279
submitted 6 months ago by lemmyreader@lemmy.ml to c/privacy@lemmy.ml

It was at the Securedrop website. How did I end up there ? I read something about Sequoia and encryption and then wanted to see what Securedrop entailed.

Meanwhile I've raised the security settings. Still, today someone in this community (?) mentioned that Tor browser does not protect the remote to check for the OS, and now this. Color me surprised.

you are viewing a single comment's thread
view the rest of the comments
[-] Redjard@lemmy.dbzer0.com 7 points 6 months ago

That can't have been the reason, rather the fact it could tell.
Your browser sends information about its version and the os in the useragent string. It is supposed to lie and say it is a very commonly used useragent, specifically for purposes of fingerprinting. That would be windows, default configuration, firefox version something not you firefox version

[-] Deckweiss@lemmy.world 1 points 6 months ago

The underlying OS will be detected regardless of the useragent.

[-] Redjard@lemmy.dbzer0.com 9 points 6 months ago

That would be a fail of the fingerprinting protection. A properly set up TOR browser for example should not allow that detection by any means. If you know how to detect it, please report it as a critical vulnerability.

I could think of maybe some edge case behavior in webrenderer or js cavas etc., which would mainly expose info on the specific browser and underlying hardware, but that is all of course blocked of or fixed in hardened browsers.

Further, if you have a reliable method, you could sell it off to for example Netflix, who are trying to block higher resolutions for Linux browsers but are currently foiled by changing the useragent (if you have widevine set up).

[-] ComradeEd@lemmygrad.ml 3 points 6 months ago

That would be a fail of the fingerprinting protection

It isn't.

A properly set up TOR browser for example should not allow that detection by any means.

Yes it should, through Javascript. https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26146#note_2649490

[-] monk@lemmy.unboiled.info 1 points 6 months ago

Blocking UA access via JS alone is not enough.

[-] Atemu@lemmy.ml 1 points 6 months ago

Do you have a better source than a 5 y/o comment in an issue?

[-] ComradeEd@lemmygrad.ml 4 points 6 months ago* (last edited 6 months ago)

Trust me, I spent 3 years in the Tor community I know this shit, this thing comes up so often.

Alternatively: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41610

load more comments (17 replies)
load more comments (17 replies)
load more comments (17 replies)
this post was submitted on 23 Apr 2024
279 points (98.6% liked)

Privacy

31971 readers
324 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS