Firefox is getting more browser fingerprinting protection courtesy of Tor Browser's "letterboxing" technique

Cory Doctorow 10:56 am Thu Mar 7, 2019

Even if you block cookies, many sites still track you with "browser fingerprinting," that use the unique combination of your screen resolution, browser and OS version, installed fonts and plugins, and other data that allows you to be reliably identified between sessions and across sites.

To fight this, the Tor Browser uses a technique called "letterboxing," that reports browser size rounded down to 100px increments, meaning that in nearly every case, your browser has the same dimensions as millions of other users' browsers; once the page has loaded and your browser has ceased to interact with the server, the content is resized to the true dimensions of your window.

The feature has been a part of Tor Browser since 2015; now it is being integrted into Firefox (Tor Browser is a derivative of the Firefox browser). It's part of "Tor Uplift," which is gradually moving privacy features from Tor Browser into Firefox. Firefox has already implemented other anti-fingerprinting techniques from Tor, including a blacklist of known-fingerprinting domains, protection for font-based fingerprinting, anti-HTML5 fingerprinting countermeasures, and per-domain cookie separation.

According to a Bugzilla entry, this is how Firefox's letterboxing protection works in these two states:

When the user maximizes the window, the largest possible viewport is used, again a multiple of 200 x 100. Empty gray margins in the chrome part of the window cover the rest of the screen. Similarly, in fullscreen, the viewport is again given dimensions a multiple of 200 x 100, and the chrome areas around it are set to black.

Finally, an extra zoom was applied to the viewport in fullscreen and maximized modes to use as much of the screen as possible and minimize the size of the empty margins. In that case, the window had a "letterbox" (margins at top and bottom only) or "pillbox" (margins at left and right only) appearance. window.devicePixelRatio was always spoofed to 1.0 even when device pixels != CSS pixels.

The only thing that's missing in Firefox's letterboxing support is the warning that the Tor Browser shows users when users are maximizing their window.

When privacy.resistFingerprinting=true, dynamically round content dimensions [Bugzilla]

Firefox to add Tor Browser anti-fingerprinting technique called letterboxing [Catalin Cimpanu/Zdnet]

(via /.)

U.S. is investigating claims that TikTok violated children's privacy

The FTC and the Justice Department are investigating claims that TikTok, the popular social media app with close ties to China, violated a 2019 agreement to protect children's privacy. READ THE REST
CCPA: California to enforce new digital privacy law starting today, despite calls for further pandemic delay

New data privacy law took effect in January, with a six-month grace period READ THE REST
IRS says it bought in to location database for millions of US cellphones to track tax crime suspects

The United States Internal Revenue Service says it purchased access to a marketing database that offers location data for millions of US cellphones, so the IRS can identify and track… READ THE REST
Short Post, just one paragraph

Dessert cheesecake wafer bear claw fruitcake. Fruitcake chupa chups donut candy canes marzipan. Apple pie sweet roll tart chocolate cake macaroon marshmallow carrot cake gummi bears sweet. Pastry sugar plum… READ THE REST
Save 50% on a 1-year subscription to Dashlane's premium password manager

We all know vital information about ourselves and our private digital accounts can be compromised by cybercriminals. However, many would be frightened to know just how compromised they and their… READ THE REST
The Bite Helper removes the itch of a mosquito bite in seconds

While mosquitoes have certainly earned their title as the deadliest animal on earth, their impact on most of our lives is usually a lot less consequential. But even though they… READ THE REST