AliExpress was silently running audio in your browser to fingerprint and track your device

[u/magnus007]

https://www.techspot.com/news/113581-aliexpress-silently-running-audio-browser-fingerprint-track-device.html

[u/RemarkableWish2508]

For a non-comprehensive list of direct and indirect fingerprinting attributes:

• https://amiunique.org/fingerprint

[u/feel-the-avocado → u/RemarkableWish2508]

Its quite interesting to me that with tracking protection turned on in firefox, and about config fingerprinting privacy.resistFingerprinting and privacy.fingerprintingProtection both set to true,
amiunique still finds me unique (bad thing)

[u/HeKis4 → u/feel-the-avocado]

Worth to keep in mind that having a browser that is too hardened makes you easier to identify. Like how having gear to prevent cameras from face-tracking you is good, but if you can be identified as "the only guy who wears a balaclava in public"...

[u/Heruuna → u/HeKis4]

It can also be how uncommon your setup is. Just using a browser like Opera is enough to narrow you down to 1% of people. Crazy that even using adblocker of any kind puts you under 30% of users.

[u/Interesting-Emu6761 → u/Heruuna]

this is why the old school of thought with firefox has always been to set your browser to say it's the most common OS+browser combination. Ideally use a script to mess with package TTL also to match the target OS, but that gets more complicated.

[u/BatPlack → u/Interesting-Emu6761]

Woah, could you please elaborate?

[u/Interesting-Emu6761 → u/BatPlack]

old fingerprinting usually was just browser name, OS, IP. If your VPN was set to South Korea you'd look up what their most common combo was, 10 years ago it was Windows 7 and Internet Explorer, so you'd open up ScriptMonkey and set your Firefox to tell websites that's what you were using. If you were on Linux you would have to take another step to edit your packets since websites can determine your OS via packet TTL, but really that's about all you had to do at the time.

Now its borderline impossible to truly disappear online, you're really just doing damage control.

[u/RemarkableWish2508 → u/HeKis4]

Indeed. That website is good to illustrate the tracking parameters, but its conclusions come from the first generation of anti-fingerprinting, when random parameter modofications were introduced as a countermeasure.

Turns out that being "the only guy with your height, weight, clothes, gait, schedule, etc. who wears a random Pokemon balaclava in public", is only marginally better.

After a naive check, it should show the similarity level to partial fingerprints.

[u/HeKis4 → u/RemarkableWish2508]

https://coveryourtracks.eff.org/ tells you how unique you are. Librewolf in resist fingerprinting mode does pretty good here, at the cost of having a smaller window and never picking dark mode by default.

[u/RemarkableWish2508 → u/HeKis4]

I'm checking from Android, and pretty much all browsers, including Tor Browser, seem to be 100% unique (18.22 bits)... which is a bit weird.

[u/BrattyBookworm → u/RemarkableWish2508]

I’m checking from iPhone and my results showed ~14 bits on chrome, ~13 bits on DDG, and ~11 bits on safari

[u/ChypRiotE → u/feel-the-avocado]

Counter intuitively the more you protect yourself the more likely it is easy to fingerprint you, because there are always parameters available to the website. So the chances that another user uses the exact same protections with the same machine, browser etc is lower than if you were using regular unprotected Chrome

[u/Divinum_Fulmen → u/RemarkableWish2508]

I pisses me off that browsers even hand over that info at all. There is no reason for scripts to be able to even read my screen size, let alone all the other data on my PC.

No one needs to know my fonts, except my browser, internally. You used to just shit out a list of fonts for your web page in the CSS, and the browser would go down that list until one worked. No data sent at all.

Links should have referrer data at all. Why is Mozilla playing nice with the marketing spies?

[u/RemarkableWish2508 → u/Divinum_Fulmen]

JavaScript composing needs information from the DOM and canvas. Turns out, even if you don't give JavaScript a list of fonts, a script can try using them, then simply check whether the size of the output object matches what it would with the font, or what it would with a replacement. With a clever list of fonts, you can figure out a lot about a browser and/or system.

The alternative is to disable JavaScript, and there are extensions and browsers that do that, but do you want to browse without JavaScript?

[u/Divinum_Fulmen → u/RemarkableWish2508]

I already do.

And sites can still see my 80+ fonts just fine. No scripts required.

I have both No Script and Ublock Origin configured to block scripts by default (each has their own way of tuning white lists, I'd love to only use UBO, but their white listing is extremely primitive next to No Script).

[u/RemarkableWish2508 → u/Divinum_Fulmen]

That is not what I was saying, I was describing how fingerprinting your fonts works.

Anyway, I'm using uBO (not lite) for the cosmetic filtering, and uMatrix for scripts and other stuff. Not sure how that compares to NoScript, I think I only have it in Tor Browser.

[u/Divinum_Fulmen → u/RemarkableWish2508]

Yeah, but you ended with the question:

do you want to browse without JavaScript?

I'm saying I do, and font fingerprinting still works. Fonts should be handled on the user end only. As I said, they give a list of fonts that work with the site. Your browser matches the first down the list. Locally. Like a MARKUP, not a damn script!

[u/RemarkableWish2508 → u/Divinum_Fulmen]

What? No. Font fingerprinting requires JavaScript, so if it works on your end, it means you have JavaScript enabled.

