11 ms·

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is op

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

dccoolgai 10y ago
This is much-needed research. Thank you for your work. Regarding the WebRTC tracking- would it be possible for WebRTC to work without exposing the local IP? I.e. is there any real reason that fingerprint needs to be there?
- englehardt 10y ago
  Other co-author here. Unfortunately there are good performance reasons for allowing WebRTC to access the local IP, see the lengthy discussion here: https://bugzilla.mozilla.org/show_bug.cgi?id=959893 https://bugzilla.mozilla.org/show_bug.cgi?id=959893. One use case is allowing two peers behind the same NAT to communicate directly without leaving the local network. The working group recommendation that we linked in the paper (https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling/ https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handli...) addresses some of the concerns that arise from that (namely the concern that a user behind a VPN or proxy will have their real, public address exposed), but still recommends that a single private IP address be returned by default and without user permission. However that's still quite identifying for some network configurations, e.g. a network which assigns non-RFC1918 IPs to users behind a NAT. Seems to me that putting access to the local IP address behind a permission would both remove the tracking risk and still allow the performance gains after the user grants permission.
  - dccoolgai 10y ago
    Thanks for the response! If you're interested and it would be useful for your research, I have some really, really interesting privacy findings regarding Service Workers I'd be happy to share. I'm strongly in favor of an enhanced Open Web, but I'm not comfortable with the opaque nature in which tracking/privacy can be likewise enhanced with little user interaction or notification. Keep up the good work.
    - englehardt 10y ago
      Feel free to email us at the addresses listed on the bottom of the linked site.
projectramo 10y ago
I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that what you mean? If this is the case, how can the "canvas fingerprinting" work since I had to browse to a new page and all the old pixels from the previous page are no longer there. Anyway, if it is what I understand it to be, then it sounds very interesting. I bet some science fiction author wishes they had though to use it.
- detaro 10y ago
  Canvas fingerprinting uses differences in rendering e.g. of fonts. Output a text, hash resulting pixel values. Depending on exact version of the font(s) installed, anti-aliasing settings, default font sizes, operating system... you get slightly different results. So you don't rely on information stored on the device, but on repeatable behavior that differs between devices.
  - projectramo 10y ago
    I thought that was "Canvas-Font Fingerprinting" But now I see that is just seeing which fonts are available. Thanks for the explanation. Its just hard to believe devices are so different. I would think most versions of iOS would have roughly the same set of fonts etc.
    - detaro 10y ago
      I would assume that iOS devices are quite hard to tell apart using most of these techniques, yes. But I also wouldn't be too surprised if there were something that works for them, some kind of cookie that isn't cleared by default or ...
      - mpeg 10y ago
        Yup HSTS supercookies or some kinds of network fingerprinting will work to distinguish between two otherwise identical iOS devices.
BinaryBullet 10y ago
Will you post insight into the data you've collected? Obviously I don't care about IP addresses, etc, but it would be nice to know how many people have submitted data vs how many unique hashes have been collected for say the "Fingerprint using DynamicsCompressor", etc. I also haven't checked every page on the site, so the data might already be there (and I'm missing it)...
- englehardt 10y ago
  Yes, we'll definitely do an analysis on this and write it up.
grav 10y ago
Why would two browsers with the exact same user agent (ie same, version, same OS, same arch) yield two different renditions of an audio fingerprint?
- hendi_ 10y ago
  They wouldn't. But the point of fingerprinting is that practically no two "browsers" are the same: - browser software and exact version - installed plugins - size of browser window - OS software and exact version (think of patches!) - language - time zone - screen resolution - ... - (and all the stuff mentioned in the submitted article!) See the EFF's Panopticlick to see _how_ unique your browser is. Be sure to click the "Show full results for fingerprinting" after the test to see all things it considers. [0] https://panopticlick.eff.org/ https://panopticlick.eff.org/
  - dao- 10y ago
    That doesn't really answer the question, because most of the factors you listed should be irrelevant for _audio_ fingerprinting.
    - hendi_ 10y ago
      It does. > They wouldn't.
      - dao- 10y ago
        That's a pretty short answer, and it sounds wrong to me. Are you implying that browser version, OS type and version, and system architecture are all factors that matter for audio fingerprinting? If so, what would be the point of audio fingerprinting when you can just look at the user agent string?
