Hacker News Reader

Comment by Jerry2 | Hacker News Reader

Here's one they missed: do not resize your window! If you do, your browser instance has a potential to have a unique viewport size and hence, there's a probability you can be tracked. Whatever size window Tor opens, do not re-size it.

I do not use Tor myself but few years ago I've analyzed an anonymized data site and was amazed how easy it was, with a high degree of probability, to track someone just based on screen resolution + viewport size (i.e. size of your browser window). Almost every viewport size was unique (when correlated with screen resolution).

View on HN

  > Here's one they missed: do not resize your window!

Under the "Don't change settings if you don't know their consequences." section:

  For example removing a menu bar or using Full Screen
  in Tor Browser is recommended against. The latter
  is known to modify the screen size, which is bad
  for the web fingerprint.

Also, the current version of the Tor Browser warns you when you resize the window.

>Also, the current version of the Tor Browser warns you when you resize the window.

I believe it only warns you if you maximize the window, not if you resize it.

Resizing it isn't a problem. It doesn't open at a magically untrackable size, the point of this advice is that if you are fullscreen you will be the same size always and therefore potentially trackable between sessions, if you are resizing it yourself even if you try to resize to roughly the same size as last time you won't be exactly the same. (Window management features like snapping to half screen instead of full screen of course would be the same as going full screen.)

Interesting. I'd have thought custom sizing would be bad for between-site tracking as it's much more likely to be unique, whereas fullscreen wouldn't have been much of a problem since resolutions are pretty standardised.

Hmm, my thinking was that Tor browser would randomly pick a size, but maybe it only has a certain number of options to make sure every user crosses with plenty of other users too? In which case resizing of any sort would make you more unique, just within the session. (I'm no expert on Tor/browser.)

For those with knowledge of how window size affects page layout, is there any technical reason for Tor browser not to fuzz with a random +/- 5 pixels while in a single session (say, on every page load)?

Similar to what the nosleep utility does with jiggling the mouse by an unnoticable +/- a few pixels.

Too easy to average that away.

Could make sense to do so on a session-by-session basis, though.

Randomly picking a size still gives a good chance of being able to track user connections across a single session.

Sure but you shouldn't be connecting as distinct psuedo-identities during the same Tor session (mentioned in the article); if a custom browser size is associated with a one-time-use anonymous session then it shouldn't be a problem except that it leaks information about what window sizes are possible on your system, and your custom resize is very unlikely to be random; probably predictably proportional to your actual screen size.

Actually it does. Check window.innerHeight and window.innerWidth.

The specific values depend on the individual configuration of your browser - icon size, toolbars, themes ...

mine is: 1920 x 992

if I add the bookmark bar the sizeing turns: 1920 x 968

It's not identifying but individual.

At least some mitigation to this is in the pipeline. If you try "hardened" version (although, currently only available for Linux 64-bit) you'll see it will only resize and lettersized to a certain set of "common" screen size.

I don't know what their roadmap is, but I'm assuming, this will be eventually coming to the stable release for all platforms supported.

Why doesn't Tor Browser just spoof a default screensize? Why is it necessary to tell websites what size the screen is? Would it be possible to still see responsive websites if a default screensize was chosen? Perhaps a few 'presets' could be created for different aspect ratios and then it would alright?

Just curious I guess, it's a shame that there are people out there who've likely done everything right except changing the size of their window, and maybe they got v& or even hurt because of this.

I think if you browse without JavaScript on, this information is not available to the sites you visit.

Viewport width can be obtained via CSS, e.g. by using a media query for every screen width:

    @media (min-width: 400px) {
      .thing {
        background-image: url(size-400.png);
      }
    }
    @media (min-width: 401px) {
      .thing {
        background-image: url(size-401.png);
      }
    }

You could combine this with pixel density for even more specificity.

The tor browser bundle does have settings to disable media queries for this reason, but it is still conceivable to be identified by browser size unless you completely disable all embeded media (including images). Perhaps the browser delays loading images that aren't visible on the screen.

This seems almost trivial for the browser to fix. Just load all CSS resources, regardless of media query matching.

IIRC TOR is already slow. I am now sure you want to do this.

Yeah, it's speed for anonymity, just like everything else about TOR.

What idiots thought this was a good idea? I swear, sometimes it seems like browser writers, standard writers, and website writers are actively colluding with advertisers and spies to make it easier to uniquely track everyone.

Well, the idea was to do stuff like

    @media(max-size: 200px) { #container { background: url(tiny_mobile.png); } }

    @media(max-size: 400px) { #container { background: url(small_mobile.png); } }

    @media(max-size: 800px) { #container { background: url(medium_tablet.png); } }

    @media(max-size: 2000px) { #container { background: url(large_desktop.png); } }

    @media(min-size: 2000px) { #container { background: url(retina.png); } }

Not always loading the same image is a good idea on mobile.

See my reply elsewhere. Background images are bad meaning this isn't a very compelling argument.

Often these aren't really background images, they're just using that to set image sources via CSS. These days you can do the same thing with srcset, which also allows someone to learn your screen resolution.

It's almost as if when your goal is to track someone you can use widely available, generally innocuous means to do so.

People being smart is the horse, and programmers colluding with "advertisers and spies" in a massive fashion is the zebra.

Well, if I put a HD background picture on a website, I sure don't want it to load on a mobile and use all of this user's data. It only makes sense.

Don't put HD background images on your website! Desktops have bandwidth caps too and most people are only interested in the page text not frilly multimedia.

Indeed. Background images were bad in the geocities age, background images were bad in the myspace age, background images are bad in the current tumblr age.

There's kind of a long-term issue about the web platform changing in ways that increase trackability, often without people thinking about it (or maybe in a few cases without people admitting that they thought about it).

There is a W3C TAG document that touches on this at

http://www.w3.org/2001/tag/doc/unsanctioned-tracking/

One problem is that there are so many ways of tracking user-agents in the web platform today that it can be hard to convince anyone that addressing one of them will improve the situation. :-(

You're the one who sent an HTTP request to a web server. They're only "tracking" requests your browser makes to them. If you don't want a site tracking you, stop sending them data.

I can and do control many of the requests a website tells my browser to make. I deny javascript. I deny cookies (strictly speaking I have cookies deleted when I close the page). I deny flash. I deny third-party objects. I do this because I have knowledge about them (and just the right amount of paranoia about other parties). I lament the fact that other people don't and bitch about it when appropriate.

Also, toolbar/dock/taskbar location matters. I'm aware that due to my vertical taskbar I have a rather unique viewport size. The usability improvements of not wasting limited vertical viewing area trump that though (and I don't use TOR).

Or just disable JavaScript? Seriously: why would you brows for with JavaScript enabled?

If you're setting up your browser to blend in, turning off JS, which nobody in the real world actually does, only serves to draw attention to yourself.

You're already on tor. JavaScript should be disabled by default in the tor browser bundle anyway.

That you are on Tor and that you are not using javascript are two unusual things that compound each other in making you uniquely identifiable.

One reason that it is still relevant even though you are already using Tor is that there are many ways to slip up and expose yourself. And when you do, you've paired this additional one in a hundred identifier to yourself. Might as well just use lynx.

It's trivial to distinguish a tor user from a regular user on both ends of the connection. Hiding the fact that you are using tor is not the goal, making yourself indistinguishable from other tor users is the goal.

Reply on news.ycombinator.com