This ZDNET article reports on Firefox's adoption of letterboxing, an anti-fingerprinting technique developed by the Tor Project to protect user privacy. The article advocates positively for privacy-enhancing technology by explaining how letterboxing prevents advertising networks from profiling users through browser fingerprinting. Coverage frames privacy protection as beneficial to users and provides implementation details, though structural tension exists between the site's commercial advertising model and its privacy advocacy.
> The general idea is that "letterboxing" will mask the window's real dimensions by keeping the window width and height at multiples of 200px and 100px during the resize operation --generating the same window dimensions for all users-- and then adding a "gray space" at the top, bottom, left, or right of the current page.
> The advertising code, which listens to window resize events, then reads the generic dimensions, sends the data to its server, and only after does Firefox remove the "gray spaces" using a smooth animation a few milliseconds later.
Would using a setTimeout() on the window resize event bypass this? Send the data 20-50ms after resize is completed giving enough time for the letterboxing stuff to go away revealing the actual dimensions, or something? They say it only blocks the dimensions during the resize event and FF removes the letterboxing "a few ms later"
I recommend the privacy.resistFingerpriting about:config mentioned. It's been available for a while and does other things too, like changing your user agent.
This is awesome. Other things I'd like to see added directly to Firefox are things like Ad and script blocking, HTTPS everywhere, and maybe something like a Tor button so that I don't have to rely on third parties for these critical privacy features.
I've been using FF with resistFinterprinting on since it was available. Letterboxing does break a lot of websites and apps, sometimes making them unusable due to incorrect positioning and scaling of the elements.
Every time there's something about online privacy with browsers, it's mostly Firefox or Safari. I wondered if Chrome had resisting fingerprinting on its radar (guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online), and I found this [1] confirming my guess (emphasis mine):
> Since we don't believe it's feasible to provide some mode of Chrome that can truly prevent passive fingerprinting, we will mark all related bugs and feature requests as WontFix.
I haven't read all the analyses in the links in that article, but this sounds defeatist and lazy, much unlike a stance that Chromium would take on security or performance on the web.
Contrast the above with what this article says about Firefox:
> Firefox's upcoming letterboxing feature is part of a larger project that started in 2016, called Tor Uplift.
> Part of Tor Uplift, Mozilla developers have been slowly porting privacy-hardening features developed originally for the Tor Browser and integrating them into Firefox.
If you value online privacy, your best choice is Firefox (though it requires some additional manual configuration). Safari comes second (its extensions directory could use more love). The choice where you can add more of your influence to is Firefox — by using it, evangelizing it and by donating (if feasible) to it.
What's the canvas fingerprinting one do? From what I (very poorly) understand, Tor returns a constant number for fingerprint requests. Can this be done for other requests?
Why not simply allow the user to control the js apis that are available/enabled, kind of like the camera/mic permissions? If sites simply cannot use the mouse events or window size events, they won’t be able to fingerprint. This grey box alternative seems like a complicated hack.
Why can't the ad industry just accept that there are some people out there who don't want to see ads and wouldn't click on one to begin with? Then they can honor Do Not Track and those who choose to work in adtech can start working on things that are more productive to their business.
But I've already got code in my xmonad.hs that clamps firefox windows to common monitor sizes?
It's truly unfortunate that browsers just punted on security, dumping endless amounts of sensitive information into a purported sandbox. Why bother developing something with a secure mindset to begin with, when you can just band-aid on patches later?! It's the sendmail/ActiveX philosophy all over again, only now with network effects.
At this point Firefox should just merge with Tor if they want to market themselves as the pro-privacy browser. Right now I just use Chrome when I'm using my real identity for work and shopping and social media anyway as it's a very good browser and supported everywhere and has an open source version through Chromium.
When I need actual privacy, I just use Tor which supports most sites and is way more protective of my privacy than firefox. May switch to Brave in the future for this use case as they're adding Tor support but right now Chrome + Tor every once in a while works best for me.
This is horrible from a UX perspective. There are many fingerprinting techniques besides this. I don't see how adding a user hostile behaviour will help.
