3 ms·

Are these settings available individually? For example I would he happy with most of these except I can't live with UTC time zone and no site-specific zoom. I w

Are these settings available individually? For example I would he happy with most of these except I can't live with UTC time zone and no site-specific zoom. I would probably also keep the performance API available. Maybe this will become available when they roll out more broadly with a configuration UI.

gruez 4y ago
If the site notices your canvas data is returning garbage, but your timezone is somewhat legit (ie. not UTC), then they can conclude you have canvas protection enabled but not timezone spoofing. That can be used to build a fingerprint of your browser depending on what fingerprinting protection settings you enabled.
- kevincox 4y ago
  This is true, but the fact that I have canvas disabled must give far less entropy than actually getting a canvas fingerprint. Presumably this is true for each individual option. Even with correlations between the different options from an individual point of view it is likely that each disabled item is a pretty decent drop in entropy. Especially since you can probably guess my time-zone and IP are very highly correlated anyways. I think the main downside to this is that it hurts the people who do want the most protection. If 5% of people enable max settings then they have a reasonable set size. However if only 1% do and the other 4% opt out of a few options that is a dramatic privacy reduction for those users without anything they can personally do to improve it.
kbrosnan 4y ago
The goal is to provide a testbed of Tor features so that Tor is not broken when they update their Firefox ESR version. It has a secondary behavior of making Firefox roughly look like a Tor user thus slightly increasing the population of possible Tor users. Allowing people to select individual PRF features would make you look extremely unique.
- easrng 4y ago
  > It has a secondary behavior of making Firefox roughly look like a Tor user thus slightly increasing the population of possible Tor users. Not really, considering you can just check if the IP is a Tor exit node.

gruez 4y ago

If the site notices your canvas data is returning garbage, but your timezone is somewhat legit (ie. not UTC), then they can conclude you have canvas protection enabled but not timezone spoofing. That can be used to build a fingerprint of your browser depending on what fingerprinting protection settings you enabled.

kevincox 4y ago
This is true, but the fact that I have canvas disabled must give far less entropy than actually getting a canvas fingerprint. Presumably this is true for each individual option. Even with correlations between the different options from an individual point of view it is likely that each disabled item is a pretty decent drop in entropy. Especially since you can probably guess my time-zone and IP are very highly correlated anyways. I think the main downside to this is that it hurts the people who do want the most protection. If 5% of people enable max settings then they have a reasonable set size. However if only 1% do and the other 4% opt out of a few options that is a dramatic privacy reduction for those users without anything they can personally do to improve it.

kbrosnan 4y ago

The goal is to provide a testbed of Tor features so that Tor is not broken when they update their Firefox ESR version. It has a secondary behavior of making Firefox roughly look like a Tor user thus slightly increasing the population of possible Tor users. Allowing people to select individual PRF features would make you look extremely unique.

easrng 4y ago
> It has a secondary behavior of making Firefox roughly look like a Tor user thus slightly increasing the population of possible Tor users. Not really, considering you can just check if the IP is a Tor exit node.