Slashdot Mirror
Firefox To Add Tor Browser Anti-Fingerprinting Technique Called Letterboxing (zdnet.com)
Mozilla is scheduled to add a new user anti-fingerprinting technique to Firefox with the release of version 67, scheduled for mid-May this year. "Called 'letterboxing,' this new technique adds 'gray spaces' to the sides of a web page when the user resizes the browser window, which are then gradually removed after the window resize operation has finished," reports ZDNet. From the report: Advertising networks often sniff certain browser features, such as the window size to create user profiles and track users as they resize their browser and move across new URLs and browser tabs. The general idea is that "letterboxing" will mask the window's real dimensions by keeping the window width and height at multiples of 200px and 100px during the resize operation -- generating the same window dimensions for all users -- and then adding a "gray space" at the top, bottom, left, or right of the current page.
The advertising code, which listens to window resize events, then reads the generic dimensions, sends the data to its server, and only after does Firefox remove the "gray spaces" using a smooth animation a few milliseconds later. In other words, letterboxing delays filling the newly-resized browser window with the actual page content long enough to trick the advertising code into reading incorrect window dimensions. The feature was first developed for the Tor Browser, and can be seen in action here. In order to enable the feature in Firefox, "users will first need to visit the about:config page, enter 'privacy.resistFingerprinting' in the search box, and toggle the browser's anti-fingerprinting features to 'true,'" reports ZDNet.
The advertising code, which listens to window resize events, then reads the generic dimensions, sends the data to its server, and only after does Firefox remove the "gray spaces" using a smooth animation a few milliseconds later. In other words, letterboxing delays filling the newly-resized browser window with the actual page content long enough to trick the advertising code into reading incorrect window dimensions. The feature was first developed for the Tor Browser, and can be seen in action here. In order to enable the feature in Firefox, "users will first need to visit the about:config page, enter 'privacy.resistFingerprinting' in the search box, and toggle the browser's anti-fingerprinting features to 'true,'" reports ZDNet.
A long way to go, but I like this direction.
they watch/listen our way around, never saying excuse me or thank you.. phewww
I hate it
Sure, but what happens when they deploy their missle-missle-anti-anti-anti-missle-anti-anti missles?
The lazy bastards only seem to add configuration page or about:config entries for settings that they are going to use, as opposed to the ones that users may wish to use. I'm in the process of creating a build machine for Firefox so I can start to add buttons for settings that I'd like to see exposed in the configuration settings.
For example, the new 'you must have search enabled' setting that requires having a search bar or forcing the address bar to double as a search bar. Second: the dropdown that covers the top 1/2" of the page when you start typing a URL, which if you're lucky, isn't being displayed in the top 1/2" of the page. Third: I'm going to re-attach the tabs to the pages and put the adress bar back on top where it belongs.
Except there are literally hundreds of additional data points which allow websites to uniquely identify you. The best you could do without too much hassle is to run the English version of Google Chrome under the latest release of Windows 10 without any extensions or additional fonts installed. But even that is not enough since you still expose your time zone, WebGL extensions and then there are evercookies, mouse tracking, canvas fingerprinting, etc. etc. etc.
It surely looks like the WWW was built with tracking in mind. Not intentionally of course.
Isn't it trivial to write some java script to delay a bit before reading browser dimensions?
privacy.resistFingerprinting will set your useragent to Firefox 60 as i discovered when i visited the addons site in 65 and the page said i was running an incompatible version, a quick check of my useragent confirmed it was reporting 60, setting privacy.resistFingerprinting to the default false put the UA back to normal
Fingerprinting is useful for moderation and in the fightagainst trolls, cheaters etc. It is about identifying a computer, not about identifying a person. If they make moderation harder, then there will be less place to socialize on the web. Moreover, income from untargetted ads is only 1/3 - 1/10 of the income for targetted ads. The reduced income results in less service. People could easily pay to replace ad income, but microtransactions haven't taken off for 20 years. They cannot win either, at most they make the monopolies of the internet stronger. It seems the developer community around the web shoot itself in the foot.
it takes the browser an extra 10-15+ seconds to search for my profile then encourage me to have one so the page phucking ADs i see will be relevant.. phewww.. cease fire stand down.. people only buy what they want..
people wonder why are todays computers, which are so powerful, so slow?
well, this is the answer, first you have code running trying to identify who you are, then you have code running that tries to trick the other code detection mechanism. many cpu cycles are lost.
cpu cycles are not the only wasted resource, mind you. there is also somebody coding all this stuff, which otherwise perhaps could have been implementing really cool things.
On a long enough timeline, the survival rate for everyone drops to zero.
I'm using nightly 67 and if you enable this, your browser won't launch in full screen mode anymore. It will start
much smaller and you will have to manually resize your window. It's kind of annoying.
Yah, and mass surveillance is useful to fight crime. Go live in China if you like that.
I think what we need is a proxy in front of the browser (it has to handle TLS) which just manipulates the outgoing requests and LIES to the website. Because we have been given all reasons to mistrust most of them.
