News for hackers. Stuff that matters.

A comment on Reverse Engineering TikTok's VM Obfuscation (Part 1). Parent comment

Re:Reverse Engineering TikTok's VM Obfuscation (Part 1) by cmeacham98 on Saturday December 24, 2022 @06:40AM (#34115977)
They're not that big of a deal, but my two biggest annoyances with RFP:

1. prefers-color-scheme is completely broken, even in the dev tools. Mozilla refuses to fix this in any way, it is allegedly "by design" that you have to disable all RFP protection if you're a web dev and need to test the dark color scheme of your website.

2. Similarly, RFP always vends your timezone as UTC with no way to change.

[ Parent | on HN ]
Re:Reverse Engineering TikTok's VM Obfuscation (Part 1) by arein3 on Saturday December 24, 2022 @06:57AM (#34116051)
They could add switches for individual features to mask on a hidden/advanced menu
[ Parent | on HN ]
Re:Reverse Engineering TikTok's VM Obfuscation (Part 1) by nightpool on Saturday December 24, 2022 @09:25AM (#34117037)
that's a great way to get even more fingerprinting potential, each additional switch is another bit of identification on top of the actual fingerprint itself.
[ Parent | on HN ]
Re:Reverse Engineering TikTok's VM Obfuscation (Part 1) by cmeacham98 on Saturday December 24, 2022 @09:38AM (#34117154)
Mozilla refuses to add _any_ toggle to disable RFP's control over features it touches, including even an about:config entry.

See example bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1535189

My "fix" for this involves using a janky old version of an addon that attempts to muck with the CSS/JS to reproduce the effect.

[ Parent | on HN ]
Re:Reverse Engineering TikTok's VM Obfuscation (Part 1) by asalahli on Thursday December 29, 2022 @06:20AM (#34171555)
Does adding your website to privacy.resistFingerprinting.exemptedDomains not work?
[ Parent | on HN ]