tomrittervg

6 ms·

1.
by tomrittervg 27d ago
Yes, it is a bug, in fact it's this bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1863193#c9 which is of course getting some more attention now =)
2.
by tomrittervg 28d ago
WebAudio fingerprinting is largely mitigated (in Firefox, potentially other browsers) - I wrote a quick overview that talks about the current distribution of values as well as our more recent efforts. https://ritter.vg/blog
3.
by tomrittervg 4mo ago
For a time RFP - by itself - could be enabled by web extensions. (It might still be possible, I don't recall if we removed it.) But it's a footgun because it became even easier for people to enable it by accident. I can point yo
4.
by tomrittervg 4mo ago
And to the point about Mozilla's protections lacking, I've corrected the record: https://ritter.vg/blog-webgl_renderer.html
5.
by tomrittervg 4mo ago
The Bugzilla bug is at https://bugzilla.mozilla.org/show_bug.cgi?id=2036440 The breadth of responses here about people who can't reproduce this (or can) is one of the most frustrating things about working on fingerprin
6.
by tomrittervg 4mo ago
> Also by default addons.mozilla.org is a privileged site so of course they include google tracking in it and they get the proper fingerprint no matter what you have configured AMOs privileges are limited to (A) installing extensions wit
7.
by tomrittervg 4mo ago
(n.b. I own these features in Firefox) There are three levels of protection: - ETP Standard (see [0] for the latest improvements we rolled out) - ETP Strict (we're working on things in Bugs 2036879 specifically this issue, 2037260, an
8.
by tomrittervg 5mo ago
Mozilla is working on it. (I know you said 'Academic', but we publish papers sometimes too.)
9.
by tomrittervg 5mo ago
> Ultimately most fingerprinting technologies use features that are intended behavior Strong disagree. > IP address/cookies/useragent obviously are useful Cookies are an intended tracking behavior. IP Address, as a routing a
10.
by tomrittervg 10mo ago
In this context "a unique fingerprint" means that your fingerprint does not match any other user's. When you visit Site A and B you give a fingerprint X that is the same on A and B but no one else on the internet has ever se
11.
by tomrittervg 10mo ago
It's 'Suspected Fingerprinters' that controls the Fingerpritning Protection feature described in the blog post. But yes, naming and descriptions is hard and never seems to work. But to disable it on a per-site basis, I would
12.
by tomrittervg 2y ago
This is true, but adding a sandboxing to browsers has been a huge part in driving up the difficulty/cost of browser exploits, and driving down the frequency of their use. And also we'll pay for a bypass of the wasm sandbox. (Actu
13.
by tomrittervg 2y ago
The vulnerability did require JavaScript to trigger. I think it would be a labor of love and craftsmanship to exploit a content process today without using JavaScript.
14.
by tomrittervg 2y ago
This is precisely how I feel about Binary Transparency
15.
by tomrittervg 8y ago
Ah okay, I understand better. The (second) pseudocode you have is right (the second two 'hash()' should be 'hkdf()', and the first should be 'pbkdf()'.) The first is an alternate way to do it. But for cryptogra
16.
by tomrittervg 8y ago
There are more details above but the short version is that it is possible to build extensions for other browsers that work with Firefox Sync. But the only one linked seemed to be for Gnome's browser, so no one may have actually done it
17.
by tomrittervg 8y ago
From the RFC: "Its goal is to take some source of initial keying material and derive from it one or more cryptographically strong secret keys." In our case, the initial keying material is the output of PBKDF; and the two outputs w
18.
by tomrittervg 8y ago
I happen to also work on Firefox/Tor Browser's anti-fingerprinting work, so yea - we're trying to make improvements there too =) Containers is a big Firefox feature (exposed through an Add-On) in this category too. As far as
19.
by tomrittervg 8y ago
I wasn't aware that any distribution (besides Tor Browser) was building Firefox (or anything really) reproducibly. There's debian's https://reproducible-builds.org/ effort, but I thought that wasn't maki
20.
by tomrittervg 8y ago
It is many folks', and we appreciate the feedback. Hopefully things will get better soon: https://github.com/mozilla/multi-account-containers/issues/3...
21.
by tomrittervg 8y ago
There's a few children of this comment, noting this, but to tie things together from someone from Mozilla: - You can self-host your own sync server. It's not something we spend a lot of time making easy, but it is possible and sup
22.
by tomrittervg 8y ago
Thanks! I filed https://bugzilla.mozilla.org/show_bug.cgi?id=1503872 When we have time we'll have to trace through what it's doing and what components of RFP are causing the failure. (If anyone wants to do that an
23.
by tomrittervg 8y ago
Safari by default has a stricter storage access policy by default for all third-party domains, which requires you to visit the domain as a first party first. So it's probably that rather than ITP.
24.
by tomrittervg 8y ago
Thanks for diagnosing that for me, you're right blocking third party cookies does cause it to fail. Both tests are equally valid. I just gave one because trying to be exhaustive about testing it would be mind-numbing. The test I provde
25.
by tomrittervg 8y ago
I won't copy paste my reply from above, but rather link it: https://news.ycombinator.com/item?id=17949613
26.
by tomrittervg 8y ago
Go to https://ritter.vg/misc/ff/fpi.html On first load it should say "There was nothing in local storage." Now go to https://rittervg.com/misc/ff/fpi.html On first load it sho
27.
by tomrittervg 8y ago
> An option could be to provide a webRTC-based node, but I am not sure how feasible that would be, after reading some comments here. I'll point you at FlashProxy ( https://crypto.stanford.edu/flashproxy/ ) and Sn
28.
by tomrittervg 8y ago
Tor Browser will exist as long as Tor feels it needs to. If the features or anti-features in FF cause them to believe Firefox does not fit their need, then we're/they're not going to discontinue it.
29.
by tomrittervg 8y ago
The Fusion project is done by a subset of that team (+me, I happen to sit with Sandboxing due to other responsibilities).
30.
by tomrittervg 8y ago
Hi all. I am a Tor Project Developer and work at Mozilla on this project. We appreciate everyone's enthusiasm and feedback. Our ultimate goal is a long way away because of the amount of work to do and the necessity to match the safety

More ›