search

gautamkrishnar / nothing-private

Do you think you are safe using private browsing or incognito mode?. :smile: :imp: This will prove that you're wrong. Previously hosted at nothingprivate.ml
https://nothingprivate.gkr.pw
GNU General Public License v3.0
2.15k stars 151 forks source link

Sentry CDN usage #135

Closed Ghostbird closed 2 years ago

Ghostbird commented 2 years ago

Is your feature request related to a problem? Please describe. I assume the fingerprint functionality is loaded from sentry CDN. If the load is prevented, you might still be fingerprintable by non-external scripts. I visited the page, and it didn't manage to fingerprint me. However, I'm using NoScript and sentry-cdn is marked as untrusted. I've got at least one more layer of protection like it. Those layers do not protect against fingerprinting in-and-of itself. Instead they prevent known finger-print scripts from being loaded in the first place.

Describe the solution you'd like Consider hosting the fingerprint script on the page itself. If the script is self-hosted, several preventative layers of protection can probably be bypassed, which makes the page better test how fingerprintable the browser is.

Describe alternatives you've considered Maybe that's not what you want to test.

Additional context The trade-off is that updates to the fingerprint script are not automatically applied.

gautamkrishnar commented 2 years ago

@Ghostbird sentry is used just for error monitoring. Not for fingerprinting. Fingerpinting code is hosted at: https://www.nothingprivate.ml/main.js

Ghostbird commented 2 years ago

Then I made a wrong assumption. I'll close this.