Hacker News Reader

Comment by _jomo | Hacker News Reader

Containers are a feature built into Firefox. There are extensions that let you use them more generally with any given website. It's also quite useful to log into websites with multiple accounts at the same time.

However, to prevent tracking I mostly use CookieAutoDelete [0] which only stores Cookies for sites that I have whitelisted after the tab is closed. It's really just a handful of sites I visit frequently and don't want to log in every time. Cookies aren't required for anything else.

Also, not having a Google account comes in handy to prevent tracking by Google. My default search engine is DuckDuckGo.

0: https://addons.mozilla.org/de/firefox/addon/cookie-autodelet...

View on HN

>to prevent tracking I mostly use CookieAutoDelete

Removing cookies will not prevent anyone from tracking.

Simple example: I once visited an online shop from browser profile in which I never logged into Facebook. Few hours later I switched to another browser profile, used exclusively for Facebook, and I got an ad on my timeline from said online shop, for the exact product I was looking for earlier in another browser profile. Facebook associated my two browsing personas without cookies, most likely using a combination of my browser's request headers and IP address. Not to mention that JavaScript (if enabled) provides additional and extremely detailed fingerprinting capabilities.

In my experience, Google seems to have a better track record in terms of respecting cookies (or lack thereof) as the main carrier of online privacy management. But I think it's just an illusion. They're just obscuring it to not freak people out too much the way like Facebook does. The information is still there. They have it, from analytics, fonts, reCaptcha and all other means of their creep.

To prevent tracking, you need to have a full control over information you send to the internet, including browser request headers, IP address, behavior patterns of web browser, and so on. Cookie management alone is just a fallacy and gives a false feeling of control over privacy.

This is also why I consider those "privacy containers" broken by design. They just operate on cookies and don't contain anything besides cookies. I would even consider them harmful because of their misleading nature.

> This is also why I consider those "privacy containers" broken by design. They just operate on cookies and don't contain anything besides cookies. I would even consider them harmful because of their misleading nature.

Privacy containers could do more interesting things like:

- Connect through a VPN/proxy, so IP address changes all the time.

- Change browser characteristics (screen size, available fonts, user agent string, etc) to fool the fingerprint. I suppose that fingerprints are hashes, so you only have to corrupt one ingredient of the hash to make the fingerprint unusable.

Tor browsers do stuff like this.

Fingerprints are not necessarily hashes, they can also be done as a collection of datapoints that combine into a probability. Here is a POC of this type of technique:

https://github.com/gulkily/browserfp

The EFF has a working one that tells you the uniqueness of your browser and how it got that score: https://panopticlick.eff.org/

"Change browser characteristics ... to fool the fingerprint."

What about hardcoding the fingerprint? So that every end user looks the same.

This doesn't deserve to be downvoted. The quickest way to combat fingerprinting is to hide in the crowd, which has value without requiring buy-in from other users; randomization as fingerprint deterrence only works once you have a critical mass of people using it.

Or if you actually randomise it, meaning "different output every time it's accessed", not "randomly set once, now it's hardcoded until you close the browser".

This is what Tor does, I believe. The problem with spoofing the fingerprint is that all the features that allow you to be fingerprinted are features that are in use by some site or another, so it would break compatibility.

Ya. I suppose you're right.

So long as the client runtime can inspect the host, inferring the fingerprint, and call back to the mothership, there's no foolproof, durable way to defeat fingerprinting.

At best, fudging the fingerprint just buys some time in the arms race.

The problem is that a 'browser fingerprint' is not some function call that can have its result be spoofed. There isn't even a single specification for what constitutes a browser 'fingerprint'

It is simply a series of attributes that are tested and compiled. Attributes that are consistent for a single browser but have some degree of variation between different computers.

Put enough of those together and you can uniquely identify someone. The exact things that are checked, however, will vary between implementations, and can always be changed in the future, so there isn't an easy way to spoof all of them to be identical.

In addition, many of these attributes that are tested need to return accurate results for normal functionality to work, so you are again limited in what you can fudge to avoid fingerprinting.

Much of the detail is irrelevant, though. There are things like languages I never use, and sofware version point-revision.

That's not a problem. Make those things normally untestable, and sites will by definition work normally without accurate information about those attributes.

A bit more than just cookies, though the other stuff is not quite as relevant. https://wiki.mozilla.org/Security/Contextual_Identity_Projec...

X is not perfect so it must be broken by design. Better not use it, instead follow these impossible steps!

It advertises itself as "prevent Google from tracking you around the web", which I consider a false and misleading statement. It doesn't prevent it. It is not "not perfect", it is not even far from perfect.

I think it is very important to make Internet users aware that cookies are the red herring in all privacy issues that are plaguing the World Wide Web. Cookie feature in modern browsers is just a tiny puzzle piece in a larger picture, consisting of wide range of entry points used for collecting data. It includes invasive JavaScript fingerprinting that can easily extract a list of installed fonts, local IP address and list of media devices from WebRTC, device capabilities, WebGL/Canvas fingerprinting, content filter list detection and much much more. Even with JS disabled most browsers share so much explicit information that is enough for precise identification without the use of cookies.

