Comment by crashdelta

5 years ago

It doesn't work in FireFox 85.0 x64 on Windows. I went to the site, did the demo, my number was A5 94 D6 7E 4A DE and when I came back in private mode it was 51 ED 26 D8 66 FC.

17 comments

crashdelta

Reply
gibspaulding  5 years ago

I can't tell from your post if you are surprised by this or just pointing it out for others who would prefer to avoid this sort of tracking, but just to be clear, this is by design:

https://blog.mozilla.org/security/2021/01/26/supercookie-pro...

  • crashdelta  5 years ago

    The creator of supercookie.me made it sound like all versions of FireFox were vulnerable.

    • circularfoyers  5 years ago

      It may have been their intention, after reading the bugzilla report they made[1].

      > I also think that it would have been appropriate to notify about the ulterior motive behind this defect report at the latest when the paper got published. This underhanded approach of reporting a defect just leaves a bad taste, really. The behavior may be an actual defect in the classical sense, but I'm just wondering what would have happened, had this been addressed "in time" by the developers. It would seem that the researchers would then have triumphantly proclaimed that all major browsers are prone to their newly found attack. Must be somewhat disappointing that it didn't get fixed "in time" to make it into the paper that way

      [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1618257

      6 replies →

    • jonasstrehle  5 years ago

      To clarify, falsifying results was never my intention: During my work I tested Firefox (v 84.0) and everything worked fine under Windows & OSX.

      Due to your feedback I've updated the table in the GitRepo and the website and added that the current FF version (v 85.0) is no longer vulnerable! ~jonas

lordofgibbons  5 years ago

Same on Firefox on linux. I got a fingerprint on one tab, and when that finished, I opened a new tab and ran the demo again - which gave me a new fingerprint ID.

Running privacy badger and ublock origin

msk-lywenn  5 years ago

You don't even need to come back with incognito mode. At least for me, just pressing the "try again" button gives me a different ID. (Firefox 85, windows)