News for hackers. Stuff that matters.

A comment on Open research, stronger privacy: Making Firefox users harder to fingerprint.

Re:Open research, stronger privacy: Making Firefox users har... by MayeulC on Wednesday November 11, 2026 @12:16PM (#50455859)
I feel like I am commenting this under every post mentioning fingerprinting, but is there a technical reason access to fingerprinting information (screen resolution, battery level, etc) couldn't be made to "taint" the data/code, where the browser would then refuse to send off that data? Or anonymise it and replay the code before sending the request.

Of course, there are legitimate use-cases: downloading specific assets based on client device, etc. And that's a whole can of worms of side channels to open, but that would feel like a useful additional layer of defense, and the paranoia level could be configured. The price might be subtle bugs, and/or a permission dialog that most people will ignore.

I am asking this as, from what I've seen, most websites do not need complex interactions: the battery level will be used to render a battery indicator, etc. XHRs do not usually depend on such data.

[ Parent | on HN ]
Re:Open research, stronger privacy: Making Firefox users har... by skaul on Wednesday November 11, 2026 @12:56PM (#50456346)
If by "tainting" the data you mean subtly changing it in a way that preserves functionality while making it harder to use for fingerprinting, then this is what we do at Brave browser for many of our anti-fingerprinting protections: https://brave.com/glossary/fingerprinting/#how-can-i-prevent...
[ Parent | on HN ]
Re:Open research, stronger privacy: Making Firefox users har... by nneonneo on Wednesday November 11, 2026 @01:33PM (#50456806)
[delayed]
[ Parent | on HN ]
Re:Open research, stronger privacy: Making Firefox users har... by MayeulC on Wednesday November 11, 2026 @03:04PM (#50457920)
[delayed]
[ Parent | on HN ]
Re:Open research, stronger privacy: Making Firefox users har... by Sayrus on Wednesday November 11, 2026 @04:08PM (#50458685)
Side-channels on such a model would be very hard to enforce: if any element of the page "moves around other elements", all other elements must be tainted as they'd leak information on the tainted DOM node. Presence or absence of a DOM node can leak information about a tainted context.

The second idea is vulnerable as well. As long as you can exfiltrate tainted data to untainted context, the protection will be quite weak.

[ Parent | on HN ]
Re:Open research, stronger privacy: Making Firefox users har... by mitxela on Wednesday November 11, 2026 @03:24PM (#50458168)
It's very difficult to prevent JavaScript from using your screen size to affect which elements are displayed on the screen (which is detectable since you'll only click something that's visible) and still make websites work.
[ Parent | on HN ]
Re:Open research, stronger privacy: Making Firefox users har... by Vinnl on Thursday November 12, 2026 @05:21AM (#50465300)
As I understand it, almost all anti-fingerprinting protections are some measure of this, balanced against the level of breakage to accept. For example, Firefox is able to "letterbox" your viewport, i.e. restrict its size to one of a number of preset ones, filling up the remaining space with grey. That reduces entropy, but makes the user experience considerably worse, so it's not enabled by default in Firefox. Something like Tor Browser has a higher tolerance for breakage, so it does enable it.
[ Parent | on HN ]