can't even train people to have some common sense when in control of tons of steel going fast loaded with highly flammable liquids... So, there's that. I don't know.
    - HWR_14 5y ago
      It's not even per page. I don't care if I trust that page, I don't want any FB scripts to run. There are so many external libraries included (loaded from a CDN they do not control) that I don't trust any developer to know with 100% certainty what their app includes.
  - CapsAdmin 5y ago
    Maybe something like randomizing the variables in a realistic way across many sessions where the real session is controlled and viewed directly by the user. I don't think it would work when there's a state across views or server though, but maybe that's something you avoid when using Tor anyway?
- romeovs 5y ago
  My hunch is that it’s not explicitly provided to the website by the browser, but there are ways to measure what the zoom level is using JavaScript on the page. One could use element.getBoundingClientRect and similar APIs to measure what size certain elements are rendered at and compare that with their default size for instance. The resulting zoom level can then be used as a signal for fingerprinting.
- no_way 5y ago
  To render content based on device screen scaling. window.devicePixelRatio provides page zoom level combined with OS DPI setting. Things like canvas do not use scaling by default, so to render content appropriately you need to know by how much you have to scale it. Other use cases exit too.
- deleted 5y ago
  [deleted]
- BLKNSLVR 5y ago
  I find that question valid for almost everything that's used for fingerprinting. Eg. Why is timezone available by default? I wrote more but I sound like old man shouts at cloud. I've got ad and JavaScript blockers, but so much of the web is created sitting upon a mesh of invasive bullshit that it breaks easily. Shakes fist at cloud anyway.
  - asddubs 5y ago
    so that dates displayed can be correct by default, without having the user select their timezone from a dropdown with a million different options
    - Folcon 5y ago
      Why not offer the "dropdown" at a layer the browser manipulates? IE, web component where you can set a format string and then the browser renders it substituting the info it has? Then sites that need to know the date can ask for it. There's a lot we could do by splitting stuff into permissions and some sort of standard templates.
      - asddubs 5y ago
        and then you can read it out to indirectly get the time zone anyway (albeit a less specific version of it, since you wouldn't have the DST info). also, sometimes you need to actually have the users time zone for things like e.g. scheduled blog posts, so that they will show up when the user expects them to, not their scheduled time in UTC or whatever. I use a site that only does UTC, and time zone related complaints are the most common issue asked about on the forums
      - peoplefromibiza 5y ago
        > IE, web component where you can set a format string and then the browser renders it substituting the info it has? you can easily detect this - please display this localdatetime as a string - read it back and parse it - are they (almost) exactly multiples of 60 minutes apart? - if yes it's most probably your timezone
- puregram 5y ago
- southerntofu 5y ago
  This is the problem with the modern web, which has become an app distribution platform. When you treat the browser as an OS, you need to expose a lot of information for stuff to work. It would be very interesting to develop a modern web based purely on declarative content (modern HTML/CSS). HTMX is an interesting take on this, although it's currently implemented as server-provided JS: i don't see a reason why such patterns couldn't be implemented by the browser itself.
  - foxfluff 5y ago
    > It would be very interesting to develop a modern web based purely on declarative content (modern HTML/CSS). For sure. I think some scripting could also potentially be implementable without massive fingerprinting / privacy implications. E.g. pure compute scripts, form validation, etc. that has no practical way to smuggle any data out of your browser. Anything that sends a request would have to be statically derived (or explicit user input as into form).
    - southerntofu 5y ago
      Functional data pipelines without side-effects could do the trick indeed. It would also make it a lot easier to debug for performance issues, and the browser could be more clever about optimizations: for example if you've got a loop changing DOM elements, maybe you could wait for the loop to finish before starting a re-render... something that's impossible to do with JS-based rendering where global page state may change under your feet at any given time. EDIT: Just for the sake of mentioning, simple/obvious computations for interactivity was the promise of GNU's libreJS project. I'm unaware of the current state of it, though.
  - mdp2021 5y ago
    > It would be very interesting to develop a modern web based purely on declarative content Is not that the subset of the web that would work when javascript is disabled? Some already develop it in that direction - what is not declarative shall be unnecessary. Or are you suggesting something different?
KoftaBob 5y ago
This is something that's confused me about Tor Browser. How helpful could zoom level possibly be towards fingerprinting a user to a degree where it's of any use for targeted advertising and the like? Seeing that a user has a site's zoom set to 90% seems to be close to worthless in terms of narrowing down what cohort they're in, let alone identifying them individually. What am I missing here?
- Tmpod 5y ago
  > Seeing that a user has a site's zoom set to 90% seems to be close to worthless in terms of narrowing down what cohort they're in, let alone identifying them individually. How so? 90% is by far not the normal zoom level people browser with, so it is a perfectly valid data point to use for fingerprinting. Every single bit of data they can get makes your whole fingerprint more unique.
- adhesive_wombat 5y ago
  It adds a little bit of information that might help identify you. It may be less than a bit (e.g. if it's set to 100%), but it's still something. You can see the informational content of various fingerprints here: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/ Another thing that has less than a bit of content is having cookies enabled. Nearly everyone has cookies enabled, for better or worse, so having them on doesn't add much to a fingerprint. Having them off adds far more. But both add something.
- foxfluff 5y ago
  > How helpful could zoom level possibly be towards fingerprinting a user It's just another bit of information. Collect enough bits and eventually you'll have a likely-unique id. It doesn't matter what that information is as long as it somehow is about you (and not e.g. random). If you want to fingerprint, you just try to grab every bit of information you can, no matter how irrelevant it is taken on its own. It doesn't need to say anything about a cohort to be useful, it just needs to enable identifying so that they can track you around and eventually combine other information they discover about you in a profile. And it doesn't even need to be 100% accurate; "that person coming from a Telia-owned IP visiting this site again at 2 AM GMT+2 using Firefox Nightly on Linux, with 1440p display and 120% zoom level and no fonts installed" could be two or three guys if I'm lucky but it's probably close enough to not matter for someone who just wants to sell me garbage. If your zoom level were the only thing, then indeed it would be useless. Problem is, browsers leak lots of bits. It's better to try plug all leaks you can than it is to ask whether that particular leak alone is harmful enough.

