8 ms·
We found a stable Firefox identifier linking all your private Tor identities
- crazysim 6mo agoI would imagine most users of Tor are using Tor Browser. I am reading there was a responsible disclosure to Mozilla but is it me or did that section leave out when the Tor Project planned to respond or release a fixed Tor Browser? Do they like keep very close or is there a large lag?
- flotzam 6mo agoTor Browser is always quick to rebase on the latest Firefox ESR. They released an update the next day: https://blog.torproject.org/new-release-tor-browser-15010/ https://blog.torproject.org/new-release-tor-browser-15010/
- crazysim 6mo agoThis is great to hear. I wish the original article was more clear on that instead of a vague "they'll get to it" which has bad connotations.
- aboardRat4 6mo agoNot sure about "most". I use tor without a tor browser, because I don't care about being identified. I only used it to go around geoblocking and visit onion sites.
- crazysim 6mo agoAre you really not sure? I'm pretty darn sure a lot of "normal" people don't know how to configure their systems to use a SOCKS proxy to use Tor.
- aboardRat4 6mo agoBut a lot of "normal" people don't use tor at all.
- crazysim 6mo agoAh I should have been more specific and saying normal Tor users.
- lpapez 6mo agoVery cool research and wonderfully written. I was expecting an ad for their product somewhere towards the end, but it wasn't there! I do wonder though: why would this company report this vulnerability to Mozilla if their product is fingeprinting? Isn't it better for the business (albeit unethical) to keep the vulnerability private, to differentiate from the competitors? For example, I don't see many threat actors burning their zero days through responsible disclosure!
- hrimfaxi 6mo agoThey probably are not relying on it and disclosure means others can't either.
- valve1 6mo agoWe don't use vulnerabilities in our products.
- lyu07282 6mo agoSo it's the criminal that convinced themselves they are the good guys, I didn't expect that one. You are a malware company get a grip.
- celsoazevedo 6mo agoWould you prefer that they kept this for themselves instead of disclosing it? I get criticizing their business and what they do wrong, but doesn't seem right to criticizing them for doing the right thing.
- trinsic2 6mo agoIt means they are suspect. I think its right to be wary of motives if they are involved in the very thing they aim to bring awareness too. Questions arise in my mind as to why they would do something like this in the first place. Its been my experience that the general public doesn't seem to follow patterns and instead focus on which switch is toggled at any given moment for a company's ethical practices. This is the main reason why we are constantly gamed by orgs that have a big picture view of crowd psychology.
- fsflover 6mo agoIt seems Qubes OS and Qubes-Whonix are not affected.
- ranger_danger 6mo agoSource?
- fsflover 6mo agoDifferent VMs result in different identifiers.
- handedness 6mo agoCreating a new identity in the browser in a disposable VM does not start a new disposable VM.
- fsflover 6mo agoI never said that. I only assumed that a user followed the docs when using Qubes-Whonix.
- handedness 6mo agoA dangerous assumption for someone who styles himself as the introducer of Qubes OS to new audiences. The saying about assumptions is as true as ever, unfortunately for both of us.
- fsflover 6mo agoPeople who use tools incorrectly bear responsibility for corresponding dangers themselves. They can always ask for an additional advice or more details. I don't understand why you are attacking me for that. See also my answer elsewhwere (and please stop repeating the same thing in every comment thread): https://news.ycombinator.com/item?id=47878794 https://news.ycombinator.com/item?id=47878794.
- sva_ 6mo agoDoes Tor Browser still allow JavaScript by default? Because if you block execution of JavaScript, you won't be affected from what I understand.
- ranger_danger 6mo agoDisabling JavaScript actually greatly increases your fingerprint as not many users turn it off, so that instantly puts you in a much smaller bucket that you need to be unique in. Yes, not having JS means it limits your options for gathering other details, but it also requires much less effort to be unique now without JS. Tor Browser also doesn't spoof navigator.platform at all for some reason, so sites can still see when you use Linux, even if the User-Agent is spoofing Windows.
- throwawayqqq11 6mo agoI have my problems with that argument. Yes, less identifying bits means a smaller bucket but for the trackers, it also means more uncertainty, doesnt it? So when just a few others without JS join your bucket eg. via a VPN, profiling should become harder.
- Springtime 6mo ago> Disabling JavaScript actually greatly increases your fingerprint as not many users turn it off, so that instantly puts you in a much smaller bucket that you need to be unique in. I've heard a handful of people say this but are there examples of what I would imagine would have to be server-side fingerprinting and the granularity? Since most fingerprinting I'm aware of is client-side, running via JS. While I expect server-side checks to be limited to things like which resources haven't be loaded by a particular user and anything else normally available via server logs either way, which could limit the pool but I wonder how effective in terms of tracking uniqueness across sites.
- ranger_danger 6mo agoIn addition to server-side bits like IP address, request headers and TLS/TCP fingerprints, there are some client-side things you can do such as with media queries, either via CSS styles or elements that support them directly like <picture>. You can get things like the installed fonts, screen size/type or platform/browser-specific identifiers. https://fingerprint.com/blog/disabling-javascript-wont-stop-fingerprinting/ https://fingerprint.com/blog/disabling-javascript-wont-stop-... There is also a method of fingerprinting using the favicon: https://github.com/jonasstrehle/supercookie https://github.com/jonasstrehle/supercookie
- bawolff 6mo agoFrom the sounds of this it sounds like it doesn't persist past browser restart? I think that would significantly reduce the usefulness to attackers.
- shevy-java 6mo agoWould it though? I guess state agencies already know all nodes or may know all nodes. When you have a ton of meta-information all cross-linked, they can probably identify people quite accurately; may not even need 100% accuracy at all times and could do with less. I was thinking about that when they used information from any surrounding area or even sniffing through walls (I think? I don't quite recall the article but wasn't there an article like that in the last 3-5 years? The idea is to amass as much information as possible, even if it may not primarily have to do with solely the target user alone; e. g. I would call it "identify via proxy information").
- Barbing 6mo ago> I guess state agencies already know all nodes or may know all nodes. Assume the same. >The idea is to amass as much information as possible Reminded, from 2012: https://www.wired.com/2012/03/ff-nsadatacenter/ https://www.wired.com/2012/03/ff-nsadatacenter/
- akimbostrawman 6mo agoAll Tor nodes are publicly known. Just knowing them doesn't help tracking at all because of onion routing, they would need access to all nodes. https://metrics.torproject.org/rs.html https://metrics.torproject.org/rs.html
- mmooss 6mo agoMany users leave their browsers open for months.
- allthetime 6mo agoPrivacy and security conscious Tor users don’t.
- shevy-java 6mo agoWell that sucks. I guess in the long run we need a new engine and different approach. Someone should call the OpenBSD guys to come up with working ideas here.
- giancarlostoro 6mo ago> Mozilla has quickly released the fix in Firefox 150 and ESR 140.10.0, and the patch is tracked in Mozilla Bug 2024220. Did you even read the article at all? Ah my children did bad in school, time to replace them with new children and a different spouse. This is what you're suggesting essentially. A browser is not just something you simply make out of thin air. There's decades of nuance to browser engines, and I'm only thinking of the HTML nuances, not the CSS or JS nuances.
- anthk 6mo agoGiven the dangers of JS and WASM they could just fork Netsurf and enhance the CSS3 support. If you are a journalist, running Tor with JS and tons of modern web tech enable makes you a bright white spot in a sea of darkness.
- fsflover 6mo agoHere you go: https://qubes-os.org https://qubes-os.org.
- Barbing 6mo ago>Why Qubes OS? >Physical isolation is a given safeguard that the digital world lacks … >In our digital lives, the situation is quite different: All of our activities typically happen on a single device. This causes us to worry about whether it’s safe to click on a link or install an app, since being hacked imperils our entire digital existence. >Qubes eliminates this concern by allowing us to divide a device into many compartments, much as we divide a physical building into many rooms. … Sold https://doc.qubes-os.org/en/latest/introduction/intro.html https://doc.qubes-os.org/en/latest/introduction/intro.html
- deleted 6mo ago[deleted]
- Meneth 6mo agoI'm confused. The IndexedDB UUID is "shared across all origins", so why not use the contents of the database to identify browers, rather than the ordering?
- lxgr 6mo agoThe content is obviously scoped to an origin, or IndexedDB would be a trivial evercookie.
- nneonneo 6mo agoThere's an instructive example on the page. Suppose a page creates the databases `a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p`, then queries their order. They might get, for example `g,c,p,a,l,f,n,d,j,b,o,h,e,m,i,k`, based on the global mapping of database names to UUIDs. The key vulnerability here is that, for the lifetime of that Firefox process, any website that makes that set of databases is going to see the exact same output ordering, no matter what the contents of those databases are. That makes this a fingerprint: it's a stable, high-entropy identifier that persists across time, even if the contents of those databases are not preserved. It is shared even across origins (where the contents would not be), and preserved after website data is deleted -- all a website has to do to re-acquire the fingerprint is recreate the databases with the same names and observe their ordering.
