It was at the Securedrop website. How did I end up there ? I read something about Sequoia and encryption and then wanted to see what Securedrop entailed.
Meanwhile I’ve raised the security settings. Still, today someone in this community (?) mentioned that Tor browser does not protect the remote to check for the OS, and now this. Color me surprised.
You must log in or register to comment.
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 57 users / day
- 383 users / week
- 1.5K users / month
- 5.7K users / 6 months
- 1 subscriber
- 3.12K Posts
- 78K Comments
- Modlog
Thanks for the heads up. Yes, I tried CreepJS before and saw it found Linux as a result :/
But if it says Linux when you use windows then it doesn’t matter, right? The point is to make them all look the same
Tor browser useragent string pretends to be Windows on all platforms. CreepJS detects Linux in my case. A commenter mentions that Tor browser does not protect OS detection. That gives me mixed feelings about the goals of Tor browser.
There are many things you can do with JavaScript, and tor can only protect against so many without completely breaking many sites. Set your slider all the way to maximum and it will no longer detect windows, but it will very likely also no longer run.
That can’t have been the reason, rather the fact it could tell.
Your browser sends information about its version and the os in the useragent string. It is supposed to lie and say it is a very commonly used useragent, specifically for purposes of fingerprinting. That would be windows, default configuration, firefox version something not you firefox version
The underlying OS will be detected regardless of the useragent.
That would be a fail of the fingerprinting protection. A properly set up TOR browser for example should not allow that detection by any means. If you know how to detect it, please report it as a critical vulnerability.
I could think of maybe some edge case behavior in webrenderer or js cavas etc., which would mainly expose info on the specific browser and underlying hardware, but that is all of course blocked of or fixed in hardened browsers.
Further, if you have a reliable method, you could sell it off to for example Netflix, who are trying to block higher resolutions for Linux browsers but are currently foiled by changing the useragent (if you have widevine set up).
What do you mean by “properly configured”
Here is a screenshot of the default Tor Browser, installed from the repos, no config changes made. As you can see, creepjs can detect that I am using Linux.
Obviously, if you disable js, then the site doesn’t work. Not sure if there are ways to detect the OS without javascript.
One common way to analyze the OS if all else fails is to look which fonts are installed. This is done by rendering thousands of divs with some text out of sight of the user. Each div with a different font. If the div width changes compared to the default, you know a font is installed. Different OS have different sets of fonts by default. Not sure if flatpak/flatseal (or other containerization methods) could protect against that. Technically you can install the exact set of Windows fonts and uninstall all Linux fonts, but I’d expect some linux app breakage and general uglyness.
An online search I did for how to completely hide the OS without breaking most websites did not result in anything except runnjng the browser in a Windows VM.
EDIT:
Per default tor has a linux useragent. And I can’t seem to change it with the useragent switcher or with about config override. So yeah… even better.
As far as I know Tor browser defaults to a Windows useragent string since years. Just double-checked by visiting a website I maintain and checked its web-server log files :
My results with LibreWolf are the same : also Windows. Plain Firefox shows the correct real OS Linux as useragent string.
How comes my useragent is Linux then? I just installed it fresh trom the arch official repos for the first time to test. Creepjs shows the useragent further down (not in this screenshot) and I visited other test sites as well.
I’ll test it tomorrow by downloading it from the website.
Becuase creepjs uses JS to figure out the userAgent, WorkerNavigator.userAgent
Here some proof of my claim that Tor browser useragent string is Windows : https://wiki.archlinux.org/title/Firefox/Privacy#Change_user_agent_and_platform
From five years ago, afaik suggesting Windows is the default : https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26146
Tor browser from the arch repos is not stock torbrowser. Add repos for torproject/guardian project/whatever it’s called now, or use the torproject.org installer.Edit. I see what you mean now. CreepJS indeed shows userAgent Linux. Weird. It got the amount of cores wrong btw.
Default linux works too ofc, I didn’t know they took that route.
Most other browsers have very specific useragents, so the main pool of same useragents will be hardened browsers anyway.
Thank you for checking
edit:
https://github.com/TheTorProject/tor-messenger-build/blob/581ba7d2f5f9c22d9c9182a45c12bcf8c1f57e6e/projects/instantbird/0001-Set-Tor-Messenger-preferences.patch#L354 would indicate it should be Windows, Ill check later.
Try it with high security settings in tor, it might be something like canvas. Did you enable any permissions for the website?
Can you share your creepjs results with tor when you have some time to check it out?
It isn’t.
Yes it should, through Javascript. https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26146#note_2649490
Blocking UA access via JS alone is not enough.
Do you have a better source than a 5 y/o comment in an issue?
Trust me, I spent 3 years in the Tor community I know this shit, this thing comes up so often.
Alternatively: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41610