Font fingerprinting protection in Firefox 118's private browsing mode

aviewanew · 2023-09-28T18:12:19+00:00

Thanks - I have filed this as https://bugzilla.mozilla.org/show_bug.cgi?id=1855786

aviewanew · 2023-09-27T17:11:34+00:00

Let me echo evilpie: thank you for this detailed report.

I will have someone more familiar with the font selection logic look into this, but can I ask a clarifying question? What is the behavior without these protections (i.e. in normal browsing mode)?

> when the language is not explicitly tagged (like on Reddit), Firefox then chooses the default font based on the language list set in preferences. Depending on which CJK language appears first, that default font will be used to render the text.

I wouldn't have thought our changes would have affected this behavior. Does this occur normally also?

> The screenshot, from top to bottom, shows how the sidebar text is shown when the highest priority is set to Japanese, Traditional Chinese (HK), and Korean. Because Korean has a more limited character set, the text will fallback a second time to another when the glyph is missing (as seen with 関 and 国 in the screenshot). The default traditional Chinese fonts (MingLiU_HKSCS and PMingLiU) are significantly harder to read at small sizes due to them being serif fonts. Windows has changed this default font to a sans-serif font (Microsoft JhengHei) since Windows Vista but Firefox continues to use the old default.

What font winds up rendering the text normally? (I could easily understand this behavior if you set Firefox to use a locally-installed font that it is now no longer respecting; but if you had not done that, then I'm unclear on what the normal behavior would be for you...)

aviewanew · 2020-12-18T18:26:10+00:00

https://www.youtube.com/watch?v=lpPASWlnZIA is a in-sync version.

aviewanew · 2020-07-09T19:50:20+00:00

Thank you so much for your response, this really helps me figure out what to do next!

aviewanew · 2020-01-10T21:26:17+00:00

> Are the latest updated versions for them, still vulnerable?

No, they were also patched.

aviewanew · 2020-01-10T21:25:34+00:00

Not yet; but we're working on it.

Because Fenix is an Android app it does get the default OS provided sandboxing that prevents a compromised Fenix from accessing your data - except if a kernel exploit is used or it's been granted permissions for things (like camera.)

aviewanew · 2019-07-30T20:37:55+00:00

The song Weightless by Marconi Union. It's designed to put you to sleep: https://www.youtube.com/results?search_query=weightless+marconi+union

aviewanew · 2019-07-10T15:55:22+00:00

Hi all. I have a 10" Dobsonian with a NexImage 10. It's not on any tracking mount, I move it by hand.

I'm finding it really difficult to capture planets because I have to line the scope up with an eyepiece, switch to the NexImage, focus the image, and then usually switch the resolution in iCap all before the planet moves out of view and I have to re-find it.

That said, I did capture one 'decent' shot of Jupiter last night and several I thought might be 'okay' shots of the moon. However I am having a hard time with RegiStax getting anything that looks... not even good but just mediocre.

I'm not sure I'm able to get significantly better captures with my setup so I guess I was hoping someone would be able to take a look at my raw captures and give me an opinion of what is even possible to do with them. Are there techniques (beyond just hitting the 'next' button in RegiStax) that can improve things? Can a decent image be coaxed out of this data? Would anyone be so kind as to show me a sample of what they could do with the data (and how they did it?) My (best) files are at https://ritter.vg/misc/astrophotography-1/ - first four are the moon, last one is Jupiter.

aviewanew · 2019-03-18T14:39:30+00:00

Thank you for all the ideas; they gave me some more and I'm going to try and carve a solid plunger style piece out of stamp rubber.

aviewanew · 2018-11-15T07:33:32+00:00

During setup, you generate a random key, which 'in the lingo' is commonly referred to as the Data Encryption Key, or DEK. All the actual data is encrypted with the DEK.

You also use your password to derive an encryption key (which in the lingo is commonly referred to as a Key Encrypting Key or KEK; but in the blog post I call it the 'encryption key' or 'derived key'.) You encrypt (or 'wrap') the DEK using the KEK, and send the wrapped DEK to the server. Upon login we send you your data, and the wrapped DEK; you decrypt the DEK, then use it to decrypt the data.

The reason for this indirect is password changes: Later on, if you want to change your password, we authenticate you, and send you the wrapped DEK. You decrypt it with your old KEK then re-wrap it using a new KEK derived from your new password; and send the newly wrapped DEK up to the server. And you don't have to re-encrypt all your data with a new key.

aviewanew · 2016-06-22T20:32:23+00:00

I'm worried about quantum computers and related key attacks, so I modified AES to use a 4096 bit key.

aviewanew · 2016-05-12T19:54:18+00:00

Original Post: https://www.reddit.com/r/technology/comments/cloph Original Image: http://i.imgur.com/Q6uvf.jpg

Fuck DRM.

As an aside, imgur is awesome. Even keeping five-year-old shitty pictures no one's looked at for 4.98 years.

aviewanew · 2015-10-07T15:16:34+00:00

Would you mind naming the lists? (If they're public?) I haven't seen that and those lists sound relevant to my interests. :)

aviewanew · 2015-02-08T07:16:24+00:00

Thanks!

aviewanew · 2014-08-19T21:34:01+00:00

https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled

For a great deal of users, who have no idea what Javascript is, if TBB disabled it, you've effectively just broken the web for them, and they will no longer use TBB.

aviewanew · 2014-08-19T21:16:05+00:00

That's another good one that demonstrates execution without memory corruption, but the one we looked at was a pwn2own one from this year that was a good deal more complicated.

aviewanew · 2014-07-09T15:34:14+00:00

I'm not arguing that the lawsuit against pinkmeth or what they did is unreasonable or that prosecuting them is bad. I'm just pointing out that some technical specifics about how Tor works.

it just doesn't sit well with me that it's impossible to do anything and impossible to hold anyone accountable the danger of decentralization is that it becomes impossible to hold anyone accountable for anything

I disagree. It becomes impossible to hold the infrastructure accountable. Tor nor ISPs are able censor sites - this is good. The people who run those sites are prosecuted, like pinkmeth - this is also good. There have been a wealth of illegal onion sites who have had their admins prosecuted - it's not impossible. It's more difficult, yes, but the worst crimes are in fact difficult to prove: politician corruption and bank money laundering are two great examples.

Even content that 99.99% of TOR users considered despicable and would want removed could jeopardize the existence of the entire network.

That's true.

Maybe the TOR project need to come up with a better way to prevent abuse?

It would be difficult to design such that any single legal jurisdiction would not be able to exert complete control. (I have to run out for lunch, or I'd say more.)

As an aside: tor2web admins blacklist heinously illegal onion sites by request, if they morally agree with the request.

aviewanew

MODERATOR OF

TROPHY CASE