[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-talk] WebGL forbidden in NoScript but Flash is not?

On 5/8/2013 3:01 PM, lucia@xxxxxxxxxxxxxxxx wrote:
Date: Wed, 8 May 2013 08:57:48 +0200
From: Lunar <lunar@xxxxxxxxxxxxxx>
To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Subject: Re: [tor-talk] WebGL forbidden in NoScript but Flash is not?
Message-ID: <20130508065748.GA975@loar>
Content-Type: text/plain; charset="us-ascii"

This means that the anonymity is broken. Your browser can be uniquely
identified among the others. In a repeated manner, across Tor circuits,
Tor Browser sessions and system reboots.

Here's a likely example of what Lunar is talking about. If you visit this
link you will be presented a survey form.

The javascript for that page creates a string listing:
1) every plugin for your browser
2) fonts that match his list of fonts.
3) The screen height of your system
4) the screen width of your system.
5) the timezone offset.
6) a timestamp:randomnumber string.

These strings added to hidden input fields and submitted to the browser
when someone agrees to participate.

The person doing the survey is likely collecting browser fingerprints to
identify duplicate entries by people using proxies.  That person
conducting the research is simultaneously the researcher and a blogger who
has been known to express quite a bit of hostility toward category of
human subjects he has invited to participate in his survey.

Obviously, fingerprints when collected are used for whatever purpose the
person collecting them wishes to use them form.

OK, lucia. Not sure, but guessing the link you gave & the type info the script obtains is talking about regular browsers - not TBB. As Mike Perry pointed out in the link https://www.torproject.org/projects/torbrowser/design/#fingerprinting-linkability, many of these things ARE either NOT allowed to be accessed by sites or certain info is faked, in all TBBs. Like time zone:
7. Timezone and clock offset *Design Goal:* All Tor Browser users MUST report the same timezone to websites. ...
Reading the entire doc, it appears many of the data that might be available for fingerprinting in normal Fx are either blocked, faked or obfuscated in some way.
tor-talk mailing list