6 comments

  • lpapez 25 minutes ago
    Very cool research and wonderfully written.

    I was expecting an ad for their product somewhere towards the end, but it wasn't there!

    I do wonder though: why would this company report this vulnerability to Mozilla if their product is fingeprinting?

    Isn't it better for the business (albeit unethical) to keep the vulnerability private, to differentiate from the competitors? For example, I don't see many threat actors burning their zero days through responsible disclosure!

    • valve1 3 minutes ago
      We don't use vulnerabilities in our products.
    • hrimfaxi 17 minutes ago
      They probably are not relying on it and disclosure means others can't either.
  • bawolff 11 minutes ago
    From the sounds of this it sounds like it doesn't persist past browser restart? I think that would significantly reduce the usefulness to attackers.
    • shevy-java 8 minutes ago
      Would it though? I guess state agencies already know all nodes or may know all nodes. When you have a ton of meta-information all cross-linked, they can probably identify people quite accurately; may not even need 100% accuracy at all times and could do with less. I was thinking about that when they used information from any surrounding area or even sniffing through walls (I think? I don't quite recall the article but wasn't there an article like that in the last 3-5 years? The idea is to amass as much information as possible, even if it may not primarily have to do with solely the target user alone; e. g. I would call it "identify via proxy information").
  • crazysim 25 minutes ago
    I would imagine most users of Tor are using Tor Browser. I am reading there was a responsible disclosure to Mozilla but is it me or did that section leave out when the Tor Project planned to respond or release a fixed Tor Browser? Do they like keep very close or is there a large lag?
  • sva_ 20 minutes ago
    Does Tor Browser still allow JavaScript by default? Because if you block execution of JavaScript, you won't be affected from what I understand.
    • ranger_danger 18 minutes ago
      Disabling JavaScript actually greatly increases your fingerprint as not many users turn it off, so that instantly puts you in a much smaller bucket that you need to be unique in. Yes, not having JS means it limits your options for gathering other details, but it also requires much less effort to be unique now without JS.

      Tor Browser also doesn't spoof navigator.platform at all for some reason, so sites can still see when you use Linux, even if the User-Agent is spoofing Windows.

  • fsflover 24 minutes ago
    It seems Qubes OS and Qubes-Whonix are not affected.
    • hrimfaxi 6 minutes ago
      How so? If you kept a disposable VM open and just created new identities in tor browser, how does Qubes mitigate the threat here?
      • fsflover 4 minutes ago
        On Qubes, you do not create a new identity in the same VM. This would go against the Qubes approach to security/privacy. Using separate VMs for independent tasks is the whole point of using Qubes.
    • ranger_danger 17 minutes ago
      Source?
  • shevy-java 10 minutes ago
    Well that sucks. I guess in the long run we need a new engine and different approach. Someone should call the OpenBSD guys to come up with working ideas here.