Hacker News Reader

Comment by frankzinger | Hacker News Reader

  > Here's one they missed: do not resize your window!

Under the "Don't change settings if you don't know their consequences." section:

  For example removing a menu bar or using Full Screen
  in Tor Browser is recommended against. The latter
  is known to modify the screen size, which is bad
  for the web fingerprint.

Also, the current version of the Tor Browser warns you when you resize the window.

View on HN

At least some mitigation to this is in the pipeline. If you try "hardened" version (although, currently only available for Linux 64-bit) you'll see it will only resize and lettersized to a certain set of "common" screen size.

I don't know what their roadmap is, but I'm assuming, this will be eventually coming to the stable release for all platforms supported.

>Also, the current version of the Tor Browser warns you when you resize the window.

I believe it only warns you if you maximize the window, not if you resize it.

Resizing it isn't a problem. It doesn't open at a magically untrackable size, the point of this advice is that if you are fullscreen you will be the same size always and therefore potentially trackable between sessions, if you are resizing it yourself even if you try to resize to roughly the same size as last time you won't be exactly the same. (Window management features like snapping to half screen instead of full screen of course would be the same as going full screen.)

Interesting. I'd have thought custom sizing would be bad for between-site tracking as it's much more likely to be unique, whereas fullscreen wouldn't have been much of a problem since resolutions are pretty standardised.

Hmm, my thinking was that Tor browser would randomly pick a size, but maybe it only has a certain number of options to make sure every user crosses with plenty of other users too? In which case resizing of any sort would make you more unique, just within the session. (I'm no expert on Tor/browser.)

For those with knowledge of how window size affects page layout, is there any technical reason for Tor browser not to fuzz with a random +/- 5 pixels while in a single session (say, on every page load)?

Similar to what the nosleep utility does with jiggling the mouse by an unnoticable +/- a few pixels.

Too easy to average that away.

Could make sense to do so on a session-by-session basis, though.

Randomly picking a size still gives a good chance of being able to track user connections across a single session.

Sure but you shouldn't be connecting as distinct psuedo-identities during the same Tor session (mentioned in the article); if a custom browser size is associated with a one-time-use anonymous session then it shouldn't be a problem except that it leaks information about what window sizes are possible on your system, and your custom resize is very unlikely to be random; probably predictably proportional to your actual screen size.

Actually it does. Check window.innerHeight and window.innerWidth.

The specific values depend on the individual configuration of your browser - icon size, toolbars, themes ...

mine is: 1920 x 992

if I add the bookmark bar the sizeing turns: 1920 x 968

It's not identifying but individual.

Why doesn't Tor Browser just spoof a default screensize? Why is it necessary to tell websites what size the screen is? Would it be possible to still see responsive websites if a default screensize was chosen? Perhaps a few 'presets' could be created for different aspect ratios and then it would alright?

Just curious I guess, it's a shame that there are people out there who've likely done everything right except changing the size of their window, and maybe they got v& or even hurt because of this.

Reply on news.ycombinator.com