Firefox to add Tor Browser anti-fingerprinting technique called letterboxing

Re:Firefox to add Tor Browser anti-fingerprinting technique ... by gpvos on Thursday March 07, 2019 @05:40AM (#19327020)

Would something like Perl's taint functionality work? I.e., all values derived from size, position, colour, pixel data, user agent, etc. are marked as tainted, and are stripped (or randomized or replaced with default values) from data that is sent over XMLHttpRequest and other communication methods. It's probably extremely hard to make that watertight though.

[ Parent | on HN ]

Re:Firefox to add Tor Browser anti-fingerprinting technique ... by Liquid_Fire on Thursday March 07, 2019 @08:35AM (#19327863)

Even if it was implemented perfectly, you could work around that using timing side channels.

For example, multiply the value (e.g. window width) by some huge number, perform a slow operation in a loop that many times, and finally clear a flag. Meanwhile another thread is filling an array one by one until the flag gets cleared. The last non-tainted index in the array indicates your approximate window width.

[ Parent | on HN ]

Re:Firefox to add Tor Browser anti-fingerprinting technique ... by thecatspaw on Thursday March 07, 2019 @06:14AM (#19327164)

That would make it difficult to serve different sized images to different sized screens

[ Parent | on HN ]