20 ms·

Online tracking: A 1-million-site measurement and analysis

592 points by itg 10y ago

rdancer 10y ago
This is the kind of nonconsensual sureptitious user tracking that the EU privacy directive 2002/58/EC concerns itself with, not those redundant, stupid cookie consent overlays.
- nailer 10y ago
  So a regular site using, say, mixpanel doesn't need to show a warning?
  - com_kieffer 10y ago
    No, from my understanding cookies are allowed by default only if they are essential to the function of the site. If you only use the cookie to handle logins and sessions then you don't need the warning. I you use the cookie for tracking or analytics then you need the warning. Note that you can use your webserver logs for analytics and that doesn't require the cookie banner.
    - rdancer 10y ago
      > Note that you can use your webserver logs for analytics and that doesn't require the cookie banner In the EU, tracking user IPs actually requires consent. Even logging them does.
  - kuschku 10y ago
    If the cookies are purely technical (say, login cookies), no. If the cookies are used for tracking, like Google Analytics, then yes, it needs to ask the user for consent. And that’s not a warning, but actual "yes/no", and in the no case, it may not set a tracking cookie, or have set a tracking cookie already. Most sites (except for a few dozen German and Dutch ones) just redirect you somewhere else, though, if you refuse to be tracked.
    - JohnTHaller 10y ago
      Something that is best left to the browser to handle... by allowing the user to enable/disable 3rd party cookies. Which we already have. But no, the EU has stupid notifications on basically every single website as a result since everyone uses third party analytics. Why? If you want your analytics to be believed by anyone who wants to advertise with you, invest in you, partner with you, or buy you, they'd damn well better be third party analytics.
      - rdancer 10y ago
        The EU Commission and the regulatory agencies actually agree with you. The stupidity is 100% with the web devs and customers.
        carlesfe 10y ago
        What do you mean with "The stupidity is 100% with the web devs and customers"? The law requires user consent, in form of a click on a banner or scrolling the page, before setting any cookie.
        rdancer 10y ago
        Which law? The 2002/58/EC doesn't.
        carlesfe 10y ago
        Not that one. http://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32009L0136 http://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:320... Complete law: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32009L0136&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... Paragraph 66 talks about cookies. A later exception was made by the EU for session cookies. Guidelines for webmasters: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#section_4 http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se... It has a sample banner which is similar to those which most users display. Spanish official directives (with further protection because of a local law called LSSI): https://www.agpd.es/portalwebAGPD/canaldocumentacion/publicaciones/common/Guias/Guia_Cookies.pdf https://www.agpd.es/portalwebAGPD/canaldocumentacion/publica..., page 17. Also comes with a sample banner Did you really think that everyone else was wrong or didn't read the law and is programming these banners as some sort of fad?
  - rdancer 10y ago
    If you can set cookies, the user has already expressed their consent by enabling the cookies in the browser. As long as cookies' existence is common knowledge (it is by now), there is no need to duplicate browser UI within every website. This is the official stance of the ICO[1], the UK national authority: there was a need to educate users what cookies were when the directive was passed. No such need exists now. ICO itself briefly used consent overlays, but does not anymore (EDIT: Aaaaand they've apparently use them again; I'll try to find the policy release where they say this is not necessary.). Cookies not used for tracking of persons never needed any consent, as they have no privacy implications. People who make their living creating cargo-cult UI designs, have predictably added cargo-cult law-compliance to their toolset. It is beyond stupid. [1] https://ico.org.uk/ https://ico.org.uk/
    - shawnz 10y ago
      I see a consent overlay on that very page.
      - rdancer 10y ago
        Thank you for pointing that out. I'll try to find the policy release where they say this is not necessary.
    - lucb1e 10y ago
      > If you can set cookies, the user has already expressed their consent by enabling the cookies in the browser. As long as cookies' existence is common knowledge (it is by now), there is no need to duplicate browser UI within every website. Wrong. If I disable cookies in my browser, I can't log in to websites anymore, so they need to be allowed. A whitelist would be very inconvenient. On top of that, it's not explicit allowance, it'd be implicit (i.e. opt-out instead of opt-in). I don't know if British legislation is different, but this is illegal at least in the Netherlands.
      - rdancer 10y ago
        You can enable session cookies only, even in the current UIs. Ditto for third-party cookies. Duplicating UI in a website is a solution looking for a problem. The web devs can nag the 0.01% who don't have cookies enabled, and leave the 99.99% who have them enabled alone. It has never been enforced that way to my knowledge, anywhere in the EU. Which law or court decision says that it is actually illegal?
- mpeg 10y ago
  And there's already been an opinion to extend 2002/58/EC to fingerprinting[0] [0]: http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp224_en.pdf http://ec.europa.eu/justice/data-protection/article-29/docum...
- sleepychu 10y ago
  If you consent to the way things have always been, do nothing!
cdnsteve 10y ago
After reading this it makes me want to disable JavaScript entirely, along with cookies, and go back to text browsing. I've been using Ghostery on my phone, it's been pretty good.
- kowdermeister 10y ago
  I'd say that's pretty needless. I run ghostery and ABP simultaneously and they do a great job catching these trackers. The downside of having no JS compared to accidentally a getting fingerprinted is a no brainer for me. Modern web is pretty useless without JS for me.
randomwalker 10y ago
Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.
- dccoolgai 10y ago
  This is much-needed research. Thank you for your work. Regarding the WebRTC tracking- would it be possible for WebRTC to work without exposing the local IP? I.e. is there any real reason that fingerprint needs to be there?
  - englehardt 10y ago
    Other co-author here. Unfortunately there are good performance reasons for allowing WebRTC to access the local IP, see the lengthy discussion here: https://bugzilla.mozilla.org/show_bug.cgi?id=959893 https://bugzilla.mozilla.org/show_bug.cgi?id=959893. One use case is allowing two peers behind the same NAT to communicate directly without leaving the local network. The working group recommendation that we linked in the paper (https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling/ https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handli...) addresses some of the concerns that arise from that (namely the concern that a user behind a VPN or proxy will have their real, public address exposed), but still recommends that a single private IP address be returned by default and without user permission. However that's still quite identifying for some network configurations, e.g. a network which assigns non-RFC1918 IPs to users behind a NAT. Seems to me that putting access to the local IP address behind a permission would both remove the tracking risk and still allow the performance gains after the user grants permission.
    - dccoolgai 10y ago
      Thanks for the response! If you're interested and it would be useful for your research, I have some really, really interesting privacy findings regarding Service Workers I'd be happy to share. I'm strongly in favor of an enhanced Open Web, but I'm not comfortable with the opaque nature in which tracking/privacy can be likewise enhanced with little user interaction or notification. Keep up the good work.
buremba 10y ago
All these things make the websites the new apps. Most probably we won't need to use many desktop applications a few years later.
- cptskippy 10y ago
  That's the line Apple took with iOS shortly before it introduced the App store. Mozilla, Palm/HP, and even Microsoft with it's Win 8 Metro Apps tried to make websites the new apps. It has some short comings. Web apps are definitely getting better, I haven't used an actual email client in 10 years, but they have a long way to go before they can replace dedicated clients entirely.
  - oblio 10y ago
    Full replacements will probably have to wait for mass adoption of WebAssembly, web workers and probably some other things as well. Heck, what would be really interesting would be hardware acceleration for the final version of WebAssembly. That should (?) make it competitive with regular assembly.
  - wtbob 10y ago
    > Web apps are definitely getting better, I haven't used an actual email client in 10 years Oddly enough, just yesterday I started using an email client once more (emacs+gnus, for Gmail). It just felt so _nice_. And fast too!
  - metasean 10y ago
    > Web apps are definitely getting better, ... but they have a long way to go before they can replace dedicated clients entirely. And yet, just yesterday there was a great discussion on Virtual Desktop Infrastructures, where entire operating systems are accessed and operated virtually through just the browser [0]. The current top comment indicates that while there are some setup hoops to jump through to use a specific OS, the performance itself "works very well" [1]. Does this not qualify as a web app replacing a client entirely? [0] https://news.ycombinator.com/item?id=11721466 https://news.ycombinator.com/item?id=11721466 [1] https://news.ycombinator.com/item?id=11722141 https://news.ycombinator.com/item?id=11722141
cptskippy 10y ago
All of this makes me wonder how some of these interfaces should be more closely guarded by the user agent. Perhaps instead of a site probing for capabilities, they should instead publish a list of what the site/page can leverage and what it absolutely needs to work. Maybe meta tags in the head or something like the robots.txt. Browsers can then pull the list and present it to the end user for white-listing. You could have a series of tags similar to noscript to decorate broken portions of sites if you wanted to advertise missing features to users and, based on what features they chose to enable/disable for the site, the browser would selectively render them.
- maxerickson 10y ago
  Users don't want to do this though. I mean, how many people are dealing with the hassle of noscript? That's probably most of the users that are going to do anything other than tell the browser to stop asking questions.
  - cptskippy 10y ago
    Users are familiar with managing permissions, they do it all of the time. Users have to manage location services and the camera in browser. iOS and Android also prompt for access to resources. Why is it unrealistic to expect the same for other interfaces like audio, video, WebRTC, and other potentially exploitable functionality?
    - maxerickson 10y ago
      I'm not arguing against enabling users to manage the permissions. I'm arguing it won't help a huge number of users because they will default to granting them.
    - recursive 10y ago
      Most permission management most users do is click the "accept" button when installing an app without reading anything on the list. I don't see how that helps.
jimktrains2 10y ago
NoScript is an all-or-nothing approach. Are there any JS-blockers that allow API-level blocks?
- BinaryBullet 10y ago
  I don't know of any. I would think it would be fairly easy to create a userscript or extension to stub built-in APIs (maybe using something like testdouble.js or sinon.js to override the default global objects that you are trying to "disable"). I'm not sure what issues you'd run into on various pages if you did that though (so it'd probably need a lot of iteration- and fixing bug reports). It might be a fun project to start though. I've been really enjoying testdouble's API (and have started using that for my unit tests).
- idbehold 10y ago
  It's kind of surprising that there isn't an extension to provide this functionality (at least in desktop browsers). All you'd have to do is monkey patch the methods that get called and throw up a confirm("are you sure you want to allow [X]")
  - BinaryBullet 10y ago
    Well, I just created a small POC: http://plnkr.co/edit/hKvPpEZQGCSkCNKly5Z3?p=preview http://plnkr.co/edit/hKvPpEZQGCSkCNKly5Z3?p=preview It would need to remember your choice so you don't get prompted everytime, but that's a small/easy change to make.
- phaer 10y ago
  If you use Firefox or Iceweasel, you can disable most of those apis in about:config or user.js. For example, media.peerconnection.enabled = false, to disable WebRTC. dom.battery.enabled = false for battery, etc.
  - drdaeman 10y ago
    Yeah, but one may want to enable those on per-site basis. So you get both the fancy stuff (with a sites you trust) and no tracking material for the rest.
wodenokoto 10y ago
What annoys me the most is how many useless cycles these trackers use to track me.
ordbajsare 10y ago
All this so they can show me adds for stuff i already bought.
kardos 10y ago
So given this information, how can we poison the results that the trackers get?
- hellweaver666 10y ago
  You would need a way to change your fingerprint on every page load I guess?
- Freak_NL 10y ago
  Just altering your own browser's fingerprint for each domain won't poison their data (it just makes you anonymous to them). Any data is good data as far as these trackers are concerned. You can devalue their data by collectively sending the same fingerprints, but there is no way to actively poison their databases.
- englehardt 10y ago
  There have been a couple plugins which try to address this question: Chameleon (https://github.com/ghostwords/chameleon https://github.com/ghostwords/chameleon), which is still in early stages, and FireGloves (https://fingerprint.pet-portal.eu/?menu=6 https://fingerprint.pet-portal.eu/?menu=6), which was built by a research group (not sure it's still supported). Also a great paper on this topic: http://research.microsoft.com/pubs/209989/tr1.pdf http://research.microsoft.com/pubs/209989/tr1.pdf
ysleepy 10y ago
Well, who would have guessed. Surprise surprise. The web is such a shit technology.
- oblio 10y ago
  And how would Silverlight or Java applets or Flash or any other client side technology be better in this regard? You have to expose capabilities and those capabilities can be used to create an unique fingerprint based on your device. How would you design the stack so that this kind of thing is impossible? Feel free to use your favorite tech stack as a base.
  - justJanne 10y ago
    Simple: Seperate documents, interactivity, and programs. If I browse the web, I usually want documents. Sometimes I also want interactivity, like in comment forms, which could be a seperated widget which could only interact in limited ways, and only with the page and the server it connects to. And then there would be programs, which could access even local files – but would have an installation process like browser extensions. Giving documents access that normally just programs do is stupid, as we have seen in Word Macro-based malware, PDF-based malware, Browser-based malware (the pdf.js exploit, for example), and so on.
  - ysleepy 10y ago
    How about not developing applications in the browser? Its about linked documents. Not angular-17 MVVM async session persistence in indexdb with websql and asm.js rendering webgl for a spinning teapot.
    - andybak 10y ago
      OK. So you get your 'document only' internet. Where do we put all the other stuff? I have a bunch of 'non-document' websites that are essential to me now. What happens under your new regime? Someone reimplements them all as native apps? The point I'm making is just because your internet is document-only please don't assume mine or other people's are.
wyldfire 10y ago
Whoa, what's the use case for exposing battery information?
- erlichmen 10y ago
  Some application want access to the battery info as they might want to disable some functionality in case your battery runs low. It would be smarter if instead of giving exact battery level it will get a callback once the battery runs low.
  - raarts 10y ago
    The Great Suspender is an example of this. Auto-sleeps browser tabs when on battery. https://chrome.google.com/webstore/detail/the-great-suspender/klbibkeccnjlkjkiokjodocebajanakg?hl=en https://chrome.google.com/webstore/detail/the-great-suspende...
    - cpeterso 10y ago
      Sharing the battery information with a browser extension seems reasonable, but are there any websites that actually use the battery information for legitimate user benefit?
- kuschku 10y ago
  Wait until you see WebUSB[1]. The use case is Chrome OS, not much more. [1] https://news.ycombinator.com/item?id=11465924 https://news.ycombinator.com/item?id=11465924
- mschuster91 10y ago
  Web apps, "half native" web apps (Appcache + show on homescreen link) and ionic/cordova apps running in fullscreen mode. E.g. a geocaching app could benefit by signaling the user if battery goes low (Ingress is a battery hog, for example!)
jkot 10y ago
Malware filtering is needed.
- rickycook 10y ago
  that's why we have things like ublock and ghostery; it's essentially the same
pmlnr 10y ago
So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular" browser fingerprinting. Is anyone aware of the existence of one?
- TazeTSchnitzel 10y ago
  I think Tor Browser tries to do this for some types of fingerprinting.
  - brador 10y ago
    The things you block and don't block could also be used to help form a fingerprint.
  - pmlnr 10y ago
    The Tor Browser does not send misinformation; it just blocks. A solution would probably be a browser where every version, on every platform reports the exact same things, always the same way.
    - TazeTSchnitzel 10y ago
      That's not true, Tor Browser does sometimes lie, see what englehardt linked.
    - neerdowell 10y ago
      > The Tor Browser does not send misinformation; it just blocks. No, it doesn't. TB sends all kinds of misinformation, from the user agent string (always reports itself as being its base version of Firefox running on 32-bit Windows 7) to rounding javascript timing functions to reduce the precision. > A solution would probably be a browser where every version, on every platform reports the exact same things, always the same way. That's exactly what Tor Browser does.
      - pmlnr 10y ago
aub3bhat 10y ago
There is an acceptable tradeoff between pseudo anonymous access through browsers vs non-anonymous access through native apps. To interpret this research as reason for crippling web or browsers would be a giant mistake. Crippling browsers will only work against users, who will be then forced into installing apps by companies. Two popular shopping companies in India exactly did this, they completely abandoned their websites and went native app only. This combined with large set of permission requested by apps lead to worse experience in terms of privacy for consumers. As the announcement for Instant Apps at Google I/O demonstrate, web as an open platform is in peril and its demise will be only hastened by blindly adopting these types of recommendations. Essentially web as open platform will be destroyed in the name of perfect privacy. Only to be replaced by inescapable walled gardens. Rather consider that web allows a motivated user to employ evasion tactics, while still offering usability to those who are not interested in privacy. While with native apps where Apple needs a credit card on file to install, offer no such opportunity. I am happy that Arvind (author of the paper) in another comment recommends a similar approach: """ Personally I think there are so many of these APIs that for the browser to try to prevent the ability to fingerprint is putting the genie back in the bottle. But there is one powerful step browsers can take: put stronger privacy protections into private browsing mode, even at the expense of some functionality. Firefox has taken steps in this direction https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-.. https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-.... Traditionally all browsers viewed private browsing mode as protecting against local adversaries and not trackers / network adversaries, and in my opinion this was a mistake. """ https://news.ycombinator.com/item?id=11730373 https://news.ycombinator.com/item?id=11730373
- crdb 10y ago
  > Two popular shopping companies in India exactly did this, they completely abandoned their websites and went native app only. This combined with large set of permission requested by apps lead to worse experience in terms of privacy for consumers. I'm surprised nobody has commented on your comment yet. I was in a meeting just this morning where my interlocutor assured me that over 70% of advertising in 10 years will be native apps since everything else is getting blocked or abandoned (and presenting it as an opportunity to do all the stuff you "can't do anymore" on browser).
anexprogrammer 10y ago
Colour me unsurprised. Disappointed though. I'm glad I disabled WebRTC when I first discovered it could be used to expose local IP on a VPN. These "extension" technologies should all be optional plugins. Preferably install on demand, but a simple, obvious way to disable would be acceptable. (ie more obvious than about:config) Not a great deal can be done about font metrics other than my belief that websites shouldn't be able to ferret around my fonts to see what I have. Not like it's a critical need for any site.
- beardog 10y ago
  If your VPN is configured correctly, your IP will not be exposed.
  - throwanem 10y ago
    Not all of my devices make it possible to disable WebRTC, which makes defense in depth a necessity. Can you provide pointers to more information?
    - beardog 10y ago
      I don't experience webrtc leaks with Openvpn and this config: http://pastebin.com/raw/hiH1TZtS http://pastebin.com/raw/hiH1TZtS (I use IVPN, their client prevents webrtc leaks on windows by default, but had to manually configure openvpn on linux). Of course, I keep webrtc disabled in Firefox anyway except when i need it, defense in depth like you said.
      - throwanem 10y ago
        Neat, thanks.
- amelius 10y ago
  > These "extension" technologies should all be optional plugins. But then still whether you installed an extension would contribute a bit of information to your fingerprint.
id122015 10y ago
I think its similar to how Absolute Computrace rootkit identifies Android and Lenovo devices. Each hardware compoment has a unique ID, like your ethernet, bluetooth, even microphones and batteries.
radicalbyte 10y ago
Of course this is something you do. Throw it together with all of the other information you can clean from a browser (referrer, ip) and you can get a match with a very high confidence level. Shops can do the same with baskets, you find that people are either identified by one very rare feature which reoccurs often or their little graph of 4-5 items which correlate 99% to them.
ape4 10y ago
Seems like browsers should ask the user's permission to use these html5 features. Then whitelist. For example, a site that does nothing with audio should be denied access to the audio stack.
deleted 10y ago
[deleted]
tomkin 10y ago
Ahhh. Remember when this was just a Flash problem, and getting rid of Flash was going to rid the world of evil? Spoiler: that didn't happen.
- CyberDildonics 10y ago
  Things like this happened with flash but you had no control over them since flash was all or nothing and closed source.
  - tomkin 10y ago
    I agree with that (technical person's) perspective, but that was not the mainline argument. Steve Jobs got on stage and said it was a hunk of battery wasting crap that invaded your privacy. I'm saying you can make that case regardless of your platform de jour.
codedokode 10y ago
Some methods of fingerprinting are probably used to distinct between real users and bots. Bots can use patched headless browsers that are masquaraded as desktop browsers (for example as latest Firefox or Chrome running on Windows). Subtle differences in font rendering or missing audio support can be useful to detect underlying libraries and platform. Hashing is used to hide exact matching algorithm from scammers. There is a lot of people trying to earn on clicking ads with bots. Edit: and by the way disabling JS is an effective method against most of the fingerprinting techniques.
- dsl 10y ago
  As someone who has written code to detect bots, exactly this. We don't care about fingerprinting the user, we care about fingerprinting to verify the user agent you claim to be.
MichaelGG 10y ago
WebRTC guys get around this by stating fingerprinting is game over, so don't even bother. They ignore that they are going against the explicitly defined networking (proxy) settings. Browsers are complicit in this. If the application asks "should I use a proxy", then ignores it, silently, wherever it wants, that's deceptive and broken. There's still zero (0) use cases to have WebRTC data channels enabled in the background with no indicator. If all these APIs are added, the web will turn into a bigger mess than it is. They can't prompt for permissions too much. So they'll skip that, like WebRTC does.
pjc50 10y ago
I think it's time for HTML--, which would contain no active content at all and simply be a reflowable document display format.
- xg15 10y ago
  SO basically AMP minus the Google-sourced JS...
  - manigandham 10y ago
    ...which is just HTML then.
ultramancool 10y ago
As soon as I saw these APIs being added I immediately dropped into about:config and disabled them. How the hell do these people think this is a good idea to do without asking any permissions? Put these in your user prefs.js file on Firefox: user_pref("dom.battery.enabled", false); user_pref("device.sensors.enabled", false); user_pref("dom.vibrator.enabled", false); user_pref("dom.enable_performance", false); user_pref("dom.network.enabled", false); user_pref("toolkit.metrics.ping.enabled", false); user_pref("dom.gamepad.enabled", false); Here's my full firefox config currently: https://up1.ca/#nUSA1WtY13ECfmYC5c825w https://up1.ca/#nUSA1WtY13ECfmYC5c825w Privacy on the web keeps getting harder and harder. Of course this should only be used in conjunction with maxed out ad blockers, anti-anti-adblockers, privacy badger and disconnect. We need browsers to start asking permission. When you install an app on Android or iOS it says "here's what it's going to use, do you want this?". The mere presence of the popup would annoy people and prevent them from using these APIs.
- DavideNL 10y ago
  fyi, related: Firefox addon "Privacy Settings" : https://addons.mozilla.org/en-US/firefox/addon/privacy-settings/ https://addons.mozilla.org/en-US/firefox/addon/privacy-setti...
- mccr8 10y ago
  Of course, now a site could potentially fingerprint you by the set of APIs you have disabled!
- Zooper 10y ago
  Thank you, user, for making your fingerprint hash more unique by disabling certain default features, given your user-agent string, thus opting into cat-facts.
  - shostack 10y ago
    Disabling them probably makes you significantly more unique than those that don't just because the vast majority of people never will disable them.
- 10y ago
brudgers 10y ago
Google has a vested interest in information leakage. I have a suspicion that the Chromium project expresses a strategic desire to shape the direction of browser development away from stopping those leaks. The idea of signing into the browser with an identity is a core feature and in Google's branded version, Chrome, the big idea is that the user is signed into Google's services. Google only pitches the idea of multiple identities in the context of sharing devices among several people: https://support.google.com/chrome/answer/2364824?hl=en https://support.google.com/chrome/answer/2364824?hl=en and even then doesn't do much to surface the idea. https://www.google.com/search?hl=en&as_q=multiple+identities+in+chrome&as_epq=&as_oq=&as_eq=&as_nlo=&as_nhi=&lr=&cr=&as_qdr=all&as_sitesearch=google.com&as_occt=any&safe=images&as_filetype=&as_rights= https://www.google.com/search?hl=en&as_q=multiple+identities...
- exelius 10y ago
  This is why Firefox is gaining momentum; they seem to be the only browser interested in user privacy. Users are definitely interested.
  - DavideNL 10y ago
    Indeed. i even use FF despite its terrible terrible "pinch to zoom" functionality - which works perfectly in other browsers (Safari, Chromium, Chrome). Zooming is such a basic thing... i don't understand why they implement it in such a crappy way. Certainly doesn't attract users.
    - gruez 10y ago
      Can you elaborate what's so bad about Firefox's pinch to zoom?
      - DavideNL 10y ago
        Take a look at this movement: https://up1.ca/#q07x8mFjrGtXR6ju1r3EQw https://up1.ca/#q07x8mFjrGtXR6ju1r3EQw In Safari, this is what it does: https://up1.ca/#Lu0r_cI_v0vXvzpa9nUmEg https://up1.ca/#Lu0r_cI_v0vXvzpa9nUmEg So in Safari it lets me zoom all the way in and/or out with 1 smooth movement. This is what the same movement does in Firefox: https://up1.ca/#SEKWNOm1BSQnkntxj_v53w https://up1.ca/#SEKWNOm1BSQnkntxj_v53w In Firefox, if i want to zoom all the way in, i have to pinch in like 10 times (very annoying) and then to zoom out pinch out another 10 times...
f- 10y ago
Although the emphasis on the actual abuse of newly-introduced APIs is much needed, it is probably important to note that they are not uniquely suited for fingerprinting, and that the existence of these properties is not necessarily a product of the ignorance of browser developers or standards bodies. For most part, these design decisions were made simply because the underlying features were badly needed to provide an attractive development platform - and introducing them did not make the existing browser fingerprinting potential substantially worse. Conversely, going after that small set of APIs and ripping them out or slapping permission prompts in front of them is unlikely to meaningfully improve your privacy when visiting adversarial websites. Few years back, we put together a less publicized paper that explored the fingerprintable "attack surface" of modern browsers: https://www.chromium.org/Home/chromium-security/client-identification-mechanisms https://www.chromium.org/Home/chromium-security/client-ident... Overall, the picture is incredibly nuanced, and purely technical solutions to fingerprinting probably require breaking quite a few core properties of the web.
makecheck 10y ago
Over 3,000 top sites using the font technique, and from the description this sounds really wasteful (choosing and drawing in a variety of fonts for no reason other than to sniff out the user). Each font is probably associated with a non-trivial caching scheme and other OS resources, not to mention the use of anti-aliasing in rendering, etc. So a web page, doing something you don’t even want, is able to cause the OS to devote maybe 100x more resources to fonts than it otherwise would? A simple solution would be to set a hard limit, such as “4 fonts maximum”, for any web site; and, to completely disallow linked domains from using more.
chatmasta 10y ago
If you want to see a live demo of all the ways your browser can fingerprint you, this is a great website: https://www.browserleaks.com/ https://www.browserleaks.com/
coygui 10y ago
Would it be more secure to use tor than traditional browser. The only drawback is the longer RTT.
youaretracked 10y ago
Since the original web based ad campaigns were launched we have been tracked. Serious web analytics companies know these tactics already. So what exactly is the research contribution being made here? What's new and interesting?

