135
Website detects whether you have LaTeX installed [among many other things] (kuber.studio)
submitted 2 days ago by to c/privacy@lemmy.ca
21 comments fedilink hide all child comments

all 21 comments

sorted by: hot top controversial new old
[–] 37 points 2 days ago (7 children)

Figured I'd give this a shot with LibreWolf, NoScript, CanvasBlocker. First of all, NOTHING loads without JavaScript. Simple websites should work without. What it got wrong: CPU core count, display resolution, timezone.

I do actually feel a bit safer with these, mostly due to NoScript, because arbitrary domains can't run code on my system and even begin to try and collect that kind of information. I really do wish we could go back to JavaScript not being required, only enhancing UX here and there.

  • permalink
  • fedilink
  • source
  • hideshow 7 child comments
    •
  • [–] [S] 15 points 2 days ago* (4 children)

    Good old times... Unfortunately, as that website points out, it doesn't really matter if it detects incorrect values: for fingerprinting it's sufficient that the values be "consistent* through visits, even if wrong.

    I'm not sure whether it needs JavaScript to read the values? I'd like to know.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 9 points 2 days ago (2 children)

    If it reports the same values for everyone, or randomizes them every start (like display resolution and timezone), then it becomes less useful for fingerprinting. In fact, it calculated a different fingerprint altogether this time, though it did know it was the second time I visited.

    I’m not sure whether it needs JavaScript to read the values? I’d like to know.

    Yeah no, it actually will need JS for most of that information. Otherwise the server will just get the HTTP request header which includes your browser's user-agent and some other less identifying stuff, plus maybe your IP (unless you're behind a VPN).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 1 day ago

    Yeah no, it actually will need JS for most of that information.

    99% of the Internet doesn't work without JS. Yes, having a script blocker that blocks google static & whatever else will help you some, but it's not perfect & this type of script blocking specifically is under heavy attack right now.

  • permalink
  • fedilink
  • source
  • parent
  • [–] [S] 3 points 2 days ago

    Thanks for the useful info! Indeed randomizers are good. But as you wrote, it's sad that so many sites just don't work, or work badly if one alters some of those values...

    Maybe the long-distance future of sane people will be I2P or similar infrastructures...

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 day ago

    Letterboxing could help here making consistency a bit more random by setting each websites height/width to different values. Mullvad-browser does this by default. I think on other FF forks you have to turn it on in about:config.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 1 day ago

    Funny enough, I have noticed some big sites have reversed course on what loads with out JavaScript.
    e.g. Amazon is the biggest one I noticed, obvious reasons for them, somewhat functional without JavaScript running (go back a month or so and you couldn't do shit), though you still have to enable js to go through pictures etc. Not getting any more of my money, but it was definitely funny to see

  • permalink
  • fedilink
  • source
  • parent
    • [–] 8 points 1 day ago (4 children)

    The last time I came across a fingerprinting website I wasn't able to make any noticiable dent in its ability to fingerprint me. I'm running like 6 different addons and they don't seem to have any affect on this site. I've not really been able to find projects that are successful against fingerprinting.

    This website has a bunch of hows after every statement but just scrolling to the bottom without digging doesn't give a clear answer how to fix the issue.

    Also why is a browser giving up specific details about my system? Like my specific CPU and GPU shouldn't need to be shareable. Is there an addon that spits out random information for every request? I used to take the time to find the most common Useragent string and set mine to that, but with browsers just giving up such details it seems worthless effort.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] [S] 6 points 1 day ago (1 child)

    It's WebGL that gives your GPU away. I disabled it on Firefox, but some sites that I use often broke down. As far as I know it's not possible to enable it per-site. If you're on Firefox, there are settings to disable giving this information.

    But the point, as the link emphasizes, is that if you don't allow such information to be read, that's also something to fingerprint you – actually even more, since it's a minority who take care of such privacy settings.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 5 points 1 day ago

    The original idea was to gather all sys info including .extension app connections, and font capability, so that the web server and browser could tailor screen size and resolution and mime app stuff for the best web experience. Seems it's way out of hand now. Site gleans sensor info too, especially android compass, orientation sensors etc. The web page you visit could tell if you are sitting or walking etc.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 9 points 1 day ago* (3 children)

    Good stuff. It's sad that only 10% of visitors use a "do not track" addon/extension. Electronic Frontier Foundation's "Privacy Badger" extension is highly recommended for the minimum of protection. And of course an adblocker, and while I skeptical of uBlock Origin Lite, it's actually quite competent.

    Of course, we're on Lemmy, so I'm probably preaching to the choir.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 2 points 23 hours ago (1 child)

    I'm a little slow on the uptake with all of these new ways people are tracked, so I apologize for the question I'm about to ask:

    Every single box that uBlock Origin shows me in the settings for it I tick to on (except experimental stuff and any languages I don't speak or visit those websites) so I still need Privacy Badger or an equivalent of that, you're saying?

    I only use base Firefox so I can sign in and send stuff from my phone over to the computer or vice versa. So, essentially, I'm still a very easy person to identify? :-/

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 16 hours ago

    Privacy badger will hold back certain scripts and resources being loaded on sites, so it'll be a bit aggressive to begin with and prevent youtube embeds, X post embeds etc. on sites, but as you visit sites you trust you can slowly permanently allow these things if you feel like you can trust them.
    A great thing about the extension is that it puts out the "Do not track" (Global Privacy Control) signal to sites, which at least most lawful sites hosted in the USA respect.

    Settings you can set, including GPC.

    Blocked over 3k tracking domains to date.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 1 point 1 day ago

    these are super basic info what this slop site have showed me, and fucked up the resolution completely btw.

  • permalink
  • fedilink
  • source
    •
    [–] 5 points 1 day ago (2 children)

    The only thing it got wrong was my graphics card. I'm running a GTX 4060 and the site reads my graphics card as a GTX 980.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •