14 ms·

Firefox's protection against fingerprinting

323 points by pmoriarty 4y ago

calvinmorrison 4y ago
"Dear Valued Customer, your browser does not appear to support our online banking application. Please use Google Chrome. Thank you."
- shadowgovt 4y ago
  Probably not online banking, but a lot of game applications or media intense applications in the browser are going to get real squirrely if they cannot detect the user's configuration. Even things like the GPU make and model can end up necessary because the webgl mechanisms for determining those things are allowed to lie (i.e. I've seen cards that report in the gestalt data that they allow various features, when those features are in reality implemented in software and therefore basically unusable).
- brobinson 4y ago
  https://addons.mozilla.org/en-US/firefox/addon/uaswitcher/ https://addons.mozilla.org/en-US/firefox/addon/uaswitcher/ "Look at me: I'm the Chrome now."
tomxor 4y ago
I both love and hate this. I'm all for anti-fingerprinting, but i'm also for interactive graphics on the web, and getImageData() is essentially your way of accessing a pixel buffer... I would be better if it was more conditional. e.g instead gate the call that ultimately attempts to send any derivatives of that data over the network - although I understand that may entail significant complexity in the JS engine. Alternatively, gate getImageData() only if fingerprintable context methods have previously been called, i.e those with antialiasing, compositing, blending differences etc or any other rendering method with potential differences emerging from the underlying algorithm. That way someone just trying to use the pixel buffer as an output doesn't get punished by needlessly causing modals to be thrown in front of the user.
- infinityio 4y ago
  I wonder whether introducing slight per-pixel-per-draw noise into the values could be used here, to mask this sort of detail? Or would you be able to average it out somehow
  - gruez 4y ago
    >Or would you be able to average it out somehow Isn't it pretty obvious? Generate the same image 1000 times and take the median pixel value for each pixel to get the "real" image.
    - leodriesch 4y ago
      If the noise would not change between individual calls but only on page reloads it would be pretty hard to get 1000 samples.
      - gruez 4y ago
        how do you ensure the noise doesn't change between calls? if I want to fingerprint how the letter "a" is rendered, how do you ensure that I can't try drawing "a1", "a2", "a3", etc. which are "different" draw calls, but still allow me to build a composite image of what "a" looks like?
  - tomxor 4y ago
    I think you're right on both... adding noise would reduce the accuracy of the fingerprint, but boarder biases would continue to be detectable. For instance i'm aware of some quite significant biases between firefox and chrome in antialiasing fillRect() for subipixel values as the dimensions drop bellow 1x1 pixel that only a distracting amount of noise would be able to conceal for one sample. I know that's already detectable via the useragent string, but I suspect those who are focused on collecting those biases will find strong ones for other data points.
  - fn-mote 4y ago
    In general noise is never the answer to fingerprinting. It makes gathering "accurate" data a little harder; it doesn't stop statistical analysis from revealing the truth.
Night_Thastus 4y ago
How does/will this new feature compare against an addon like CanvasBlocker?
- gruez 4y ago
  It's far more comprehensive (covers more fingerprinting vectors), and since it's baked into the browser you're far less likely to run into webextension limitations causing your protections to be defeated[1]. Finally, being the "official" implementation, and with only an on/off flag, you won't get fingerprinted based on what fingerprint mitigating extensions you have installed (eg. maybe you have canvas blocker installed but not webaudio blocker?). [1] https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/ https://palant.info/2020/12/10/how-anti-fingerprinting-exten...
Aardwolf 4y ago
> The browser window prefers to be set to a specific size Any idea how this works? Can you still set your browser window to any size you want in your window manager, does it misreport it? Could that not cause rendering issues too?
- cowtools 4y ago
  I can't seem to find this option in firefox, perhaps it refers to the feature in Tor browser that restricts the window size to a few most common resolutions.
- gruez 4y ago
  The two mitigations I'm aware of are: 1. by default, any non-maximized windows will default to a 1000x1000 viewport. This is consistent with how the tor browser works. Of course, this doesn't do anything when your window is maximized. On tor browser they warn you not to maximize your window for this reason. The idea here is that if everybody's window is 1000x1000, you won't be able to fingerprint based on people's monitor sizes, OS decoration sizes, and the user's window size preferences. 2. you can optionally enable a feature called "letterboxing", which rounds the viewport size to multiples of 100px. This works even if you maximize/resize your browser window.
  - cpeterso 4y ago
    Seems like using a viewport size of 1024x768 would be less unique (and thus better resist fingerprinting) than exactly 1000x1000.
    - gruez 4y ago
      Presumably the idea is that other features of fingerprinting resistance (eg. UTC time zone, missing performance data) is already going to make it painfully obvious that you have it enabled, so there's no point disguising that data point. The only thing that using 1024x768 would help is against naive analytics scripts.
  - Aardwolf 4y ago
wing-_-nuts 4y ago
Stuff like this is why I hope Firefox remains viable as a browser long term. Chrome is now what? 80% of the browser market share and they have no incentive to protect user privacy. I'm really worried that we're going to head down the road of chrome becoming the only browser anyone tests their site against and we're going to go back to the bad old days of IE 6 compatible sites that are completely broken in other browsers.
- spicybright 4y ago
  It's already like that TBH, especially with really important sites like banking or government services. That in particular makes me nervous sometimes. If the implementation can't even run properly on other browsers, I don't want to know what other corners they're cutting behind the scenes.
- tomatowurst 4y ago
  yet for most the inconvenience of having to port over all of their profiles, history, cookies will be enough to keep them on Chrome. Most can't be bothered with installing another browser or even aware that they can import Chrome profiles into Firefox. Even for me for some stuff I keep on Chrome since its too connected to all the business/saas/hosting logins and etc.
- newguynewphone 4y ago
  I would agree with other posters that it's already like that, reddit.com, one of the biggest websites in the internet, will ask if you want to continue on chrome or the app if accessing from a mobile phone, essentially calling the mobile browser Chrome.
  - pitaj 4y ago
    It used to be like that, but not anymore. I just checked and if you access it through Firefox, it will have Firefox in the prompt.
  - jeroenhd 4y ago
    To be fair to the internet at large, I'm 100% convinced that whoever develops the Reddit website intentionally makes it obnoxiously unusable. Even on a relatively beefy desktop I can't scroll past more than five or six videos before the video player becomes unusable. Opening a reddit link on mobile is a guarantee to get an ad for their app that requires several click to bypass. It's like they're deliberately ruining the experience in everything but their app to feed their ever growing hunger for more user data. It's the worst website I regularly visit by a mile.
zucked 4y ago
> If you discover the (fingerprinting) setting has become re-enabled, it is likely a Web Extension you have installed is setting it for you. How very helpful, you extension! I'll wager this "feature" gets baked into all sorts of extensions :)
- deleted 4y ago
  [deleted]
mrandish 4y ago
I'd like to have this capability but not if it makes typical web browsing annoying with too many alerts. I'd prefer to have the feature work by default with a blacklist of sites known or likely to do fingerprinting (ie larger social and media sites). Of course it can also have an optional strict mode for those who want a higher degree of anonymity in exchange for more disruption of their browsing. My personal concern with fingerprinting isn't so much any individual low-traffic site recognizing my browser. It's the higher-traffic sites working together to aggregate profiles. I don't need "zero tolerance" anti-fingerprinting. I just want to make it harder for big data aggregators to compile highly accurate, large population databases. Hopefully, a sweet spot can be found in testing which is minimally disruptive for typical users but frustrates data aggregator's ability to compile highly-lucrative data products across sites. I'd imagine just applying anti-fingerprinting to the 1,000 highest traffic websites might be enough to cut the profitability of cross-site aggregation significantly.