592 points by itg 10y ago

This is the kind of nonconsensual sureptitious user tracking that the EU privacy directive 2002/58/EC concerns itself with, not those redundant, stupid cookie consent overlays.

nailer 10y ago
So a regular site using, say, mixpanel doesn't need to show a warning?
- com_kieffer 10y ago
  No, from my understanding cookies are allowed by default only if they are essential to the function of the site. If you only use the cookie to handle logins and sessions then you don't need the warning. I you use the cookie for tracking or analytics then you need the warning. Note that you can use your webserver logs for analytics and that doesn't require the cookie banner.
  - rdancer 10y ago
    > Note that you can use your webserver logs for analytics and that doesn't require the cookie banner In the EU, tracking user IPs actually requires consent. Even logging them does.
- kuschku 10y ago
  If the cookies are purely technical (say, login cookies), no. If the cookies are used for tracking, like Google Analytics, then yes, it needs to ask the user for consent. And that’s not a warning, but actual "yes/no", and in the no case, it may not set a tracking cookie, or have set a tracking cookie already. Most sites (except for a few dozen German and Dutch ones) just redirect you somewhere else, though, if you refuse to be tracked.
  - JohnTHaller 10y ago
    Something that is best left to the browser to handle... by allowing the user to enable/disable 3rd party cookies. Which we already have. But no, the EU has stupid notifications on basically every single website as a result since everyone uses third party analytics. Why? If you want your analytics to be believed by anyone who wants to advertise with you, invest in you, partner with you, or buy you, they'd damn well better be third party analytics.
    - rdancer 10y ago
      The EU Commission and the regulatory agencies actually agree with you. The stupidity is 100% with the web devs and customers.
      - carlesfe 10y ago
        What do you mean with "The stupidity is 100% with the web devs and customers"? The law requires user consent, in form of a click on a banner or scrolling the page, before setting any cookie.
        rdancer 10y ago
        Which law? The 2002/58/EC doesn't.
        carlesfe 10y ago
        Not that one. http://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32009L0136 http://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:320... Complete law: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32009L0136&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... Paragraph 66 talks about cookies. A later exception was made by the EU for session cookies. Guidelines for webmasters: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#section_4 http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se... It has a sample banner which is similar to those which most users display. Spanish official directives (with further protection because of a local law called LSSI): https://www.agpd.es/portalwebAGPD/canaldocumentacion/publicaciones/common/Guias/Guia_Cookies.pdf https://www.agpd.es/portalwebAGPD/canaldocumentacion/publica..., page 17. Also comes with a sample banner Did you really think that everyone else was wrong or didn't read the law and is programming these banners as some sort of fad?
- rdancer 10y ago
  If you can set cookies, the user has already expressed their consent by enabling the cookies in the browser. As long as cookies' existence is common knowledge (it is by now), there is no need to duplicate browser UI within every website. This is the official stance of the ICO[1], the UK national authority: there was a need to educate users what cookies were when the directive was passed. No such need exists now. ICO itself briefly used consent overlays, but does not anymore (EDIT: Aaaaand they've apparently use them again; I'll try to find the policy release where they say this is not necessary.). Cookies not used for tracking of persons never needed any consent, as they have no privacy implications. People who make their living creating cargo-cult UI designs, have predictably added cargo-cult law-compliance to their toolset. It is beyond stupid. [1] https://ico.org.uk/ https://ico.org.uk/
  - shawnz 10y ago
    I see a consent overlay on that very page.
    - rdancer 10y ago
      Thank you for pointing that out. I'll try to find the policy release where they say this is not necessary.
  - lucb1e 10y ago
    > If you can set cookies, the user has already expressed their consent by enabling the cookies in the browser. As long as cookies' existence is common knowledge (it is by now), there is no need to duplicate browser UI within every website. Wrong. If I disable cookies in my browser, I can't log in to websites anymore, so they need to be allowed. A whitelist would be very inconvenient. On top of that, it's not explicit allowance, it'd be implicit (i.e. opt-out instead of opt-in). I don't know if British legislation is different, but this is illegal at least in the Netherlands.
    - rdancer 10y ago
      You can enable session cookies only, even in the current UIs. Ditto for third-party cookies. Duplicating UI in a website is a solution looking for a problem. The web devs can nag the 0.01% who don't have cookies enabled, and leave the 99.99% who have them enabled alone. It has never been enforced that way to my knowledge, anywhere in the EU. Which law or court decision says that it is actually illegal?
mpeg 10y ago
And there's already been an opinion to extend 2002/58/EC to fingerprinting[0] [0]: http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp224_en.pdf http://ec.europa.eu/justice/data-protection/article-29/docum...
sleepychu 10y ago
If you consent to the way things have always been, do nothing!

cdnsteve 10y ago

After reading this it makes me want to disable JavaScript entirely, along with cookies, and go back to text browsing. I've been using Ghostery on my phone, it's been pretty good.

kowdermeister 10y ago
I'd say that's pretty needless. I run ghostery and ABP simultaneously and they do a great job catching these trackers. The downside of having no JS compared to accidentally a getting fingerprinted is a no brainer for me. Modern web is pretty useless without JS for me.

randomwalker 10y ago

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

dccoolgai 10y ago
This is much-needed research. Thank you for your work. Regarding the WebRTC tracking- would it be possible for WebRTC to work without exposing the local IP? I.e. is there any real reason that fingerprint needs to be there?
- englehardt 10y ago
  Other co-author here. Unfortunately there are good performance reasons for allowing WebRTC to access the local IP, see the lengthy discussion here: https://bugzilla.mozilla.org/show_bug.cgi?id=959893 https://bugzilla.mozilla.org/show_bug.cgi?id=959893. One use case is allowing two peers behind the same NAT to communicate directly without leaving the local network. The working group recommendation that we linked in the paper (https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling/ https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handli...) addresses some of the concerns that arise from that (namely the concern that a user behind a VPN or proxy will have their real, public address exposed), but still recommends that a single private IP address be returned by default and without user permission. However that's still quite identifying for some network configurations, e.g. a network which assigns non-RFC1918 IPs to users behind a NAT. Seems to me that putting access to the local IP address behind a permission would both remove the tracking risk and still allow the performance gains after the user grants permission.
  - dccoolgai 10y ago
    Thanks for the response! If you're interested and it would be useful for your research, I have some really, really interesting privacy findings regarding Service Workers I'd be happy to share. I'm strongly in favor of an enhanced Open Web, but I'm not comfortable with the opaque nature in which tracking/privacy can be likewise enhanced with little user interaction or notification. Keep up the good work.

buremba 10y ago

All these things make the websites the new apps. Most probably we won't need to use many desktop applications a few years later.

