Browser Fingerprinting Without JavaScript

Tor is not Tor Browser. Detecting outdated Tor Browser version would help you detect well-known vulns. Detecting non-TBB browser over Tor would suggest that side-channel attacks are available to defeat onion routing (eg. WebRTC leaks).

If you want privacy, use Tor Browser. It's the only privacy-friendly browser out there. All others have many holes and leaks and very little intentions to close them. Although Firefox has a "Tor uplift" project upstreaming patches from Tor Browser into Firefox's strict privacy mode.

Tor's techniques also make it a monoculture. The smallest fuck up that makes you just a little bit more identifiable normally, makes you stick out like a sore thumb among TBB users.

> So how crippled does regular web browsing become using Tor safest mode?

In my experience, not really much. There's occasionally a few articles i can't read because they require JS just to display their blogpost but outside of HN planet, it's not that common (most people use Wordpress themes or other decent HTML/CSS templates).

The real problem is Cloudflare and other gatekeepers who claim to protect from bots and attacks, but are more likely to block honest people. If you know people using Cloudflare, please insist that they don't. If you really need DDOS protection because you're repeatedly been a victim, please use a decent network-level mitigation (as provided by professional hosts like OVH/Hetzner) not some shitty invasive DPI solution that will have 99% false positives.

An interesting aspect of Safest mode i enjoy is the web is "read-only" again with it. Well you can still POST stuff via forms, but it's an explicit opt-in operation. TBB's Safest mode is closer to reading a newspaper than the modern web could ever be.

As a nice bonus, the Safest mode is really resource-efficient. I can have hundreds (thousands?) of tabs open for days without leaking memory, and CPU is only used to draw stuff (no tab mining coins on my behalf). I don't know a single browser with JS enabled who can keep many tabs open without rendering my machine utterly useless due to overusing CPU/RAM. Hell, i don't know a single browser with JS who can prevent a single tab from using all of my resources. TBB's Safest mode is really the only modern way i know to browse the web on low-resource hardware (lighter webbrowsers exist, but they usually don't implement modern CSS3 features).

EDIT: I should mention that the only useful service i can't use with Safest mode is Gitlab. Because Gitlab still does client-side rendering for some reason?!

I think the biggest problem of surfing the web via Tor end nodes will be the Cloudflare captcha. As much as I like Cloudflare, their captcha makes the open web pretty much unusable through Tor. At least last time I tried.

Rooting your phone and it being secure are two completely different things my friend.

TCP is a bidirectional stream so ignoring some of the edge cases you can just proxy it across any stream transport. in the case of TOR it sets up a bidirectional stream across its network and then bytes come into the exit node over the TOR stream and then the exit node just writes them out using the normal operating system write() method. bytes then come from the normal operating system read() method on the exit node and the TOR exit node just sends them back over the TOR stream. on the client node setting up the stream over the TOR network and receiving/sending is exposed as a SOCKS proxy but i guess you could also have something fancy which intercepted traffic transparently (https://gitlab.torproject.org/legacy/trac/-/wikis/doc/Transp...). i haven't looked at the TOR project for a while but it looks like they are heavily pushing the TOR browser which I guess means the user is not exposed to any proxy setup and can't accidentally misconfigure things in a way that would break their anonymity.

Yes, the one was on Void Linux (no desktop environment), the other on Kubuntu (KDE).

painfully true

thou it will be argued that it is a minority that is affected and it makes little economic sense to care.

Live with a 2 font maximum and popups every time a site chose to load another font? It would break every icon on the web. You'd either only load the icons or only load the text fonts. If you want to avoid fingerprinting, and actually think this method remotely works, by all means block those requests. If you actually care about privacy a better place to start would be the fact that chrome logs you in on the browser level whenever you login to anything with a Google password. Some random fingerprinting is not worth shutting down all design for. On that idea we should just go back to dialup because everything is too dangerous for idiots to handle.

They might agree in principle, but they’d be pretty pissed off when nothing works when the open their web browser. The golden rule in web standards development is “don’t break the web”, ie you can’t just recklessly change web platform features, you have to do it thoughtfully and carefully to avoid breaking existing websites. It’s not a perfect rule, there are exceptions where the breakage is tiny and the benefit is huge, but what you’re proposing is huge destruction and would not make it past the first stage of consideration.

> Besides, it'd still work fine, but you'd only be able to view two or three fonts at a time.

That would be trivial to break over a few requests, I think

You don't seem to realize that the fingerprinting has nothing to do with what fonts you load from a page. It's what fonts you have installed on your machine.

More permissions are not the right answer. Too many and users get conditioned to blindly clicking accept.

Every webpage should be a 640x480 jpg hosting exclusively through a CDN separate from the originating site.

Why can't we make a better web like this that respects your privacy?

Not everyone on Earth uses an ascii-compatible language, though.

Or another way to look at it, you go to the doctor because your head hurts so they give you aspirin to treat the symptom rather than treating cause from the gaping wound.

We keep suggesting things like limiting use of fonts as a polyfill for not being able to create legislation or what not. How about not exposing the available fonts to the browser through JS? If the font is not available, it should silently regress through options listed in CSS or browser defaults. JS can request a font, and it can be used if available. If it's not available, JS shouldn't need to know about it.

According to https://gs.statcounter.com/browser-market-share, Chromium-based/Safari browsers have 93% market share, so I wouldn't really count on other browsers that much.

"Viewing a site in English" misunderstands the problem. Mixed-language content is a reality. Not all websites are a single language, because they can host user-generated content or snippets of content in other languages (commentary on translated material, live translations, instructional material, etc.)

You bring up an interesting point. But even at the peak of slavery in the US, there were "white" people who believed all people are created equal and deserve equal rights, some even helped free slaves.

I think it is more of a worldview thing which is influenced by local culture. You beliefs about answers to fundamental questions like why do people exist? What are valid authority systems and structures? What is the origin of humans? And more questions like this, makes the difference.

I believe racism is wrong because I don't believe race is a thing beyond a social classification system. I believe in ethnicities and diffrences between them, but humans share a common origin. Even if some humans have less or more capability to do certain things than others, in order to be just, one must evaluate others as individuals not groups. Even if some statistic about a group can predict behavior of all but one members of a group, prejudice against that one member is still unjust and unfair, We should treat others the way we want to be treated ourselves.

But back to the topic, I think I agree with you that why we believe privacy is important is critical to make any improvements or changes. Simply put, privacy is power. When someone deprives you of privacy against your consent (where expectation of it is readonable), they are excercising power over you. They are excecising a claim that for whatever reason, information about you now belongs to them. If all or most information about you belongs to someone, you are now their subject.

It could be as simple as a lack of understanding of the implications of privacy deprivation.

Except I was replying to a comment about systemic acceptance of privacy deprivation. Groping and racism are considered unacceptable in most places, good case studies to correlatr and then find cause of systemic acceptances.

Interesting how you are trying to change the conversation and make it about the analogy used to analyze the root cause of the issue described in the post.

I would rather not distract from the discussion at hand. If you don't already know the answer to that, I would rather not discuss the subject here.

By being "better" than the (FOSS) competition, even if only for some narrowly scoped use cases. Maybe there is a market for privacy products that allows you to make some money. They seem to be focused on privately storing and sharing documents and other files. What FOSS competition is there that just works? Signal and matrix have very limited UI/UX for that use case, and they also severely limit file sizes (100 MB I think, which is nothing if you share a 4K video of the family singing Happy Birthday for grandma). Signal also does not really work on desktop, and not at all without a phone. What else is there? dropbox and google drive and amazon fail on the privacy aspect, mega.nz is too shady both in history and in current business practices. Most other competitors do not really have sharing or fail the privacy bit, and the other open source "apps" usually require you setting up some infrastructure, which won't work for most people as they lack the skills to do so and/or motivation to go through the hassle of maintaining such a setup[1].

They also try to be kinda snapchat with self-destructing file shares. That this is impossible at the very least thanks to the analog hole is a given, but at least they mention that and mention how they intent to fight it (by using watermarks to discourage people from screenshots, etc). They seem to overstate their capabilities in their main marketing material, tho. They are a bit sparse on the details and very "marketingey" - which is understandable given the target audience of this campaign - but they promise a proper white paper and open source (not necessarily free) code soon.

All I see is that they have a kickstarter for a measly $150K, not really VC funding? So "make a profit for investors" might be a kind non-goal at least for now. It doesn't sound like they aim to be the next unicorn, just to be sustainable and maybe eventually make the major investors their money back and then some.

I wouldn't call this thing "fishy". It has a high likelihood of failure in the market and/or not quite delivering on the promises, sure, but that's true for all early startups. But they might come out with a real product valuable enough for some niche of people to pay for it and sustain it.

The Smarter Every Day guy also put his reputation on the line. He doesn't seem stupid enough to back complete vaporware or worse, grab the money and run. His reputation is likely more valuable mid to long term than the $500K (of $150K they asked for).

My personal guess: it will fail to be big (the space is too crowded in "good enough" apps, and they will have a hard time building enough network effect that their "sharing files" mission requires), it will fail to deliver everything they aspire to deliver, but they will deliver something that a niche of people will like and use. If that will be enough to sustain the thing... maybe not. They kinda have to go as a freemium app, like lastpass or mega.nz or protonmail to even have a chance to build up momentum, or find themselves some "sugardaddies" and "sugarmommies" as signal did or mozilla did (tho the latter is in trouble now thanks to the codependence - as well as bad management). They could even become a mega or even a dropbox competitor. Or they will fail to acquire enough users and fade away or have to pivot to a secure and private file management/backup solution, and still face a lot of competitors.

[1] Obligatory: https://news.ycombinator.com/item?id=8863

What if I am using an extension that blocks/ignores etag headers?

And what if my browser sends requests via multiple proxies? Would the etag likely be different then as well?

Does private browsing in FF solve this by not caching between program starts?