Hacker News Reader

Comment by tyingq | Hacker News Reader

RFC2109, from 1997, had this:

8.3 Unexpected Cookie Sharing

A user agent should make every attempt to prevent the sharing of session information between hosts that are in different domains. Embedded or inlined objects may cause particularly severe privacy problems if they can be used to share cookies between disparate hosts. For example, a malicious server could embed cookie information for host a.com in a URI for a CGI on host b.com. User agent implementors are strongly encouraged to prevent this sort of exchange whenever possible.

View on HN

It's really weird that they claim there privacy work started in 2015. Netscape Navigator add cross site cookie blocking at some point, and firefox has always (?) had it.

The innovation here seems to be that they further partition by the URL in the address bar.

It's frustrating that browsers have been fighting and losing this war for 25 years. (Presumably they still don't block browser fingerprinting, so sites will just move to that instead...)

It's not possible to block browser fingerprinting since it's a range of techniques and heuristics based on numerous features. There's no "turn off fingerprinting" button you can just press.

Whonix says hello. https://www.whonix.org/

I was planning to use it exclusively when I was working on a system to fight cartels, so I got pretty deep into these kinds of questions. Whonix has its own problems but it's the best solution available.

The communities are interesting too. One fellow was trying to download map data, which confused me initially. Why was he so fixated on maps? It's because if you're in the middle of a warzone, there's obviously no cell service, and it might be a few weeks before you reach an area with wifi. Remarkably prescient given that this was 2013 or so.

But you're right in general that there's no way to do it that isn't a pain in the ass for most people. "I can't resize my browser window? Really?"

I'm sure that the techniques used in Whonix can reduce the number of valuable features used in fingerprinting but you can't "solve" fingerprinting without every single user switching over to something like this.

It is possible to enable obstacles to fingerprinting.

In Firefox, it is configuration entry

  privacy.resistFingerprinting

Some details (the list is not exhaustive):

> * Your timezone is reported to be UTC; * Not all fonts installed on your computer are available to webpages; * The browser window prefers to be set to a specific size; * Your browser reports a specific, common version number and operating system; * Your keyboard layout and language is disguised; * Your webcam and microphone capabilities are disguised; * The Media Statistics Web API reports misleading information; * Any Site-Specific Zoom settings are not applied; * The WebSpeech, Gamepad, Sensors, and Performance Web APIs are disabled, etc.

I’ve got this enabled - the only one that’s been more than a mild pain in the ass is the UTC timezone change. Always takes a minute to remember why a site is telling me my appointment is at 2:30 in the morning.

Is there a way to reset the timezone but have all the other protections? Timezone provides pretty low information relative to the pain it causes me when I show up to my meeting 5 hours later.

I have tried and tried to override this on a site-by-site basis

I tried setting:

privacy.resistFingerprinting.exemptedDomains to the domain

privacy.resistFingerprinting.testGranularityMask -> 4

I still get utc in slack

Just move to London

UK has daylight savings time. Better move to Iceland instead. They're always on UTC.

It's certainly possible to curtail fingerprinting.

Why is my browser reporting my resolution to the server? Why can't you just serve me HTML and let me render it how I damn well please?

Sounds like a really unique, fingerprintable way to browse.

> Why is my browser reporting my resolution to the server

The browser doesn’t need to report anything by default. You can get a reasonable estimate with CSS + JavaScript (e.g. using media queries to modify some observable properties on the basis of the screen width and then report what those properties are via a call to fetch)

It's not binary but it's unfair to say "it can't be done" it absolute can be made significantly better.

The strongest fingerprinting techniques use a lot of computing (e.g. font, canvas analysis) so they are expensive to use - no one wants to slow down their visitors by several seconds. The weaker fingerprint techniques can be easily patched and mocked it's just that it's a constant effort to keep up with them.

All it would take is 1 major browser to enable it by default to distrubt whole fingerprinting ecosystem to the point where it would be too expensive to effectively fingerprint people.

Internet explorer used to ask the user before saving cookies.

And the server had to declare what cookies would be used for in machine readable form (P3P) which the browser used to decide if it want to allow the cookie (google blatantly lied)

And more recently DNT.

A graveyard of failed attempts at improving privacy

FIrefox used to ask, then it would ask if you set the right preference, and then it stopped asking entirely. I was very disappointed in them.

Why was it disappointing in them? Don't they need to compete with Chrome and Safari's UX, that just allow those cookies?

That's no reason to remove the preference that allowed people to re-enable the dialog box.

Reply on news.ycombinator.com