Hacker News Reader

Comment by zbraniecki | Hacker News Reader

Hi all,

I'm an engineer working on Firefox Platform (Gecko). In the linked blog post, the author recommends Firefox (thanks!) and links to a "privacy recommendations" for it, which include items such as "resistFingerprinting" settings.

I'd like to remind everyone that turning on this setting has far fetched consequences to how you experience the Web. Your dates, timezones, preferred languages will all be masked which will result in weird experiences.

The option is behind a flag and without UI precisely because it is a pretty complex feature, that we didn't iron out yet, and which should be well understood before being used.

It concerns me to see it being references and recommended without any explanation whatsoever.

Of course I'm likely biased because I'm on the receiving end of bug reports from people who experience the Web in weird languages and with wrong timezones because they followed some tutorial that recommended it. :(

View on HN

Is there a moderate resistFingerprinting setting? I don't mind my date/tz/language being known. There are 150m+ people living in my timezone who use en-US.

I don't want my fonts, plugins, user agent, or detailed HW/graphics features (e.g. canvas/WebGL hash) being known. Those can uniquely identify me according to https://panopticlick.eff.org.

Those can uniquely identify me

So does your resolution. And that's hard to mask because JS usually needs to know it.

If you're not using the browser fullscreen, chances are that you're using a unique innerWidth+innerHeight.

As unsatisfying as it is, the current best solution seems to be not to care about privacy most of the time, and then take privacy seriously when you do. Whonix is excellent for this.

The Tor Plugin sets the window sizes to predefined values that match various fullscreen resolutions. So there are options, but they all involve tradeoffs.

If fingerprinting uses a hash based on a number of input criteria, then you only need to perturb one of those inputs to make the entire hash unusable. Perhaps Firefox is perturbing the other inputs (?) such that screen resolution doesn't matter much. (Just guessing and looking for a positive angle here).

True, but that's assuming inputs go to a hash rather than something more robust like a probability function.

I had to work on fingerprinting (not my proudest moment) and disabling hashing to avoid this problem was literally the very first thing we did. Just a datapoint, of course.

It's hard to imagine any non-toy implementation of fingerprinting doing anything that naive, really.

But I resize my browser all the time? Even with timezone + language surely it's a very short lived fingerprint? When it's not manually sized it's snapped to either side of a standard screen.

idk - it seems like that can't be enough?

Your resolution alone will not likely uniquely identify you. The idea is to eliminate many of the data points that make it easy to track you across IPs. Resolution is very common if you're browsing with a maximized window so it's not in the same league as these others that quickly diverge amongst users.

No, not alone. But if you're not masking your IP address, it probably will.

Weirdly, I tried to measure how unique my window.innerWidth/Height was, but panopticlick no longer seems to measure this. It only uses my full screen resolution, which of course is much less unique than canvas dimensions.

> No, not alone. But if you're not masking your IP address, it probably will.

If you're not masking your IP, resolution and anything else is largely irrelevant for tracking you.

> JS usually needs to know it

What do you mean by this?

JS is often used to change the position of elements based on the window size. If you give it wrong info, it will break the layout.

True, but if you round it down to the closest multiple of (say) 32, you significantly reduce the information content while leaving JS/CSS layout essentially the same.

Indeed, it will surely make resize look less sexy (jumping by 32s instead of pixels), and you might waste a few pixels of screen real estate on some sites at some times -- but it's the kind of tradeoff that some people happily do for more privacy.

Related, does anyone know if privacy badger include "screen size determination" in its heuristics?

I can't imagine that's 'usual'; most sites will do absolute positioning in css, if at all. As you suggest, trying to layout pixel-by-pixel designs is notoriously awkward and best avoided.

You could still do fingerprinting for resolution based on media queries in CSS.

I'm not talking about absolute positioning, but calculating positions and width/length based on rules (like the browser does with CSS, but for stuff the browser can't do). For example: https://css-tricks.com/scaled-proportional-blocks-with-css-a...

Sure, I just don't think that kind of thing is 'usual'.

Don't huge swaths of people have the same resolution, though? Yes, I understand other things come into play here (OS, Browser, available plugins, etc) but I am skeptical that people are really building UUIDs based on someone's screen resolution. Or, if they are, that such IDs are meaningfully accurate.

Not if the browser is not full screen, this is resolution/size of browser window.

Nope, you can get the screen size, too:

    > window.outerWidth
    1168
    > screen.width
    1920

It's all about the bits. You need 33 bits to identify 8 billion people. All that is required is for these bits to be independently uniformly distributed.

Say everybody uses one of four resolutions equally. That's two bits: 00, 01, 10 and 11. Now let's say that people's gender is also binary, distributed 50/50 and independent from what resolution someone uses. You can just tack that bit onto the two you already got and now you have three (the ability to distinguish between 2^3 = 8 individuals).

I won't go into the details, but if you have an estimate for the probability distribution of browser resolutions, it's fairly easy to extract the proper amount of bits of entropy. Being independent is a bit harder to make sure of, but as long as you pick things which aren't too obviously correlated, you can just take a safety margin and use, say, 40 bits to identify people, and it's probably fine (and for tracking purposes, a false positive isn't the end of the world, either).

