Hacker News Reader

Comment by controversial97 | Hacker News Reader

So ... it is a fork of Mozilla Firefox with privacy-friendly settings by default, some script blocking, and dns lookups done via Mullvads encrypted dns service

Sounds ok to me, I have a longish and probably out of date list of settings that I like to chance in a new instance of firefox. I trust mullvad to not log dns more than I trust my ISP and I live in the UK so unencrypted dns here is being logged and stored by order of the government.

Keeping a fork of firefox in sync with mainline firefox to get security fixes is a load of work, it is good that somebody is doing it, in this case I think the tor project is doing a lot of the work.

View on HN

AFIK it's a "fork" of the tor-browser (which is a fork of Firefox) but instead of connecting to the tor network you connect to a VPN.

So you get all the in-browser tracking protection Firefox has (e.g. against fingerprinting) + the ones only the Tor browser has but without the drawbacks of the tor network and in turn without onion security.

Does the tor browser fork stay up to date quickly? I would be quite worried about stale browsers in this day and age, to an extent at least

I believe Tor is collaborating with Mozilla very closely, to the point that Mozilla includes patches from Tor Browser now: https://wiki.mozilla.org/Security/Tor_Uplift

And Mullvad is a Tor project sponsor.

And Mozilla's partner for the Mozilla VPN.

Dang, it's a tight-knit group.

I recently discovered the useful Firefox about:config setting “resistfingerprinting”, which I believe came from this collaboration.

Yes, but beware that many websites are broken when “resistFingerprinting” is enabled. That’s why that mode is not enabled by default or an opt-in option in Firefox’s settings UI.

I've ran into a couple ones that have some canvas-based features that break when resistFingerprinting is on. They get some visible noise added on top (which does indeed thwart fingerprinting, but also makes it harder / weirder to use those features).

I believe you can turn off the canvas-based meddling per-site. There's a small icon that appears on the left of the URL input box on affected sites that allows you to do this.

Tor Browser updates often come the same day as Mozilla releases, sometimes a bit longer.

Yes. They are aware that this is one attack vector they need to protect their users against.

The Tor desktop browser is based on Firefox ESR (Extended Support Release), Mozilla’s LTS branch of Firefox that receives security fixes for 14 months. The Tor Android browser is based on Mozilla’s regular Firefox Android browser, updated every four weeks.

> I have a longish and probably out of date list of settings that I like to chance in a new instance of firefox

Not a user but part of the purpose of the TOR fork is settings, anything that is detectable via JS is supposed to remain default to prevent fingerprinting.

It's partly why it's not widely popular, I don't know if this is still true but it used to be that it was supposed to be run at a specific viewport resolution regardless of your device. All in the name of making your fingerprint as close to the same as all other TOR browser users.

> run at a specific viewport resolution regardless of your device.

It's more like pretending to the website that your screen has a "common" resolution etc. which is nearly but not quite the same as what you said.

In the past they semi required you to keep your tor window in a specific window size for this, which just didn't work well in practice.

By now they better integrated that in the browser from what I heard, so you can resize it however you want but websites might have an "empty" border are to the left/right/bottom depending on you screen resolution, windows size etc. from what I have heard.

With a typical maximized window on 1080p you won't really notice it, on 4k you might notice that it's just "dump" up scaled from 1080p, but the person I spoke with wasn't sure if maybe they have a set of supported common resolutions instead of just one. And on a 4:3 screen he said it's quite noticeable.

Not sure how it's designed but if I was designing a system of reducing detectable entropy from viewport size, I'd make a fixed list of available resolutions. First all the common resolutions (1920x1080, 2550x14540 and so on), and in addition to that maybe just "snapped" grid sizes in 64p pixel increments. If you use a window size that doesn't match, it should just render the viewport to the closest smaller allowed size, and fill the border with something (e.g. the background color of the page). Perhaps that's exactly how it works?

Yes, that's how it works, if you're talking about the setting privacy.resistFingerprinting.letterboxing. To my memory, the list is any multiple of 200 on width and any multiple of 100 on height. So at this moment my viewport is, I believe, exactly 1200x900.

Bear in mind that it's a minority of people that hit F11 to browse fullscreen, they still have toolbars, so it's not as common as you'd think for the viewport to match a common screen resolution like 1920x1080.

Yeah the ones you want I guess would be 1920x1200 with the height reduced by common (say Windows 10/11) taskbar and tooobars. It's never going to be perfect but you'd at least want to minimize letterboxing for the most common fullscreen setups on the most common platform(s). But you could throw in 1920x1200 full screen as well for good measure.

Perhaps it would be better to letterbox randomly with say 20px width and 20px height, so it's just 1 chance in 400 to even return to the same reported screen size? That way you'd be even harder to track than if you are the only person running exactly 1000x800.

I was thinking about that very thing is keeping up with patches. I suspect that tor is probably a couple of months behind firefox and then mullvad will probably be a month or two behind tor. It is easier to check between tor browser and mullvad browser because they both use git. firefox uses mercurial, so is probably harder.

Speaking of which, anyone have / seen an updated list of which FF to change and how? I presume the last one I bookmarked is dated.

Dear Santa...please stop making a safe & private internet so gosh darn friction-y :(

Sounds great for the audience it’s probably intended for.

Reply on news.ycombinator.com