chmars 5y ago

Why does a website need to know my zoom level, i.e., why is this information even made available?

3np 5y ago
It’s been a while but IIRC as long as there’s JS it can be gotten implicitly by probing and comparing dimensions of elements and viewport on the page. We could question if that’s really necessary as well but the ship has kind of sailed on that one.
- egeozcan 5y ago
  IMHO, even when sand-boxed, allowing a fully Turing-complete language with such a vast selection of available APIs to run on page load per default is what kills privacy. People should be trained to allow script execution only when they trust the site, and there should be levels: Zero, Fully Isolated, Trusted. OK now time to wait for someone to tell me this will be too much to ask from users. It wouldn't be an invalid point either, we can't even train people to have some common sense when in control of tons of steel going fast loaded with highly flammable liquids... So, there's that. I don't know.
  - HWR_14 5y ago
    It's not even per page. I don't care if I trust that page, I don't want any FB scripts to run. There are so many external libraries included (loaded from a CDN they do not control) that I don't trust any developer to know with 100% certainty what their app includes.
- CapsAdmin 5y ago
  Maybe something like randomizing the variables in a realistic way across many sessions where the real session is controlled and viewed directly by the user. I don't think it would work when there's a state across views or server though, but maybe that's something you avoid when using Tor anyway?
romeovs 5y ago
My hunch is that it’s not explicitly provided to the website by the browser, but there are ways to measure what the zoom level is using JavaScript on the page. One could use element.getBoundingClientRect and similar APIs to measure what size certain elements are rendered at and compare that with their default size for instance. The resulting zoom level can then be used as a signal for fingerprinting.
no_way 5y ago
To render content based on device screen scaling. window.devicePixelRatio provides page zoom level combined with OS DPI setting. Things like canvas do not use scaling by default, so to render content appropriately you need to know by how much you have to scale it. Other use cases exit too.
deleted 5y ago
[deleted]
BLKNSLVR 5y ago
I find that question valid for almost everything that's used for fingerprinting. Eg. Why is timezone available by default? I wrote more but I sound like old man shouts at cloud. I've got ad and JavaScript blockers, but so much of the web is created sitting upon a mesh of invasive bullshit that it breaks easily. Shakes fist at cloud anyway.
- asddubs 5y ago
  so that dates displayed can be correct by default, without having the user select their timezone from a dropdown with a million different options
  - Folcon 5y ago
    Why not offer the "dropdown" at a layer the browser manipulates? IE, web component where you can set a format string and then the browser renders it substituting the info it has? Then sites that need to know the date can ask for it. There's a lot we could do by splitting stuff into permissions and some sort of standard templates.
    - asddubs 5y ago
      and then you can read it out to indirectly get the time zone anyway (albeit a less specific version of it, since you wouldn't have the DST info). also, sometimes you need to actually have the users time zone for things like e.g. scheduled blog posts, so that they will show up when the user expects them to, not their scheduled time in UTC or whatever. I use a site that only does UTC, and time zone related complaints are the most common issue asked about on the forums
    - peoplefromibiza 5y ago
      > IE, web component where you can set a format string and then the browser renders it substituting the info it has? you can easily detect this - please display this localdatetime as a string - read it back and parse it - are they (almost) exactly multiples of 60 minutes apart? - if yes it's most probably your timezone
puregram 5y ago
southerntofu 5y ago
This is the problem with the modern web, which has become an app distribution platform. When you treat the browser as an OS, you need to expose a lot of information for stuff to work. It would be very interesting to develop a modern web based purely on declarative content (modern HTML/CSS). HTMX is an interesting take on this, although it's currently implemented as server-provided JS: i don't see a reason why such patterns couldn't be implemented by the browser itself.
- foxfluff 5y ago
  > It would be very interesting to develop a modern web based purely on declarative content (modern HTML/CSS). For sure. I think some scripting could also potentially be implementable without massive fingerprinting / privacy implications. E.g. pure compute scripts, form validation, etc. that has no practical way to smuggle any data out of your browser. Anything that sends a request would have to be statically derived (or explicit user input as into form).
  - southerntofu 5y ago
    Functional data pipelines without side-effects could do the trick indeed. It would also make it a lot easier to debug for performance issues, and the browser could be more clever about optimizations: for example if you've got a loop changing DOM elements, maybe you could wait for the loop to finish before starting a re-render... something that's impossible to do with JS-based rendering where global page state may change under your feet at any given time. EDIT: Just for the sake of mentioning, simple/obvious computations for interactivity was the promise of GNU's libreJS project. I'm unaware of the current state of it, though.
- mdp2021 5y ago
  > It would be very interesting to develop a modern web based purely on declarative content Is not that the subset of the web that would work when javascript is disabled? Some already develop it in that direction - what is not declarative shall be unnecessary. Or are you suggesting something different?

