Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think only as much as you can do so anonymously in the first place. Regarding the resizing issue specifically, the use of "resolution + window size" is sufficiently unique in fullscreen (especially if you have a vertical toolbar like many devs do) that it can be deanonymized.


I don't understand the risk of the window-size issue.

If I am running a normal Windows installation(say, Windows 7 Home) on a commonly-sized screen (say, 1366x768) and have a normal sized taskbar, no odd widgets, toolbars, or other screen-space taking things, it seems I am only reducing the anonymity pool to those other users with the same features, which I suspect is more than 4.

For a non-persistent live-boot situation such as Tails, I would expect the risk to be even lower.

What am I missing, if anything? Was there some legal situation in which browser window size was used to de-anonymize someone that warrants the attention to browser window size? I understand it's another layer of protection, defense-in-depth and all, but it seems to be getting a disproportionate amount of attention.


You're exactly right. However, the concern comes from those who aren't using a commonly-sized screen with a normal taskbar, etc. That's precisely why certain versions of the Tor browser only resize to certain sizes/dimensions.

If (for example) you've got a vertical taskbar on a 4k monitor the pool will be much lower. Add in one other slip up, such as visiting a low-traffic website you've visited outside of Tor, and you've got a huge vulnerability for deanonymization.

As far as legal, I don't think there has ever been such a case, no. However, it definitely opens someone up to parallel construction, and there are always certain agencies for which a legal case is not necessary their end goal (CIA, NSA, etc).


I mean, use Tor non-anonymously alongside your anonymous usage. So do resize your regular browser with which you visit regular sites, just do it over Tor so it won't look suspicious when you run the actual anonymous browser to visit other sites over Tor anonymously.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: