4 ms·

This is a good use of Firefox resources. Unfortunately Firefox is at a natural disadvantage for fingerprinting by virtue of being used by such a small number of

by xnx 1y ago

This is a good use of Firefox resources. Unfortunately Firefox is at a natural disadvantage for fingerprinting by virtue of being used by such a small number of users.

prism56 1y ago
Interesting. So when you try resist fingerprinting. If you dont go all the way you're at risk of making your differentiations smaller?
- kube-system 1y ago
  As an oversimplified example: If a website has 100 visitors, and 99 of them use Chrome, and 1 user uses Firefox, it doesn't matter how good their fingerprinting resistance is, they're always the one using Firefox. https://xkcd.com/1105/ https://xkcd.com/1105/
  - Phelinofist 1y ago
    But if another Firefox user comes they are indistinguishable from each other, while every Chrome user is uniquely identifiable, are they not?
    - kube-system 1y ago
      > if another Firefox user comes they are indistinguishable from each other, Even if every Firefox browser gave off the exact same fingerprint, that wouldn't make the network traffic indistinguishable between Firefox users. There is a lot of entropy that is provided by your network stack of your device, the networks you connect to in order to get to the end website, the behavior of your requests, etc. Now, most websites aren't doing this kind of analysis. But it isn't unheard of or impossible. There are major websites that are known to do TLS fingerprinting.
  - godelski 1y ago
    Firefox is low on browser count but it's still around 4%[0]. That's enough that there will be lots of collisions. Even a small percent of a very large number is a very large number [0] https://radar.cloudflare.com/reports/browser-market-share-2025-q1 https://radar.cloudflare.com/reports/browser-market-share-20...
    - kube-system 1y ago
      Of course. However, if you're trying to search for somebody, and you're able to eliminate 96% of the data, you're in a much better position to accomplish your goal. Whether or not you should care about this depends on what kind of tracking threats you're trying to avoid.
      - godelski 1y ago
        I mean yes and no. Raw numbers still matter. It's all about context. If you have a billion visitors and rule out 96% of them, sure, searching 4 million it's easier but it's still such a large number that that alone isn't enough. That's all I'm trying to say.
        kube-system 1y ago
        Completely agreed
NoboruWataya 1y ago
I often think about this in connection with my user agent. I am sure it helps identify me. If I spoofed a Chrome/Windows UA that would probably be better from a privacy perspective. But if we all do that then web designers will never know that we exist. I want people to know there are Firefox and Linux users out there.
- kube-system 1y ago
  Spoofed UAs are easily detected. And if you are spoofing your UA you are among a very small subset of users.
  - godelski 1y ago
    Easy to detect but companies are lazy. I remember when Netflix first worked for Linux on chrome but not Firefox. I changed my agent and was good to go. After some months I emailed them asking to lift the agent block. They assured me they weren't blocking by agent. I sent them screenshots. They doubled down. So I said ¯\_(ツ)_/¯ and just kept using the agent until they unblocked it
    - kube-system 1y ago
      Absolutely, but the parent was speaking about privacy. Access is a different story, because you can test different user agent strings, and immediately determine whether you get access. By contrast, you can't change a user agent string and readily determine whether or not you've broken someone's ability to track you.
      - godelski 1y ago
        My example of access is just a clearer example of laziness. Maybe they were tracking but it seems unlikely, right? If they were, why not block? Laziness is a much better explanation. I can get feedback with access, I can't get feedback with tracking. That's why I mentioned access.
firefax 1y ago
>This is a good use of Firefox resources. Unfortunately Firefox is at a natural disadvantage for fingerprinting by virtue of being used by such a small number of users. I'd rather be trackable but secure -- the big draw for me is NoScript. Paired with uBlock, I'm safe from malvertising[1] [1] https://en.wikipedia.org/wiki/Malvertising#Examples_of_malicious_advertisements https://en.wikipedia.org/wiki/Malvertising#Examples_of_malic...
- dorgo 1y ago
  I was wondering why uBlock is not enough since you can block Javascript globally and re-enable per site. AI's answer: Only things uBlock doesn’t replicate: NoScript’s anti-XSS and anti-clickjacking heuristics (uBlock just blocks the sources, not sanitize payloads). NoScript’s control over other active content types (e.g., WebGL, media codecs, etc).
  - firefax 1y ago
    It's also a lot better UI -- it doesn't look like it's nearly as easy to see a drop down list of JS and selectively enable as NS allows.
- lone-cloud 1y ago
  You're more trackable by using NoScipt and there's no good reason to use it if you know how to properly use uBlock: https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-dont-bother https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-don... uBlock is a content blocker so it can do everything NoScript can if you learn its advanced UI usage. Using additional extensions makes you more trackable.
  - firefax 1y ago
    >You're more trackable by using NoScipt and there's no good reason to use it if you know how to properly use uBlock What data do you have to support this assertion? uBlock doesn't seem to have the ability to selectively enable only JS nessecary for functionality, and if it does, the UI makes it much more difficult to enable. I just ran a test -- merely uBlock use renders me unique, whereas one in 5742.77 had the same fingerprint as me when using NoScript. (I suspect that's the number of people also using Firefox with NoScript who own this particular monitor size) A big chunk of the fingerprinting techniques require JS -- it's pretty hard to ascertain what specific extensions are installed with it. I tested disabling it and it didn't seem to do much difference in terms of bits of entropy on EFF's tool. I encourage you to try for yourself and then think hard on your advice.
port11 1y ago
There was a commenter some time back showing that browser statistics were easy to skew. Safari and Firefox are less likely to show up in analytics, so website owners think they're less important than they really are. Conflating client-side with server-side analytics showed quite a gap.
- kube-system 1y ago
  Most of the people who are just looking at browser statistics for the purpose of managing a website are using simple tools that just simply collect data from user agent strings. Determining browser from this isn't 100% straightforward, but it's enough to give website operators a rough idea of what browser to target. This data was more important in the days when everything wasn't Chrome/Android/iOS, and it actually mattered what version of IE your users were running. If you're doing fingerprinting for tracking purposes, you're gonna be tracking a lot more in-depth data. But in the end, there are pretty much three types of Internet user today: 1. The person who uses the default browser installed on their device. 2. The user who always downloads Chrome when they first get a new computer. and 3. Nerds who do something else.
  - port11 1y ago
    I don't disagree, but it makes for bad web development practices. Google Analytics is still the de facto king everywhere I've worked, but it's going to more often Safari and Firefox than other browsers due to tracking protections and users being more likely to run ad blockers. Then there's all the edge cases like Brave. I don't remember the discrepancy that the study found, but it's significant. So… we keep optimising for Chrome, as if that's the bulk of our audience. That makes things shittier for everybody else, and we think it's okay because they're such a small part of the group. This reminds me of a former client burning almost 9 million euros every year because they excluded IE6–8 from their reporting, yet they would account for 15% of the traffic.

