4 ms·

How unique -- and trackable -- is your web browser?

67 points by profquail 17y ago

maukdaddy 17y ago
Apparently quite unique =( Your browser fingerprint appears to be unique among the 234,579 tested so far. Currently, we estimate that your browser has a fingerprint that conveys at least 17.84 bits of identifying information.
- thaumaturgy 17y ago
  It's not really that big of a deal. Their site still thinks my browser is totally unique, despite having visited them the last time this was posted. The reason? I installed a couple of new fonts.
  - ryanwaggoner 17y ago
    Interesting...one solution from the perspective of the tracker might be a system that assigns different weights to different types of information, with things like fonts and browser plugins given less ranking than things like OS, browser type, and time zone, which probably change much less frequently. You might not be able to get 100% unique tracking, but if you could guess that there was a 99% chance that it was the same person, doing things like behavioral advertising would probably still be worth it. The interesting application of things like this and the visited link color hack is to use them in Europe, where apparently you have to get users to approve a cookie every time? This might be a good way to skirt the issue for a lot of sites that don't need a guarantee that it's the same person.
  - Tichy 17y ago
    So you suggest installing a different set of fonts each time you visit a new site?
    - thaumaturgy 17y ago
      No, I'm suggesting that the majority of computer use will invalidate this as a viable method of identifying users. Connecting from home versus a cafe or a friend's place; browser upgrades; plugin changes/upgrades; using a different browser; installing or removing fonts ... all of those will break this. The prospect of having this in place instead of cookies would be a huge victory for privacy.
- zzzmarcus 17y ago
  Chromium nightly?
- fburnaby 17y ago
  Hey! You're exactly as unique as me!
chaosmachine 17y ago
http://news.ycombinator.com/item?id=1082464 http://news.ycombinator.com/item?id=1082464
samaparicio 17y ago
The scary thought is that their "solutions" page doesn't really offer any good solution. TOR = slow browsing, privacy mode = doesn't really help that much, browsing from your cell phone = hell no... With regards to the "privacy mode" of most browsers, I think that the feature is mis-named since it mostly refers to the browser's tracking of your activity, not the server's.
- asb 17y ago
  You ignore the noscript option which seems the most practical.
  - mseebach 17y ago
    I have noscript, but I'm still only one in 47,347. While not uniquely identifying me, I often frequent sites with far less than 50.000 unique visitors. I'm guessing my non-snow leopard Mac combined with Firefox (that seems to release an update every few weeks) gives me away. Maybe Firefox should stop putting more then major.minor, and certainly not build number, in the User-Agent? EDIT: let's see: https://bugzilla.mozilla.org/show_bug.cgi?id=543202 https://bugzilla.mozilla.org/show_bug.cgi?id=543202
keefe 17y ago
very very interesting and somewhat scary....
ekiru 17y ago
I think it's somewhat dishonest about the uniqueness of visitor's fingerprints. I've tried it three times and been told I was unique each time. However, the last two times consisted of me visiting the site and, without doing anything else at all, refreshing.
- jmreardon 17y ago
  Visiting the site sets a cookie on your machine. It would appear they are checking that cookie to determine if you get counted again.
teye 17y ago
Your link includes a flag indicating the browser allows JS. For those who run NoScript or disable it: http://panopticlick.eff.org/ http://panopticlick.eff.org/
maurycy 17y ago
Combine this with p0f (http://lcamtuf.coredump.cx/p0f.shtml http://lcamtuf.coredump.cx/p0f.shtml), some basic machine learning and you're all doomed. By the way, browsers are generally scary thing. What about using the browser's cache for tracking? http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracking-users-without-cookies/ http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracki... It's an interesting idea how to get a truly anonymous browsing, though.
- majke 17y ago
  I was thinking about it for a long time. I haven't implemented it yet - as I can't find a selling point. What eff is selling: bits of entropy. What my mother understands - nothing. What other users understand: I'm not anonymous, being anonymous is hard, let's go shopping. So yes - from technical point of view I can identify you even better than that, but it doesn't solve any problem. Well, maybe except for advertising :)
gommm 17y ago
hmmm, having a chinese plugin for taobao really marks my browser.... I wonder if there's a way to tell to safari not to return the list of plugins? But then I guess it would break a few pages...
jrockway 17y ago
Thanks for reminding me that I need to use Privoxy.
- jrockway 17y ago
  I did that, and I am still totally unique. Methinks it's time to uninstall fonts I don't need, like "Radios in Motion" and "Fake Receipt", or to just lie to the web page.
Tichy 17y ago
Very surprised that my plugins provided the most bits (13), as I have only Flash installed. Maybe it is because everybody has a slightly different version of the Flash plugin? Also, I can only assume that FutureSplash Player comes with Flash? I also have the "Gecko default plugin", not idea whatsoever what it does.
FluidDjango 17y ago
I'm using Safari(Mac) 4.0.4 (with only non-standard being ClickToFlash FWIW) and they say: "Your browser fingerprint appears to be unique among the 261,326 tested so far." I think not.
- julio_the_squid 17y ago
  Have any non-default fonts installed or anything like that?
  - FluidDjango 17y ago
    negative
Raphael 17y ago
Google Gears 0.5.33.0; These are the Gears that power the tubes! :-)
mohanarun 17y ago
From The EFF's Panopticlick's things that enable it to create 'unique browser fingerprint' about your system + browser, Combined with browsing history as determined by www.whattheinternetknowsaboutyou.com, this is quite scary!

67 points by profquail 17y ago

Apparently quite unique =( Your browser fingerprint appears to be unique among the 234,579 tested so far. Currently, we estimate that your browser has a fingerprint that conveys at least 17.84 bits of identifying information.

thaumaturgy 17y ago
It's not really that big of a deal. Their site still thinks my browser is totally unique, despite having visited them the last time this was posted. The reason? I installed a couple of new fonts.
- ryanwaggoner 17y ago
  Interesting...one solution from the perspective of the tracker might be a system that assigns different weights to different types of information, with things like fonts and browser plugins given less ranking than things like OS, browser type, and time zone, which probably change much less frequently. You might not be able to get 100% unique tracking, but if you could guess that there was a 99% chance that it was the same person, doing things like behavioral advertising would probably still be worth it. The interesting application of things like this and the visited link color hack is to use them in Europe, where apparently you have to get users to approve a cookie every time? This might be a good way to skirt the issue for a lot of sites that don't need a guarantee that it's the same person.
- Tichy 17y ago
  So you suggest installing a different set of fonts each time you visit a new site?
  - thaumaturgy 17y ago
    No, I'm suggesting that the majority of computer use will invalidate this as a viable method of identifying users. Connecting from home versus a cafe or a friend's place; browser upgrades; plugin changes/upgrades; using a different browser; installing or removing fonts ... all of those will break this. The prospect of having this in place instead of cookies would be a huge victory for privacy.
zzzmarcus 17y ago
Chromium nightly?
fburnaby 17y ago
Hey! You're exactly as unique as me!

chaosmachine 17y ago

http://news.ycombinator.com/item?id=1082464 http://news.ycombinator.com/item?id=1082464

samaparicio 17y ago

The scary thought is that their "solutions" page doesn't really offer any good solution. TOR = slow browsing, privacy mode = doesn't really help that much, browsing from your cell phone = hell no... With regards to the "privacy mode" of most browsers, I think that the feature is mis-named since it mostly refers to the browser's tracking of your activity, not the server's.

asb 17y ago
You ignore the noscript option which seems the most practical.
- mseebach 17y ago
  I have noscript, but I'm still only one in 47,347. While not uniquely identifying me, I often frequent sites with far less than 50.000 unique visitors. I'm guessing my non-snow leopard Mac combined with Firefox (that seems to release an update every few weeks) gives me away. Maybe Firefox should stop putting more then major.minor, and certainly not build number, in the User-Agent? EDIT: let's see: https://bugzilla.mozilla.org/show_bug.cgi?id=543202 https://bugzilla.mozilla.org/show_bug.cgi?id=543202

keefe 17y ago

very very interesting and somewhat scary....

ekiru 17y ago

I think it's somewhat dishonest about the uniqueness of visitor's fingerprints. I've tried it three times and been told I was unique each time. However, the last two times consisted of me visiting the site and, without doing anything else at all, refreshing.

jmreardon 17y ago
Visiting the site sets a cookie on your machine. It would appear they are checking that cookie to determine if you get counted again.

teye 17y ago

Your link includes a flag indicating the browser allows JS. For those who run NoScript or disable it: http://panopticlick.eff.org/ http://panopticlick.eff.org/

maurycy 17y ago

Combine this with p0f (http://lcamtuf.coredump.cx/p0f.shtml http://lcamtuf.coredump.cx/p0f.shtml), some basic machine learning and you're all doomed. By the way, browsers are generally scary thing. What about using the browser's cache for tracking? http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracking-users-without-cookies/ http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracki... It's an interesting idea how to get a truly anonymous browsing, though.

majke 17y ago
I was thinking about it for a long time. I haven't implemented it yet - as I can't find a selling point. What eff is selling: bits of entropy. What my mother understands - nothing. What other users understand: I'm not anonymous, being anonymous is hard, let's go shopping. So yes - from technical point of view I can identify you even better than that, but it doesn't solve any problem. Well, maybe except for advertising :)

gommm 17y ago

hmmm, having a chinese plugin for taobao really marks my browser.... I wonder if there's a way to tell to safari not to return the list of plugins? But then I guess it would break a few pages...

jrockway 17y ago

Thanks for reminding me that I need to use Privoxy.

jrockway 17y ago
I did that, and I am still totally unique. Methinks it's time to uninstall fonts I don't need, like "Radios in Motion" and "Fake Receipt", or to just lie to the web page.

Tichy 17y ago

Very surprised that my plugins provided the most bits (13), as I have only Flash installed. Maybe it is because everybody has a slightly different version of the Flash plugin? Also, I can only assume that FutureSplash Player comes with Flash? I also have the "Gecko default plugin", not idea whatsoever what it does.

FluidDjango 17y ago

I'm using Safari(Mac) 4.0.4 (with only non-standard being ClickToFlash FWIW) and they say: "Your browser fingerprint appears to be unique among the 261,326 tested so far." I think not.

julio_the_squid 17y ago
Have any non-default fonts installed or anything like that?
- FluidDjango 17y ago
  negative

Raphael 17y ago

Google Gears 0.5.33.0; These are the Gears that power the tubes! :-)

mohanarun 17y ago

From The EFF's Panopticlick's things that enable it to create 'unique browser fingerprint' about your system + browser, Combined with browsing history as determined by www.whattheinternetknowsaboutyou.com, this is quite scary!