Hacker News Reader

Comment by shultays | Hacker News Reader

I have a few questions about finger printing.

Why Tor sends window size to servers? If it has to, why it can't send closest multiple of 100 instead of real value?

Why servers request size of client windows anyway? I assume so they can serve different resolution images to clients or maybe different layouts, is this correct? But then instead of sending 1920x1080, simply sending 1900x1100 would also work right?

Same goes for fonts, as soon as you install a few different fonts, you are pretty much unique now. Why does a browser has to send the fonts you have? Shouldn't it be possible to only send the fonts you have? Default fonts of OSes enabled by default, and new fonts are disabled?

View on HN

> Why Tor sends window size to servers? If it has to, why it can't send closest multiple of 100 instead of real value?

It's not Tor that does so, by using JS one can determine canvas size. Worse, CSS alone can be used to extract.[1] You can take a look here for a live demo.[2]

[1] : https://matt.traudt.xyz/p/YF4ciVY6.html

[2] : https://system33.pw/cssmediapoc

This is all done client side with Flash/Javascript. For Tor it is recommended to disable JS, and I believe the Tor browser bundle comes with NoScript by default. Plugins should be disabled because they are very exploitable to de-tor someone.

Tor comes with NoScript but JS is still enabled. The very first thing you should do after installing Tor is disable JS.

The browser needn't directly send info to the server; it simply has to be available to client-side Javascript. That can then, in turn, send that info to the server, which (I think) is really hard for browsers to detect.

CSS alone can get window size

https://news.ycombinator.com/item?id=13929211

actually common browser window sizes are divisible by 128, which means that you could just bitmask all but the last few digits to achieve the same result in a few cycles

No, you actually have to display the content inside a pane of a common size because there are many ways to get screen size indirectly from content that's occupying it. Think responsive mode of developer tools.

Reply on news.ycombinator.com