That said, while I support the concept and idea behind panopticlick, I've always felt it overestimated the unicity of my browser. Or maybe I just really underestimate it myself. I don't know.

Assuming there's 4k possibilities for width and 2k for height, that's 8 millions possibilities right here. Compared to ~2 billions of people accessing the internet, the odds of having a unique one seems really really low.

It's one of many different data points that can be used to identify you though, and if you aren't full screen at a standard resolution then it's a very good one.

Of course keeping in mind that a good number of those will rarely be seen. (e.g. anything less than 100px)

> As unsatisfying as it is, the current best solution seems to be not to care about privacy most of the time, and then take privacy seriously when you do. Whonix is excellent for this.

No offense, but advice like this is useless. It reduces to, "someone I don't know thinks the average person with no special risk factors should think this way about their personal privacy based on who knows what priors."

Different people have different reactions to risk, have different actual exposures to risks, different competencies, and different tolerances for the hassles of opsec. And potential future risks of data slopping about are unknown.

There is no such thing as a "best solution" when talking about this.

That https://panopticlick.eff.org link was interesting, but I don't see what about my user agent string makes it so unique (1: 76540.09) ?

  Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.62 Safari/537.36

Looks fairly generic, I think I'm running a mainstream chrome browser on a mainstream OS.

Using Javascript the page can query more details about the environment including installed plugins, addons, configuration settings (language etc), certificates and fonts. That combination is often unique.

One problem is that your user agent is matched against all tested user agents from all times. This includes very old ones. If the user agent was used to track you online, they would account for that it frequently updates and for a lot of users (considering that most browsers update automatically these days).

So the site should really only take into account your OS, maybe its major version, and browser version (which changes frequently so trackers can’t rely on that). Or at least not count any that are not used anymore.

This is amazing, I use Ghostery, Privacy Badger and Scriptsafe in Firefox, and I was MORE private in non-private window! wth?

I suspect it's partly because these plugins don't function fully in a private window?

After the constant succession of revelations of the sorry state of privacy, along with myriad data breaches, all I want a browser to do is lie and obfuscate. So I'll gladly take the sledgehammer boolean of resistFingerprinting for now.

I've yet to come across an extension that does something like this so I'm presuming it's not possible via extensions?

Are Mozilla working to make this more granular and let me whitelist individual features on a per site basis?

I'd far rather lose tracking than get the very minor benefit of a (slow loading) web font or en-GB over en-US. Especially if I can opt in the few I trust or need those features.

> After the constant succession of revelations of the sorry state of privacy, along with myriad data breaches...

I remember reading an article about how Richard Stallman interacts with the internet a while back. I remember thinking that it seemed totally insane. But in light of the reality of 2018, I am coming around. The way I see it, I can keep tweaking privacy settings in a browser, or opting out of collection, or doing any number of other things to attempt to protect my privacy, _or_ I could just stop using services that do not respect my privacy in the first place. Perhaps certain aspects of modern life have taken too much, and they need to be abandoned until they are reformed?

> I remember reading an article about how Richard Stallman interacts with the internet a while back.

One of these you mean?

[1] https://news.ycombinator.com/item?id=16869515

[2] https://stallman.org/stallman-computing.html

It was directly related to #2, but I only made it there as a result of reading some other article. It has been a while and I don't remember the source.

The irony is that everyone knows a bit too much about RMS and exactly how he behaves online or in interviews. His efforts at privacy have backfired.

RMS’s efforts are not for not privacy as some absolutist doctrine: no one must know anything about me. Instead they are about freedom: people should know about me what I let them know about me; I am in control of my data and my online presence. We know lots about RMS’s internet habits specifically because he shares them with us using free and open services.

He's put his own special RMS twist on the classic 'vagrant in the library' model of internet use, taking it a step further by shunning browsers entirely and not using cellular devices. IIRC, he does explicitly mention privacy as being one of his motivations.

I agree. I'm coming around to some of his view, and no longer see him as quite so extreme. Still think he weakens his message with the alternative language, like "used" instead of user etc. Always have.

The difficulty of course is right now it's nearly everyone at it. Too early to say if GDPR will make an appreciable difference, though it seems like it should. So that leaves few choices outside of gnu everything or layers of hacks and browser extensions. I have hope that many services will start being much more careful in what tracking and data they actually need after recent events.

For FF: https://addons.mozilla.org/en-US/firefox/addon/random-agent-...

I think this one is no longer working with the newest FF versions, but check back in on it every once in a while.

For Chrome: https://chrome.google.com/webstore/detail/random-user-agent/...

Not as configurable as I'd like, but it gets 25% of the job done.

I actually used to use the Firefox one. IIRC when they changed the extensions system the dev announced he couldn't support it in the new system.

Time to give the chrome one a look, thanks.

NoScript, uBlock or uMatrix offer this (largely). Fingerprinting relies heavily on Javascript. Many sites work just fine without it or with first-party JS only (fingerprinting is mostly done by third-party trackers).

If Firefox really cared more about privacy than about its money flow they would have disabled 3rd party cookies by default instead of explicitly hiding¹ that setting.

Apple can do it. There's no reason why Firefox can't. And if there is a reason, it should have been dealt with years ago.

¹ i just noticed that in Firefox 60, the setting is no longer as hidden as it used to be. Good!

Most casual users would be quite upset if cookies stopped working. "Why does this site not stay logged in"? Etc.

Not all cookies, just 3rd party ones.

You think Apple is upsetting casual users?

I don't know, I think if a user is following all of the steps in this article, they likely know what fingerprinting is. Running an Android device without the Play Store, for example, is by far a much more difficult & complicated thing to do than just toggling a flag in a Firefox browser.

That, and the user is likely used to having less-than-ideal browsing experiences if they run any adblockers. I do agree that the article should outline what the consequences would be for disabling browser fingerprinting; they simply have one sentence recommending it, and nothing else.

By the way, what does GDPR say about fingerprinting? Is it legal? (Asking because the EU explicitly made cookies an opt-in technique, but not sure if they considered fingerprinting).

The EU did not make cookies an opt-in technique. The EU made irrelevant cookies opt-in. Cookies that are essential for the functioning of the service do not need a notice. If you require user accounts, you don't need to show a cookie notice. If you implement a shopping cart without user accounts, you also don't need to show a cookie notice.

Unfortunately most websites don't understand this simple idea and show the cookie notice indiscriminately (or, perhaps, they just all use cookies for tracking in which case the notice should be there).

Probably most websites use Google Analytics or an alternative.

> Probably most websites use Google Analytics or an alternative.

How is this not essential though? You can't effectively run a business without some understanding of your traffic and where it's coming from. Also, you can use Google Analytics in a way that doesn't store PII.

I could run the business just fine without Google Analytics. Would just be in the dark a bit more.

I'm not associated with EU so I haven't pondered on this as much as others. My first thought is that this should really be up to the browsers and their users on what info Analytics software is able to work out just from the user being on the page.

Users should just assume that every business will absorb all available information. At least then we wouldn't see those ridiculous cookie notices everywhere.

As a web developer, I'm kinda surprised 3rd party cookies ever became a thing in the first place.

Users should just assume that every business will absorb all available information.

Users don't know what "available information" is. And frankly, not even the browser developers do - we keep discovering new ways to track people (e.g. using ETags) with features that weren't intended for that. So it's quite hard to claim the user can simply decide what to share.

That’s one of the most frustrating aspects of GDPR in relation to cookies - many businesses that could happily run a site with no cookie opt-in end up implementing one anyway because that irritating pop-up gives the end user a perception of ‘handling privacy well’.

I’d be so keen for the solution to lie in the browser UX- in the same way as we currently request location information - rather than the current mish-mash of badly implemented, often disingenuous site overlays that have become the modern equivalent of the ‘enter site’ splash screen...

If you're a business, you have tracking on your site. The cookie warning it's almost always warranted.

> That’s one of the most frustrating aspects of GDPR in relation to cookies - many businesses that could happily run a site with no cookie opt-in end up implementing one anyway because that irritating pop-up gives the end user a perception of ‘handling privacy well’.

Have you actually seen examples of that? sad...

Yea, maybe you should prioritize 'ironing' it out.

I’m certain they’ll accept help. So maybe go test, report bugs and issues and get involved if that’s a priority for you. Triage some of those weird bug reports. Write a guide on how to properly enable the feature, what it does and what to expect if it’s enabled. Explain what’s a bug and what’s just part of the expected - and sometimes annoying - behavior.

Or just donate if you can’t do any of those things.

Prioritize it over the probably 1,000s of other things they have to do, which we might not have any idea about? Just because one person was kind enough to try to help people with a short cautionary message, therefore bringing this specific issue to our attention?

This feature is not even part of the UI yet. It's in progress. I really don't understand why technical people would start recommending its use to others on blogs in its current state. All you create is lots of bug reports coming in to Mozilla, forcing them to put resources into responding to users who blindly followed the blog and now their Firefox is "not working" anymore.

>I really don't understand why technical people would start recommending its use to others on blogs in its current state.

Because when ordinary users ask "what can I do to protect my privacy?" you have two possible answers:

a) "Nothing, you're not smart enough to do this, you're screwed"

b) "These things"

B has a high learning curve, but telling people about it scares them off. If you care about your friends privacy and want to get them past that learning curve, it's better to let them stumble into issues and be there to answer questions.

But then the answer is not "These things" and let the FF devs deal with the fallout. The answer would be "This is what you can do and you'll see quite a few odd results. Ask _me_ when you have questions and I'll explain as good as I can.".

I have quite a few of these switches on. First party isolation for example breaks the paypal payment flow on some, but not all, shops. It also breaks quite a few pages that recognize it as an adblocker. I know what to do if that happens, but I would never just recommend enabling that switch.

Do you know why there are so many separate things bundled under a single flag? Would it take much effort to add sub-flags for entirely separate anti-fingerprinting features?

Reply on news.ycombinator.com