Reading between the lines of my #Tor dev mailing list post: lists.torproject.org/pipermail/tor-
How does breaking software monocultures affect fingerprinting?
CC:
#opsec #fingerprinting #privacy
Conversation
Also CC: . Curious about how changing the heap impl at the OS level, so even libc picks it up, would affect fingerprinting.
Or, generalized: how changing certain low-level OS bits affect fingerprinting.
1
I’d defer to and ... pretty much anyone who knows more about heap implementations than I do.
Opsec is too complex to make any categorical statements.
1
1
Agreed. From a JS-in-a-browser perspective, it'd be interesting to see how breaking monocultures of various low-level system components affects fingerprinting.
Does jemalloc produce different timings visible to JS than hardened_malloc? (Thinking out loud.)
1
1
Yes, definitely, see the thread I wrote at twitter.com/DanielMicay/st. Chromium uses the system allocator rather than TCMalloc on Android so Vanadium on GrapheneOS uses hardened_malloc. My assumption is that with JavaScript enabled it can be identified as Vanadium on GrapheneOS.
Quote Tweet
blog.jse.li/posts/chrome-7
This applies to many of the ongoing attempts at anti-fingerprinting across browsers. Performance testing can bypass many of the attempts at hiding information about the hardware and OS too. It can also be quite reliable. Talked about this a few days ago.
Show this thread
1
1
2
Chromium makes heavy usage of specialized allocators so someone would need to find something exposed to JavaScript that depends on the system allocator to measure it. There are other approaches though. In general, you cannot hide much about the hardware or the OS from JavaScript.
The Tor Browser's anti-fingerprinting can't hide much about the hardware and OS with JavaScript enabled. Users can also still be fingerprinted via things like keyboard / mouse input. They remove a lot of surface for fingerprinting but it's often unclear what is accomplished.
1
1
On a separate note, got to love the Mozilla employee in that thread not understanding the question and trying to imply that jemalloc isn't a massive security liability. Not sure why people attack a project without even reading the basic documentation like github.com/GrapheneOS/har.
1
1
Show replies