Open research, stronger privacy: Making Firefox users harder to fingerprint

ada-h00k

I think it's great that Firefox is finally doing more to combat fingerprinting. For a long time, they lagged a bit behind Brave in this regard. That said, unfortunately, neither browser has been able to do anything about Cloudflare Turnstile yet. Kagi, for example, uses it to fingerprint users.

zx8080

Am I the only expecting it to completely break the sites behind cloudflare on Firefox?

idbehold

I'd like to have some of the APIs that read the data used to fingerprint browsers be behind a confirmation dialog per site similar to allowing popups or microphone/video access. > Oh, I see that you'd like to read the canvas pixel data, let me check if that's okay with the user first.

theyeenzbeanz

One caveat I’ve experienced with Firefox branches that focus on privacy is I get “punished” with captchas from hell because I refuse to let websites siphon and prey on every last bit of private info. Hopefully this doesn’t succumb to the same issue.

asciimoo

Too bad they still generate a random unique ID for each installed extension that can expose a trackable UUID... https://bugzilla.mozilla.org/show_bug.cgi?id=1717671

MayeulC

I feel like I am commenting this under every post mentioning fingerprinting, but is there a technical reason access to fingerprinting information (screen resolution, battery level, etc) couldn't be made to "taint" the data/code, where the browser would then refuse to send off that data? Or anonymise it and replay the code before sending the request. Of course, there are legitimate use-cases: downloading specific assets based on client device, etc. And that's a whole can of worms of side channels to open, but that would feel like a useful additional layer of defense, and the paranoia level could be configured. The price might be subtle bugs, and/or a permission dialog that most people will ignore. I am asking this as, from what I've seen, most websites do not need complex interactions: the battery level will be used to render a battery indicator, etc. XHRs do not usually depend on such data.

lwansbrough

Some people seem to be under the false illusion that the free and open web will continue to function without fingerprinting. For those of us actually on the front line combatting previously unseen volumes abuse from bots, the thought of losing even more access to important signals sounds cursed. Privacy may have to take a back seat so we can keep services online until we can figure out anonymous proof of humanity. Unpopular opinion, I know.

nxobject

Your move, Apple.