Privacy

31871 readers

406 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

Chat rooms

[Matrix/Element]Dead
Discord

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

[email protected]

279

Today I got greeted on a Tor friendly website (lemmy.ml)

submitted 6 months ago by [email protected] to c/[email protected]

39 comments fedilink hide all child comments

It was at the Securedrop website. How did I end up there ? I read something about Sequoia and encryption and then wanted to see what Securedrop entailed.

Meanwhile I've raised the security settings. Still, today someone in this community (?) mentioned that Tor browser does not protect the remote to check for the OS, and now this. Color me surprised.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 3 points 6 months ago* (last edited 6 months ago) (15 children)

What do you mean by "properly configured"

Here is a screenshot of the default Tor Browser, installed from the repos, no config changes made. As you can see, creepjs can detect that I am using Linux.

Obviously, if you disable js, then the site doesn't work. Not sure if there are ways to detect the OS without javascript.

One common way to analyze the OS if all else fails is to look which fonts are installed. This is done by rendering thousands of divs with some text out of sight of the user. Each div with a different font. If the div width changes compared to the default, you know a font is installed. Different OS have different sets of fonts by default. Not sure if flatpak/flatseal (or other containerization methods) could protect against that. Technically you can install the exact set of Windows fonts and uninstall all Linux fonts, but I'd expect some linux app breakage and general uglyness.

An online search I did for how to completely hide the OS without breaking most websites did not result in anything except runnjng the browser in a Windows VM.

EDIT:

Per default tor has a linux useragent. And I can't seem to change it with the useragent switcher or with about config override. So yeah... even better.

[–] [email protected] 2 points 6 months ago (12 children)

Per default tor has a linux useragent. And I can’t seem to change it with the useragent switcher or with about config override. So yeah… even better.

As far as I know Tor browser defaults to a Windows useragent string since years. Just double-checked by visiting a website I maintain and checked its web-server log files :

"Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0"

My results with LibreWolf are the same : also Windows. Plain Firefox shows the correct real OS Linux as useragent string.

[–] [email protected] 1 points 6 months ago* (last edited 6 months ago) (11 children)

How comes my useragent is Linux then? I just installed it fresh trom the arch official repos for the first time to test. Creepjs shows the useragent further down (not in this screenshot) and I visited other test sites as well.