- Joe_Cool 6mo agoAs I understood not ANY website can see it. But the same website can see it regardless if you reset your identity in Tor Browser. So it persists between anonymous sessions. So you could connect User A that logged out and reset the identity to User B who believed was using a fresh anonymous session and logged in afterwards.
- stratos123 6mo agoNo, it does allow identification across different websites (the article says "both cross-origin and same-origin tracking"). Both websites just need to create some databases with the same names. Since the databases are origin-scoped, these aren't the same databases, so you can't just write some data into one and read it on another website. But it turns out that if two websites use the same names for all these databases, the order the list of databases is returned in is random-per-user but the same regardless of website.
- anthk 6mo agoThe best for Tor would just be Links2/Links+ with the socks4a proxy set to 127.0.0.1:9050, enforcing all connection thru a proxy in the settings (mark the checkbox) and disabling cookies altogether.
- sixothree 6mo agoWould whonix fit that bill?
- angry_octet 6mo agoThe best is probably tor in a VM, chromium in a separate VM, javascript disabled, on a private virtual network, with a egress firewall (not just guest VM firewalls, but enable those too) that only allows traffic from a specific origin port on the tor machine. You would also want the VM to spoof the processor features and unique IDs. System time drift/offset remains a vector which is hard to deal with. Dump the rendered window pixels out to a simple viewer. Mouse movement is still a pain to deal with, but I would default to spoofing it as moving between clicks, with some image parsing logic to identify menu traversal. Then it should reboot the browser process regularly. I've been waiting for someone to make a packaged 'VPC in a box' incorporating networking and linked VMs.
- anthk 6mo agoLinks can force to pass all connections to a proxy, so a FW might be redundant. Forget almost mouse, Links can be render the page either to plain X11 or a terminal.
- angry_octet 6mo agoI'm assuming the browser is going to be compromised at some point, for example by getting it to retrieve something without using the socks proxy.
- anthk 6mo agoHow? Links in that case wont connect to anything.
- LoganDark 6mo ago> For developers, this is a useful reminder that privacy bugs do not always come from direct access to identifying data. Sometimes they come from deterministic exposure of internal implementation details. > For security and product stakeholders, the key point is simple: even an API that appears harmless can become a cross-site tracking vector if it leaks stable process-level state. This reads almost LLM-ish. The article on the whole does not appear so, but parts of it do.
- SirMaster 6mo agoI question why websites can even access all this info without asking or notifying the user. Why don't browsers make it like phones where the server (app) has to be granted permission to access stuff?
- t-3 6mo agoThe most popular browser is made by an ad company. They also provide the majority of funding for their biggest competitor. Why would you expect anything different?
- john_strinlai 6mo agomost people would expect something different from tor, surely.
- briansmith 6mo agoThe purpose of a system is what it does.
- triceratops 6mo agoThis phrase is practically https://en.wikipedia.org/wiki/Thought-terminating_clich%C3%A9 https://en.wikipedia.org/wiki/Thought-terminating_clich%C3%A... now
- octoberfranklin 6mo agoThe funding for tor project is nowhere near what is needed to develop an entire browser. Mainly because the web has become such a bloatfest, not because of any wrongdoing by tor.
- Barbing 6mo ago>Why don't browsers make it like phones where the server (app) has to be granted permission to access stuff? Like Android phones perhaps? Unfortunate Apple gives very little granular control.
- codedokode 6mo agoHonestly it seems that most of Web Standards are used mostly for fingerprinting - I think a small number of websites uses IndexedDB (who even needs it) for actually storing data rather than fingerprinting. That's why expansion of web standards is wrong. Browser should provide minimal APIs for interacting with device and features like IndexedDB can be implemented as WebAssembly library, leaking no valuable data. For example, if canvas provided only access to picture buffer, and no drawing routines calling into platform-specific libraries, it would become useless for fingerprinting.
- Dwedit 6mo agoYou can use a browser extension like "Local Storage Editor" to see the contents of the Local Storage of a website. So far, I've seen it used for caching long-life images (like on gmail), or used as another way to do logins instead of cookies.
