It was at the Securedrop website. How did I end up there ? I read something about Sequoia and encryption and then wanted to see what Securedrop entailed.

Meanwhile I’ve raised the security settings. Still, today someone in this community (?) mentioned that Tor browser does not protect the remote to check for the OS, and now this. Color me surprised.

    • brbposting@sh.itjust.works
      28·
      8 months ago

      Wow nice. Any opinions on how these fingerprinting evaluators compare?

      CreepJS:
      https://abrahamjuliot.github.io/creepjs

      EFF’s Cover Your Tracks:
      https://coveryourtracks.eff.org

      Am I Unique?:
      https://amiunique.org

      Sad a pretty stock iPhone that’s blocking via some filterlists and using iCloud Private Relay (a “VPN”) is so detectable! Should be so many browsers appearing similar but there’s always this & that that mean I’m unique.

      • ExcessShiv@lemmy.dbzer0.com
        6·
        8 months ago

        Just tried amiunique.org and got this…

        “Yes! You are unique among the 2561164 fingerprints in our entire dataset.”

        So much for using VPN and “hardened” Mull browser 😅

          • ExcessShiv@lemmy.dbzer0.com
            3·
            8 months ago

            It really makes it feel like we’re all just wasting time here on a futile effort trying to get digital privacy. Clearly the steps I’ve taken make absolutely no fucking difference, so it’s not really worth the hassle TBH.

      • refalo@programming.dev
        4·
        8 months ago

        Haven’t used amiunique but the EFF one I have seen people criticize because it only checks your uniqueness among people who opted in to take the test, so the results can be highly skewed.

        • pingveno@lemmy.mlEnglish
          2·
          8 months ago

          The results aren’t going to be that skewed. They operate on a simple principle. There are many features available on a modern web browser with a high degree of variability. Even not having a feature is itself a piece of a fingerprint. The combination of those many, many features is going to produce a high degree of uniqueness for almost any browser.

          • refalo@programming.dev
            2·
            8 months ago

            I wasn’t trying to debate how the uniqueness is calculated, you’re absolutely right on that, and other sites like creepjs do the same, but I think where the eff site is a tad misleading is in how it presents their “just how unique AM I” part of the results, because they only have their own collected data to compare that against.

            Sadly I think even disabling JS entirely would take away so much “blending in” that it still wouldn’t be hard to uniquely fingerprint a user without it. Even CSS (without JS) and standard HTML tags like “picture” can be used to fingerprint now.

            • lemmyreader@lemmy.mlOPEnglish
              1·
              8 months ago

              Sadly I think even disabling JS entirely would take away so much “blending in” that it still wouldn’t be hard to uniquely fingerprint a user without it. Even CSS (without JS) and standard HTML tags like “picture” can be used to fingerprint now.

              Right. I guess there’s also a difference between wanting to be as anonymous as possible and wanting to not be tracked too much by some sites.

              In some browser profiles I do block JS completely for a few reasons.

              • Let’s me read a lot of articles. Even articles with supposedly “paywalls”.
              • Clutter free reading. Does it matter that the remote sites can recognize me based on a unique FP and build a profile ? I’m not too bothered. Should I ?

              For other use cases I prefer Tor browser without any added extensions.

    • lemmyreader@lemmy.mlOPEnglish
      14·
      8 months ago

      Thanks for the heads up. Yes, I tried CreepJS before and saw it found Linux as a result :/

      • Redjard@lemmy.dbzer0.com
        7·
        8 months ago

        That can’t have been the reason, rather the fact it could tell.
        Your browser sends information about its version and the os in the useragent string. It is supposed to lie and say it is a very commonly used useragent, specifically for purposes of fingerprinting. That would be windows, default configuration, firefox version something not you firefox version

          • Redjard@lemmy.dbzer0.com
            101·
            8 months ago

            That would be a fail of the fingerprinting protection. A properly set up TOR browser for example should not allow that detection by any means. If you know how to detect it, please report it as a critical vulnerability.

            I could think of maybe some edge case behavior in webrenderer or js cavas etc., which would mainly expose info on the specific browser and underlying hardware, but that is all of course blocked of or fixed in hardened browsers.

            Further, if you have a reliable method, you could sell it off to for example Netflix, who are trying to block higher resolutions for Linux browsers but are currently foiled by changing the useragent (if you have widevine set up).

            • Deckweiss@lemmy.world
              3·
              8 months ago

              What do you mean by “properly configured”

              Here is a screenshot of the default Tor Browser, installed from the repos, no config changes made. As you can see, creepjs can detect that I am using Linux.

              Obviously, if you disable js, then the site doesn’t work. Not sure if there are ways to detect the OS without javascript.

              One common way to analyze the OS if all else fails is to look which fonts are installed. This is done by rendering thousands of divs with some text out of sight of the user. Each div with a different font. If the div width changes compared to the default, you know a font is installed. Different OS have different sets of fonts by default. Not sure if flatpak/flatseal (or other containerization methods) could protect against that. Technically you can install the exact set of Windows fonts and uninstall all Linux fonts, but I’d expect some linux app breakage and general uglyness.

              An online search I did for how to completely hide the OS without breaking most websites did not result in anything except runnjng the browser in a Windows VM.

              EDIT:

              Per default tor has a linux useragent. And I can’t seem to change it with the useragent switcher or with about config override. So yeah… even better.

        • lemmyreader@lemmy.mlOPEnglish
          101·
          8 months ago

          Tor browser useragent string pretends to be Windows on all platforms. CreepJS detects Linux in my case. A commenter mentions that Tor browser does not protect OS detection. That gives me mixed feelings about the goals of Tor browser.

          • Syn_Attck@lemmy.today
            5·
            8 months ago

            There are many things you can do with JavaScript, and tor can only protect against so many without completely breaking many sites. Set your slider all the way to maximum and it will no longer detect windows, but it will very likely also no longer run.

    • MonkderDritte@feddit.de
      2·
      8 months ago

      Btw, i have this error in Firefox console:

      - audio failed creep.js:1:10246
- TypeError: document[U5(...)] is undefined
    Ww https://abrahamjuliot.github.io/creepjs/creep.js:14
    xi https://abrahamjuliot.github.io/creepjs/creep.js:14
creep.js:14:1271