5 ms·
This is probably a naive question, but... Doesn't the idea of swapping extension specific IDs to your browser specific extension IDs mean that instead of your
by awesome_dude 9mo ago
This is probably a naive question, but...
Doesn't the idea of swapping extension specific IDs to your browser specific extension IDs mean that instead of your browser being identifiable, you become identifiable?
I mean, it goes from "Oh they have X, Y , and Z installed" to "Oh, it's jim bob, only he has that unique set of IDs for extensions"
- triceratops 9mo agoIt's not a naive question. This comment says it's not possible to do that: https://news.ycombinator.com/item?id=46905213 https://news.ycombinator.com/item?id=46905213
- awesome_dude 9mo agoOh, it's (re)randomised upon each restart, whew, thanks for the heads up edit: er, I think that that also suggests that I need to restart firefox more often...
- tech234a 9mo agoThe webpage would have to scan the entire UUID space to create this fingerprint, which seems unlikely.
- deleted 9mo ago[deleted]
- throwaway808081 9mo agoJust have a database of UUIDs. Seems pretty trivial to generate and sort as it's only 16 bytes each.
- dullcrisp 9mo agohttps://libraryofbabel.info/ https://libraryofbabel.info/
- stirfish 9mo agolol Let's go a step further and just iterate through them on the client. I plan on having this phone well past the heat death of the universe, so this is guaranteed to finish on my hardware. function* uuidIterator() { const bytes = new Uint8Array(16); while (true) { yield formatUUID(bytes); let carry = 1; for (let i = 15; i >= 0 && carry; i--) { const sum = bytes[i] + carry; bytes[i] = sum & 0xff; carry = sum > 0xff ? 1 : 0; } if (carry) return; } } function formatUUID(b) { const hex = [...b].map(x => x.toString(16).padStart(2, "0")); return ( hex.slice(0, 4).join("") + "-" + hex.slice(4, 6).join("") + "-" + hex.slice(6, 8).join("") + "-" + hex.slice(8, 10).join("") + "-" + hex.slice(10, 16).join("") ); } This is free. Feel free to use it in production.
- b00ty4breakfast 9mo agoFree space heater
- deleted 9mo ago[deleted]
- Velocifyer 9mo agoWhat license is this? Company policy says we can't use Apache licensed stuff.
- Dylan16807 9mo ago"Just" have a database, and then what? I can set up a database of all UUIDs very easily, but I don't think it's helpful.
- direwolf20 9mo agoWhere are you storing them, a black hole?
- techpression 9mo agoFast writes, very slow reads.
- Dylan16807 9mo agoAll you need is basic compression, like storing the start and stop points of each block of UUIDs in the database. Wait, you already linked to everyuuid. Do you think the server it's on uses black hole storage?
- seg_lol 9mo agoI would store them as offsets within the digits of pi.
- pshirshov 9mo agoThat's actually a bright idea! Have you ever thought about applying for VC funds? Once you deliver that, you can also think about a database of natural numbers!
- deleted 9mo ago[deleted]
- phanimahesh 9mo agoBut that has no moat. Anyone can generate a database of natural numbers using SOTA models.
- deleted 9mo ago[deleted]
- voussoir 9mo agoRelevant: https://news.ycombinator.com/item?id=42342382 https://news.ycombinator.com/item?id=42342382
- direwolf20 9mo agoIt exists https://everyuuid.com/ https://everyuuid.com/
- xhcuvuvyc 9mo agoWoosh
- direwolf20 9mo agosomeone took your joke and made it real
- fragmede 9mo agoThe write-up for it is surprisingly interesting! https://eieio.games/blog/writing-down-every-uuid/#toc:entropy-and-bijectivity https://eieio.games/blog/writing-down-every-uuid/#toc:entrop...
- Mikhail_Edoshin 9mo ago16 bytes is a lot. 4 bytes are within reach, we can scan all of them quickly, but even 8 bytes are already too much. Kolmogorov said that computers do not help with naturally hard tasks; they raise a limit compared to what we can fo manually, but above that limit the task stays as hard is it was.
- jorvi 9mo agoDoing it on restart makes the mitigation de facto useless. How often do you have 10, 20, 30d (or even longer) desktop uptime these days? And no one is regularly restarting their core applications when their desktop is still up. Enjoy the fingerprinting.
- eek2121 9mo agoUmm, I restart my PC about once a week for security and driver updates. If you don't, you have a lot more to worry about beyond fingerprinting... Oh and I'm on LINUX (CachyOS) mind you.
- tristan957 9mo agoI restart my browser basically every day.
- cyanydeez 9mo agoyeah I close out everything as a mental block against anything I'm working on. I think there's a subset of people that offload memory to their browsers and that's kinda scary given how these fingerprint things work.
- recury 9mo agoYou just need to open so many instances and tabs in each instance that it crashes every couple days
- Thiez 9mo agoThere isn't enough energy in the solar system to count to 2^128. Now a uuid v4 number "only" has 2^122 bits of entropy. Regardless, you cannot realistically scan the uuid domain. It's not even a matter of Moore's law, it is a limitation of physics that will stand until computers are no longer made of matter.
- Ghoelian 9mo agoI don't think that's the case. I have the Earth View extension installed which shows a random google earth image. I have this set as my homepage in Firefox as moz-extension://<extension-id>/index.html, and this has not changed since installing the extension. The page still works.
- deleted 9mo ago[deleted]
- deleted 9mo ago[deleted]
- b112 9mo agoMaybe, but how long are the extension ids? And if they are random, how long to scan a trillion random alphanumeric ids, to find matches? I presume the extension knows when it wants to access resources of its own. But random javascript, doesn't.
- maples37 9mo agoThe extension IDs are UUIDs/GUIDs, so 128 bits of entropy. No site is going to be able to successfully scan that full range.
- b112 9mo agoChatGPT told me it can be done though. It won't disclose how, as it says it has had several users report it. And that it expects 50% of the bounty, and will use it for GPU upgrades.
- Sophira 9mo agoAnd just in case the magnitude of that isn't obvious to people, that means there are 340,282,366,920,938,463,463,374,607,431,768,211,456 total possible UUIDs. Good luck.
- account42 9mo agoUUIDs are 128 bit long but generally have a bit less entropy than that as they are not just a random number. Still more than enough to make enumeration infeasible though.
- deleted 9mo ago[deleted]
- deleted 9mo ago[deleted]
- calvinmorrison 9mo agoyes thats how browser fingerprinting works and it is impossible to defeat because there are just too many variations in monitors (relevant for fonts), simple things like user agent, etc.
- ahoka 9mo agoAnd browsers trying to mitigate fingerprinting are miserable to use (fixed window size with only Arial available, etc) and probably fingerprintable anyway.
- mrweasel 9mo agoWhy does the browser even allow a website to query for installed extensions? I really don't see what the point of that would be. The website should never be able to tell what's running in my browser, or on my computer in general. The browser renders the page, maybe runs a little Javascript, but there's no reason why it should be able to query anything about my environment. I wonder how much stuff would break if the Chrome sandboxing was extended to preventing access to chrome-extension:// from Javascript loaded of random websites.