cptskippy 10y ago
That's the line Apple took with iOS shortly before it introduced the App store. Mozilla, Palm/HP, and even Microsoft with it's Win 8 Metro Apps tried to make websites the new apps. It has some short comings. Web apps are definitely getting better, I haven't used an actual email client in 10 years, but they have a long way to go before they can replace dedicated clients entirely.
- oblio 10y ago
  Full replacements will probably have to wait for mass adoption of WebAssembly, web workers and probably some other things as well. Heck, what would be really interesting would be hardware acceleration for the final version of WebAssembly. That should (?) make it competitive with regular assembly.
- wtbob 10y ago
  > Web apps are definitely getting better, I haven't used an actual email client in 10 years Oddly enough, just yesterday I started using an email client once more (emacs+gnus, for Gmail). It just felt so _nice_. And fast too!
- metasean 10y ago
  > Web apps are definitely getting better, ... but they have a long way to go before they can replace dedicated clients entirely. And yet, just yesterday there was a great discussion on Virtual Desktop Infrastructures, where entire operating systems are accessed and operated virtually through just the browser [0]. The current top comment indicates that while there are some setup hoops to jump through to use a specific OS, the performance itself "works very well" [1]. Does this not qualify as a web app replacing a client entirely? [0] https://news.ycombinator.com/item?id=11721466 https://news.ycombinator.com/item?id=11721466 [1] https://news.ycombinator.com/item?id=11722141 https://news.ycombinator.com/item?id=11722141

cptskippy 10y ago

All of this makes me wonder how some of these interfaces should be more closely guarded by the user agent. Perhaps instead of a site probing for capabilities, they should instead publish a list of what the site/page can leverage and what it absolutely needs to work. Maybe meta tags in the head or something like the robots.txt. Browsers can then pull the list and present it to the end user for white-listing. You could have a series of tags similar to noscript to decorate broken portions of sites if you wanted to advertise missing features to users and, based on what features they chose to enable/disable for the site, the browser would selectively render them.

maxerickson 10y ago
Users don't want to do this though. I mean, how many people are dealing with the hassle of noscript? That's probably most of the users that are going to do anything other than tell the browser to stop asking questions.
- cptskippy 10y ago
  Users are familiar with managing permissions, they do it all of the time. Users have to manage location services and the camera in browser. iOS and Android also prompt for access to resources. Why is it unrealistic to expect the same for other interfaces like audio, video, WebRTC, and other potentially exploitable functionality?
  - maxerickson 10y ago
    I'm not arguing against enabling users to manage the permissions. I'm arguing it won't help a huge number of users because they will default to granting them.
  - recursive 10y ago
    Most permission management most users do is click the "accept" button when installing an app without reading anything on the list. I don't see how that helps.

jimktrains2 10y ago

NoScript is an all-or-nothing approach. Are there any JS-blockers that allow API-level blocks?

BinaryBullet 10y ago
I don't know of any. I would think it would be fairly easy to create a userscript or extension to stub built-in APIs (maybe using something like testdouble.js or sinon.js to override the default global objects that you are trying to "disable"). I'm not sure what issues you'd run into on various pages if you did that though (so it'd probably need a lot of iteration- and fixing bug reports). It might be a fun project to start though. I've been really enjoying testdouble's API (and have started using that for my unit tests).
idbehold 10y ago
It's kind of surprising that there isn't an extension to provide this functionality (at least in desktop browsers). All you'd have to do is monkey patch the methods that get called and throw up a confirm("are you sure you want to allow [X]")
- BinaryBullet 10y ago
  Well, I just created a small POC: http://plnkr.co/edit/hKvPpEZQGCSkCNKly5Z3?p=preview http://plnkr.co/edit/hKvPpEZQGCSkCNKly5Z3?p=preview It would need to remember your choice so you don't get prompted everytime, but that's a small/easy change to make.
phaer 10y ago
If you use Firefox or Iceweasel, you can disable most of those apis in about:config or user.js. For example, media.peerconnection.enabled = false, to disable WebRTC. dom.battery.enabled = false for battery, etc.
- drdaeman 10y ago
  Yeah, but one may want to enable those on per-site basis. So you get both the fancy stuff (with a sites you trust) and no tracking material for the rest.

wodenokoto 10y ago

What annoys me the most is how many useless cycles these trackers use to track me.

ordbajsare 10y ago

All this so they can show me adds for stuff i already bought.

kardos 10y ago

So given this information, how can we poison the results that the trackers get?

hellweaver666 10y ago
You would need a way to change your fingerprint on every page load I guess?
Freak_NL 10y ago
Just altering your own browser's fingerprint for each domain won't poison their data (it just makes you anonymous to them). Any data is good data as far as these trackers are concerned. You can devalue their data by collectively sending the same fingerprints, but there is no way to actively poison their databases.
englehardt 10y ago
There have been a couple plugins which try to address this question: Chameleon (https://github.com/ghostwords/chameleon https://github.com/ghostwords/chameleon), which is still in early stages, and FireGloves (https://fingerprint.pet-portal.eu/?menu=6 https://fingerprint.pet-portal.eu/?menu=6), which was built by a research group (not sure it's still supported). Also a great paper on this topic: http://research.microsoft.com/pubs/209989/tr1.pdf http://research.microsoft.com/pubs/209989/tr1.pdf

ysleepy 10y ago

Well, who would have guessed. Surprise surprise. The web is such a shit technology.

oblio 10y ago
And how would Silverlight or Java applets or Flash or any other client side technology be better in this regard? You have to expose capabilities and those capabilities can be used to create an unique fingerprint based on your device. How would you design the stack so that this kind of thing is impossible? Feel free to use your favorite tech stack as a base.
- justJanne 10y ago
  Simple: Seperate documents, interactivity, and programs. If I browse the web, I usually want documents. Sometimes I also want interactivity, like in comment forms, which could be a seperated widget which could only interact in limited ways, and only with the page and the server it connects to. And then there would be programs, which could access even local files – but would have an installation process like browser extensions. Giving documents access that normally just programs do is stupid, as we have seen in Word Macro-based malware, PDF-based malware, Browser-based malware (the pdf.js exploit, for example), and so on.
- ysleepy 10y ago
  How about not developing applications in the browser? Its about linked documents. Not angular-17 MVVM async session persistence in indexdb with websql and asm.js rendering webgl for a spinning teapot.
  - andybak 10y ago
    OK. So you get your 'document only' internet. Where do we put all the other stuff? I have a bunch of 'non-document' websites that are essential to me now. What happens under your new regime? Someone reimplements them all as native apps? The point I'm making is just because your internet is document-only please don't assume mine or other people's are.

wyldfire 10y ago

Whoa, what's the use case for exposing battery information?