- gruez 4y ago
  >I'd like to have this capability but not if it makes typical web browsing annoying with too many alerts. I'd prefer to have the feature work by default with a blacklist of sites known or likely to do fingerprinting (ie larger social and media sites). Of course it can also have an optional strict mode for those who want a higher degree of anonymity in exchange for more disruption of their browsing. That sounds like brave/firefox's "tracking protection", which blacklists well-known fingerprinting scripts >My personal concern with fingerprinting isn't so much any individual low-traffic site recognizing my browser. It's the higher-traffic sites working together to aggregate profiles. I don't need "zero tolerance" anti-fingerprinting. I just want to make it harder for big data aggregators to compile highly accurate, large population databases. Hopefully, a sweet spot can be found in testing which is minimally disruptive for typical users but frustrates data aggregator's ability to compile highly-lucrative data products across sites. I'd imagine just applying anti-fingerprinting to the 1,000 highest traffic websites might be enough to cut the profitability of cross-site aggregation significantly. What counts as a "low-traffic site"? how would this work with tricks like CNAME cloaking?
daneel_w 4y ago
The "browser window prefers a specific size" part is infuriating to say the least. I wonder what the person who came up with this detail was thinking. Can't you just leave the window size up to the user but still keep the other changes? I'd like to believe that all the other changes still contribute plenty towards obscuring the fingerprint, but there's no way I can adjust to manually having to resize the browser window every time I open a new one.
- 333c 4y ago
  I'm not sure this would work, in general. A page will often render slightly differently based on the size of the window, so whatever size is "reported" to the webpage would end up being how big the page is rendered.
  - daneel_w 4y ago
    Only if there's active use of e.g. JavaScript or some server-side scripting that needs the info for some processing, for example using JavaScript to place a floating modal flush against bottom/right corner. The browser itself doesn't need to relay the dimensions "to the webpage" in order for HTML/CSS to render as any specific size, nor to achieve responsive/scaling UI design that adjusts to the window size.
    - rhn_mk1 4y ago
      It does, via media queries that include resources loaded at specific shapes.
      - daneel_w 4y ago
        What I'm trying to convey is that it's a misunderstanding that the server renders the page for the browser, and that reporting innerHeight/Width properties to the web server ("the webpage") is a requirement for having anything pop up on the screen.
- enkrs 4y ago
deleted 4y ago
[deleted]
yamrzou 4y ago
Given that not many people use Firefox, wouldn't the usage of fingerprinting protection within a given geography (can be inferred from IP address) be considered a fingerprint itself?
- dheera 4y ago
  Yeah I would rather FF provide falsified, plausible data than no data. The website should ideally not be able to detect fingerprint protection.
  - mithr 4y ago
    It seems like that's basically the approach they're already taking. Items such as these read like plausible fake data: > Your timezone is reported to be UTC > Not all fonts installed on your computer are available to webpages > Your browser reports a specific, common version number and operating system > The Media Statistics Web API reports misleading information
    - jefftk 4y ago
      A user with that particular combination of settings is very likely to be running with fingerprinting resistance enabled. Your parent is hoping for something where the site is unable to tell whether the feature is enabled.
  - brobinson 4y ago
    Librewolf does this. It's a patchset for Firefox that removes all the bad stuff and makes a bunch of security/tracking improvements. It fakes your agent, timezone, screen resolution, disables a bunch of APIs that can be used to track you, etc. It _does_ break some websites, but I just use another browser for those one-offs.
dt2m 4y ago
The irony of this is that you'll end up with a fingerprint that is probably more unique than just running standard Chrome at 1920x1080.
- gruez 4y ago
  The flaw with this is that the set of fingerprintable features is far more than just "browser brand you're using" and "monitor resolution". At the very least running without fingerprinting resistance leaks your GPU model. That might be fine 1. you're forgetting about other fingerprintable features. the obvious one would be WEBGL_debug_renderer_info which leaks your gpu model. that might be fine if you're running intel uhd graphics, but for someone with high end discrete graphics it's quite revealing. There's also more[1] 2. what if you don't have a 1920x1080 monitor? if you have a 1440p or 4k monitor, then what? JS APIs allow you to get both the viewport size as well as the monitor size. That's going to make you stick out as well. You can try to mitigate this by running in a VM, but then your GPU model would show up as "VMware SVGA 3D" or "Virtualbox Graphics Adapter", which also makes you stick out like a sore thumb. [1] https://browserleaks.com/javascript https://browserleaks.com/javascript
  - moron4hire 4y ago
    The overall attack surface of fingerprinting is so huge that even if some fantasy world in which all of WebGL, Canvas, Web Audio, WebRTC, etc., could be permanently removed, you're still fingerprintable. The time of day you visit specific sites is enough to eventually fingerprint you. This data can and is collected on back-ends and then shared across data networks. It doesn't matter what you do in the client, you're fingerprintable.
    - gruez 4y ago
      >The overall attack surface of fingerprinting is so huge that even if some fantasy world in which all of WebGL, Canvas, Web Audio, WebRTC, etc., could be permanently removed, you're still fingerprintable. I guess that's true in the abstract, but the more fingerprinting vectors there are, the easier it is to identify a specific person. The best case scenario is something like the iPhone, where each model behaves identically and there are limited amount of user-configurable settings, such that there are tens of thousands of people in your city alone that have the same model/settings (eg. timezone/dark mode on/off). You can do all the fingerprinting you want, but for a medium traffic site you're probably still going to get hundreds/thousands of users with the same fingerprint. >The time of day you visit specific sites is enough to eventually fingerprint you. How does this even work? If I'm on a VPN (ie. shared IP with hundreds of other users) and have total cookie protection (separate cookie jars for each site), it's effectively impossible to tell whether I'm one user visiting a dozen sites, or a dozen users viewing one site each.
1024core 4y ago
I really, really wish they would make it site-specific: i.e., give me the option to disable it for certain domains. Currently, I have it enabled, but this causes sites (like GMail) to not know the current time. So my GMail shows emails' times in GMT. I mean, I'm already logged into the site; I have already given them my name, password, etc. So what am I trying to hide from them??
- Slylencer 4y ago
  You can add exemptions to preference: privacy.resistFingerprinting.exemptedDomains edit: wording
  - gruez 4y ago
    You also need privacy.resistFingerprinting.testGranularityMask set to 4 for it to work. https://old.reddit.com/r/firefox/comments/q9kql8/help_setting_rfp_exception/ https://old.reddit.com/r/firefox/comments/q9kql8/help_settin...
    - m463 4y ago
      for some reason, neither of these work. I've been trying to get slack to show the current time on messages. does it just hardcode GMT?
      - gruez 4y ago
        have you tried closing the tab and restarting the browser? failing that, there might be some mechanism where slack saves your timezone in its user profile (or localstorage) and uses that even if the timezone reported by the browser changes
- jeroenhd 4y ago
  Does disabling tracking protection for the website not work? When I click the little shield in the address bar and toggle tracking protection, most sites relying on tracking scripts start working again. I suppose there's no field to enter these domains beforehand but I don't really run into any trouble because of this feature.
