Tor 0day: Uniquely Tracking Computers

Oh great, this guy again? He has a history of posting overhyped tor "0days". The comment threads from the last few times should tell you all you need to know.

https://news.ycombinator.com/item?id=23929312

https://news.ycombinator.com/item?id=24500214

Not quite sure this fits is a '0-day', better title could be 'Uniquely Fingerprinting Tor Browsers'

In my side-by-side test of Chrome vs Tor on the EFF's browser fingerprinting tool, Chrome had a 'unique fingerprint' whereas Tor has a 'nearly unique fingerprint' -- WebGL and Canvas contributed significantly to the bits of identifying information conveyed in both browsers. I suspect my unique monitor and gpu setup could be largely contributing to this fingerprinting process. See https://coveryourtracks.eff.org/

A few years ago I decided that all of the encryption protocols and privacy measures in the world aren't going to protect you from state-actors.

Even if your software is perfectly implemented (it won't be), your hardware is mostly a black box and manufactured by major corporations with track records of cozying up to major governments. All the debate over the security of these algorithms is moot when you can't see the code the underlying machine is running.

You may just about be able to keep a Romanian script kiddy out of of your system if you keep up with every new vulnerability across your entire tech stack, but the Government is getting in whenever they feel like it.

My philosophy is thus to never do or say anything that will make the Government mad at me.

To put it politely, Neal is a well-known character in security circles. I don't consider this a vulnerability.

How does listing your graphics card features and Direct X version lead to a unique fingerprint? Am i missing something here?

about:config -> webgl.disabled -> true

It is sad that pyllyukko's user.js is more hardened than default TBB, but at least it's easy to mitigate for now.