Is it impossible? For 99.99% of Internet users it requires so much hoops to hop through it might as well be impossible. However, I believe that awareness could slow down this privacy decline. I hope users will finally start demanding more native privacy controls in their browsers. Native JavaScript filter in Firefox would be a good place to start.

They aren’t impossible steps, just get virtualbox for sites you don’t want tracking you. Unless they can break out of the VM they can’t fingerprint the hardware even if JavaScript is enabled

IP address, screen size, etc. will still be the same in the VM no?

Not to mention the attributes of the VM itself will then be used for tracking.

How exactly would you use the attributes of a VM for tracking? You can have a separate one for fb and for google. All they are going to be able to track is what you want them to know

Not exactly impossible, the Tor browser for example implements many if not all of these.

Do you have much experience using the tor browser? I think it’s a good example of why it’s impossible.

Yes indeed, I've generally found it quite good - what's the issue? You don't like dealing with NoScript or something?

I have that even on my regular browser...

ReCaptchas, the inability to post to many sites because tor ip addresses have been blacklisted, latency, etc. It’s better than nothing but like many solutions it doesn’t really seem to address the underlying problem.

Those have absolutely nothing to do with the Tor browser though nor any of the solutions mentioned, that's simply IP blacklisting.

The underlying problem of privacy is addressed. The consequence of anonymity is a lack of trust.

AFAIK FB will do semi-targetted advertising based on IP alone if there's a very small number of users logged in from that IP.

On mobile your IP will change every few hours.

Anyway the very idea that people are making money from me keeps me up at night so I use FF with a bunch of privacy aiding extensions. The war to fingerprint users is endless though. Ad tech is a billion dollar industry.

That happened behind my ISP's NAT in a densely populated area, so I don't think so, no.

I'd be surprised if it was the only thing they used, to be fair. But there is fairly obviously some IP-specificity going on.

So you need to control your IP address but your example shows it doesn't matter?

You could use separate profiles on Firefox (which I do, I have half a dozen) and in each profile set up different browser headers. Everything coming from the same IP address would still be an issue, but I doubt that trackers rely on that alone as it's too coarse. Families will easily have 6 - 12 devices for several different people in the home all NATed through the same ISP IP address. You could use proxies if you're really worried about it.

My project does that.[1] Since each profile has its own profile.js and extensions. One application is that I hate triggering financial portals to re-authenticate. So all of my finance happens from my home IP, no matter where I am. And instead of a heavy VPN, it is just an ssh tunnel. When I was in university, my school browser profile always routed through my school proxy. If I start using facebook again, I will use Facebook's TOR public gateway, but only for the Facebook profile.

[1]: https://github.com/unqueued/foxbox

Device fingerprinting (and cache attacks) could still connect the different profiles unless you change more parameters than just headers. Or disable javascript for some or all the profiles.

Like I mentioned in parent comment, my project has had a lot of success with that. I know I was able to fool the Evercookie[1]. I can even have different profiles have different browser engines if I want. They each use individual prefs.js files.

[1]: https://samy.pl/evercookie/

I think you are right that fingerprinting is much better at tracking than just cookies. And that it has become trivial to do.

I think that your comment makes it seem trivial to control fingerprinting by controlling the information you send over the internet. While I suppose it is true that you can prevent fingerprinting by not allowing data transmission, this will also make the intenet and especially the www unusable.

Masking your IP address would require access to multiple IP pools, which is cost prohibitive. Alternatively, you could use some centralized proxy, which just changes who controls the information about you, but perhaps in even a more scary way.

Obscuring your screen size breaks responsive web design. Obscuring your browser still breaks a lot of everything even in 2018. Chrome vs Firefox vs Edge vs Safari still don't have the same web api. Disabling Javascript breaks most websites. Disabling XHR/fetch also breaks a great deal.

Once again, privacy and convenience conflict.

I've been using a separate profile for FB for several years. I've never seen this happen. I wonder what I have to do to make it happen

I mostly use the phone for browsing the internet and I couldn't find the container feature on FF for Android so what I did was refused to store cookies on FF & began using Chrome for logins

That way, my identity is disassociates, hopefully. All logins are on chrome which are used minimally and all browsing is on FF with no track on, cookies blocked etc

I'll just leave this here ... https://github.com/snapper26/shapeshifter

> Also, not having a Google account comes in handy to prevent tracking by Google. My default search engine is DuckDuckGo.

They still can track and target ads at you without an account. An account is not required for that.

Indeed. Your unique fingerprint is your account. Even with Facebook. Being logged in just syncs your fingerprint better, possibly your multiple fingerprints.

I also find CookieAutoDelete invaluable, particularly in combination with "I don't care about cookies" extension which removes almost all of the cookie warning dialogs which you would get otherwise. Web is usable again :)

I just block them for everything except for first party sites using uMatrix.

For some sites I need to allow google.com cookies otherwise I will keep getting recaptcha checks.

Exact same setup here. Works great.

I have the same setup as you

Reply on news.ycombinator.com