KoftaBob 5y ago

This is something that's confused me about Tor Browser. How helpful could zoom level possibly be towards fingerprinting a user to a degree where it's of any use for targeted advertising and the like? Seeing that a user has a site's zoom set to 90% seems to be close to worthless in terms of narrowing down what cohort they're in, let alone identifying them individually. What am I missing here?

Tmpod 5y ago
> Seeing that a user has a site's zoom set to 90% seems to be close to worthless in terms of narrowing down what cohort they're in, let alone identifying them individually. How so? 90% is by far not the normal zoom level people browser with, so it is a perfectly valid data point to use for fingerprinting. Every single bit of data they can get makes your whole fingerprint more unique.
adhesive_wombat 5y ago
It adds a little bit of information that might help identify you. It may be less than a bit (e.g. if it's set to 100%), but it's still something. You can see the informational content of various fingerprints here: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/ Another thing that has less than a bit of content is having cookies enabled. Nearly everyone has cookies enabled, for better or worse, so having them on doesn't add much to a fingerprint. Having them off adds far more. But both add something.
foxfluff 5y ago
> How helpful could zoom level possibly be towards fingerprinting a user It's just another bit of information. Collect enough bits and eventually you'll have a likely-unique id. It doesn't matter what that information is as long as it somehow is about you (and not e.g. random). If you want to fingerprint, you just try to grab every bit of information you can, no matter how irrelevant it is taken on its own. It doesn't need to say anything about a cohort to be useful, it just needs to enable identifying so that they can track you around and eventually combine other information they discover about you in a profile. And it doesn't even need to be 100% accurate; "that person coming from a Telia-owned IP visiting this site again at 2 AM GMT+2 using Firefox Nightly on Linux, with 1440p display and 120% zoom level and no fonts installed" could be two or three guys if I'm lucky but it's probably close enough to not matter for someone who just wants to sell me garbage. If your zoom level were the only thing, then indeed it would be useless. Problem is, browsers leak lots of bits. It's better to try plug all leaks you can than it is to ask whether that particular leak alone is harmful enough.