this post was submitted on 23 Apr 2024
279 points (98.6% liked)

Privacy

31946 readers
672 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

It was at the Securedrop website. How did I end up there ? I read something about Sequoia and encryption and then wanted to see what Securedrop entailed.

Meanwhile I've raised the security settings. Still, today someone in this community (?) mentioned that Tor browser does not protect the remote to check for the OS, and now this. Color me surprised.

you are viewing a single comment's thread
view the rest of the comments
[–] Deckweiss@lemmy.world 1 points 6 months ago (1 children)

The underlying OS will be detected regardless of the useragent.

[–] Redjard@lemmy.dbzer0.com 9 points 6 months ago (2 children)

That would be a fail of the fingerprinting protection. A properly set up TOR browser for example should not allow that detection by any means. If you know how to detect it, please report it as a critical vulnerability.

I could think of maybe some edge case behavior in webrenderer or js cavas etc., which would mainly expose info on the specific browser and underlying hardware, but that is all of course blocked of or fixed in hardened browsers.

Further, if you have a reliable method, you could sell it off to for example Netflix, who are trying to block higher resolutions for Linux browsers but are currently foiled by changing the useragent (if you have widevine set up).

[–] ComradeEd@lemmygrad.ml 3 points 6 months ago (2 children)

That would be a fail of the fingerprinting protection

It isn't.

A properly set up TOR browser for example should not allow that detection by any means.

Yes it should, through Javascript. https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26146#note_2649490

[–] monk@lemmy.unboiled.info 1 points 6 months ago

Blocking UA access via JS alone is not enough.

[–] Atemu@lemmy.ml 1 points 6 months ago (1 children)

Do you have a better source than a 5 y/o comment in an issue?

[–] ComradeEd@lemmygrad.ml 4 points 6 months ago* (last edited 6 months ago)

Trust me, I spent 3 years in the Tor community I know this shit, this thing comes up so often.

Alternatively: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41610

[–] Deckweiss@lemmy.world 3 points 6 months ago* (last edited 6 months ago) (2 children)

What do you mean by "properly configured"

Here is a screenshot of the default Tor Browser, installed from the repos, no config changes made. As you can see, creepjs can detect that I am using Linux.

Obviously, if you disable js, then the site doesn't work. Not sure if there are ways to detect the OS without javascript.

One common way to analyze the OS if all else fails is to look which fonts are installed. This is done by rendering thousands of divs with some text out of sight of the user. Each div with a different font. If the div width changes compared to the default, you know a font is installed. Different OS have different sets of fonts by default. Not sure if flatpak/flatseal (or other containerization methods) could protect against that. Technically you can install the exact set of Windows fonts and uninstall all Linux fonts, but I'd expect some linux app breakage and general uglyness.

An online search I did for how to completely hide the OS without breaking most websites did not result in anything except runnjng the browser in a Windows VM.

EDIT:

Per default tor has a linux useragent. And I can't seem to change it with the useragent switcher or with about config override. So yeah... even better.

[–] Redjard@lemmy.dbzer0.com 2 points 6 months ago* (last edited 6 months ago) (1 children)

Default linux works too ofc, I didn't know they took that route.
Most other browsers have very specific useragents, so the main pool of same useragents will be hardened browsers anyway.

Thank you for checking

edit:
https://github.com/TheTorProject/tor-messenger-build/blob/581ba7d2f5f9c22d9c9182a45c12bcf8c1f57e6e/projects/instantbird/0001-Set-Tor-Messenger-preferences.patch#L354 would indicate it should be Windows, Ill check later.
Try it with high security settings in tor, it might be something like canvas. Did you enable any permissions for the website?

[–] Deckweiss@lemmy.world 1 points 6 months ago

Can you share your creepjs results with tor when you have some time to check it out?

[–] lemmyreader@lemmy.ml 2 points 6 months ago (1 children)

Per default tor has a linux useragent. And I can’t seem to change it with the useragent switcher or with about config override. So yeah… even better.

As far as I know Tor browser defaults to a Windows useragent string since years. Just double-checked by visiting a website I maintain and checked its web-server log files :

"Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0"

My results with LibreWolf are the same : also Windows. Plain Firefox shows the correct real OS Linux as useragent string.

