Hacker News Reader

Comment by floatboth | Hacker News Reader

Just enable privacy.resistFingerprinting in about:config, no addons needed

privacy.resistFingerprinting is even better since it covers more than just canvas fingerprinting, but anyone who uses it should be aware of all of the side effects.

https://wiki.mozilla.org/Security/Fingerprinting

For example, new Firefox windows will no longer open maximized, and users who prefer maximized browser windows would need to maximize them manually.

That shouldn't be necessary if the browser didn't report accurate window sizing information

Exposing the window size is needed for many festures. CSS media queries change what's displayed based on the screen size, and pure css can cause effects that can be independently measured (set a css property and the read it with JS and log the result, or have the css load a background image with tracking data embedded in ths url). Webapps that manually position elements using JavaScript use the API as well.

It's also he extremely hard to prevent any way of getting at it. For example, I could measure if a line of text overflows and by how much.

CSS media queries don't get handled by anything that has the capability to send that information back, so window size reporting isn't needed for that.

The only place that needs it, are those JS apps that manually position items.

Measuring text overflow is only possible by the APIs exposed by the CSSOM set [0], which also happens to include the window sizing elements. If we only allowed a subset of that group, all those problems might evaporate or become extremely difficult to successfully use.

[0] https://www.quirksmode.org/dom/w3c_cssom.html

CSS media queries themselves don't have the capability to send any tracking information back, but the effects they cause absolutely do. Consider:

  @media (min-width: 600px) { .pixel { background-image: url("/pixel?width=600"); } }
  @media (min-width: 700px) { .pixel { background-image: url("/pixel?width=700"); } }

You could add as many of these media queries as you like to increase the resolution of your tracking. Combine this with the min-height media query and you can get the absolute size of the view port.

That's still more finite than what JS can report, and can be easily broken by browser prefetching. (And could have performance implications that could drive users away.)

Whilst it's better-than-nothing fingerprinting, it is still far less effective than JS having access to the window and height properties directly.

False: it is possible with just CSS [1][2] to track screen resolution, browser engine, fonts, mouse movements and inputs.

[1] https://github.com/jbtronics/CrookedStyleSheets

[2] https://github.com/maxchehab/CSS-Keylogging

Both those methods rely on the browser not prefetching certain resources, which they are absolutely allowed to prefetch.

So if a browser changes the prefetching algo, the method is immediately broken. (For example enabling network.predictor.enable-prefetch in Firefox).

It isn't an inherent weakness of CSS itself.

The only side effect I really notice in everyday browsing with privacy.resistFingerprinting enabled is time. It spoofs the system time zone as UTC which makes it a bit confusing looking at things like sports and TV schedules.

I'm using a 1920x1080 monitor with default panel sizes. So are tens of millions of other people. I totally understand fingerprint resistance, but the maximization restriction is silly in a lot of cases and should be controllable separately.

Unfortunately this sets the timezone to UTC which breaks calendar alerts and all timestamps.

But it disables per-site zoom which is inconvenient.

Reply on news.ycombinator.com