The Tor Uplift process later continued in Firefox 55 when Mozilla added a Tor Browser feature known as First-Party Isolation (FPI), which worked by separating cookies on a per-domain basis, preventing ad trackers from using cookies to track users across the Internet. This feature is now at the heart of Project Fission and will morph into a Chrome-like "site isolation" feature for Firefox.
Is there any reason this isn't on by default? I don't know exactly how it works, but to my understanding anti fingerprinting tech generally works better when everyone uses it (otherwise you stick out as the "anti fingerprinting" browser)
I've been using privacy.resistFingerprinting for a while and also recommend it, but there is one major "side effect": your reCAPTCHA score will drop to 0.1 making many websites really tedious to use. It's a price I'm willing to pay though...
Changing your user agent will do terrible things to captchas. I actually change my user agent specifically to test the fail state of captchas. I'd suggest only turning that on if you know what you're doing.
> guessing that it wouldn't be in Google's interests to add any feature that would thwart profiling users online
I would actually think the opposite. Wouldn't it be better because then only Google would have that information? Only Google would be able to fingerprint. This is of course under the assumption (which is currently accurate) that Google has the majority share of browsers. But maybe it wouldn't be, because it would teach others how to thwart their fingerprinting.
It prompts the user to decline a site from accessing data from the Canvas API. This data can uniquely identify the user's computer. The Firefox feature is identical to the one from the Tor Browser.
There is a way to stop fingerprinting. That way is serving pages via distributed network (over a WoT or torrent-like thing).
All these other ways do is give people the illusion that they're safe from being tracked, when the reality is that they're tracked just the same, but by fewer people so the data is more valuable. This means that the money is centralizing around the actors with the most inexplicable methods of tracking; which are almost always the worst actors.
I hate it too, even though I'm not blameless. It's impossible to compete without a level playing field, and that playing field needs to be technically enforced, because otherwise we get region shopping and advertising / analytics models that push people to create intractable mechanisms so they can paper over how tracking fed into it.
For example, imagine a world where I'm bidding to show an ad to a visitor of nytimes.com. Now, I may not track the user, but if anyone is, they can incorporate what they know and sell that traffic back to me on a CPA model. All I see is the incoming traffic. I don't track anyone (wink, wink) but there is no difference.
In the long run this will either be solved one way or another, and all these online surveillance capitalism companies will crash and burn. Either we get a web with technical guarantees or we get a balkanized internet where every state makes their own weird laws about what is allowed or not.
The problem is this will straight up crash many important sites. In the battle between usability and privacy, usability wins. Just try disabling javascript or cookies and see how long you last.
Presumably the implementation is smarter than being defeated by this easy trick, but I too wonder how it works.
> Finally, an extra zoom was applied to the viewport in fullscreen and maximized modes to use as much of the screen as possible and minimize the size of the empty margins. In that case, the window had a "letterbox" (margins at top and bottom only) or "pillbox" (margins at left and right only) appearance. window.devicePixelRatio was always spoofed to 1.0 even when device pixels != CSS pixels.
So presumably the window size is not being reset to real size - firefox just does a smart zoomin. In other words the fake size remains throughout entire session.
Firefox is already valuable for browsing on mobile phone, where there is not much space on screen to have Dev console anyway.
I recommend trying Firefox Mobile
> Would using a setTimeout() on the window resize event bypass this? Send the data 20-50ms after resize is completed giving enough time for the letterboxing stuff to go away revealing the actual dimensions, or something? They say it only blocks the dimensions during the resize event and FF removes the letterboxing "a few ms later"
No, it will be a setTimeout on the document load event that will poll the window size every 100ms from here till the page is evicted by a close or navigation event, increasing the detrimental effect of adtech.
> it seems like it would mostly not do anything when using a tiling WM with fixed splits
In the bug report [1] it says:
> We haven't yet landed this feature in Tor Browser for at a few reasons:
> - ...
> - * Tiling window managers on Linux are hard to detect. Any implementation will need to behave appropriately for those.
They should turn fingerprinting to max and install uBlock origin by default.
It might mean millions of FF users would suddenly struggle with captchas, but it might also mean that site creators just stop using reCaptcha and similar.
Aside from the downsides mentioned in other comments, this significantly reduces JS timer accuracy which will make games and WebGL laggy and unusable.