[–] Deckweiss@lemmy.world 1 points 6 months ago* (last edited 6 months ago) (3 children)

How comes my useragent is Linux then? I just installed it fresh trom the arch repos. creepjs shows the useragent further down and I visited other test sites as well.

[–] lemmyreader@lemmy.ml 2 points 6 months ago (1 children)

Here some proof of my claim that Tor browser useragent string is Windows : https://wiki.archlinux.org/title/Firefox/Privacy#Change_user_agent_and_platform

Tip:

The value Mozilla/5.0 (Windows NT 10.0; rv:102.0) Gecko/20100101 Firefox/102.0 is used as the user agent for the Tor browser, thus being very common.

From five years ago, afaik suggesting Windows is the default : https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26146

[–] Syn_Attck@lemmy.today 1 points 6 months ago* (last edited 6 months ago) (2 children)

~~Tor browser from the arch repos is not stock torbrowser. Add repos for torproject/guardian project/whatever it's called now, or use the torproject.org installer.~~

[–] ComradeEd@lemmygrad.ml 1 points 6 months ago* (last edited 6 months ago) (1 children)

Yes it is. Since what the arch repos have is a script to download TB from torproject.org

Add repos for torproject/guardian project/whatever it’s called now, or use the torproject.org installer.

You're thinking of F-Droid (on Android), at least that is what the Guardian Project repo is for.

[–] Syn_Attck@lemmy.today 2 points 6 months ago

Thanks for the correction.

[–] lemmyreader@lemmy.ml 1 points 6 months ago (1 children)

Are you saying that Arch Linux is providing Tor browser with a different useragent string ?

[–] Syn_Attck@lemmy.today 2 points 6 months ago* (last edited 6 months ago) (1 children)

I believe that is the case, if you inspected the HTTP headers and found if to show Linux instead of Windows. my last experience with that would have been years ago. Arch does like to compile things from source instead of using binary blobs, and compilers and configs can undo a lot of the work the torproject has done to combat fingerprinting, which is why it's recommended to run the pre-built binary and install no plugins. However it's important to note that it ALSO gives you a unique JavaScript fingerprint every time, when tools use as much information as possible to generate a fingerprint, because it generates new information on every reload. That's why OPSEC is important and for can't help you if you use it wrong. If you login to 2 different unlinked sites in the same session, and you don't want them to be linked, too bad now they're linked via JS fingerprinting. JavaScript is more or less a programming language within the browser, and you'll never escape JavaScript fingerprinting. Which is why it's important to learn how to use tor properly, and leave JS disabled as much as you can.

One thing you can do with your arch build is use the fingerprinting tool to see how unique you are, then get a new identity, then go back and do it again. Does it now say you're one of 2 people who have used the tool, or does it show you're (again) unique? If the latter, then it's working (at least enough) properly.

[–] lemmyreader@lemmy.ml 1 points 6 months ago (1 children)

One thing you can do with your arch build is use the fingerprinting tool to see how unique you are, then get a new identity, then go back and do it again. Does it now say you’re one of 2 people who have used the tool, or does it show you’re (again) unique? If the latter, then it’s working (at least enough) properly.

Interesting. I would have expected the useragent string to be part of the user configuration files that are automatically created in the browser profile directory. I've not used Tor browser package from Arch yet but curious to do some testing.

[–] ComradeEd@lemmygrad.ml 2 points 6 months ago (1 children)

torbrowser-launcher (found in the extra repo) simply downloads Tor Browser from torproject.org, unless you use some AUR version of Tor Browser that recompiles it, you are getting the exact same TB as you would by manually downloading it.

[–] lemmyreader@lemmy.ml 2 points 6 months ago

Thanks. AUR seems to only have a Tor browser bin which does not recompile.

[–] lemmyreader@lemmy.ml 2 points 6 months ago* (last edited 6 months ago)

Edit. I see what you mean now. CreepJS indeed shows userAgent Linux. Weird. It got the amount of cores wrong btw.

[–] ComradeEd@lemmygrad.ml 1 points 6 months ago

Becuase creepjs uses JS to figure out the userAgent, WorkerNavigator.userAgent