6 ms·
Looks like Firefox is immune. This works by looking for web accessible resources that are provided by the extensions. For Chrome, these are are available in a
by cbsks 7mo ago
Looks like Firefox is immune.
This works by looking for web accessible resources that are provided by the extensions. For Chrome, these are are available in a webpage via the URL chrome-extension://[PACKAGE ID]/[PATH] https://developer.chrome.com/docs/extensions/reference/manifest/web-accessible-resources https://developer.chrome.com/docs/extensions/reference/manif...
On Firefox, web accessible resources are available at "moz-extension://<extension-UUID>/myfile.png" <extension-UUID> is not your extension's ID. This ID is randomly generated for every browser instance. This prevents websites from fingerprinting a browser by examining the extensions it has installed. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/web_accessible_resources https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
- awesome_dude 7mo agoThis is probably a naive question, but... Doesn't the idea of swapping extension specific IDs to your browser specific extension IDs mean that instead of your browser being identifiable, you become identifiable? I mean, it goes from "Oh they have X, Y , and Z installed" to "Oh, it's jim bob, only he has that unique set of IDs for extensions"
- triceratops 7mo agoIt's not a naive question. This comment says it's not possible to do that: https://news.ycombinator.com/item?id=46905213 https://news.ycombinator.com/item?id=46905213
- awesome_dude 7mo agoOh, it's (re)randomised upon each restart, whew, thanks for the heads up edit: er, I think that that also suggests that I need to restart firefox more often...
- tech234a 7mo agoThe webpage would have to scan the entire UUID space to create this fingerprint, which seems unlikely.
- deleted 7mo ago[deleted]
- throwaway808081 7mo agoJust have a database of UUIDs. Seems pretty trivial to generate and sort as it's only 16 bytes each.
- dullcrisp 7mo agohttps://libraryofbabel.info/ https://libraryofbabel.info/
- stirfish 7mo agolol Let's go a step further and just iterate through them on the client. I plan on having this phone well past the heat death of the universe, so this is guaranteed to finish on my hardware. function* uuidIterator() { const bytes = new Uint8Array(16); while (true) { yield formatUUID(bytes); let carry = 1; for (let i = 15; i >= 0 && carry; i--) { const sum = bytes[i] + carry; bytes[i] = sum & 0xff; carry = sum > 0xff ? 1 : 0; } if (carry) return; } } function formatUUID(b) { const hex = [...b].map(x => x.toString(16).padStart(2, "0")); return ( hex.slice(0, 4).join("") + "-" + hex.slice(4, 6).join("") + "-" + hex.slice(6, 8).join("") + "-" + hex.slice(8, 10).join("") + "-" + hex.slice(10, 16).join("") ); } This is free. Feel free to use it in production.
- b00ty4breakfast 7mo agoFree space heater
- deleted 7mo ago[deleted]
- jorvi 7mo agoDoing it on restart makes the mitigation de facto useless. How often do you have 10, 20, 30d (or even longer) desktop uptime these days? And no one is regularly restarting their core applications when their desktop is still up. Enjoy the fingerprinting.
- eek2121 7mo agoUmm, I restart my PC about once a week for security and driver updates. If you don't, you have a lot more to worry about beyond fingerprinting... Oh and I'm on LINUX (CachyOS) mind you.
- tristan957 7mo agoI restart my browser basically every day.
- cyanydeez 7mo agoyeah I close out everything as a mental block against anything I'm working on. I think there's a subset of people that offload memory to their browsers and that's kinda scary given how these fingerprint things work.
- recury 7mo agoYou just need to open so many instances and tabs in each instance that it crashes every couple days
- Thiez 7mo agoThere isn't enough energy in the solar system to count to 2^128. Now a uuid v4 number "only" has 2^122 bits of entropy. Regardless, you cannot realistically scan the uuid domain. It's not even a matter of Moore's law, it is a limitation of physics that will stand until computers are no longer made of matter.
- Ghoelian 7mo agoI don't think that's the case. I have the Earth View extension installed which shows a random google earth image. I have this set as my homepage in Firefox as moz-extension://<extension-id>/index.html, and this has not changed since installing the extension. The page still works.
- deleted 7mo ago[deleted]
- deleted 7mo ago[deleted]
- b112 7mo agoMaybe, but how long are the extension ids? And if they are random, how long to scan a trillion random alphanumeric ids, to find matches? I presume the extension knows when it wants to access resources of its own. But random javascript, doesn't.
- maples37 7mo agoThe extension IDs are UUIDs/GUIDs, so 128 bits of entropy. No site is going to be able to successfully scan that full range.
- b112 7mo agoChatGPT told me it can be done though. It won't disclose how, as it says it has had several users report it. And that it expects 50% of the bounty, and will use it for GPU upgrades.
