Monday, May 04, 2020

Re: Tor Browser font fingerprinting defense

Hi,



Thank you Caspar for taking the time.

I am sadly not in a position to test the port at the moment.

But there is no need to wait for my confirmation as my process was not any
more sophisticated than visiting <https://panopticlick.eff.org> and having it
test the browser and then pressing "Show full results for fingerprinting". If
for any entry the value for "one in _x_ browsers have this value" is any
bigger than a number low in the 2 digits something is up.



A more robust test could be against the tor projects own test suite <https://t
rac.torproject.org/projects/tor/wiki/doc/TorBrowser/Hacking#FPCentral> , but I
don't know what it's current status is.

It might be worth it to just ask someone on the tor-talk mailing list about
this.

<https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk/>



I don't think we need to point out that there is no warranty, but I think we
should state how close we think we are to providing a tor browser "doing what
we think it should do".

I think getting close to feature parity here is/would be a major achievement
and a work well done.

When done our upstream could be convinced to advertise OpenBSDs ability to get
a proper tor browser by just doing "pkg_add tor-browser" on the
<https://www.torproject.org/download/> page, which I personally think would be
neat.

That too would be a topic for their mailing list.



Being aware that I am not actually doing much of this work myself, I want to
again state my appreciation for what you people do here.



Cheers!

No comments:

Post a Comment