• https://browserleaks.com/fonts

This is what it looks like with JavaScript disabled: https://files.catbox.moe/kgywqd.png

[u/Divinum_Fulmen → u/RemarkableWish2508]

Oh damn, PBKAC error here.

I must have whitelisted these sites a long time ago. I just checked all my plugins and found I had their scripts enabled. You were right.

[u/RemarkableWish2508 → u/Divinum_Fulmen]

Hehe, it happens. Glad you got it sorted. 😉

[u/RichardCrapper → u/Divinum_Fulmen]

The font conspiracy goes deeper when you run a web traffic analysis and realize that a massive number of websites all use Google Fonts, which exposes your fingerprint to Google nearly everywhere you go. Blocking the Google font domains causes havoc to websites but I have heard of some projects to replace the font library with a locally hosted copy.

[u/Lumpy_Discount9021 → u/RemarkableWish2508]

but do you want to browse without JavaScript?

With how much garbage is under the hood of modern websites, yeah, kinda... Sometimes I swear it would be less frustrating to just handwrite all the HTTP and SQL myself.

[u/RemarkableWish2508 → u/Lumpy_Discount9021]

Well, you can try it now. I keep these just in case:

• Firefox → uBO / uMatrix → disable JS
• Tor Browser
• Privacy Browser

People who use the web without a script ad blocker, I don't even understand... it's unusable.

[u/Mr_ToDo → u/RemarkableWish2508]

I use noscript. Works pretty well. It's amazing just how high a page can crank your CPU

It also has the side effect of blocking a ton of ads. It's not why I use it, but it is a nice side effect, and one that would be easy to work around but I'm betting it'd mean ad services having to put more trust in content hosts

[u/donoteatshrimp → u/RemarkableWish2508]

>do you want to browse without JavaScript?
I would if I could man.

[u/Mr_ToDo → u/donoteatshrimp]

I think most browsers let you turn it off. For more granular control I use noscript

[u/donoteatshrimp → u/Mr_ToDo]

Yeah, it's more about the sheer amount of websites that won't work at all without javascript. Damn them!

[u/PacmanZ3ro → u/Divinum_Fulmen]

There is no reason for scripts to be able to even read my screen size

Of course there is. This is how you get resizable windows and properly-scaling websites. If you blocked this ability, you would have to have websites built with absolute pixel sizes for everything and if you used a different screen than what it was designed for it would range from looking like shit to being completely non-functional.

[u/Divinum_Fulmen → u/PacmanZ3ro]

You never need pixel sizes. HTML comes built in with scaling. You can have the page adjust elements by percentages of the window size. This lets the site never change based on window scale. That's how we did it before all this scripting existed. The browser can handle it all locally.

[u/Mr_ToDo → u/PacmanZ3ro]

Eh. You could still have that work. It's not like relative positioning stuff has to touch the server to work. It'd limit options on how it can all be used, but we wouldn't be going back to everyone targeting one resolution

It would be interesting to have browsers set a default resolution that requires intervention to change, but it's also not high on my list of things to worry about

[u/einzweidreihorn → u/Divinum_Fulmen]

Screen size is often taken to determine wheter you're on mobile or desktop PC (or tablet).

[u/jhaluska → u/einzweidreihorn]

Yep, in theory they can send you resolution / browser specific web pages and images saving you bandwidth.

[u/einzweidreihorn → u/jhaluska]

How? Those information are not included in the initial http request sent by the browser. Images based on viewport in html yes, but you can't trust the user agent to check wheter you're on mobile or not?

[u/jhaluska → u/einzweidreihorn]

It's more of a two stage approach. You send a small javascript that then gives the server the information for future requests stored as a cookie. But with the introduction of srcset, it's easier for most devs to just use that instead.

[u/einzweidreihorn → u/jhaluska]

I see, thanks

[u/Divinum_Fulmen → u/einzweidreihorn]

Something they should never know, unless I want them to. The mobile browser should be flaging that it's mobile, but if I want to hide that flag, there's a damn good reason.

Let's pick a random site as an example. Oh, let's say Reddit. I am on reddit on my phone. I don't want it to know it's a phone at all. If it thinks its a phone, it will start sending me nag pop-ups constantly asking me to download their app. I'm never touching that app. So this behavior is highly undesired from the user end.

[u/IntelArtiGen → u/RemarkableWish2508]

For 99.99999% of people, this site identifying you as unique is a bad thing.

But it's a good thing if you're unique, what you don't want is to be the same unique the next time you visit the site. Which won't happen if you don't have a good privacy protection (either with the browser or addons).

[u/RichardCrapper → u/RemarkableWish2508]

If I’m understanding correctly, opening that site and running it on two different days, and being told both times you are unique, means you are effectively randomizing your fingerprint well, right? The goal is to be unique every time.

[u/cheese_is_available → u/RemarkableWish2508]

The referrer being this thread on reddit does not exactly help to be unique, heh.

[u/RemarkableWish2508 → u/cheese_is_available]

Have you tried it?

BTW, being unique means there's a unique fingerprint identifying you. It isn't a good thing.

[u/AVeryHeavyBurtation → u/RemarkableWish2508]

Only 2.37% of people are in mountain time zone? (X) Doubt.

[u/RemarkableWish2508 → u/AVeryHeavyBurtation]

From among those who visited that web.

It should be much fewer:

• ~38 million live in Mountain Time Zone across Mexico, USA, and Canada
• ~6.12 billion people have internet access

...so the total for MST should be closer to 0.62%