Re:Javascript exploit actively used against TorBrowser
by tlrobinson on Tuesday November 29, 2016 @07:43PM
(#13067527)
I mean fullscreen within the VM's desktop (no need for normal GNOME/KDE/whatever desktop), which itself may not be fullscreen on host OS. It would act like a native app. If you quit the browser it shuts down the VM.
Re:Javascript exploit actively used against TorBrowser
by zwindl on Tuesday November 29, 2016 @08:15PM
(#13067673)
Ah, You mean the VM only have one program which is Tor browser, and when Tor terminated the VM should terminated with it.
Re:Javascript exploit actively used against TorBrowser
by gruez on Tuesday November 29, 2016 @08:09PM
(#13067648)
>I mean fullscreen within the VM's desktop
so like... maximized?
Re:Javascript exploit actively used against TorBrowser
by 4ad on Wednesday November 30, 2016 @05:15AM
(#13069618)
How does this work?
I would expect a generic resolution like 1920x1080 to convey much less identifiable information that some random 1583x1176 that the user might resize tor browser window to.
Re:Javascript exploit actively used against TorBrowser
by easychewie on Wednesday November 30, 2016 @10:16AM
(#13071366)
The idea is to not change the window size at all from the default. If this advice is followed, you minimize the possible information leak. In your example, 1583x1176 tells us that your system is capable of rendering at least that size. Given the unusual numbers, we further suspect you're not maximized on a system capable of an 1176px tall browser (much fewer of those than 1920x1080). While not uniquely identifying, it's a piece of the puzzle.
Re:Javascript exploit actively used against TorBrowser
by 4ad on Wednesday November 30, 2016 @10:50AM
(#13071658)
A better idea would be to simply not leak any of this information at all, or if it must, return some generic 1080p regardless of the actual size. It's a terrible UX to restrict yourself to the default window size (and depending on the window manager, the default window size might not even be respected). Plus, it's so easy to accidentally change the browser window size.
Re:Javascript exploit actively used against TorBrowser
by micaksica on Tuesday November 29, 2016 @07:45PM
(#13067542)
The VM can go "full screen" and lock the height/width in X, then.
Re:Javascript exploit actively used against TorBrowser
by trome on Tuesday November 29, 2016 @09:45PM
(#13068041)
We could do stretching then when the user tries to enbiggen it, that way they don't get deanonymized!
Re:Javascript exploit actively used against TorBrowser
by micaksica on Tuesday November 29, 2016 @11:30PM
(#13068506)
It is basically impossible to fully anonymize a browser as long as JavaScript+plugins are running. EFF's Panopticlick [1] and browserleaks [2] are good at explaining some of these fingerprinting vectors.
Tor recommends not going full-screen, since window size can be used as one of several identifiers.