Delivery-Date: Tue, 29 Jul 2014 14:42:25 -0400
Return-Path: <tor-talk-bounces@lists.torproject.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on moria.seul.org
X-Spam-Level: 
X-Spam-Status: No, score=-4.3 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
	FROM_LOCAL_NOVOWEL,RCVD_IN_DNSWL_MED,RP_MATCHES_RCVD autolearn=ham
	version=3.3.1
X-Original-To: archiver@seul.org
Delivered-To: archiver@seul.org
Received: from eugeni.torproject.org (eugeni.torproject.org [38.229.72.13])
	(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by khazad-dum.seul.org (Postfix) with ESMTPS id A001E1E068C
	for <archiver@seul.org>; Tue, 29 Jul 2014 14:42:23 -0400 (EDT)
Received: from eugeni.torproject.org (localhost [127.0.0.1])
	by eugeni.torproject.org (Postfix) with ESMTP id 66CF62FF2E;
	Tue, 29 Jul 2014 18:42:13 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by eugeni.torproject.org (Postfix) with ESMTP id 954A930649
 for <tor-talk@lists.torproject.org>; Tue, 29 Jul 2014 18:29:52 +0000 (UTC)
X-Virus-Scanned: Debian amavisd-new at eugeni.torproject.org
Received: from eugeni.torproject.org ([127.0.0.1])
 by localhost (eugeni.torproject.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id U_ys4X1qp98a for <tor-talk@lists.torproject.org>;
 Tue, 29 Jul 2014 18:29:52 +0000 (UTC)
Received: from mout.gmx.com (mout.gmx.com [74.208.4.200])
 (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by eugeni.torproject.org (Postfix) with ESMTPS id 6995C2FAEE
 for <tor-talk@lists.torproject.org>; Tue, 29 Jul 2014 18:29:52 +0000 (UTC)
Received: from [127.0.0.1] ([99.190.181.188]) by mail.gmx.com (mrgmxus002)
 with ESMTPSA (Nemesis) id 0MQ3G9-1X6zUM1s5D-005Eph for
 <tor-talk@lists.torproject.org>; Tue, 29 Jul 2014 20:29:49 +0200
Message-ID: <53D7E802.8020700@gmx.com>
Date: Tue, 29 Jul 2014 13:29:22 -0500
From: Joe Btfsplk <joebtfsplk@gmx.com>
User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64;
 rv:24.0) Gecko/20100101 Thunderbird/24.6.0
MIME-Version: 1.0
To: tor-talk@lists.torproject.org
References: <53D3F004.6070209@yandex.ru> <53D412F9.4030107@googlemail.com>
 <53D6B3F0.8030706@yandex.ru> <53D6E666.9070108@gmx.com>
 <CACf9JSVq5GT+GEysOs0oGBBUy52Nq3XpWsL4j4FD0EAk9RDuPw@mail.gmail.com>
In-Reply-To: <CACf9JSVq5GT+GEysOs0oGBBUy52Nq3XpWsL4j4FD0EAk9RDuPw@mail.gmail.com>
X-Provags-ID: V03:K0:93nB7jeb75ImknLkA7zitT+SBB07hxxajIV6G8QV5Faw9gvDAiY
 qJd++qVVe79xsJQ8CS5pLDsn1bGkAiCKnCwUF+tQJCCU53pLT3gskQYKwadGKxB/cwTHTaR
 hH6EuEZcvkYK3v1kogWb5YTOwBqA2yJuPiacC93PqlvRRI6NBKiwygd5wbe09ONJTt7yb9g
 96qLmwXR45K29nc6CdAyA==
X-Content-Filtered-By: Mailman/MimeDel 2.1.15
Subject: Re: [tor-talk] Spoofing a browser profile to prevent fingerprinting
X-BeenThere: tor-talk@lists.torproject.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: tor-talk@lists.torproject.org
List-Id: "all discussion about theory, design,
 and development of Onion Routing" <tor-talk.lists.torproject.org>
List-Unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
List-Archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-Post: <mailto:tor-talk@lists.torproject.org>
List-Help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-Subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: tor-talk-bounces@lists.torproject.org
Sender: "tor-talk" <tor-talk-bounces@lists.torproject.org>


On 7/29/2014 12:16 AM, Ben Bailess wrote:
> There are some built-in protections in TBB that keep honored requests for
> known fingerprinting data to a minimum, so the TBB does not function like a
> normal browser in this instance.
>
> It most notably limits the high entropy factors -- responses for fonts and
> plugin microversions. And as long as you obey the nice Tor devs and don't
> install any additional plugins, then plugin microversions won't be
> unique/identifiable either. *So enabling JS really isn't quite as big* of a
> step out into the light as it would be in say Chromium or Firefox, which
> has no protections against HTML5 canvas fingerprinting (or anything by
> default) for instance.
[Emphasis Added].  Don't know about enabling JS not being "big."
This isn't a "feeling" topic or discussion (general statement, not aimed 
at anyone).
Either we use facts (as best understood) to make decisions on this, or 
we don't.

I'm no expert on fine details of this, but over a long time of checking 
TBB, Firefox, JonDo Fox, etc., on multiple test sites, it's always clear 
that far more info is available when JS is enabled.
The EFF says ~ 33 bits of identifying info (ii) are needed to accurately 
identify the same browser / machine at multiple sites.

Even if that's just a ball park figure, when I visit Panopticlick, 
BrowserSpy.dk & others (many times, many browser versions, spread out 
over a yr +) , the difference in bits ii when JS is enabled or disabled, 
goes from well below 33 bits (in mid 20's) to well over 40 bits.
It's the same in vanilla Fx.
In vanilla Fx & NoScript - JS disabled, test sites might show * 24  bits 
of ii *.  Nearly as good as TBB w/ JS disabled.  Well under EFF's 
threshold to accurately identify a browser / device.
Enable JS in vanilla Fx & it shoots to * > 43 bits ii * (again, 
essentially the same as TBB under same scenario).

That appears to mean that vanilla Fx & NoScript w/ JS disabled, is no 
more * identifiable * as "the same browser" than TBB w/ JS disabled.
So either EFF's (& others) estimation on what's needed to identify a 
browser is considerably off, or enabling JS is a * BIG * deal.

>
> So if allowing at least some JavaScipt is inevitable, then I think the Tor
> devs have the right idea -- assume that some use of JS is a foregone
> conclusion and protect the users from the additional exposure to
> fingerprinting in a way that makes them all look as similar as possible.
>
> If the user prefers to have more privacy / security by forsaking some
> anonymity by disabling JavaScript and thereby making him/herself
> identifiable as a smaller subset of overall Tor Browser users, that's
> his/her option.
Yes, in a smaller subset.  But, what good is being in a larger set of 
Tor users (that leave JS enabled), if doing so allows sites / trackers 
to clearly identify the same browser at multiple sites, or even end to 
end of Tor circuits, for advanced adversaries?
"Hiding" in a crowd, where you're still clearly identifiable doesn't 
make much sense.

Back to one main school of thought:  * an adversary needs X bits of 
identifying info * to accurately identify the same browser at multiple 
sites, or end to end in Tor circuits.
Do you want to be in a large crowd, where everyone reveals well over the 
required bits ii needed to accurately identify each one?
Or be in a smaller crowd, but users can't be individually identified - 
end to end, or site to site?

Unless this business of "necessary bits of identifying info to identify 
the same browser" is inaccurate & blown out of proportion.
That's where I have to rely on * real * experts.  Not on feelings or 
supposition.
Either the results from repeated tests I've done, separated by many 
months, are meaningful or they're not.
Either ~ 33 bits of info (or anything close) will allow identifying a 
browser, or it won't.

>   But in that instance, said user should probably be using
> Tails to remedy those sorts of problems since Tails addresses even more
> fingerprinting issues.
>
If Tails, or any other means is needed to provide anonymity (while still 
being able to actually use the web), then those should be a part of Tor 
/ TBB.
Unless the only goal is to hide destinations from ones ISP, then 
providing only part of what's needed in TBB for reasonable anonymity is...
*"Here's a browser / network that'll hide your IPa.  BTW, if you use it 
w/ JS, you can be identified at each end of a circuit and at each website."*
-- 
tor-talk mailing list - tor-talk@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