by xnx 1y ago

This is a good use of Firefox resources. Unfortunately Firefox is at a natural disadvantage for fingerprinting by virtue of being used by such a small number of users.

prism56 1y ago

Interesting. So when you try resist fingerprinting. If you dont go all the way you're at risk of making your differentiations smaller?

kube-system 1y ago
As an oversimplified example: If a website has 100 visitors, and 99 of them use Chrome, and 1 user uses Firefox, it doesn't matter how good their fingerprinting resistance is, they're always the one using Firefox. https://xkcd.com/1105/ https://xkcd.com/1105/
- Phelinofist 1y ago
  But if another Firefox user comes they are indistinguishable from each other, while every Chrome user is uniquely identifiable, are they not?
  - kube-system 1y ago
    > if another Firefox user comes they are indistinguishable from each other, Even if every Firefox browser gave off the exact same fingerprint, that wouldn't make the network traffic indistinguishable between Firefox users. There is a lot of entropy that is provided by your network stack of your device, the networks you connect to in order to get to the end website, the behavior of your requests, etc. Now, most websites aren't doing this kind of analysis. But it isn't unheard of or impossible. There are major websites that are known to do TLS fingerprinting.
- godelski 1y ago
  Firefox is low on browser count but it's still around 4%[0]. That's enough that there will be lots of collisions. Even a small percent of a very large number is a very large number [0] https://radar.cloudflare.com/reports/browser-market-share-2025-q1 https://radar.cloudflare.com/reports/browser-market-share-20...
  - kube-system 1y ago
    Of course. However, if you're trying to search for somebody, and you're able to eliminate 96% of the data, you're in a much better position to accomplish your goal. Whether or not you should care about this depends on what kind of tracking threats you're trying to avoid.
    - godelski 1y ago
      I mean yes and no. Raw numbers still matter. It's all about context. If you have a billion visitors and rule out 96% of them, sure, searching 4 million it's easier but it's still such a large number that that alone isn't enough. That's all I'm trying to say.
      - kube-system 1y ago
        Completely agreed

NoboruWataya 1y ago

I often think about this in connection with my user agent. I am sure it helps identify me. If I spoofed a Chrome/Windows UA that would probably be better from a privacy perspective. But if we all do that then web designers will never know that we exist. I want people to know there are Firefox and Linux users out there.

kube-system 1y ago
Spoofed UAs are easily detected. And if you are spoofing your UA you are among a very small subset of users.
- godelski 1y ago
  Easy to detect but companies are lazy. I remember when Netflix first worked for Linux on chrome but not Firefox. I changed my agent and was good to go. After some months I emailed them asking to lift the agent block. They assured me they weren't blocking by agent. I sent them screenshots. They doubled down. So I said ¯\_(ツ)_/¯ and just kept using the agent until they unblocked it
  - kube-system 1y ago
    Absolutely, but the parent was speaking about privacy. Access is a different story, because you can test different user agent strings, and immediately determine whether you get access. By contrast, you can't change a user agent string and readily determine whether or not you've broken someone's ability to track you.
    - godelski 1y ago
      My example of access is just a clearer example of laziness. Maybe they were tracking but it seems unlikely, right? If they were, why not block? Laziness is a much better explanation. I can get feedback with access, I can't get feedback with tracking. That's why I mentioned access.

firefax 1y ago

>This is a good use of Firefox resources. Unfortunately Firefox is at a natural disadvantage for fingerprinting by virtue of being used by such a small number of users. I'd rather be trackable but secure -- the big draw for me is NoScript. Paired with uBlock, I'm safe from malvertising[1] [1] https://en.wikipedia.org/wiki/Malvertising#Examples_of_malicious_advertisements https://en.wikipedia.org/wiki/Malvertising#Examples_of_malic...

dorgo 1y ago
I was wondering why uBlock is not enough since you can block Javascript globally and re-enable per site. AI's answer: Only things uBlock doesn’t replicate: NoScript’s anti-XSS and anti-clickjacking heuristics (uBlock just blocks the sources, not sanitize payloads). NoScript’s control over other active content types (e.g., WebGL, media codecs, etc).
- firefax 1y ago
  It's also a lot better UI -- it doesn't look like it's nearly as easy to see a drop down list of JS and selectively enable as NS allows.
lone-cloud 1y ago
You're more trackable by using NoScipt and there's no good reason to use it if you know how to properly use uBlock: https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-dont-bother https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-don... uBlock is a content blocker so it can do everything NoScript can if you learn its advanced UI usage. Using additional extensions makes you more trackable.
- firefax 1y ago
  >You're more trackable by using NoScipt and there's no good reason to use it if you know how to properly use uBlock What data do you have to support this assertion? uBlock doesn't seem to have the ability to selectively enable only JS nessecary for functionality, and if it does, the UI makes it much more difficult to enable. I just ran a test -- merely uBlock use renders me unique, whereas one in 5742.77 had the same fingerprint as me when using NoScript. (I suspect that's the number of people also using Firefox with NoScript who own this particular monitor size) A big chunk of the fingerprinting techniques require JS -- it's pretty hard to ascertain what specific extensions are installed with it. I tested disabling it and it didn't seem to do much difference in terms of bits of entropy on EFF's tool. I encourage you to try for yourself and then think hard on your advice.

port11 1y ago

There was a commenter some time back showing that browser statistics were easy to skew. Safari and Firefox are less likely to show up in analytics, so website owners think they're less important than they really are. Conflating client-side with server-side analytics showed quite a gap.

kube-system 1y ago
Most of the people who are just looking at browser statistics for the purpose of managing a website are using simple tools that just simply collect data from user agent strings. Determining browser from this isn't 100% straightforward, but it's enough to give website operators a rough idea of what browser to target. This data was more important in the days when everything wasn't Chrome/Android/iOS, and it actually mattered what version of IE your users were running. If you're doing fingerprinting for tracking purposes, you're gonna be tracking a lot more in-depth data. But in the end, there are pretty much three types of Internet user today: 1. The person who uses the default browser installed on their device. 2. The user who always downloads Chrome when they first get a new computer. and 3. Nerds who do something else.
- port11 1y ago
  I don't disagree, but it makes for bad web development practices. Google Analytics is still the de facto king everywhere I've worked, but it's going to more often Safari and Firefox than other browsers due to tracking protections and users being more likely to run ad blockers. Then there's all the edge cases like Brave. I don't remember the discrepancy that the study found, but it's significant. So… we keep optimising for Chrome, as if that's the bulk of our audience. That makes things shittier for everybody else, and we think it's okay because they're such a small part of the group. This reminds me of a former client burning almost 9 million euros every year because they excluded IE6–8 from their reporting, yet they would account for 15% of the traffic.