- Sophira 7mo agoAnd just in case the magnitude of that isn't obvious to people, that means there are 340,282,366,920,938,463,463,374,607,431,768,211,456 total possible UUIDs. Good luck.
- account42 7mo agoUUIDs are 128 bit long but generally have a bit less entropy than that as they are not just a random number. Still more than enough to make enumeration infeasible though.
- deleted 7mo ago[deleted]
- deleted 7mo ago[deleted]
- calvinmorrison 7mo agoyes thats how browser fingerprinting works and it is impossible to defeat because there are just too many variations in monitors (relevant for fonts), simple things like user agent, etc.
- ahoka 7mo agoAnd browsers trying to mitigate fingerprinting are miserable to use (fixed window size with only Arial available, etc) and probably fingerprintable anyway.
- mrweasel 7mo agoWhy does the browser even allow a website to query for installed extensions? I really don't see what the point of that would be. The website should never be able to tell what's running in my browser, or on my computer in general. The browser renders the page, maybe runs a little Javascript, but there's no reason why it should be able to query anything about my environment. I wonder how much stuff would break if the Chrome sandboxing was extended to preventing access to chrome-extension:// from Javascript loaded of random websites.
- rchaud 7mo agoAnd they said that using a browser with sub-5% market share would cause us to miss out on the latest and greatest in web technology!
- dana321 7mo agochrome was made by ex-firefox devs, chrome is still not as good!
- userbinator 7mo agoThe latest and greatest is not great for you, but for them.
- cranberryturkey 7mo agoThe real friction in browser hopping isn't features — it's keeping your workflow portable. Bookmarks especially. Each browser has its own sync silo (Chrome → Google, Firefox → Mozilla, Safari → iCloud). For multi-browser setups (Firefox for fingerprint resistance, Chrome for the sites that only work there), cross-browser bookmark sync is weirdly undersolved. Xbrowsersync, marksyncr, and a few others exist but most people don't know about them.
- timnetworks 7mo agoAnecdote: yesterday i exported my bookmarks into an html file and then asked for a script that will make a webpage out of them. with a search. and favicon download from domain. better than any bookmark bar imho.
- Bluecobra 7mo agoThis is a great idea, thanks. I built an IPv6 only webhost in Digital Ocean a while ago as a learning exercise and it’s been sitting idle. Making a personal portal sounds like a fun project.
- cranberryturkey 7mo agoCheckout marksyncr.com for bookmarks
- LAC-Tech 7mo agoAnecdotally, I sometimes notice my computer fan spinning ferociously... it's almost always because I have left a firefox tab with linkedin open somewhere. Are they bit coin mining or are they just incompetent?
- techpression 7mo agoConsidering the app was a battery catastrophe I’m confident in the latter, even if your question could be read as rhetorical.
- kijin 7mo agoJudging from GP's description of how extension IDs work in Firefox, I wouldn't be surprised if LinkedIn were trying to brute-force those UUIDs!
- farhanhubble 7mo agoIf the two are indeed "Linked", I see a case for users-first browsers to show system metrics right along the page.
- rob74 7mo agoMaybe it's trying (and failing) to access your browser extensions? In a loop?
- veyh 7mo agoI've noticed similar issues with the web version of MS Teams. You can actually see what tabs are hogging CPU by pressing SHIFT-ESC to open the task manager (about:processes) inside Firefox.
- Bluecobra 7mo agoIt’s probably some feature they sell to recruiters to grab your attention. :)
- xhcuvuvyc 7mo agoIt's ok, they can fingerprint you for using Firefox.
- jonners00 7mo agoYeah, but they don't know which specific one of Firefox's last dozen users I am.
- OJFord 7mo agoThough LinkedIn in Firefox with uBlock Origin allowing just enough (not sure if that's relevant, just haven't run it without) does not last long without rocketing CPU & memory usage, fan spinning up, etc. (ime, anyway)
- Tade0 7mo agoIn my case LinkedIn consistently crashes Firefox the first time I navigate there on a given day. After I restart FF, all is fine.
- nilslindemann 7mo agoYes, is it now? https://fingerprint.com/ https://coveryourtracks.eff.org/ https://abrahamjuliot.github.io/creepjs/ I don't have Firefox or another browser installed right now, but the last time I checked, every browser was detected, especially on the first link. Further, When I used Tor, a few sites, like Google, showed me Captchas for a while afterward, when using my _normal_ browser. Further I heard that sites like PayPal are giving me black karma when I try to avoid Fingerprinting by using e.g. Tor.
- nilslindemann 7mo agoI actually don't even care too much if they try to detect, that I am the X from last time. The issue is them selling the data, or using it in unrelated locations, or trying to detect me as a person. And their programmers are not enforced and rewarded when they report such behavior to law agencies / the public. And the law is not punishing it.