Slashdot Mirror
Firefox To Add Tor Browser Anti-Fingerprinting Technique Called Letterboxing (zdnet.com)
Mozilla is scheduled to add a new user anti-fingerprinting technique to Firefox with the release of version 67, scheduled for mid-May this year. "Called 'letterboxing,' this new technique adds 'gray spaces' to the sides of a web page when the user resizes the browser window, which are then gradually removed after the window resize operation has finished," reports ZDNet. From the report: Advertising networks often sniff certain browser features, such as the window size to create user profiles and track users as they resize their browser and move across new URLs and browser tabs. The general idea is that "letterboxing" will mask the window's real dimensions by keeping the window width and height at multiples of 200px and 100px during the resize operation -- generating the same window dimensions for all users -- and then adding a "gray space" at the top, bottom, left, or right of the current page.
The advertising code, which listens to window resize events, then reads the generic dimensions, sends the data to its server, and only after does Firefox remove the "gray spaces" using a smooth animation a few milliseconds later. In other words, letterboxing delays filling the newly-resized browser window with the actual page content long enough to trick the advertising code into reading incorrect window dimensions. The feature was first developed for the Tor Browser, and can be seen in action here. In order to enable the feature in Firefox, "users will first need to visit the about:config page, enter 'privacy.resistFingerprinting' in the search box, and toggle the browser's anti-fingerprinting features to 'true,'" reports ZDNet.
The advertising code, which listens to window resize events, then reads the generic dimensions, sends the data to its server, and only after does Firefox remove the "gray spaces" using a smooth animation a few milliseconds later. In other words, letterboxing delays filling the newly-resized browser window with the actual page content long enough to trick the advertising code into reading incorrect window dimensions. The feature was first developed for the Tor Browser, and can be seen in action here. In order to enable the feature in Firefox, "users will first need to visit the about:config page, enter 'privacy.resistFingerprinting' in the search box, and toggle the browser's anti-fingerprinting features to 'true,'" reports ZDNet.
A long way to go, but I like this direction.
Sure, but what happens when they deploy their missle-missle-anti-anti-anti-missle-anti-anti missles?
Except there are literally hundreds of additional data points which allow websites to uniquely identify you. The best you could do without too much hassle is to run the English version of Google Chrome under the latest release of Windows 10 without any extensions or additional fonts installed. But even that is not enough since you still expose your time zone, WebGL extensions and then there are evercookies, mouse tracking, canvas fingerprinting, etc. etc. etc.
It surely looks like the WWW was built with tracking in mind. Not intentionally of course.
Ad interference or blocking sometimes has the nice side effect of letting through the better ads, like the humorous ones or the higher quality longer running ads like those multi part ads some of the agencies make for long running campaigns
Isn't it trivial to write some java script to delay a bit before reading browser dimensions?
privacy.resistFingerprinting will set your useragent to Firefox 60 as i discovered when i visited the addons site in 65 and the page said i was running an incompatible version, a quick check of my useragent confirmed it was reporting 60, setting privacy.resistFingerprinting to the default false put the UA back to normal
Fingerprinting is useful for moderation and in the fightagainst trolls, cheaters etc. It is about identifying a computer, not about identifying a person. If they make moderation harder, then there will be less place to socialize on the web. Moreover, income from untargetted ads is only 1/3 - 1/10 of the income for targetted ads. The reduced income results in less service. People could easily pay to replace ad income, but microtransactions haven't taken off for 20 years. They cannot win either, at most they make the monopolies of the internet stronger. It seems the developer community around the web shoot itself in the foot.
people wonder why are todays computers, which are so powerful, so slow?
well, this is the answer, first you have code running trying to identify who you are, then you have code running that tries to trick the other code detection mechanism. many cpu cycles are lost.
cpu cycles are not the only wasted resource, mind you. there is also somebody coding all this stuff, which otherwise perhaps could have been implementing really cool things.
On a long enough timeline, the survival rate for everyone drops to zero.
Yah, and mass surveillance is useful to fight crime. Go live in China if you like that.
I think what we need is a proxy in front of the browser (it has to handle TLS) which just manipulates the outgoing requests and LIES to the website. Because we have been given all reasons to mistrust most of them.
Saddly it seems that whitelisting Javascript (e.g.: the Firefox NoScript extension) and keeping it to the bare strict minimum required to successfully display a web page is the only practical way to avoid/diminish the online tracking.
Luckily, it seems that nearly all the web rely on 3rd party libraries to do the tracking and thus blocking 3rd party libraries and only allowing select few helps increasing the protection against tracking.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Boo hoo. Stop bitching and work around it. If you're even half-decent you'll find a way, but most video game developers are lazy bastards like yourself who couldn't code a Hello World without a dozen proprietary clutches and middleware packages. You think we give a shit about your game? This is our privacy at stake, here. Find another way to identify me, asshole.
Maybe this is a stupid question, but wouldn't a better solution simply be to deny "advertising code" from being able to access the window size? Why does any website need to be told what your window size is anyway, or for that matter, why does it need to be told anything at all about you?
See, the problem is we seem to have reached the point of stupid where we let any random web page run scripts, as well as pulling in from any number of external assholes and parasites.
So, I treat ad networks for what they are .. useless sacks of shit who add no value to my life, consume my resources, and wish to harvest my personal information against my wishes. And my solution to that is to block the fuck out of these pieces of shit.
We need to get away from this busted security model in which any site can run scripts, can link to a dozen external sites who then claim you've agreed to their privacy policy and consented to scripts. Browsers have devolved to pretty much completely promiscuous so they'll run scripts from anybody anywhere, and that is eroding out security and our privacy.
Sorry, you don't get to fingerprint my browser, because your site isn't allowed to run scripts, and every site I visit that pulls in 3rd party parasites I block the parasites -- which makes them blocked everywhere.
If you work for an internet ad agency, you really deserve every user of the internet to stand in line and punch you in the throat ... because you're an asshole, and you deserve it.
As long as we keep up this fiction that we should be allowing every web site and whoever they partner with to run scripts on our browsers, we'll have this shit. We need to start reining in how much we allow sites to run scripts, and absolutely blocking the 3rd parties who add no value to the user ... and don't tell me ads and analytics offers value to me.
Sorry, but if you work for an analytics company, or an internet ad company, you really are a sack of shit who deserves the feel the wrath of everyone who is tired of being spied on ... and as such, you and your family have forfeited any right to privacy, as you have decided that we don't have any.
The way I read the summary was that the browser would maintain a "virtual window" inside of the real window. The real window could have any size; it is the size of the virtual window which would be quantised to 100px steps, and the gap between the real window and the virtual window would be the "letterbox".
DontBeAMoran ( 4843879 ) wrote:
So congratulations, idiots. You just gave advertisers a way to target Firefox users even if they use a fake user agent string.
Targeting "Firefox users" isn't as valuable as targeting "D. B. A. Moran" who lives on 484 38th Street, apartment 79.
But the point of this virtual window is that it is the value returned to the scripts, which is going to make it easier to target Firefox users.
#DeleteFacebook
What uses are these?
Your ad here. Ask me how!
It's used to align things when CSS fails to have a proper solution. It's used for interfaces, games, etc. It can be used to determine what resolution of image to dynamically fetch for your device. No point in downloading a 4K photo for a laptop that's not even full HD.
#DeleteFacebook
IDing a computer that looks at X, and IDing that same computer as signed into FB as Joe Schmo (at the same time?) is a clear way to link Joe Schmo to X.
It doesn't work so well when Joe Schmo logs into Facebook from the same public library computer from which other patrons log into Facebook.
You think people using Opera, a now-owned-by-China browser, are smarter?
You think people who use Internet Explorer, which has been abandoned by Microsoft itself over a year ago, are smarter than people who use Edge?
You're a dumbass.
You're a dumbass.
Says the Chrome user.....
My eyes reflect the stars and a smile lights up my face.
It's used to align things when CSS fails to have a proper solution. It's used for interfaces, games, etc. It can be used to determine what resolution of image to dynamically fetch for your device. No point in downloading a 4K photo for a laptop that's not even full HD.
You should be programming for the RELATIVE CONTENT POSITIONING and allow auxiliary scripts to dynamically fetch the right-sized create assets... Unless you're talking about scroll-over advertisements that are supposed to take over the entire screen, then yeah sure I can see why you're upset.
The year 2001 called, it wants its fixed content positioning CSS definitions back...
Relative positioning usually works, but sometimes you need to calculate something and position things manually.
Also... "allow auxiliary scripts to dynamically fetch the right-sized create assets...", how do you do that if not via javascript and reading the screen size?
#DeleteFacebook