- troupo 6mo ago> You can use a browser extension like "Local Storage Editor" to see the contents of the Local Storage of a website. Or just open dev tools
- deleted 6mo ago[deleted]
- fc417fc802 6mo agoI'm with you up to the bit about canvas. The problem there is that if you want hardware acceleration then either you can't permit services to read back what was rendered (why do they need to do that again?) or else you're inevitably going to leak lots of very subtle platform specific details. Personally I think reading back the content of a canvas should be gated behind a permission dialog.
- codedokode 6mo agoYou can put hardware acceleration behind permission.
- firefax 6mo agoThe OP's link is timing out over Tor for me, but the Wayback[1] version loaded without issue. Also, does anyone know of any researchers in the academic world focusing on this issue? We are aware that EFF has a project that used to be named after a pedophile on this subject, but we are more looking for professors at universities or pure research labs ala MSR or PARC than activists working for NGOs, however pure their praxis :-) As privacy geeks, we have become fascinated with the topic -- it seems that while we can achieve security through extensions like noscript or ublock origin or firefox containers (our personal "holy trinity"), anonymity slips through our fingers due to fingerprinting issues. (Especially if we lump stylometry in the big bucket of "fingerprinting".) [1] https://web.archive.org/web/20260422190706/https://fingerprint.com/blog/firefox-tor-indexeddb-privacy-vulnerability/ https://web.archive.org/web/20260422190706/https://fingerpri...
- Cynddl 6mo agoyes, there’s an active area of research on web fingerprint, both attacks and defences. Look at conferences like PETS for instance
- firefax 6mo agopets is a good conference. i also like anonbib as a central repo for interesting work. https://www.freehaven.net/anonbib/topic.html https://www.freehaven.net/anonbib/topic.html
- dirasieb 6mo agowhat are you referring to with that EFF app part?
- tomrittervg 6mo agoMozilla is working on it. (I know you said 'Academic', but we publish papers sometimes too.)
- firefax 6mo agoI'd lump Mozilla into the bucket since it's a nonprofit and open source, it's hard to come up with an objective list of what makes an org "good" so sometimes it's been useful to fall back on the fact that at least in the states, academics are bound by the IRB.
- yencabulator 6mo ago> the identifier can also persist [...] as long as the Firefox process remains running Make sure to exit Tor Browser at the end of a session. Make sure not to mix two uses in one session.
- SeriousM 6mo agoOr shut down and boot tails again. You need privacy? Take your time.
- friendzis 6mo agoAnyone that serious about opsec should have dedicated hardware for that anyway
- Phelinofist 6mo agoWhy not tails in a VM?
- negura 6mo agobecause your host might be compromised
- yard2010 6mo agoUse a separate machine for these stuff, never mix your clean machines with the dirty ones, complete separation, different networks
- negura 6mo agothe vulnerability was fixed upstream by mozilla anyway
- sdrm 6mo agobetter yet, disable javascript when using tor.
- wolvoleo 6mo agoTails (without persistent storage) will mitigate this though. I'm not too concerned.
- wlonkly 6mo agoI'm not sure it will. The problem in Tor here is that the ordering persists beyond "New Identity". It does not persist between browser restarts.
- wolvoleo 6mo agoBut that's the key thing about tails. You start it fresh every time from a clean usb stick or iso image. It's more than a browser restart, it's a complete system wipe every time. Tails is made on the premise that exactly this kind of trick will occur. Sometimes even persisting between browser restart. For that reason even the persistent storage is very limited. But that's optional and cautioned against for maximum anonymity. What would be worrying with tails would be if there was some way for some hardware identifier to be exposed. Like a serial number or MAC address. But this kind of thing is exactly what it's made to protect against.
- keepamovin 6mo agoNice, yes, a fresh Tails restart would definitely teardown the Fox process. And I think if you're disciplined, then purely ephemeral environments are the best mitigation for process-level state leaks like this IndexedDB ordering bug. For those who want an ephemeral setup but prefer the Chromium engine over Firefox, you can achieve a similar "destroy after use" workflow using BrowserBox. It has a tor-run function that connects Chrome to a Tor SOCKS proxy and wraps all auxiliary network calls over torsocks. You can easily spin up a purely ephemeral session using a GitHub action [0] so that absolutely no state persists once you close it. As a bonus, you can also run the BrowserBox instance itself as an onion hidden service while browsing over Tor. [0]: https://github.com/marketplace/actions/browserbox https://github.com/marketplace/actions/browserbox
- 6mo ago
- farfatched 6mo ago> Because the behavior is process-scoped rather than origin-scoped Hmm, I'm a little confused, since in 2021 Mozilla released experimental one-process-per-site: > This fundamental redesign of Firefox’s Security architecture extends current security mechanisms by creating operating system process-level boundaries for all sites loaded in Firefox for Desktop https://blog.mozilla.org/security/2021/05/18/introducing-site-isolation-in-firefox/ https://blog.mozilla.org/security/2021/05/18/introducing-sit... Perhaps that is not fully released? Or perhaps it is, but IndexedDB happens to live outside of that isolation?
- farfatched 6mo agohttps://news.ycombinator.com/item?id=47868736 https://news.ycombinator.com/item?id=47868736 helps me understand that there's a sliver of behaviour that happens to be global, and this thus allows fingerprinting. If so, cool!
- ranger_danger 6mo agoYou can also fingerprint browsers profile-wide across sessions without any JS, CSS or even HTML, using the favicon: https://github.com/jonasstrehle/supercookie https://github.com/jonasstrehle/supercookie
- snailmailman 6mo agoI think most browsers have patched this out? i didnt do super concrete tests, but at least on my machine their demo is failing to fingerprint me across private browsing/incognito sessions as they claim. Tested in firefox and edge.
- ranger_danger 6mo agoNot sure about Chromium-based browsers, but the author of this paper on the technique: https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1C-5_24202_paper.pdf https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1... Says that Firefox has a bug that prevents favicons from being loaded from cache, which inadvertently protects against this technique. They filed a bug report on it in 2020 but nothing has happened with it yet: https://bugzilla.mozilla.org/show_bug.cgi?id=1618257 https://bugzilla.mozilla.org/show_bug.cgi?id=1618257
- zzo38computer 6mo agoSome users disable favicons; I am one of them (although that is main because I do not use them, rather than due to that).
- heavyset_go 6mo agoThere are others that Cloudflare and friends use for fingerprinting.
- VladVladikoff 6mo agoWhat are these databases not scoped to origin of creation like cookies?
- AgentME 6mo agoThey are. The leak is that if a webpage you visit creates several databases with certain names, the order is random but stays the same within the same browser session.
- bfivyvysj 6mo agoI learned enough about security years ago that there's basically zero chance you're secure and almost 100% chance someone is watch everything you do online. Whether they care is entirely separate.
- PoignardAzur 6mo agoAh, yes, the "fuck it" approach to infosec.
- tdeck 6mo agoIt seems to have worked for Fiverr.
- jimbo808 6mo agoCould be accurate but governments can be profoundly incompetent even with great capability at their disposal
- IAmBroom 6mo ago"Watching" is doing heavy lifting. "Able to watch" or "being recorded, along with terabytes of parallel information from others", is more apt. Actually discriminating the signal (communications from a desired target, or about a desired topic) from noise is the problem with your "nothing you do will stop them" theory.
- jancsika 6mo agoBe careful when telling other campers that you think it's pointless to try to outrun a grizzly bear. They may outwardly appear to agree with your statement, but it may be for very different reasons than you think. Edit: clarification
- phatskat 6mo agoI forget where I saw it but there’s an old adage along the lines of “even if your computer is unplugged, in a vault, with armed guards, it’s probably not safe”.
- Cider9986 6mo agoBeing fingerprinted across Tor is different from being deanonymized—it basically just "psuedonomizes" you. You now have an identifier. It is a significant threat, but it is not hard to "psuedonomize" someone based on stylometry and some of the people with the highest threat model—operating an illegal site, will be pseudonymous anyway. Don't get your opsec advice from HN. Check whonix, qubes, grapheneos, kicksecure forums/wikis. Nihilist opsec, Privacyguides.
- grumbelbart2 6mo agoThis fingerprint persists over private and non-private Firefox sessions until you restart Firefox. State actors might be able to connect your Google-login in FF window 1 with your tor session in FF private window 2.
- sigmoid10 6mo agoGood opsec usually means you don't do this anyway. Don't use your anonymous browser for anything related to your real persona. In fact, don't re-use the OS between anonymous and public personas. Or even better: Don't re-use the hardware (also goes for networking). There will always be bugs across all levels of software and hardware that could eventually be chained to expose you. But if there is nothing there that could be exposed, you're already much better off by default. Even if that is very hard to achieve in practice.
- realusername 6mo agoUsually you have TOR browser for TOR and a standard Firefox for the standard browsing so they already are two sessions.
- goodpoint 6mo agoNo, fingerprinting is a synonym of deanonymization.
- litigator 6mo agoNo. If everyone (or browser installs) had identical fingerprints... Good luck deanonymising them.
- Cider9986 6mo agohttps://archive.ph/BbVZo https://archive.ph/BbVZo — for those that would rather be fingerprinted by Google than fingerprint-com
- biosboiii 6mo agoTor on Chromium, when? Seriously, I am saddened that Chromium dominates the browser market as much as it does, but at this point the herd-immunity of Chromium is necessary to keep users safe.
- keepamovin 6mo agoTo answer "Tor on Chromium, when?", well - you can actually do this right now using BrowserBox! It has a built-in tor-run function that connects Chrome to a Tor SOCKS proxy, and it wraps any other browsing-related network calls over torsocks as well. Because it's an isolated remote browser, you also get a lot of flexibility. You can run BrowserBox itself as an onion hidden service connected to the clearnet, or connect BrowserBox to browse over Tor, or even do both at the same time. Since this Firefox IndexedDB vulnerability relies on persisting state, you can completely avoid it by running BrowserBox (based on Chromium), and doing it ephemerally. There's actually a new GitHub action [0] that makes spinning up a purely ephemeral, disposable session incredibly easy and would be immune to this kind of process-level state tracking. The action runs BrowserBox on a GitHub Action Runner, you can specify whether you want a CloudFlare tunnel, or a tor tunnel (which comes with torweb access). And there's a conveneince script you can use to run from the command-line - which does the setup then spits out your login link. All you need is a BrowserBox license (not free), but then you can use it. I would consider this a lightweight Tor-proxied Browser, not a replacement for Tor Browser, at this time as there are likely edges and leaks that the official Tor Browser has long patched. However, as cases liek this IDB bug demonstrate - no security is perfect. If you simply want a way to access tor, and add an extra "ephemeral" hop on a runner, itself over Tor, and not trying to do anything especially sensitive or life-threatening - it's probably good. [0]: https://github.com/marketplace/actions/browserbox https://github.com/marketplace/actions/browserbox [1]: https://github.com/BrowserBox/BrowserBox https://github.com/BrowserBox/BrowserBox
- b1temy 6mo ago> ...stored in the global StorageDatabaseNameHashtable. > This mapping: > - Is keyed only by the database name string > ... > - Is shared across all origins Why is this global keyed only by the database name string in the first place? The post mentions a generated UUID, why not use that instead, and have a per-origin mapping of database names to UUID somewhere? Or even just have separate hash-tables for each origin? Seems like a cleaner fix to me compared to sorting (imo, though admittedly, more of a complex fix with architectural changes) Seems to me that having a global hashtable that shares information from all origins is asking for trouble, though I'm sure there is a good explanation for this (performance, historical reasons, some benefits of this architecture I'm not aware of, etc.).
- immanuwell 6mo ago[flagged]
- Fokamul 6mo agoImho, EU should make any fingerprinting illegal in all browsers. And all browser devs should be required to actively fight against fingerprinting. There is no legitimate need for fingerprinting in browsers.
- jonathanstrange 6mo agoFingerprinting is done by servers, not by browsers, and it is already illegal in the EU when it is done without explicit user consent and according to the GDPR data handling requirements. The GDPR covers all of this, it doesn't matter where the data comes from.
- self-portrait 6mo agoWhy is Firefox DB open-source MPLv2.0 running .cpp indexedDBdatabses() script on the API: namespace mozilla { namespace dom::indexedDB { using namespace mozilla::dom::quota; using namespace mozilla::ipc; using mozilla::dom::quota::Client;
- Amekedl 6mo ago"The signal is not just stable. It also has high capacity." stopped reading right there also it's nothing that anybody using tails for example should have to worry about. Nothingburger.
- rendall 6mo agoThis headline reads like the subject line of an alarming scam email.
- aboardRat4 6mo agoWhy would a webpage reader even have an "indexdb"?
- 1vuio0pswjnm7 6mo agoIs it assumed that all users, including Tor users, have Javasctipt enabled How does this "identifier" work with Javascript disabled
- lixtra 6mo ago> The cleanest mitigation is to return results in a canonical order, such as lexicographic sorting. And hope that the sorting time cannot be used as a side channel.
- octoberfranklin 6mo agodjbsort is constant-time. Because most post-quantum cryptosystems need this primitive. https://sorting.cr.yp.to/ https://sorting.cr.yp.to/