Saddly it seems that whitelisting Javascript (e.g.: the Firefox NoScript extension) and keeping it to the bare strict minimum required to successfully display a web page is the only practical way to avoid/diminish the online tracking.
Luckily, it seems that nearly all the web rely on 3rd party libraries to do the tracking and thus blocking 3rd party libraries and only allowing select few helps increasing the protection against tracking.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
If someone forks Privoxy to accept community blacklists such as EasyList, I'll use it on everything. I love Privoxy but I fucking hate training the bastard all the time.
My thoughts exactly. I think you got the litany of complaints backwards though. You left the biggest complaint at the bottom of the list, which might work out in your fantasy world but in the real world you should put it at the top of your list. You see the litany does not get more interesting as you peruse it. It gets less and less interesting. But hey please keep filling up the slashdot server with text that will literally never be read by anyone.
Boo hoo. Stop bitching and work around it. If you're even half-decent you'll find a way, but most video game developers are lazy bastards like yourself who couldn't code a Hello World without a dozen proprietary clutches and middleware packages. You think we give a shit about your game? This is our privacy at stake, here. Find another way to identify me, asshole.
this, spamming, robocalling and all that sort of mess, if people would actually stop giving them money/buying their stuff, they'd stop doing it
Maybe this is a stupid question, but wouldn't a better solution simply be to deny "advertising code" from being able to access the window size? Why does any website need to be told what your window size is anyway, or for that matter, why does it need to be told anything at all about you?
See, the problem is we seem to have reached the point of stupid where we let any random web page run scripts, as well as pulling in from any number of external assholes and parasites.
So, I treat ad networks for what they are .. useless sacks of shit who add no value to my life, consume my resources, and wish to harvest my personal information against my wishes. And my solution to that is to block the fuck out of these pieces of shit.
We need to get away from this busted security model in which any site can run scripts, can link to a dozen external sites who then claim you've agreed to their privacy policy and consented to scripts. Browsers have devolved to pretty much completely promiscuous so they'll run scripts from anybody anywhere, and that is eroding out security and our privacy.
Sorry, you don't get to fingerprint my browser, because your site isn't allowed to run scripts, and every site I visit that pulls in 3rd party parasites I block the parasites -- which makes them blocked everywhere.
If you work for an internet ad agency, you really deserve every user of the internet to stand in line and punch you in the throat ... because you're an asshole, and you deserve it.
As long as we keep up this fiction that we should be allowing every web site and whoever they partner with to run scripts on our browsers, we'll have this shit. We need to start reining in how much we allow sites to run scripts, and absolutely blocking the 3rd parties who add no value to the user ... and don't tell me ads and analytics offers value to me.
Sorry, but if you work for an analytics company, or an internet ad company, you really are a sack of shit who deserves the feel the wrath of everyone who is tired of being spied on ... and as such, you and your family have forfeited any right to privacy, as you have decided that we don't have any.
Okay, who here has a monitor with a display resolution that is a perfect multiple of 100 in both X and Y? Not most people, that's who.
Does everyone who works on Firefox have an old 800x600 CRT or a laptop with a 1600x900 display or something? Because in the real world, there's a lot of resolutions and most of them are not divisible by 100.
The most popular one, which is "full HD" (1920x1080) is certainly not divisible by 100 in either X or Y.
So congratulations, idiots. You just gave advertisers a way to target Firefox users even if they use a fake user agent string.
We won't even talk about the problems this is going to create for web programmers who need to rely on knowing the exact size of the display for real-world purposes.
TL;DR, this is one more reason to NOT bother supporting Firefox anymore.
#DeleteFacebook
IDing a computer that looks at X, and IDing that same computer as signed into FB as Joe Schmo (at the same time?) is a clear way to link Joe Schmo to X.
It doesn't work so well when Joe Schmo logs into Facebook from the same public library computer from which other patrons log into Facebook.
What part of "long way to go" was unclear to you? User agent string is useful for formatting, you can spoof it, same with all that canvas info. TIME ZONE you put in the same category, lol? DNT we know has issues for all browsers.
How is any of that a "firefox" specific problem?
> Scramble whatever they read. Be it an ad cookie, screen size or other fingerprinting stuff. The data will be useless.
I'd love to have an extension which recognizes common cookie patterns (e.g. 128 bits, base64 encoded) and replaces them with random numbers in that same format.
(It wouldn't work for long, though; adding a checksum allows bogus values to be ignored, and if it's a MAC, the client can't generate a valid one. So it would work the same as deleting it.)
If it's possible for him to work around it, it will be possible for mal-ad-tracking-devs too.
and when the night came
the forest folded its branches
around me
something passed by
and I went into a dream
Are you trying to kiss their ass or something? I don't understand the argument you're trying to make. Let me make my stance perfectly clear:
I do not consent to even ONE FUCKING CPU CYCLE being used for any of this nonsense. It's MY cpu, it's MY electricity. Not one data bit, not one cpu cycle. These websites can fuck right off!
If you're still running Firefox at this point, you're already standing out. If its market share is still over 0.5% I'd be surprised.
And they did it all to themselves with this quantum faggotry and the sad attempt to be a chrome clone that's been going on since FF 27. FUCK EM they ruined a good browser