In about:config if you search for 'resistFingerprinting' there seem to be sub-settings which you can tweak to disable the timer modifications, but even after tweaking them I wasn't able to get performance to be as smooth as when resistFP was completely disabled.
Google isn't going to bother the general public like that, that’s limited to small groups like techs who block the canvas fingerprinting. Do you think Google is going to spam people that use the Safari default intelligent tracking protection?
Fortunately, this is entirely optional. The "privacy.resistFingerprinting" option bundles a set of features that make it more difficult for sites to uniquely identify the user at a cost to usability. It's up to each user to determine whether that usability cost is worth the privacy improvements. On Firefox, it's an opt-in setting, off by default.
What else can they do to decrease the effectiveness of increasingly hostile trackers?
Editorial Channel
What the content says
+0.80
Article 12Privacy
High Advocacy Framing Practice
Editorial
+0.80
SETL
+0.89
Article's primary focus: anti-fingerprinting technique explicitly designed to protect user privacy. Strongly advocates for privacy protection through positive reporting of feature benefits. Explains technical mechanism and frames as user benefit against tracking networks.
FW Ratio: 63%
Observable Facts
Article states letterboxing prevents advertisers from sniffing browser features like window size for user profiling
Feature described as masking 'real dimensions by keeping window width and height at multiples of 200px and 100px'
Article reports Mozilla integrating privacy-hardening features originally developed by Tor Project
Content explains fingerprinting as primary threat: 'Advertising networks often sniff certain browser features...to create user profiles and track users'
Article provides implementation instructions for users to enable the privacy feature
Inferences
Editorial framing presents privacy protection as positive user benefit, implicitly advocating for adoption
Detailed technical explanation and positive coverage advocate for privacy-enhancing technology adoption
Structural model as commercial publisher funded by advertising contradicts advocacy for privacy from advertising networks
+0.50
Article 19Freedom of Expression
Medium Framing
Editorial
+0.50
SETL
+0.50
Privacy from fingerprinting enables freedom of expression and thought by preventing surveillance-based profiling. Reporting on privacy protection supports the foundational conditions for free expression.
FW Ratio: 50%
Observable Facts
Article covers privacy-enhancing technology without apparent editorial restriction
Detailed reporting on privacy mechanisms supports informed public discourse on digital freedom
Inferences
Privacy protection from tracking enables users to exercise freedom of thought and expression without surveillance chilling effect
Positive coverage of privacy features frames protection as enabling foundational rights
+0.40
PreamblePreamble
High Framing
Editorial
+0.40
SETL
+0.40
Article frames privacy protection as fundamental to protecting human dignity from unauthorized profiling by tracking networks
FW Ratio: 50%
Observable Facts
Article describes letterboxing as preventing advertisers from creating detailed user profiles through browser dimension tracking
Feature positioning frames privacy as protecting users from surveillance and unauthorized data collection
Inferences
Editorial framing advocates for privacy-enhancing technology as supporting fundamental human dignity
Content advocates for dignity protection through technical privacy measures
+0.30
Article 3Life, Liberty, Security
Medium Framing
Editorial
+0.30
SETL
+0.30
Privacy protection from fingerprinting enhances user security and liberty from surveillance threats
FW Ratio: 67%
Observable Facts
Article describes fingerprinting as security risk that enables unauthorized user profiling and tracking
Letterboxing presented as protective measure against advertising networks' surveillance capability
Inferences
Privacy protection from tracking supports both security (preventing misuse) and liberty (freedom from monitoring)
+0.20
Article 1Freedom, Equality, Brotherhood
Medium Framing
Editorial
+0.20
SETL
+0.20
Feature applies privacy protection equally to all users regardless of identity or characteristics
FW Ratio: 50%
Observable Facts
Article explains letterboxing works uniformly for all Firefox users by standardizing dimensions at multiples of 200px x 100px
Inferences
Equal application of privacy protection supports equal rights to protection from surveillance
+0.10
Article 2Non-Discrimination
Medium Framing
Editorial
+0.10
SETL
+0.10
Letterboxing does not discriminate in its application across users
FW Ratio: 50%
Observable Facts
Feature treats all Firefox users identically regardless of background, location, or demographics
Inferences
Non-discriminatory privacy protection aligns with equality principle
ND
Article 4No Slavery
Not addressed
ND
Article 5No Torture
Not addressed
ND
Article 6Legal Personhood
Not addressed
ND
Article 7Equality Before Law
Not addressed
ND
Article 8Right to Remedy
Not addressed
ND
Article 9No Arbitrary Detention
Not addressed
ND
Article 10Fair Hearing
Not addressed
ND
Article 11Presumption of Innocence
Not addressed
ND
Article 13Freedom of Movement
Not addressed
ND
Article 14Asylum
Not addressed
ND
Article 15Nationality
Not addressed
ND
Article 16Marriage & Family
Not addressed
ND
Article 17Property
Not addressed
ND
Article 18Freedom of Thought
Not addressed
ND
Article 20Assembly & Association
Not addressed
ND
Article 21Political Participation
Not addressed
ND
Article 22Social Security
Not addressed
ND
Article 23Work & Equal Pay
Not addressed
ND
Article 24Rest & Leisure
Not addressed
ND
Article 25Standard of Living
Not addressed
ND
Article 26Education
Not addressed
ND
Article 27Cultural Participation
Not addressed
ND
Article 28Social & International Order
Not addressed
ND
Article 29Duties to Community
Not addressed
ND
Article 30No Destruction of Rights
Not addressed
Structural Channel
What the site does
0.00
PreamblePreamble
High Framing
Structural
0.00
Context Modifier
ND
SETL
+0.40
Site structure is standard commercial publisher; no inherent privacy protections embedded in site design
0.00
Article 1Freedom, Equality, Brotherhood
Medium Framing
Structural
0.00
Context Modifier
ND
SETL
+0.20
Site structure neutral on equality
0.00
Article 2Non-Discrimination
Medium Framing
Structural
0.00
Context Modifier
ND
SETL
+0.10
Neutral
0.00
Article 3Life, Liberty, Security
Medium Framing
Structural
0.00
Context Modifier
ND
SETL
+0.30
Neutral
0.00
Article 19Freedom of Expression
Medium Framing
Structural
0.00
Context Modifier
ND
SETL
+0.50
News site reports freely on privacy topics; structural neutrality
-0.20
Article 12Privacy
High Advocacy Framing Practice
Structural
-0.20
Context Modifier
ND
SETL
+0.89
Commercial news publisher (Ziff Davis) with advertising-dependent revenue model. Site likely employs extensive user tracking for ad targeting, creating structural contradiction with editorial privacy advocacy. Tension between reported values and actual practices.
ND
Article 4No Slavery
Not addressed
ND
Article 5No Torture
Not addressed
ND
Article 6Legal Personhood
Not addressed
ND
Article 7Equality Before Law
Not addressed
ND
Article 8Right to Remedy
Not addressed
ND
Article 9No Arbitrary Detention
Not addressed
ND
Article 10Fair Hearing
Not addressed
ND
Article 11Presumption of Innocence
Not addressed
ND
Article 13Freedom of Movement
Not addressed
ND
Article 14Asylum
Not addressed
ND
Article 15Nationality
Not addressed
ND
Article 16Marriage & Family
Not addressed
ND
Article 17Property
Not addressed
ND
Article 18Freedom of Thought
Not addressed
ND
Article 20Assembly & Association
Not addressed
ND
Article 21Political Participation
Not addressed
ND
Article 22Social Security
Not addressed
ND
Article 23Work & Equal Pay
Not addressed
ND
Article 24Rest & Leisure
Not addressed
ND
Article 25Standard of Living
Not addressed
ND
Article 26Education
Not addressed
ND
Article 27Cultural Participation
Not addressed
ND
Article 28Social & International Order
Not addressed
ND
Article 29Duties to Community
Not addressed
ND
Article 30No Destruction of Rights
Not addressed
Supplementary Signals
How this content communicates, beyond directional lean. Learn more
build aba2bc8+myve · deployed 2026-02-28 16:36 UTC · evaluated 2026-02-28 16:29:11 UTC
Support HN HRCB
Each evaluation uses real API credits. HN HRCB runs on donations — no ads, no paywalls.
If you find it useful, please consider helping keep it running.