deleted 4y ago
[deleted]
kevincox 4y ago
Are these settings available individually? For example I would he happy with most of these except I can't live with UTC time zone and no site-specific zoom. I would probably also keep the performance API available. Maybe this will become available when they roll out more broadly with a configuration UI.
- gruez 4y ago
  If the site notices your canvas data is returning garbage, but your timezone is somewhat legit (ie. not UTC), then they can conclude you have canvas protection enabled but not timezone spoofing. That can be used to build a fingerprint of your browser depending on what fingerprinting protection settings you enabled.
  - kevincox 4y ago
    This is true, but the fact that I have canvas disabled must give far less entropy than actually getting a canvas fingerprint. Presumably this is true for each individual option. Even with correlations between the different options from an individual point of view it is likely that each disabled item is a pretty decent drop in entropy. Especially since you can probably guess my time-zone and IP are very highly correlated anyways. I think the main downside to this is that it hurts the people who do want the most protection. If 5% of people enable max settings then they have a reasonable set size. However if only 1% do and the other 4% opt out of a few options that is a dramatic privacy reduction for those users without anything they can personally do to improve it.
- kbrosnan 4y ago
  The goal is to provide a testbed of Tor features so that Tor is not broken when they update their Firefox ESR version. It has a secondary behavior of making Firefox roughly look like a Tor user thus slightly increasing the population of possible Tor users. Allowing people to select individual PRF features would make you look extremely unique.
  - easrng 4y ago
natrys 4y ago
This messes up alt modifier (event.altKey is always false), which is an instant deal breaker for me as I have many `alt-*` shortcuts in tridactyl.
behnamoh 4y ago
I was a long-time FF user and yesterday I switched to Brave. Why? Because of ridiculously high CPU usage of FF on my Mac (M1, to be specific). I was surprised to realize that Brave uses less CPU when playing a 4K video, compared to a FF with no tabs! I really wish Mozilla would address battery/CPU issues of FF first. I'm not an ordinary user, but I can see why many people would just pick Chrome/Brave/Safari if they realize FF drains their battery too fast.
- dralley 4y ago
  Are you sure it was using hardware acceleration?
  - behnamoh 4y ago
    yes it was.
- jeroenhd 4y ago
  Does Firefox not have hardware decoding support on the M1? Did the API change when Apple changed architectures or something? Youtube and Chrome have the same CPU usage on my machine when playing 4K60 video (downscaled to 2K even for even more load). Tested on Firefox and Chrome using this video: http://ftp.vim.org/ftp/ftp/pub/graphics/blender/demo/movies/BBB/bbb_sunflower_2160p_60fps_normal.mp4 http://ftp.vim.org/ftp/ftp/pub/graphics/blender/demo/movies/... (had to hack in a <video> element on the parent page to get it to play instead of download). Firefox uses about 150% of a CPU core, Chrome about 160%. CPU is a i7-7700k, GPU is a GTX1080 but I'm on Ubuntu so the latest Nvidia update probably broke something to get these load numbers. Many bloated Javascript websites are slower on Firefox for sure, but video playback is one of those things it seems to handle fine (or, just as badly as their competitors do).
- Melatonic 4y ago
  Are you saying specifically on the M1 Mac or on all machines? I have not personally noticed Firefox ever taking a lot of CPU on my machine
- pedro2 4y ago
cmitsakis 4y ago
If you want even better protection from tracking and fingerprinting, I recommend arkenfox user.js [1]. It's a configuration file for firefox. I have created tmpfox [2] a simple program that creates a temporary firefox profile on /tmp, and installs arkenfox user.js and some plugins I find useful. [1] https://github.com/arkenfox/user.js https://github.com/arkenfox/user.js [2] https://github.com/cmitsakis/tmpfox https://github.com/cmitsakis/tmpfox
JonathanBuchh 4y ago
You can test the effectiveness of this setting using the EFF's Cover Your Tracks tool: https://coveryourtracks.eff.org https://coveryourtracks.eff.org
codedokode 4y ago
That's an awesome feature, although it doesn't seem to be complete. I did some research whether it is possible to stop fingerprinting using a browser extension that patches JS environment before loading the page, and it turns out that it is difficult or impossible. Because first of all, there is no API for patching a JS environment from an extension. I think that many of new HTML standards are poorly designed in regards to privacy. For example, WebGL reports the video card that you use. Who needs that? Well, maybe there is a tiny percentage of sites that use this information to detect bugs but main use of this feature is a reliable unforgeable signal for fingerprinting a device. Most of sites do not need WebGL at all. It seems that browser vendors hurry to push forward as many features as possible without much thinking about user's privacy. So basically today we have lots of standards that provide signals for fingerprinting (Web Audio, WebGL, Canvas API, WebRTC, port scanning via fetch or websocket, probing extensions list) and zero APIs or settings that allow to control it or block (unless you are ready to patch a browser).
- rosmax_1337 4y ago
  >It seems that browser vendors hurry to push forward as many features as possible without much thinking about user's privacy. Vendors in plural makes it sound like the market isn't a monopoly of Google at this point. Google naturally loves to be able to fingerprint people based on as many metrics as possible, for their ads.
  - shadowgovt 4y ago
    Last I checked, Google still adheres to w3c standards on these things. And they haven't captured the w3c process itself... We need to be holding the w3c accountable for considering privacy as they refine new rfcs for apis.
    - dmitriid 4y ago
      > Last I checked, Google still adheres to w3c standards on these things. It adheres to web standards that it primarily writes and pushes through. > We need to be holding the w3c accountable for considering privacy as they refine new rfcs for apis. You know, when w3c does that HN is ablaze with "Safari is the new IE" and "Firefox is irrelevant". See all of hardware APIs (Bluetooth, Serial, HID etc.) that are rejected by both Safari and Firefox primarily on privacy issues.
azinman2 4y ago
Somewhat tangential — now that webrender is in, are there any recent benchmarks for Firefox comparing against Chrome and Safari for real world web pages? I’d also love to see interoperability with history, keychain, and bookmarks with other browsers. Would make it far easier to switch between.
zeptonix 4y ago
Guessing this will be an unpopular opinion, but anyone troubled by this war on web standards and web developers? Like, if we're just going to take stuff that should work, and decide unilaterally now it won't work because <X> ... can we really rely on anything to work?
MasterYoda 4y ago
Sometimes resistFingerprinting can break some site, but rarely. But if it happens the addon "Toggle Resist Fingerprinting" [1] can be helpful to temporarily inactivate it with a simple click on an button. Instead of having to go to about:config and change "privacy.resistFingerprinting" to "false" manually. [1] https://addons.mozilla.org/en-US/firefox/addon/toggle-resist-fingerprinting https://addons.mozilla.org/en-US/firefox/addon/toggle-resist...
- orbital-decay 4y ago
  What bothers me is that RFP breaks many addons as well. For example, the reduced timer precision breaks Surfingkeys on Windows (vim combinations are behaving erratically, jerky scrolling etc). Another example, Alt key is completely disabled by RFP as some national keyboard layouts can be used for fingerprinting. [1] As a result, hotkeys with Alt become inaccessible for addons. etc etc etc [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1598862#c3 https://bugzilla.mozilla.org/show_bug.cgi?id=1598862#c3
charcircuit 4y ago
Fingerprinting has important usages for preventing abuse. Trying to protect against fingerprinting will someday cause companies to seek more drastic measures and before you know it communicating with websites will require a running their code in a secure enclave and you can say good bye to being able to customize the experience or make alternate clients. Fingerprinting is necessary for an open web to work.
namlem 4y ago
So that's why I never get caught ban evading on Reddit lol.
moron4hire 4y ago
I've yet to see a satisfying, realistic answer to what to do about fingerprinting. Every proposal I've seen would A) cause significant harm to legitimate use of Web API features, and B) not actually make users un-fingerprintable. So WebGL/Web Audio/et. al. leak information about your system. What are you going to do about it? Argue that these sorts of features should be reserved for native apps and remove them completely, or hobble them to the point that they are basically useless? (At which point you might as well just remove them completely.) Okay, let's do that. Let's force every WebGL developer to start making native apps instead. We do not have a write-once-run-anywhere platform for developing applications that is anywhere near as reliable as the Web. So now, developers need to massively explode their project configuration to build all the native versions of their app for all the platforms that were previously supported by their web app. Every new release of their project has to go through a walled garden approval process. Hope you aren't a doing anything Apple or Google don't approve of! It was painful, but here we are: users aren't fingerprintable. Wrong. It's even easier now. The native application platforms give the nefarious data collector so much more access to be able to fingerprint users. Hell, you are often readily given a unique user identifier by the app platform. Even if the user resets that ID, it's not going to bug you too much because you'll just re-fingerprint them and then be able to correlate the new data to the old. Oh, you're not allowed to do that by the platform ToS? How long does it take to catch you doing that? And do you actually get banned, or told to cease and desist in favor of purchasing the same data directly from the platform? It's so nice of Google to make suggestions on what not to do here, wink wink nudge nudge https://developer.android.com/training/articles/user-data-ids https://developer.android.com/training/articles/user-data-id.... How would they even know if you were bridging advertiser IDs in your own database completely out of their control? And your browser sessions are still fingerprintable, too, because even the most basic of common information that has been transmitted to HTTP servers since day 1 is enough to fingerprint users. You've succeeded in none of your goals to reduce fingerprinting but have harmed legitimate developers massively. All for what? Because of essentialist arguments about how the Web used to be? The problem is not that application platforms leak data. We are walking, talking data leaks by our very nature of not being 100% literal clones of everyone else. Maybe in the 1960s you could walk into a shop and pay cash for something and reasonably assume that nobody was videotaping you and collecting your credit card number and storing all this information in a database, but that ship sailed a long time ago. The problem is that collecting this data, correlating it, colluding between other data collectors, and selling it off to the highest bidder is not regulated. Look at all the data breaches that credit reporting services like Experian have allowed to happen to them. All of this data is a potential weapon against users and it's just sitting around in woefully underregulated databases, everyone hoping the likes of Equifax know what they're doing (when they have demonstrated on several occasions they don't). But browsers and web app developers. That's where we need to draw the line. Right.
skyfaller 4y ago
> Not all fonts installed on your computer are available to webpages I recognize that I'm probably in the minority for wanting to avoid web fonts in my web pages, to make my web pages more lightweight / faster / environmentally friendly. I prefer to use locally installed fonts, a.k.a. native fonts or system fonts. Unfortunately, this privacy measure may somewhat interfere with that, to an extent that depends on the details of how it's implemented. I'll accept the privacy win, since surveillance capitalism and trackers also significantly increase bandwidth / energy usage and GHG emissions, but it's always sad when some efficiencies have to be discarded because we've turned the internet into a panopticon (or for other reasons related to humans behaving badly).
deleted 4y ago
[deleted]
jackbeck 4y ago
The problem with a lot of these attempts at fingerprinting prevention is that they cause additional data which can be used to more accurately fingerprint users. getImageData() is blocked - datapoint Any detectable difference from what a “regular” browser would return is another point of entropy.
- m-p-3 4y ago
  If the default for Firefox is that it blocks these, then you don't really get a useful datapoint.
  - jackbeck 4y ago
    At the moment it’s not the default though. So people who enable this feature will, ironically be more unique and therefore more accurately fingerprintable.
- danShumway 4y ago
  It's a problem to be aware of, definitely. However, the accuracy of device fingerprinting with `getImageData()` is as far as I can tell a lot higher than the accuracy from trying to fingerprint people based on whether they're returning blank data from that call. If turning off a feature reveals a new 3 bits of information, but leaving it on would have revealed 5 bits, then it's still probably a good idea to turn it off. Again, not to say that people shouldn't care about those 3 bits, they should. But it's not necessarily a waste of time even if a site tries to use anti-fingerprinting as its own metric. It only becomes a waste of time if the anti-fingerprinting is more unique than leaving the holes open.
  - jackbeck 4y ago
    Yup, I agree with you about this. It’d be interesting to do a deep dive into a library like FingerprintJS and see what has the most weight in terms of uniqueness. Maybe getImageData is worthwhile blocking, but perhaps other APIs will increase the amount of entropy.
Udo 4y ago
This is not sustainable and fingerprinting is just one side of this whole fragmented mess we're in. Browsers should present very few fingerprintable attributes by default. By now I'm convinced user-preferred languages is the only really defensible header. Everything else? Ask for permission. The way we're doing capability permissions on the web (to the extent browsers do it at all) is just broken. A barrage of piecemeal modal dialog boxes is not the way forward. It needs to be drastically simplified. A website should be treated exactly like any other kind of app: if it needs to use extended features, it should put that into a manifest so the browser can provide a specific list of items for the user to approve or reject. If none of these permissions are given, sites should be extremely restricted in what they can do, including cookies and localStorage. Let's get rid of UserAgent and codec compatibility headers. Especially UserAgent is already useless and both should be replaced entirely by an improved feature detection system. There are only 3 major browser vendors left. They could fix this within months. This is not a technology problem, it's a question of will and ad revenue.
apeace 4y ago
I tried a before-and-after on the EFF Cover Your Tracks tool[0]. Before: One in 69970.67 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 16.09 bits of identifying information. After: One in 104957.5 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 16.68 bits of identifying information. So according to that, my browser is more fingerprintable after enabling the setting! I didn't expect this experimental feature to be a silver bullet, but I certainly didn't expect it to make me more unique. I'm not sure what to think of that. [0] https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/
- kbrosnan 4y ago
  The pref makes you look like a Tor user, mostly. So yes that population of users is pretty small. The Firefox/Tor privacy protections favor uniformity over randomizing everything.
tiffanyh 4y ago
Obligatory post about https://librewolf.net/ https://librewolf.net/ It’s a fork of Firefox with security / privacy configurations set as default.
deleted 4y ago
[deleted]
turpialito 4y ago
Setting privacy.resistFingerprinting to true turns YT's dark mode off. Resetting it to false brings dark mode back.
_8j50 4y ago
I think virtualized rendering might be the future both for privacy and security. MS has (had?) Appguard with edge for example, although it wasn't for privacy. Hardware enforced boundaries. Although, ultimately my opinion is this is a legal problem. The entities that are a threat to my privacy that also use fingerprinting operate within the boundaries of criminal law.
UnitedSMEs 4y ago
[dead]
account42 4y ago
Unfortunately Firefox' enhanced tracking protection makes the browser tell websites to use a light color scheme instead of indicating no preference, which would have the same privacy benefit.
jokoon 4y ago
This break dark theme, so nope.

323 points by pmoriarty 4y ago

"Dear Valued Customer, your browser does not appear to support our online banking application. Please use Google Chrome. Thank you."

shadowgovt 4y ago
Probably not online banking, but a lot of game applications or media intense applications in the browser are going to get real squirrely if they cannot detect the user's configuration. Even things like the GPU make and model can end up necessary because the webgl mechanisms for determining those things are allowed to lie (i.e. I've seen cards that report in the gestalt data that they allow various features, when those features are in reality implemented in software and therefore basically unusable).
brobinson 4y ago
https://addons.mozilla.org/en-US/firefox/addon/uaswitcher/ https://addons.mozilla.org/en-US/firefox/addon/uaswitcher/ "Look at me: I'm the Chrome now."

tomxor 4y ago

I both love and hate this. I'm all for anti-fingerprinting, but i'm also for interactive graphics on the web, and getImageData() is essentially your way of accessing a pixel buffer... I would be better if it was more conditional. e.g instead gate the call that ultimately attempts to send any derivatives of that data over the network - although I understand that may entail significant complexity in the JS engine. Alternatively, gate getImageData() only if fingerprintable context methods have previously been called, i.e those with antialiasing, compositing, blending differences etc or any other rendering method with potential differences emerging from the underlying algorithm. That way someone just trying to use the pixel buffer as an output doesn't get punished by needlessly causing modals to be thrown in front of the user.

infinityio 4y ago
I wonder whether introducing slight per-pixel-per-draw noise into the values could be used here, to mask this sort of detail? Or would you be able to average it out somehow
- gruez 4y ago
  >Or would you be able to average it out somehow Isn't it pretty obvious? Generate the same image 1000 times and take the median pixel value for each pixel to get the "real" image.
  - leodriesch 4y ago
    If the noise would not change between individual calls but only on page reloads it would be pretty hard to get 1000 samples.
    - gruez 4y ago
      how do you ensure the noise doesn't change between calls? if I want to fingerprint how the letter "a" is rendered, how do you ensure that I can't try drawing "a1", "a2", "a3", etc. which are "different" draw calls, but still allow me to build a composite image of what "a" looks like?
- tomxor 4y ago
  I think you're right on both... adding noise would reduce the accuracy of the fingerprint, but boarder biases would continue to be detectable. For instance i'm aware of some quite significant biases between firefox and chrome in antialiasing fillRect() for subipixel values as the dimensions drop bellow 1x1 pixel that only a distracting amount of noise would be able to conceal for one sample. I know that's already detectable via the useragent string, but I suspect those who are focused on collecting those biases will find strong ones for other data points.
- fn-mote 4y ago
  In general noise is never the answer to fingerprinting. It makes gathering "accurate" data a little harder; it doesn't stop statistical analysis from revealing the truth.

Night_Thastus 4y ago

How does/will this new feature compare against an addon like CanvasBlocker?

gruez 4y ago
It's far more comprehensive (covers more fingerprinting vectors), and since it's baked into the browser you're far less likely to run into webextension limitations causing your protections to be defeated[1]. Finally, being the "official" implementation, and with only an on/off flag, you won't get fingerprinted based on what fingerprint mitigating extensions you have installed (eg. maybe you have canvas blocker installed but not webaudio blocker?). [1] https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/ https://palant.info/2020/12/10/how-anti-fingerprinting-exten...

Aardwolf 4y ago

> The browser window prefers to be set to a specific size Any idea how this works? Can you still set your browser window to any size you want in your window manager, does it misreport it? Could that not cause rendering issues too?

cowtools 4y ago
I can't seem to find this option in firefox, perhaps it refers to the feature in Tor browser that restricts the window size to a few most common resolutions.
gruez 4y ago
The two mitigations I'm aware of are: 1. by default, any non-maximized windows will default to a 1000x1000 viewport. This is consistent with how the tor browser works. Of course, this doesn't do anything when your window is maximized. On tor browser they warn you not to maximize your window for this reason. The idea here is that if everybody's window is 1000x1000, you won't be able to fingerprint based on people's monitor sizes, OS decoration sizes, and the user's window size preferences. 2. you can optionally enable a feature called "letterboxing", which rounds the viewport size to multiples of 100px. This works even if you maximize/resize your browser window.
- cpeterso 4y ago
  Seems like using a viewport size of 1024x768 would be less unique (and thus better resist fingerprinting) than exactly 1000x1000.
  - gruez 4y ago
    Presumably the idea is that other features of fingerprinting resistance (eg. UTC time zone, missing performance data) is already going to make it painfully obvious that you have it enabled, so there's no point disguising that data point. The only thing that using 1024x768 would help is against naive analytics scripts.
- Aardwolf 4y ago

wing-_-nuts 4y ago

Stuff like this is why I hope Firefox remains viable as a browser long term. Chrome is now what? 80% of the browser market share and they have no incentive to protect user privacy. I'm really worried that we're going to head down the road of chrome becoming the only browser anyone tests their site against and we're going to go back to the bad old days of IE 6 compatible sites that are completely broken in other browsers.

spicybright 4y ago
It's already like that TBH, especially with really important sites like banking or government services. That in particular makes me nervous sometimes. If the implementation can't even run properly on other browsers, I don't want to know what other corners they're cutting behind the scenes.
tomatowurst 4y ago
yet for most the inconvenience of having to port over all of their profiles, history, cookies will be enough to keep them on Chrome. Most can't be bothered with installing another browser or even aware that they can import Chrome profiles into Firefox. Even for me for some stuff I keep on Chrome since its too connected to all the business/saas/hosting logins and etc.
newguynewphone 4y ago
I would agree with other posters that it's already like that, reddit.com, one of the biggest websites in the internet, will ask if you want to continue on chrome or the app if accessing from a mobile phone, essentially calling the mobile browser Chrome.
- pitaj 4y ago
  It used to be like that, but not anymore. I just checked and if you access it through Firefox, it will have Firefox in the prompt.
- jeroenhd 4y ago
  To be fair to the internet at large, I'm 100% convinced that whoever develops the Reddit website intentionally makes it obnoxiously unusable. Even on a relatively beefy desktop I can't scroll past more than five or six videos before the video player becomes unusable. Opening a reddit link on mobile is a guarantee to get an ad for their app that requires several click to bypass. It's like they're deliberately ruining the experience in everything but their app to feed their ever growing hunger for more user data. It's the worst website I regularly visit by a mile.

zucked 4y ago

> If you discover the (fingerprinting) setting has become re-enabled, it is likely a Web Extension you have installed is setting it for you. How very helpful, you extension! I'll wager this "feature" gets baked into all sorts of extensions :)

deleted 4y ago
[deleted]

mrandish 4y ago

I'd like to have this capability but not if it makes typical web browsing annoying with too many alerts. I'd prefer to have the feature work by default with a blacklist of sites known or likely to do fingerprinting (ie larger social and media sites). Of course it can also have an optional strict mode for those who want a higher degree of anonymity in exchange for more disruption of their browsing. My personal concern with fingerprinting isn't so much any individual low-traffic site recognizing my browser. It's the higher-traffic sites working together to aggregate profiles. I don't need "zero tolerance" anti-fingerprinting. I just want to make it harder for big data aggregators to compile highly accurate, large population databases. Hopefully, a sweet spot can be found in testing which is minimally disruptive for typical users but frustrates data aggregator's ability to compile highly-lucrative data products across sites. I'd imagine just applying anti-fingerprinting to the 1,000 highest traffic websites might be enough to cut the profitability of cross-site aggregation significantly.

gruez 4y ago
>I'd like to have this capability but not if it makes typical web browsing annoying with too many alerts. I'd prefer to have the feature work by default with a blacklist of sites known or likely to do fingerprinting (ie larger social and media sites). Of course it can also have an optional strict mode for those who want a higher degree of anonymity in exchange for more disruption of their browsing. That sounds like brave/firefox's "tracking protection", which blacklists well-known fingerprinting scripts >My personal concern with fingerprinting isn't so much any individual low-traffic site recognizing my browser. It's the higher-traffic sites working together to aggregate profiles. I don't need "zero tolerance" anti-fingerprinting. I just want to make it harder for big data aggregators to compile highly accurate, large population databases. Hopefully, a sweet spot can be found in testing which is minimally disruptive for typical users but frustrates data aggregator's ability to compile highly-lucrative data products across sites. I'd imagine just applying anti-fingerprinting to the 1,000 highest traffic websites might be enough to cut the profitability of cross-site aggregation significantly. What counts as a "low-traffic site"? how would this work with tricks like CNAME cloaking?

daneel_w 4y ago

The "browser window prefers a specific size" part is infuriating to say the least. I wonder what the person who came up with this detail was thinking. Can't you just leave the window size up to the user but still keep the other changes? I'd like to believe that all the other changes still contribute plenty towards obscuring the fingerprint, but there's no way I can adjust to manually having to resize the browser window every time I open a new one.

333c 4y ago
I'm not sure this would work, in general. A page will often render slightly differently based on the size of the window, so whatever size is "reported" to the webpage would end up being how big the page is rendered.
- daneel_w 4y ago
  Only if there's active use of e.g. JavaScript or some server-side scripting that needs the info for some processing, for example using JavaScript to place a floating modal flush against bottom/right corner. The browser itself doesn't need to relay the dimensions "to the webpage" in order for HTML/CSS to render as any specific size, nor to achieve responsive/scaling UI design that adjusts to the window size.
  - rhn_mk1 4y ago
    It does, via media queries that include resources loaded at specific shapes.
    - daneel_w 4y ago
      What I'm trying to convey is that it's a misunderstanding that the server renders the page for the browser, and that reporting innerHeight/Width properties to the web server ("the webpage") is a requirement for having anything pop up on the screen.
enkrs 4y ago

deleted 4y ago

[deleted]

yamrzou 4y ago

Given that not many people use Firefox, wouldn't the usage of fingerprinting protection within a given geography (can be inferred from IP address) be considered a fingerprint itself?

dheera 4y ago
Yeah I would rather FF provide falsified, plausible data than no data. The website should ideally not be able to detect fingerprint protection.
- mithr 4y ago
  It seems like that's basically the approach they're already taking. Items such as these read like plausible fake data: > Your timezone is reported to be UTC > Not all fonts installed on your computer are available to webpages > Your browser reports a specific, common version number and operating system > The Media Statistics Web API reports misleading information
  - jefftk 4y ago
    A user with that particular combination of settings is very likely to be running with fingerprinting resistance enabled. Your parent is hoping for something where the site is unable to tell whether the feature is enabled.
- brobinson 4y ago
  Librewolf does this. It's a patchset for Firefox that removes all the bad stuff and makes a bunch of security/tracking improvements. It fakes your agent, timezone, screen resolution, disables a bunch of APIs that can be used to track you, etc. It _does_ break some websites, but I just use another browser for those one-offs.

dt2m 4y ago

The irony of this is that you'll end up with a fingerprint that is probably more unique than just running standard Chrome at 1920x1080.

gruez 4y ago
The flaw with this is that the set of fingerprintable features is far more than just "browser brand you're using" and "monitor resolution". At the very least running without fingerprinting resistance leaks your GPU model. That might be fine 1. you're forgetting about other fingerprintable features. the obvious one would be WEBGL_debug_renderer_info which leaks your gpu model. that might be fine if you're running intel uhd graphics, but for someone with high end discrete graphics it's quite revealing. There's also more[1] 2. what if you don't have a 1920x1080 monitor? if you have a 1440p or 4k monitor, then what? JS APIs allow you to get both the viewport size as well as the monitor size. That's going to make you stick out as well. You can try to mitigate this by running in a VM, but then your GPU model would show up as "VMware SVGA 3D" or "Virtualbox Graphics Adapter", which also makes you stick out like a sore thumb. [1] https://browserleaks.com/javascript https://browserleaks.com/javascript
- moron4hire 4y ago
  The overall attack surface of fingerprinting is so huge that even if some fantasy world in which all of WebGL, Canvas, Web Audio, WebRTC, etc., could be permanently removed, you're still fingerprintable. The time of day you visit specific sites is enough to eventually fingerprint you. This data can and is collected on back-ends and then shared across data networks. It doesn't matter what you do in the client, you're fingerprintable.
  - gruez 4y ago
    >The overall attack surface of fingerprinting is so huge that even if some fantasy world in which all of WebGL, Canvas, Web Audio, WebRTC, etc., could be permanently removed, you're still fingerprintable. I guess that's true in the abstract, but the more fingerprinting vectors there are, the easier it is to identify a specific person. The best case scenario is something like the iPhone, where each model behaves identically and there are limited amount of user-configurable settings, such that there are tens of thousands of people in your city alone that have the same model/settings (eg. timezone/dark mode on/off). You can do all the fingerprinting you want, but for a medium traffic site you're probably still going to get hundreds/thousands of users with the same fingerprint. >The time of day you visit specific sites is enough to eventually fingerprint you. How does this even work? If I'm on a VPN (ie. shared IP with hundreds of other users) and have total cookie protection (separate cookie jars for each site), it's effectively impossible to tell whether I'm one user visiting a dozen sites, or a dozen users viewing one site each.

1024core 4y ago

I really, really wish they would make it site-specific: i.e., give me the option to disable it for certain domains. Currently, I have it enabled, but this causes sites (like GMail) to not know the current time. So my GMail shows emails' times in GMT. I mean, I'm already logged into the site; I have already given them my name, password, etc. So what am I trying to hide from them??

Slylencer 4y ago
You can add exemptions to preference: privacy.resistFingerprinting.exemptedDomains edit: wording
- gruez 4y ago
  You also need privacy.resistFingerprinting.testGranularityMask set to 4 for it to work. https://old.reddit.com/r/firefox/comments/q9kql8/help_setting_rfp_exception/ https://old.reddit.com/r/firefox/comments/q9kql8/help_settin...
  - m463 4y ago
    for some reason, neither of these work. I've been trying to get slack to show the current time on messages. does it just hardcode GMT?
    - gruez 4y ago
      have you tried closing the tab and restarting the browser? failing that, there might be some mechanism where slack saves your timezone in its user profile (or localstorage) and uses that even if the timezone reported by the browser changes
jeroenhd 4y ago
Does disabling tracking protection for the website not work? When I click the little shield in the address bar and toggle tracking protection, most sites relying on tracking scripts start working again. I suppose there's no field to enter these domains beforehand but I don't really run into any trouble because of this feature.

deleted 4y ago

[deleted]

kevincox 4y ago

Are these settings available individually? For example I would he happy with most of these except I can't live with UTC time zone and no site-specific zoom. I would probably also keep the performance API available. Maybe this will become available when they roll out more broadly with a configuration UI.

gruez 4y ago
If the site notices your canvas data is returning garbage, but your timezone is somewhat legit (ie. not UTC), then they can conclude you have canvas protection enabled but not timezone spoofing. That can be used to build a fingerprint of your browser depending on what fingerprinting protection settings you enabled.
- kevincox 4y ago
  This is true, but the fact that I have canvas disabled must give far less entropy than actually getting a canvas fingerprint. Presumably this is true for each individual option. Even with correlations between the different options from an individual point of view it is likely that each disabled item is a pretty decent drop in entropy. Especially since you can probably guess my time-zone and IP are very highly correlated anyways. I think the main downside to this is that it hurts the people who do want the most protection. If 5% of people enable max settings then they have a reasonable set size. However if only 1% do and the other 4% opt out of a few options that is a dramatic privacy reduction for those users without anything they can personally do to improve it.
kbrosnan 4y ago
The goal is to provide a testbed of Tor features so that Tor is not broken when they update their Firefox ESR version. It has a secondary behavior of making Firefox roughly look like a Tor user thus slightly increasing the population of possible Tor users. Allowing people to select individual PRF features would make you look extremely unique.
- easrng 4y ago

natrys 4y ago

This messes up alt modifier (event.altKey is always false), which is an instant deal breaker for me as I have many `alt-*` shortcuts in tridactyl.

behnamoh 4y ago

I was a long-time FF user and yesterday I switched to Brave. Why? Because of ridiculously high CPU usage of FF on my Mac (M1, to be specific). I was surprised to realize that Brave uses less CPU when playing a 4K video, compared to a FF with no tabs! I really wish Mozilla would address battery/CPU issues of FF first. I'm not an ordinary user, but I can see why many people would just pick Chrome/Brave/Safari if they realize FF drains their battery too fast.

dralley 4y ago
Are you sure it was using hardware acceleration?
- behnamoh 4y ago
  yes it was.
jeroenhd 4y ago
Does Firefox not have hardware decoding support on the M1? Did the API change when Apple changed architectures or something? Youtube and Chrome have the same CPU usage on my machine when playing 4K60 video (downscaled to 2K even for even more load). Tested on Firefox and Chrome using this video: http://ftp.vim.org/ftp/ftp/pub/graphics/blender/demo/movies/BBB/bbb_sunflower_2160p_60fps_normal.mp4 http://ftp.vim.org/ftp/ftp/pub/graphics/blender/demo/movies/... (had to hack in a <video> element on the parent page to get it to play instead of download). Firefox uses about 150% of a CPU core, Chrome about 160%. CPU is a i7-7700k, GPU is a GTX1080 but I'm on Ubuntu so the latest Nvidia update probably broke something to get these load numbers. Many bloated Javascript websites are slower on Firefox for sure, but video playback is one of those things it seems to handle fine (or, just as badly as their competitors do).
Melatonic 4y ago
Are you saying specifically on the M1 Mac or on all machines? I have not personally noticed Firefox ever taking a lot of CPU on my machine
pedro2 4y ago

cmitsakis 4y ago

If you want even better protection from tracking and fingerprinting, I recommend arkenfox user.js [1]. It's a configuration file for firefox. I have created tmpfox [2] a simple program that creates a temporary firefox profile on /tmp, and installs arkenfox user.js and some plugins I find useful. [1] https://github.com/arkenfox/user.js https://github.com/arkenfox/user.js [2] https://github.com/cmitsakis/tmpfox https://github.com/cmitsakis/tmpfox

JonathanBuchh 4y ago

You can test the effectiveness of this setting using the EFF's Cover Your Tracks tool: https://coveryourtracks.eff.org https://coveryourtracks.eff.org

codedokode 4y ago

That's an awesome feature, although it doesn't seem to be complete. I did some research whether it is possible to stop fingerprinting using a browser extension that patches JS environment before loading the page, and it turns out that it is difficult or impossible. Because first of all, there is no API for patching a JS environment from an extension. I think that many of new HTML standards are poorly designed in regards to privacy. For example, WebGL reports the video card that you use. Who needs that? Well, maybe there is a tiny percentage of sites that use this information to detect bugs but main use of this feature is a reliable unforgeable signal for fingerprinting a device. Most of sites do not need WebGL at all. It seems that browser vendors hurry to push forward as many features as possible without much thinking about user's privacy. So basically today we have lots of standards that provide signals for fingerprinting (Web Audio, WebGL, Canvas API, WebRTC, port scanning via fetch or websocket, probing extensions list) and zero APIs or settings that allow to control it or block (unless you are ready to patch a browser).

rosmax_1337 4y ago
>It seems that browser vendors hurry to push forward as many features as possible without much thinking about user's privacy. Vendors in plural makes it sound like the market isn't a monopoly of Google at this point. Google naturally loves to be able to fingerprint people based on as many metrics as possible, for their ads.
- shadowgovt 4y ago
  Last I checked, Google still adheres to w3c standards on these things. And they haven't captured the w3c process itself... We need to be holding the w3c accountable for considering privacy as they refine new rfcs for apis.
  - dmitriid 4y ago
    > Last I checked, Google still adheres to w3c standards on these things. It adheres to web standards that it primarily writes and pushes through. > We need to be holding the w3c accountable for considering privacy as they refine new rfcs for apis. You know, when w3c does that HN is ablaze with "Safari is the new IE" and "Firefox is irrelevant". See all of hardware APIs (Bluetooth, Serial, HID etc.) that are rejected by both Safari and Firefox primarily on privacy issues.

azinman2 4y ago

Somewhat tangential — now that webrender is in, are there any recent benchmarks for Firefox comparing against Chrome and Safari for real world web pages? I’d also love to see interoperability with history, keychain, and bookmarks with other browsers. Would make it far easier to switch between.

zeptonix 4y ago

Guessing this will be an unpopular opinion, but anyone troubled by this war on web standards and web developers? Like, if we're just going to take stuff that should work, and decide unilaterally now it won't work because <X> ... can we really rely on anything to work?

