I saw two topics about how its impossible to have anonymity.
But they were too general and not enough focused on qubesos so one of them got locked.
This topic focuses on 1 threat that is affecting qubesos because qubesos doesn’t have a working solution to it.
The problem is mouse movement fingerprinting.
When you move your cursor, websites can use JS to fingerprint the movement you make.
Every human has a unique mouse movement fingerprint.
Even if you move your mouse in a different pattern, the tremors in your muscles still get picked up by the script and you become uniquely identified.
This can be done without JS as well, by using CSS. But if you have NOJS browser extension in firefox, then it blocks css from fingerprinting your mouse movement. NOJS is included in Tor browser on hardest security setting.
You can verify everything I’ve said in the Whonix documenation.
The problem is all internet requires JS.
Even the communities that are about privacy, ironically requires JS.
This means the only solution is to use Kloak which is active and installed in Whonix by default.
But not on qubesOS. QubesOS uses qubes event buffering instead which is broken and only effectively protects keyboard typing fingerprinting.
Read more info here (last few posts done about a year ago): Better mouse obfuscation - Development - Whonix Forum
This means you can be protected against mouse movement fingerprinting if you use Whonix NOT in qubesos.
Whonix installed in a VM in any other OS will protect your mouse movement fingerprinting because it uses the fully functioning Kloak, not broken qubes event buffering.
In short:
web browsing anonymity in qubesos is NOT possible.
web browsing anonymity in any other os IS possible.
Even if your assessment of the risk were true, there are simple
countermeasures any one can take.
It is simply not true that “All internet requires JS”. If this is a
concern for you do not use the sites that do require it.
Nor is is true that “all browsing requires mouse movements”. Use a text
based browser, with or without JS, and leave the mouse alone.
Proxy your browsing through a VNC connection. Using VNC will change the
input source and significantly reduce sampling rate and fidelity. Any
mouse fingerprinting will be degraded to such an extent that it will be
almost useless. Qubes makes it very easy to do this.
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
A great example of simplicity trumping complexity, However you may stand out as being one of the very few out there using a ‘text based browser’.
Now I wonder about a good use for remote desktop
I think the reason you disagree that all the internet doesn’t require JS is if you mean just to be able to read information.
But if you want to participate in the internet, I don’t know anywhere you can do that without JS.
Unless you suggest using email mailing lists? But email is not anonymous or secure.
But if I’m underestimating text browsers, can you give some examples of which online forums/discussion platforms you can create/login to an account and make posts with?
I’ve read that text browsers get flagged as bots more frequently and blocked. Is that something you experienced? Or are the articles wrong?
Like James said, you will stand out browsing primarily with a text based browser because you don’t have many other users to blend in with.
And then there are many more problems if you compare the features of tor browser vs a text based browser.
You’ll have to make a more comprehensive post to explain how text based browsers are better than tor browser for anonymity.
I assume you are using the text based browser with tor?
Think about that.
Maybe there is 1-3 users with a text based browser on randomprivsecforum.com
Now they can know which identity you have there because you have said you use text based browsers.
And if you now also say you use them with tor, then maybe only 1 of those 3 users do that. The other two are maybe using VPNs.
Maybe one of the VPN users use Mullvad and the other one use protonvpn. So all 3 text based browser users can easily be tracked through the internet since you all use a different network. And this is ignoring all other data that gets fingerprinted.
One more option is to use a browser that is mostly controlled by keyboard input. I am using qutebrowser that has a VIM like navigation method. It works relaly well, although on some pages I still require the mouse for some clicks, it basically makes me leave the mouse aside as often as I can.
There are multiple other problems too, e.g. Cloudflare, time correlation.
FWIW, some time ago I made quBO which practically turns Tor Browser into a text browser as a default setting which one can control further. I will probably have to update it, although the last time I tested it worked fine in 4.3 too.
Regarding replies about using a normal browser but using it only with the keyboard.
That would give you a unique fingerprint as well because even if you avoid mouse fingerprinting, there are so few users who use a browser like firefox/tor browser/brave/mullvad 100% by keyboard only.
You don’t have enough users to blend in with.
That’s the frustrating problem with anonymity.
It’s not that there aren’t solutions, it’s that we need everyone to use the same solution.
And the devs of qubesos and whonix control important choke points and get to decide what solution everyone should use.
And currently they’ve chosen qubes event buffering which doesn’t solve the problem.
In debian-13-vnc sudo apt install x11vnc xtightvncviewer
qvm-shutdown debian-13-vnc
qvm-create test1 -t debian-13-vnc -l purple
qvm-create test2 -t debian-13-vnc -l purple
Note IP addresses test1, test2 - say 10.137.0.201 and 10.137.0.202
Open channel between test1 and test2 in their upstream qube: nft add rule qubes custom-forward ip saddr 10.137.0.201 ip daddr 10.137.0.202 tcp dport 5900 accept nft add rule qubes custom-forward ip daddr 10.137.0.201 ip saddr 10.137.0.202 tcp dport 5900 accept or use qvm-connect-tcp
In test2 - open the vnc port: nft add rule qubes custom-input ip saddr 10.137.0.201 tcp dport 5900 accept
In test 2 - start vncserver - ``x11vnc`
In test1, vncviewer 10.137.0.202
vnc is quite effective at masking input device timings, as you can
confirm for yourself.(Compare timings on test2 with the same inputs on
test1 and test2 accessed via vnc)
But Qubes is quite effective at doing this anyway, without
intermediate vnc. Run the same tests in normal qube1 and qube2, and you
are unlikely to see significant similarities between the two - keyboard
or mouse. That is in vanilla Qubes. I suspect that people who pressed
for inclusion of kloak etc had not done these tests themselves.
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
Well, studies suggest 10-20% of users have a disability that affects
their computer use. Perhaps up to 5% use assistive technology. I
wouldnt say that is “so few”, and not a unique fingerprint.
You could compare that with the number of Linux users of firefox , or
the numbers using small amounts of memory, or all the other features
that may distinguish users.
I’ve suggested in my last post that you may care to test this alleged
“problem” in Qubes.
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
I believe the point in tracking a web browser is to equate different sets of features in a browser across different visits to coordinated websites. Usually this is done with JS to interrogate the browser settings and such. One could fight fire with fire by implementing randomization of various parameters each time you visit a website, and to be different at each website that might be coordinating that data collection.
I would propose using a TamperMonkeyscript to modify the way the browser interacts with specific websites. When this script notices certain features in the html/scripts on a website that indicate you are being fingerprinted, you just dynamically edit the HTML content to either remove those specific data collection scripts or remove specific node content to prevent their data collection.
You would of course need to work around anything that might flag you as a bot, but for somebody skilled on JS and interested in security this would be an interesting project, and you would be locked into the problem of keeping up with the latest privacy violating tactics.
Such a script could be generally placed in a global script repository and shared with the wider privacy conscious community, but it would not be a Qubes specific solution. Any browser that can run TamperMonkey would gain this capability and when new privacy violations come into use the script would automatically get pushed out to those that depend on it.
Edit:
Examples of what can be done when scripting these kinds of scripts:
If you need “all internet” while needing to avoid mouse movement fingerprinting at the same time, then I’d say something is not right with your threat model.
You say test it like there is an obvious and simple app I can install for that. Or that you actually mean to just use my eyes to compare the cursor on two different qubes?
VNC shouldn’t be able to protect against fingerprinting of mouse movement. The best case scenario is that the fingerprinting algorithm needs more data (more mouse movements) to identify you. But even in that best case scenario, it’s still most likely going to be a low amount of mouse movements.
Scientific articles about mouse movement fingerprinting suggest the sweet spot is about 20-50 movements is enough even when taking into account network delays (VNC) and changing DPI on mouse device.
Algorithms can remove noise such as 50ms spikes from VNC.
The problem with testing is there is no such app I’m aware of.
The production ready ones are proprietary.
It’s not enough to just simply log and look at the timings and compare them. If that’s how simple it would be to do mouse movement fingerprinting it wouldn’t be such a scientific and academic topic and needing to keep algorithms closed source.
That’s very vague. “affects computer use” could mean anything. and “Perhaps” sounds like a total guess. And “assistive technology” could also mean anything.
What kind of disability are you thinking about that prevents a user from using a mouse, but not from using keyboard?
Which technology are they using? Are they using the same text based terminal browser that you’re using?
Your reply is a guessing game. I could make all kinds of guesses what you are are saying or expecting as a reply.
But if I break down your reply into two parts, then it reads like this:
First your bring up the two problems “mouse movement fingerprinting” and wanting to participate in the internet.
Second part it seems like you wanted to offer a solution, but you couldn’t think of one, so you say “something is not right”.
The solution is Kloak.
Qubes event buffering is supposed to be like Kloak, but they don’t know how to make it like Kloak, that’s why it ended up only effective against keypress fingerprinting, not mouse movement.
So, the solution is the devs need to give up on qubes event buffering and use Mouser instead.
Or everyone who wants privacy need to stop using QubesOS.
I can think of the users of screen readers (there are plenty of reasons to use them). Using a screen reader with the keyboard only is something common. You can use it with any accessible browser. I sometimes prefer to browse some websites using the keyboard rather than the mouse.
I’m triggered.
I think the question/s you raised in this topic is very important and I’m learning a lot from all of this and very care of privacy as well, but you really should be ashamed for such behavior. this is not ok. People can have visual, motor function problems etc.
@slcoleman I like your suggestion But it seems mostly theoretical at this point. Google is known for obfuscating their JS as well.
And then there’s the same old problem which is you need other users to blend in with who have the same fingerprint. Which in this case is qubes os whonix dvm with tor browser.
So in this case, it seems your suggestion needs to be brought to tor project. But I don’t think they will like it because when I read their discussions about finding a way to prevent mouse movement fingerprinting from css, they seemed to prioritize not breaking any legitimate use cases from css. That’s why they decided it’s best to put the solution into NOJS extension instead of the browser itself. So it’s a bit strange that tor project didn’t seem to prioritize anonymity. Making arguments that hardest security setting should be used only for security, not anonymity improvements. Putting the solution into NOJS extension seemed like the last resort.
It’s an uphill battle but it’s an important battle as I hope you can see because mouse movement fingerprinting deanonymizes everyone if you have JS enabled when web browsing on qubes os.
This really should be highest priority to for qubesos to fix. And I think it’s suspicious they don’t take it more serious. Whonix already has a working solution (Kloak), it’s just qubes-whonix that the solution isn’t working on.
Why should I be ashamed?
can you explain how my question is offensive? Just because it triggered you doesn’t mean it’s offensive.
That would be like saying clowns are offensive because some people are triggered by clowns.
Don’t get me wrong, I actually value your initial point about mouse tracking. I care deeply about privacy myself and I completely agree that “disabling JavaScript” isn’t a real solution.
But your total lack of perspective on accessibility and the attitude is wild. To initially assume that navigating a computer with a keyboard requires the same exact physical abilities as using a mouse is just beyond. Instead of learning, you double down and minimize real world disability barriers by comparing them to a fear of clowns? what a joke
