5 ms·

When the EFF's Panopticlick says my iPhone running the latest version of iOS is basically unique I start to get suspicious. There are millions of phones just l

by rblatz 11y ago

When the EFF's Panopticlick says my iPhone running the latest version of iOS is basically unique I start to get suspicious. There are millions of phones just like mine out there.

Zikes 11y ago
Millions of iPhones out there, thousands in your area, hundreds that are the same model/screen size, and so on.
PadEdKedpo 11y ago
There are many reasons why your seemingly generic hardware has a unique fingerprint. Without access to your results page I couldn't tell you exactly why, but there are a lot of things that can be used to fingerprint your device, including browser configuration, how your gpu handles vectors (same model chips, different results), injecting supercookies, or possibly your browser is leaking other unique identifiers. If you used tor browser on panopticlick you'll see it report your browser to be fairly generic.
gleb 11y ago
I agree, seems like BS at least for iPhones. I think that tool may incorrectly assume that all factors it tests for are uncorrelated, e.g. Screen size vs browser user agent.
jandrese 11y ago
They do look at hashes of specific system objects (GL Context, canvas) and I'm curious how immutable those are on a particular device. It could be that they're accidentally including some bits from /dev/random and calling everybody unique. It doesn't necessary translate into trackable.
- semi-extrinsic 11y ago
  If you look at the detailed breakdown, those are not counted towards the fingerprint. But I think there is a big inconsistency in their data. My Moto G3 is identified as "1 in 3 million browsers have this value" based on just the user agent (which does not contain anything region specific). Since more than 0.5 million Moto G3s were sold just in India in the first 2 months after release [1], their numbers imply there is more than 100 unique browsers for every living human. [1] http://www.bgr.in/news/motorola-sold-over-5-lakh-units-of-moto-g-third-generation-in-india-in-47-days-via-flipkart/ http://www.bgr.in/news/motorola-sold-over-5-lakh-units-of-mo...
- livingparadox 11y ago
  Running the fingerprinting test on my normal browser and then incognito implies that its at least consistent within a small time window.
deleted 11y ago
[deleted]
saurik 11y ago
I just tried it out, and 1) their definition of "nearly unique" was "1 in 2068276.0 browsers", which I agree is not good but also seems to be a non-intuitive rating scale, and 2) I swear from looking at the results that they are failing to take into account cross-variable correlations (but have not dug into this enough to be sure, so don't quote me on this or anything: do your own research), by which I mean that each entropy source is considered in isolation, even though my screen size and user agent (which tells you I have an iPhone running iOS 8.4) should massively discount the screen size statistic (which is effectively just telling you I have an iPhone 6), as well as my "browser plugin details" (as they are likely the same for every single iPhone), and probably to some lesser extent even my time zone (I live in California, where I would imagine having a semi-recent iPhone would be more common, though I could see an argument that my using an out-of-date firmware is less common ;P). FWIW, if this is not yet including any knowledge of my IP address, then one in millions is brutal, as I am probably one of only a small handful of people in Isla Vista that has this specific iPhone configuration.
- jrapdx3 11y ago
  It is disconcerting to see the browser "fingerprint" and realizing it's very difficult to significantly reduce its "uniqueness" based on all the factors listed. I guess that's the point, each element in the list contributes to the uniqueness "profile". I don't think it matters that certain elements just add up to identifying an iPhone 6 or whatever we're using. I gather the profile is strictly by the numbers, here tallied as bits of entropy. The statistical inference of uniqueness reflects the ability to use the indexed bits as a pattern to identify the particular browser and presumably the individual user (if not by the user's name). It's one case where using common, generic components offers the greatest anonymity. I'd guess the HN crowd is more likely than average to go for exotic or bleeding edge configurations which no doubt will have the most distinct fingerprints of all.
  - cpeterso 11y ago
    If I'm reading it correctly, a recent Microsoft study of Bing and Hotmail traffic showed 80% of users could be uniquely identified using passive, server-side fingerprinting of just client IP address and User-Agent header. http://research.microsoft.com/pubs/156901/ndss2012.pdf http://research.microsoft.com/pubs/156901/ndss2012.pdf "User-agent strings combined with IP addresses have an entropy of 20.29 bits—higher than that of browser plug-ins, screen resolution, timezone, and system fonts combined."
CyberDildonics 11y ago
Probably not as many with the same IP.

by rblatz 11y ago

When the EFF's Panopticlick says my iPhone running the latest version of iOS is basically unique I start to get suspicious. There are millions of phones just like mine out there.

Zikes 11y ago

Millions of iPhones out there, thousands in your area, hundreds that are the same model/screen size, and so on.

PadEdKedpo 11y ago

There are many reasons why your seemingly generic hardware has a unique fingerprint. Without access to your results page I couldn't tell you exactly why, but there are a lot of things that can be used to fingerprint your device, including browser configuration, how your gpu handles vectors (same model chips, different results), injecting supercookies, or possibly your browser is leaking other unique identifiers. If you used tor browser on panopticlick you'll see it report your browser to be fairly generic.

gleb 11y ago

I agree, seems like BS at least for iPhones. I think that tool may incorrectly assume that all factors it tests for are uncorrelated, e.g. Screen size vs browser user agent.

jandrese 11y ago

They do look at hashes of specific system objects (GL Context, canvas) and I'm curious how immutable those are on a particular device. It could be that they're accidentally including some bits from /dev/random and calling everybody unique. It doesn't necessary translate into trackable.

semi-extrinsic 11y ago
If you look at the detailed breakdown, those are not counted towards the fingerprint. But I think there is a big inconsistency in their data. My Moto G3 is identified as "1 in 3 million browsers have this value" based on just the user agent (which does not contain anything region specific). Since more than 0.5 million Moto G3s were sold just in India in the first 2 months after release [1], their numbers imply there is more than 100 unique browsers for every living human. [1] http://www.bgr.in/news/motorola-sold-over-5-lakh-units-of-moto-g-third-generation-in-india-in-47-days-via-flipkart/ http://www.bgr.in/news/motorola-sold-over-5-lakh-units-of-mo...
livingparadox 11y ago
Running the fingerprinting test on my normal browser and then incognito implies that its at least consistent within a small time window.

deleted 11y ago

[deleted]

saurik 11y ago

I just tried it out, and 1) their definition of "nearly unique" was "1 in 2068276.0 browsers", which I agree is not good but also seems to be a non-intuitive rating scale, and 2) I swear from looking at the results that they are failing to take into account cross-variable correlations (but have not dug into this enough to be sure, so don't quote me on this or anything: do your own research), by which I mean that each entropy source is considered in isolation, even though my screen size and user agent (which tells you I have an iPhone running iOS 8.4) should massively discount the screen size statistic (which is effectively just telling you I have an iPhone 6), as well as my "browser plugin details" (as they are likely the same for every single iPhone), and probably to some lesser extent even my time zone (I live in California, where I would imagine having a semi-recent iPhone would be more common, though I could see an argument that my using an out-of-date firmware is less common ;P). FWIW, if this is not yet including any knowledge of my IP address, then one in millions is brutal, as I am probably one of only a small handful of people in Isla Vista that has this specific iPhone configuration.

jrapdx3 11y ago
It is disconcerting to see the browser "fingerprint" and realizing it's very difficult to significantly reduce its "uniqueness" based on all the factors listed. I guess that's the point, each element in the list contributes to the uniqueness "profile". I don't think it matters that certain elements just add up to identifying an iPhone 6 or whatever we're using. I gather the profile is strictly by the numbers, here tallied as bits of entropy. The statistical inference of uniqueness reflects the ability to use the indexed bits as a pattern to identify the particular browser and presumably the individual user (if not by the user's name). It's one case where using common, generic components offers the greatest anonymity. I'd guess the HN crowd is more likely than average to go for exotic or bleeding edge configurations which no doubt will have the most distinct fingerprints of all.
- cpeterso 11y ago
  If I'm reading it correctly, a recent Microsoft study of Bing and Hotmail traffic showed 80% of users could be uniquely identified using passive, server-side fingerprinting of just client IP address and User-Agent header. http://research.microsoft.com/pubs/156901/ndss2012.pdf http://research.microsoft.com/pubs/156901/ndss2012.pdf "User-agent strings combined with IP addresses have an entropy of 20.29 bits—higher than that of browser plug-ins, screen resolution, timezone, and system fonts combined."

CyberDildonics 11y ago

Probably not as many with the same IP.