Question regarding arkenfox

Privacy Questions
1

Question regarding arkenfox.

ATTN: arkenfox in v128 will make RFP-etc inactive and use FPP as default #1804

What is the difference between RFP and FPP?

2
5 Likes
3

Thorin-Oakenpants really needs to create some kind of summary or TL;DR. I’m not reading that entire thread. I read the OP but I don’t get it. Is RFP still the more private option? Only reason why I’d consider disabling it is if it allows me to view dark mode on sites without having to use dark reader.

2 Likes
4

RFP is what the Tor browser uses, it does things like change your time zone to UTC and other things like that that are intended to make Tor browser users blend in with each other. FPP doesn’t try to make users look the same as each other and instead takes the approach of randomizing certain values used for fingerprinting. Thorin is using the medium of boomer comics to communicate that it’s possible for the “blending in” effects to be detected by websites when you are not on tor browser and with randomization the value is still protected anyway, at least that’s what I could gather haha.

1 Like
5

I see. I saw the comics but only the car one made sense to me. I don’t get the other two.

edit: “advanced scripts” he’s referring to fingerprinting techniques by websites, right? The ship one makes a little more sense now.

1 Like
6

The boat one is like, the sharks are the tracking scripts and the mannequins are the faked values and they’re “eating” the fake values.

For the horse one the chicken is like your Firefox browser and the cowboys are like Tor browser users and it’s showing that although the chicken has all the trappings of a cowboy it’s still obvious that it’s not a cowboy.

2 Likes
7

Makes sense, but “advanced scripts can fingerprint a fingerprint protection, spot paradoxes, get detail” is he saying that the chicken is RFP? And is he also saying that RFP is fingerprinting “protection” as opposed to “randomisation”, and what is the difference?

I’m assuming RFP is about hiding values, and FPP is about randomising them. Not entirely sure what the implications are of this.

8

I encourage you to read the discussions of FPP / RFP in full, but if you want just a direct succinct answer, here are a couple relevant and concise bits that address your question from #1846:

2 Likes
9

I think they’re just kind of implying that RFP is only fully useful when used with Tor Browser (and, it should also be the case with Mullvad Browser and a VPN I’ll point out). You should first understand two definitions:

Advanced scripts are scripts that actively try to detect people using anti-fingerprinting techniques and fingerprint them anyways.

Naive scripts are scripts that fingerprint you based on reading some values from your browser.

Naive scripts account for pretty much all tracking scripts you’ll encounter on the web today, unless you’re like being hunted down or something.

Now there are 4 facts:

  1. RFP with Tor browser can thwart even advanced scripts.

  2. RFP with Firefox can’t really thwart advanced scripts, because there are still plenty of other factors that they can use to fingerprint you.

  3. Both RFP and FPP provide good protection against naive scripts.

  4. FPP is more compatible with websites than RFP.

Given all of this, they have made the choice to default to FPP, because it is more compatible, it is more flexible, and in Firefox/Arkenfox you can only realistically thwart naive scripts anyways.

If you stick with RFP you won’t be worse off, but the advantages are so small in this case with Arkenfox/Firefox that you’re also not likely to be better off either, so the trade-off of using RFP instead of FPP is probably not worth it.

Anyways, this is why we say that for people with the highest levels of risk, they need to be using Tor Browser. For people who are still concerned about these advanced threats, but can accept some tradeoff for performance (because the consequences for them might not be high, perhaps) they can use Mullvad Browser with a VPN. And for people who are only concerned about naive scripts (which is most people!) they can use Arkenfox/Firefox.

9 Likes
10

Very insightful post, thank you. I now disabled RFP again in my browser (Librewolf). The annoyances (no dark mode, constant zoom level reset, slightly broken websites) are not worth it if you’re still fingerprintable by advanced scripts. (And naive scripts are probably taken care of by FFP + ETP + uBO.)

11

Will they maintain 2 different user.js files:

1- for RFP

2- for FFP

Because it may have depended configs… Or maybe not… I hope they will have only 1 file. Otherwise there will be a maintenance issue for us and arkenfox developers…

Anyway… Is there any detailed comparison table or something to see the differences between RFP and FFP? So we know what we are doing exactly…

12

So I was told FFP with “AllTargets” enabled is the same using RFP. These are the list of targets: RFPTargets.inc - mozsearch

Here is another overview: Security/Fingerprinting - MozillaWiki
But I’m not sure if it’s up to date because for example RFP dropped the “same user agent for everyone” target but it’s still listed there.

13

No.

When arkenfox 128 is released, it will no longer have RFP enabled and users will fall back to using FPP - as long as users run prefsCleaner. The reason for this is to provide a more usable default user.js (which, again, is a template) - and those who are more tech minded can add RFP and related prefs as overrides (if it suits them)[1]

  1. Emphasis mine ↩︎