erlichmen 10y ago
Some application want access to the battery info as they might want to disable some functionality in case your battery runs low. It would be smarter if instead of giving exact battery level it will get a callback once the battery runs low.
- raarts 10y ago
  The Great Suspender is an example of this. Auto-sleeps browser tabs when on battery. https://chrome.google.com/webstore/detail/the-great-suspender/klbibkeccnjlkjkiokjodocebajanakg?hl=en https://chrome.google.com/webstore/detail/the-great-suspende...
  - cpeterso 10y ago
    Sharing the battery information with a browser extension seems reasonable, but are there any websites that actually use the battery information for legitimate user benefit?
kuschku 10y ago
Wait until you see WebUSB[1]. The use case is Chrome OS, not much more. [1] https://news.ycombinator.com/item?id=11465924 https://news.ycombinator.com/item?id=11465924
mschuster91 10y ago
Web apps, "half native" web apps (Appcache + show on homescreen link) and ionic/cordova apps running in fullscreen mode. E.g. a geocaching app could benefit by signaling the user if battery goes low (Ingress is a battery hog, for example!)

jkot 10y ago

Malware filtering is needed.

rickycook 10y ago
that's why we have things like ublock and ghostery; it's essentially the same

pmlnr 10y ago

So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular" browser fingerprinting. Is anyone aware of the existence of one?

TazeTSchnitzel 10y ago
I think Tor Browser tries to do this for some types of fingerprinting.
- brador 10y ago
  The things you block and don't block could also be used to help form a fingerprint.
- pmlnr 10y ago
  The Tor Browser does not send misinformation; it just blocks. A solution would probably be a browser where every version, on every platform reports the exact same things, always the same way.
  - TazeTSchnitzel 10y ago
    That's not true, Tor Browser does sometimes lie, see what englehardt linked.
  - neerdowell 10y ago
    > The Tor Browser does not send misinformation; it just blocks. No, it doesn't. TB sends all kinds of misinformation, from the user agent string (always reports itself as being its base version of Firefox running on 32-bit Windows 7) to rounding javascript timing functions to reduce the precision. > A solution would probably be a browser where every version, on every platform reports the exact same things, always the same way. That's exactly what Tor Browser does.
    - pmlnr 10y ago

aub3bhat 10y ago

There is an acceptable tradeoff between pseudo anonymous access through browsers vs non-anonymous access through native apps. To interpret this research as reason for crippling web or browsers would be a giant mistake. Crippling browsers will only work against users, who will be then forced into installing apps by companies. Two popular shopping companies in India exactly did this, they completely abandoned their websites and went native app only. This combined with large set of permission requested by apps lead to worse experience in terms of privacy for consumers. As the announcement for Instant Apps at Google I/O demonstrate, web as an open platform is in peril and its demise will be only hastened by blindly adopting these types of recommendations. Essentially web as open platform will be destroyed in the name of perfect privacy. Only to be replaced by inescapable walled gardens. Rather consider that web allows a motivated user to employ evasion tactics, while still offering usability to those who are not interested in privacy. While with native apps where Apple needs a credit card on file to install, offer no such opportunity. I am happy that Arvind (author of the paper) in another comment recommends a similar approach: """ Personally I think there are so many of these APIs that for the browser to try to prevent the ability to fingerprint is putting the genie back in the bottle. But there is one powerful step browsers can take: put stronger privacy protections into private browsing mode, even at the expense of some functionality. Firefox has taken steps in this direction https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-.. https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-.... Traditionally all browsers viewed private browsing mode as protecting against local adversaries and not trackers / network adversaries, and in my opinion this was a mistake. """ https://news.ycombinator.com/item?id=11730373 https://news.ycombinator.com/item?id=11730373

crdb 10y ago
> Two popular shopping companies in India exactly did this, they completely abandoned their websites and went native app only. This combined with large set of permission requested by apps lead to worse experience in terms of privacy for consumers. I'm surprised nobody has commented on your comment yet. I was in a meeting just this morning where my interlocutor assured me that over 70% of advertising in 10 years will be native apps since everything else is getting blocked or abandoned (and presenting it as an opportunity to do all the stuff you "can't do anymore" on browser).

anexprogrammer 10y ago

Colour me unsurprised. Disappointed though. I'm glad I disabled WebRTC when I first discovered it could be used to expose local IP on a VPN. These "extension" technologies should all be optional plugins. Preferably install on demand, but a simple, obvious way to disable would be acceptable. (ie more obvious than about:config) Not a great deal can be done about font metrics other than my belief that websites shouldn't be able to ferret around my fonts to see what I have. Not like it's a critical need for any site.

beardog 10y ago
If your VPN is configured correctly, your IP will not be exposed.
- throwanem 10y ago
  Not all of my devices make it possible to disable WebRTC, which makes defense in depth a necessity. Can you provide pointers to more information?
  - beardog 10y ago
    I don't experience webrtc leaks with Openvpn and this config: http://pastebin.com/raw/hiH1TZtS http://pastebin.com/raw/hiH1TZtS (I use IVPN, their client prevents webrtc leaks on windows by default, but had to manually configure openvpn on linux). Of course, I keep webrtc disabled in Firefox anyway except when i need it, defense in depth like you said.
    - throwanem 10y ago
      Neat, thanks.
amelius 10y ago
> These "extension" technologies should all be optional plugins. But then still whether you installed an extension would contribute a bit of information to your fingerprint.

id122015 10y ago

I think its similar to how Absolute Computrace rootkit identifies Android and Lenovo devices. Each hardware compoment has a unique ID, like your ethernet, bluetooth, even microphones and batteries.

radicalbyte 10y ago

Of course this is something you do. Throw it together with all of the other information you can clean from a browser (referrer, ip) and you can get a match with a very high confidence level. Shops can do the same with baskets, you find that people are either identified by one very rare feature which reoccurs often or their little graph of 4-5 items which correlate 99% to them.

ape4 10y ago

Seems like browsers should ask the user's permission to use these html5 features. Then whitelist. For example, a site that does nothing with audio should be denied access to the audio stack.

deleted 10y ago

[deleted]

tomkin 10y ago

Ahhh. Remember when this was just a Flash problem, and getting rid of Flash was going to rid the world of evil? Spoiler: that didn't happen.

CyberDildonics 10y ago
Things like this happened with flash but you had no control over them since flash was all or nothing and closed source.
- tomkin 10y ago
  I agree with that (technical person's) perspective, but that was not the mainline argument. Steve Jobs got on stage and said it was a hunk of battery wasting crap that invaded your privacy. I'm saying you can make that case regardless of your platform de jour.

codedokode 10y ago

Some methods of fingerprinting are probably used to distinct between real users and bots. Bots can use patched headless browsers that are masquaraded as desktop browsers (for example as latest Firefox or Chrome running on Windows). Subtle differences in font rendering or missing audio support can be useful to detect underlying libraries and platform. Hashing is used to hide exact matching algorithm from scammers. There is a lot of people trying to earn on clicking ads with bots. Edit: and by the way disabling JS is an effective method against most of the fingerprinting techniques.

dsl 10y ago
As someone who has written code to detect bots, exactly this. We don't care about fingerprinting the user, we care about fingerprinting to verify the user agent you claim to be.

MichaelGG 10y ago

WebRTC guys get around this by stating fingerprinting is game over, so don't even bother. They ignore that they are going against the explicitly defined networking (proxy) settings. Browsers are complicit in this. If the application asks "should I use a proxy", then ignores it, silently, wherever it wants, that's deceptive and broken. There's still zero (0) use cases to have WebRTC data channels enabled in the background with no indicator. If all these APIs are added, the web will turn into a bigger mess than it is. They can't prompt for permissions too much. So they'll skip that, like WebRTC does.

pjc50 10y ago

I think it's time for HTML--, which would contain no active content at all and simply be a reflowable document display format.

xg15 10y ago
SO basically AMP minus the Google-sourced JS...
- manigandham 10y ago
  ...which is just HTML then.

ultramancool 10y ago

As soon as I saw these APIs being added I immediately dropped into about:config and disabled them. How the hell do these people think this is a good idea to do without asking any permissions? Put these in your user prefs.js file on Firefox: user_pref("dom.battery.enabled", false); user_pref("device.sensors.enabled", false); user_pref("dom.vibrator.enabled", false); user_pref("dom.enable_performance", false); user_pref("dom.network.enabled", false); user_pref("toolkit.metrics.ping.enabled", false); user_pref("dom.gamepad.enabled", false); Here's my full firefox config currently: https://up1.ca/#nUSA1WtY13ECfmYC5c825w https://up1.ca/#nUSA1WtY13ECfmYC5c825w Privacy on the web keeps getting harder and harder. Of course this should only be used in conjunction with maxed out ad blockers, anti-anti-adblockers, privacy badger and disconnect. We need browsers to start asking permission. When you install an app on Android or iOS it says "here's what it's going to use, do you want this?". The mere presence of the popup would annoy people and prevent them from using these APIs.

DavideNL 10y ago
fyi, related: Firefox addon "Privacy Settings" : https://addons.mozilla.org/en-US/firefox/addon/privacy-settings/ https://addons.mozilla.org/en-US/firefox/addon/privacy-setti...
mccr8 10y ago
Of course, now a site could potentially fingerprint you by the set of APIs you have disabled!
Zooper 10y ago
Thank you, user, for making your fingerprint hash more unique by disabling certain default features, given your user-agent string, thus opting into cat-facts.
- shostack 10y ago
  Disabling them probably makes you significantly more unique than those that don't just because the vast majority of people never will disable them.
10y ago

brudgers 10y ago

Google has a vested interest in information leakage. I have a suspicion that the Chromium project expresses a strategic desire to shape the direction of browser development away from stopping those leaks. The idea of signing into the browser with an identity is a core feature and in Google's branded version, Chrome, the big idea is that the user is signed into Google's services. Google only pitches the idea of multiple identities in the context of sharing devices among several people: https://support.google.com/chrome/answer/2364824?hl=en https://support.google.com/chrome/answer/2364824?hl=en and even then doesn't do much to surface the idea. https://www.google.com/search?hl=en&as_q=multiple+identities+in+chrome&as_epq=&as_oq=&as_eq=&as_nlo=&as_nhi=&lr=&cr=&as_qdr=all&as_sitesearch=google.com&as_occt=any&safe=images&as_filetype=&as_rights= https://www.google.com/search?hl=en&as_q=multiple+identities...

exelius 10y ago
This is why Firefox is gaining momentum; they seem to be the only browser interested in user privacy. Users are definitely interested.
- DavideNL 10y ago
  Indeed. i even use FF despite its terrible terrible "pinch to zoom" functionality - which works perfectly in other browsers (Safari, Chromium, Chrome). Zooming is such a basic thing... i don't understand why they implement it in such a crappy way. Certainly doesn't attract users.
  - gruez 10y ago
    Can you elaborate what's so bad about Firefox's pinch to zoom?
    - DavideNL 10y ago
      Take a look at this movement: https://up1.ca/#q07x8mFjrGtXR6ju1r3EQw https://up1.ca/#q07x8mFjrGtXR6ju1r3EQw In Safari, this is what it does: https://up1.ca/#Lu0r_cI_v0vXvzpa9nUmEg https://up1.ca/#Lu0r_cI_v0vXvzpa9nUmEg So in Safari it lets me zoom all the way in and/or out with 1 smooth movement. This is what the same movement does in Firefox: https://up1.ca/#SEKWNOm1BSQnkntxj_v53w https://up1.ca/#SEKWNOm1BSQnkntxj_v53w In Firefox, if i want to zoom all the way in, i have to pinch in like 10 times (very annoying) and then to zoom out pinch out another 10 times...

f- 10y ago

Although the emphasis on the actual abuse of newly-introduced APIs is much needed, it is probably important to note that they are not uniquely suited for fingerprinting, and that the existence of these properties is not necessarily a product of the ignorance of browser developers or standards bodies. For most part, these design decisions were made simply because the underlying features were badly needed to provide an attractive development platform - and introducing them did not make the existing browser fingerprinting potential substantially worse. Conversely, going after that small set of APIs and ripping them out or slapping permission prompts in front of them is unlikely to meaningfully improve your privacy when visiting adversarial websites. Few years back, we put together a less publicized paper that explored the fingerprintable "attack surface" of modern browsers: https://www.chromium.org/Home/chromium-security/client-identification-mechanisms https://www.chromium.org/Home/chromium-security/client-ident... Overall, the picture is incredibly nuanced, and purely technical solutions to fingerprinting probably require breaking quite a few core properties of the web.

makecheck 10y ago

Over 3,000 top sites using the font technique, and from the description this sounds really wasteful (choosing and drawing in a variety of fonts for no reason other than to sniff out the user). Each font is probably associated with a non-trivial caching scheme and other OS resources, not to mention the use of anti-aliasing in rendering, etc. So a web page, doing something you don’t even want, is able to cause the OS to devote maybe 100x more resources to fonts than it otherwise would? A simple solution would be to set a hard limit, such as “4 fonts maximum”, for any web site; and, to completely disallow linked domains from using more.

chatmasta 10y ago

If you want to see a live demo of all the ways your browser can fingerprint you, this is a great website: https://www.browserleaks.com/ https://www.browserleaks.com/

coygui 10y ago

Would it be more secure to use tor than traditional browser. The only drawback is the longer RTT.

youaretracked 10y ago

Since the original web based ad campaigns were launched we have been tracked. Serious web analytics companies know these tactics already. So what exactly is the research contribution being made here? What's new and interesting?