MasterYoda 4y ago

Sometimes resistFingerprinting can break some site, but rarely. But if it happens the addon "Toggle Resist Fingerprinting" [1] can be helpful to temporarily inactivate it with a simple click on an button. Instead of having to go to about:config and change "privacy.resistFingerprinting" to "false" manually. [1] https://addons.mozilla.org/en-US/firefox/addon/toggle-resist-fingerprinting https://addons.mozilla.org/en-US/firefox/addon/toggle-resist...

orbital-decay 4y ago
What bothers me is that RFP breaks many addons as well. For example, the reduced timer precision breaks Surfingkeys on Windows (vim combinations are behaving erratically, jerky scrolling etc). Another example, Alt key is completely disabled by RFP as some national keyboard layouts can be used for fingerprinting. [1] As a result, hotkeys with Alt become inaccessible for addons. etc etc etc [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1598862#c3 https://bugzilla.mozilla.org/show_bug.cgi?id=1598862#c3

charcircuit 4y ago

Fingerprinting has important usages for preventing abuse. Trying to protect against fingerprinting will someday cause companies to seek more drastic measures and before you know it communicating with websites will require a running their code in a secure enclave and you can say good bye to being able to customize the experience or make alternate clients. Fingerprinting is necessary for an open web to work.

namlem 4y ago

So that's why I never get caught ban evading on Reddit lol.

moron4hire 4y ago

I've yet to see a satisfying, realistic answer to what to do about fingerprinting. Every proposal I've seen would A) cause significant harm to legitimate use of Web API features, and B) not actually make users un-fingerprintable. So WebGL/Web Audio/et. al. leak information about your system. What are you going to do about it? Argue that these sorts of features should be reserved for native apps and remove them completely, or hobble them to the point that they are basically useless? (At which point you might as well just remove them completely.) Okay, let's do that. Let's force every WebGL developer to start making native apps instead. We do not have a write-once-run-anywhere platform for developing applications that is anywhere near as reliable as the Web. So now, developers need to massively explode their project configuration to build all the native versions of their app for all the platforms that were previously supported by their web app. Every new release of their project has to go through a walled garden approval process. Hope you aren't a doing anything Apple or Google don't approve of! It was painful, but here we are: users aren't fingerprintable. Wrong. It's even easier now. The native application platforms give the nefarious data collector so much more access to be able to fingerprint users. Hell, you are often readily given a unique user identifier by the app platform. Even if the user resets that ID, it's not going to bug you too much because you'll just re-fingerprint them and then be able to correlate the new data to the old. Oh, you're not allowed to do that by the platform ToS? How long does it take to catch you doing that? And do you actually get banned, or told to cease and desist in favor of purchasing the same data directly from the platform? It's so nice of Google to make suggestions on what not to do here, wink wink nudge nudge https://developer.android.com/training/articles/user-data-ids https://developer.android.com/training/articles/user-data-id.... How would they even know if you were bridging advertiser IDs in your own database completely out of their control? And your browser sessions are still fingerprintable, too, because even the most basic of common information that has been transmitted to HTTP servers since day 1 is enough to fingerprint users. You've succeeded in none of your goals to reduce fingerprinting but have harmed legitimate developers massively. All for what? Because of essentialist arguments about how the Web used to be? The problem is not that application platforms leak data. We are walking, talking data leaks by our very nature of not being 100% literal clones of everyone else. Maybe in the 1960s you could walk into a shop and pay cash for something and reasonably assume that nobody was videotaping you and collecting your credit card number and storing all this information in a database, but that ship sailed a long time ago. The problem is that collecting this data, correlating it, colluding between other data collectors, and selling it off to the highest bidder is not regulated. Look at all the data breaches that credit reporting services like Experian have allowed to happen to them. All of this data is a potential weapon against users and it's just sitting around in woefully underregulated databases, everyone hoping the likes of Equifax know what they're doing (when they have demonstrated on several occasions they don't). But browsers and web app developers. That's where we need to draw the line. Right.

skyfaller 4y ago

> Not all fonts installed on your computer are available to webpages I recognize that I'm probably in the minority for wanting to avoid web fonts in my web pages, to make my web pages more lightweight / faster / environmentally friendly. I prefer to use locally installed fonts, a.k.a. native fonts or system fonts. Unfortunately, this privacy measure may somewhat interfere with that, to an extent that depends on the details of how it's implemented. I'll accept the privacy win, since surveillance capitalism and trackers also significantly increase bandwidth / energy usage and GHG emissions, but it's always sad when some efficiencies have to be discarded because we've turned the internet into a panopticon (or for other reasons related to humans behaving badly).

deleted 4y ago

[deleted]

jackbeck 4y ago

The problem with a lot of these attempts at fingerprinting prevention is that they cause additional data which can be used to more accurately fingerprint users. getImageData() is blocked - datapoint Any detectable difference from what a “regular” browser would return is another point of entropy.

m-p-3 4y ago
If the default for Firefox is that it blocks these, then you don't really get a useful datapoint.
- jackbeck 4y ago
  At the moment it’s not the default though. So people who enable this feature will, ironically be more unique and therefore more accurately fingerprintable.
danShumway 4y ago
It's a problem to be aware of, definitely. However, the accuracy of device fingerprinting with `getImageData()` is as far as I can tell a lot higher than the accuracy from trying to fingerprint people based on whether they're returning blank data from that call. If turning off a feature reveals a new 3 bits of information, but leaving it on would have revealed 5 bits, then it's still probably a good idea to turn it off. Again, not to say that people shouldn't care about those 3 bits, they should. But it's not necessarily a waste of time even if a site tries to use anti-fingerprinting as its own metric. It only becomes a waste of time if the anti-fingerprinting is more unique than leaving the holes open.
- jackbeck 4y ago
  Yup, I agree with you about this. It’d be interesting to do a deep dive into a library like FingerprintJS and see what has the most weight in terms of uniqueness. Maybe getImageData is worthwhile blocking, but perhaps other APIs will increase the amount of entropy.

Udo 4y ago

This is not sustainable and fingerprinting is just one side of this whole fragmented mess we're in. Browsers should present very few fingerprintable attributes by default. By now I'm convinced user-preferred languages is the only really defensible header. Everything else? Ask for permission. The way we're doing capability permissions on the web (to the extent browsers do it at all) is just broken. A barrage of piecemeal modal dialog boxes is not the way forward. It needs to be drastically simplified. A website should be treated exactly like any other kind of app: if it needs to use extended features, it should put that into a manifest so the browser can provide a specific list of items for the user to approve or reject. If none of these permissions are given, sites should be extremely restricted in what they can do, including cookies and localStorage. Let's get rid of UserAgent and codec compatibility headers. Especially UserAgent is already useless and both should be replaced entirely by an improved feature detection system. There are only 3 major browser vendors left. They could fix this within months. This is not a technology problem, it's a question of will and ad revenue.

apeace 4y ago

I tried a before-and-after on the EFF Cover Your Tracks tool[0]. Before: One in 69970.67 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 16.09 bits of identifying information. After: One in 104957.5 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 16.68 bits of identifying information. So according to that, my browser is more fingerprintable after enabling the setting! I didn't expect this experimental feature to be a silver bullet, but I certainly didn't expect it to make me more unique. I'm not sure what to think of that. [0] https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/

kbrosnan 4y ago
The pref makes you look like a Tor user, mostly. So yes that population of users is pretty small. The Firefox/Tor privacy protections favor uniformity over randomizing everything.

tiffanyh 4y ago

Obligatory post about https://librewolf.net/ https://librewolf.net/ It’s a fork of Firefox with security / privacy configurations set as default.

deleted 4y ago

[deleted]

turpialito 4y ago

Setting privacy.resistFingerprinting to true turns YT's dark mode off. Resetting it to false brings dark mode back.

_8j50 4y ago

I think virtualized rendering might be the future both for privacy and security. MS has (had?) Appguard with edge for example, although it wasn't for privacy. Hardware enforced boundaries. Although, ultimately my opinion is this is a legal problem. The entities that are a threat to my privacy that also use fingerprinting operate within the boundaries of criminal law.

UnitedSMEs 4y ago

[dead]

account42 4y ago

Unfortunately Firefox' enhanced tracking protection makes the browser tell websites to use a light color scheme instead of indicating no preference, which would have the same privacy benefit.

jokoon 4y ago

This break dark theme, so nope.