User.js: Another fingerprinting test

[publicarray]

https://audiofingerprint.openwpm.com/ 🔈

[nodiscc]

ajax.googleapis.com can also be avoided by using https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/ - https://github.com/Synzvato/decentraleyes - A Firefox add-on that emulates Content Delivery Networks (CDNs) locally by intercepting requests, finding the required resource and injecting it into the environment.

@pyllyukko I think you might want to add this addon to the recommended list.

[nodiscc]

Is it really necessary if we use NoScript?

Nope. But in some instances when using NoScript or other Js blocking solutions, you have to whitelist a CDN when a page requires it to interact with basic functionality (for example stackexchange websites require googleapis for anything except simple logged-out browsing, etc etc).

I doubt someone really can hack or abuse any Google service since they are constantly evolved and under active development,

I doubt someone really can hack

Better safe than sorry. In case of a MitM attack on ajax.googleapis.com the attacker would have the ability to inject custom javascript in pages (_if_ the CDN has been whitelisted). Layered security. ajax.googleapis.com is only authenticated using TLS, which has been proved vulnerable in the past :)

I agree that Decentraleyes is still in beta. Whether we should wait to recommend it or not, I don't know. user.js already has some "experimental" (and sometimes breaking) settings, so why not. It works fine for me.

[publicarray]

If you like to learn more I suggest to have a look at https://webtransparency.cs.princeton.edu/webcensus/index.html.
These guys have recently done a study on website tracking: http://randomwalker.info/publications/OpenWPM_1_million_site_tracking_measurement.pdf
It is by the same university who have released the fingerprint tool I linked to above.

[Ileca]

Since I am using user.js, I always wondered why it is not enforcing the strict list of the tracking protection but I guess it's because it breaks usability too much?
Like nodiscc said, because of google CDN used for hosting jQuery broking a lot of important features (arf, yes, stackexchange nebula, I asked them if they could use the Jquery CDN but they didn't answer so I guess they prefer their users to be tracked than losing perf), this extension should be better than my crappy resources reallocating user-script which work half the time. >.>
If someone can enlighten me with another good customizable add-on (or something else) that can redirect resources (or do html replacement) AND work with the new WebExtensions, I would appreciate.

It's a matter of opinion but I think that allowing something like the almighty google CDN is defeating the purpose of that user.js even if you are forced to find hacks.

Btw, like we are talking about CDN and Disconnect, isn't that weird that Disconnect's filters in Ublock are hosted by amazonaws? I mean, Amazon!

[pyllyukko]

Since I am using user.js, I always wondered why it is not enforcing the strict list of the tracking protection but I guess it's because it breaks usability too much?

Well the real reason is, that I couldn't figure out a way to change this in user.js. It seems to work a bit differently. It is documented in the README though. But... it does indeed break a lot of sites, so it's better to leave it for the user in that sense also.

[pyllyukko]

Regarding Decentraleyes:

@pyllyukko I think you might want to add this addon to the recommended list.

Please open a separate issue so we can discuss this. I haven't used this add-on, so I have zero knowledge about it, so I can't add it straight away.

[Ileca]

Well the real reason is, that I couldn't figure out a way to change this in user.js. It seems to work a bit differently. It is documented in the README though. But... it does indeed break a lot of sites, so it's better to leave it for the user in that sense also.

urlclassifier.trackingTable > test-track-simple,mozfull-track-digest256
https://wiki.mozilla.org/Security/Tracking_protection#Lists

@CHEF-KOCH: I don't understand why you are focusing on CDN surface attack when, at least me, was talking about tracking by the owner of the CDN himself.
For example, Amazon knows who is using uBlock Origin with the Disconnect lists and which ones and I find that as suspect as how much you find Ghostery suspect because it's a close source.

I don't understand too how blocking stuff at the browser source will result in less tracking. You are cutting the data source, not faking them, which is the same as cutting the data source with the UI.

[nodiscc]

We may could use and clean this thread to submit fingerprint pages

1 issue/PR for each test. Crawling through comments is a waste of time.

[Gitoffthelawn]

I shared this fingerprinting test (https://audiofingerprint.openwpm.com/) with several friends and colleagues, but I received some negative responses because there is no option to opt-out of them "collect[ing] the fingerprint along with a randomly assigned identifier, your IP Address, and your User-Agent and store it in a private database". As we all know, there is no such thing as a private database, especially in the USA where that test is located.

Is there a similar online test that does not store data (I could have people host it themselves, but that is too much work for many)?

Similarly is there a test I can share with others that just reports _Canvas, Javascript, and Flash Font Detection_ without storing any data?

[Gitoffthelawn]

@CHEF-KOCH Thanks. I agree with everything you said. Yes, any server may keep logs, but most sites just keep them for diagnostics and then delete them after 1-30 days. But that one explicitly states that they collect multiple pieces of data and maintain that data in a database. It doesn't sound like they ever delete any of the data. It's probably not even encrypted.

So I'm just wondering if there are other sites that run the same tests, but don't collect data. Of course, they _could_, but that's at least a step better than knowing they do.

I'm interested in both the audio tests and the Canvas, Javascript, and Flash font detection. No problem if it takes a combination of 2 or more sites.

[nodiscc]

So what should we do about this issue? Add the fingerprinting test to the README? Or can this issue be closed

[pyllyukko]

It's there now: 35cde05c15561d5c6a1d16c7d8494eb3a08df204

[pyllyukko]

Thanks @publicarray, for bringing this up! And @CHEF-KOCH for the PR.

[pyllyukko]

The con is what you've said, it's maybe not that easy to scroll trough the comments. I'm unsure, if it's better to submit each stuff at it's own then we can close it.

Each stuff at it's own, thank you :) There is so much discussion going on in all these issues (thank you all for that!), that it's better to discuss each topic on it's own "thread" and try to keep on the subject.

[Thorin-Oakenpants]

FYI:
// disable Web Audio API (FF51+)
// https://bugzilla.mozilla.org/show_bug.cgi?id=1288359
user_pref("dom.webaudio.enabled", false);

[pyllyukko]

@Roman-Nopantski: Thanks!