        hendi_ 10y ago
        Sorry, it seems I misunderstood your intention/question. The `AudioContext` API exposes several details about the host which may depend on the hardware (sound card, sound chip), software stack (OS, on Linux e.g. PulseAudio vs. ALSA), sound driver and its versions, and connected periphery (speakers? headphones?). Additionally, the audio API is used to generate a sound (which is muted before being played, but still generated before). Sound is hard, and so the browser vendors don't necessarily generate the "sound bits" themselves but ask the OS to so. Which might in fact ask its sound system to do so. Which might ask its sound driver... Some of these properties are fairly common or likely to change often. But chances are that combined they give you more bits of information then say the simple user agent string (which is shared by thousands - if not more! - other browsers).
Freak_NL 10y ago
What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's preferred language and claim en-US as your preference, and change the user agent string to blend in to the crowd). This is all assuming people don't run any third party plugins like Flash. Are browser vendors on track to figure out a solution to this problem that combines user friendliness with privacy? Or will anonymous browsing remain a privilege for those with the right amount of technical know-how? The problem it seems is that simply disabling JavaScript is not an option for normal web browsing, and even a requirement for interacting with the web services used by organisations you have a relation with (e.g., the government, insurance companies, banks, etcetera).
- randomwalker 10y ago
  Personally I think there are so many of these APIs that for the browser to try to prevent the ability to fingerprint is putting the genie back in the bottle. But there is one powerful step browsers can take: put stronger privacy protections into private browsing mode, even at the expense of some functionality. Firefox has taken steps in this direction https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-a-more-private-browsing-experience/ https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-... Traditionally all browsers viewed private browsing mode as protecting against local adversaries and not trackers / network adversaries, and in my opinion this was a mistake.
  - avar 10y ago
    Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting: https://bugs.chromium.org/p/chromium/issues/detail?id=142214#c1 https://bugs.chromium.org/p/chromium/issues/detail?id=142214... Don't you think this sort of thing warrants a separate sort of browsing mode? A lot of people who use the likes of incognito mode just use it for e.g. browsing porn where they don't want the local history to be preserved. Turning that mode into one that's highly hardened against fingerprinting would in practice ruin the browsing experience for those users. Just look at what the Tor browser needs to do with fixed preset resolutions, no JavaScript etc.
manigandham 10y ago
Thanks for this research, really interesting to see. I do want to state for the record that instinctiveads.com was testing augur.io and that's why we're listed there. We don't use them anymore but unfortunate timing, especially considering we're trying to be a better ad network than the rest. Also I'd like to point out that one of the most pervasive tracking methods is done through form submissions. Anywhere you submit an email (login, purchase, etc) can be used as identification and first-party cookie matching.
- kbenson 10y ago
  Having the insight of of someone who works in online advertising would be interesting and informative. Is there anything you can share that we might find interesting?
  - manigandham 10y ago
    I could talk about this for hours. Fundamentally, identity is important for the ad industry but it's not about your personal info, it's just a reliable ID that we're all after. A reliable ID allows for storing your ad history and interests to show you better ads and less of the same. This is proven since it's all math and data science and we can see the increase in metrics with better targeting. By the way, clicks are not the most important metric either, there's much more that goes into an ad campaign. Ironically, reliable IDs also allow for storing any opt-out settings since it's just a value attached to that ID. The email login I mentioned above is the most common way to track online, most of the big sites actually sell login data and fire tracking tags when you're logged in with the email address passed through (usually hashed but not always) so that providers can set their own cookies and recognize you again. Since emails are strongly unique, this is really effective. This tech is also used to combat ad fraud (which is what we were using it for). Fraud is a massive problem since it's so easy to start up botnets and churn through millions of ad impressions quickly. Unfortunately a lot of this new age of tracking is the result of politics, bad incentives, and a lack of regulation that's led to a wild west situation where these companies can do anything. Clearly the technical talent is capable (as seen in this research) but it's being put to the wrong use. The DNT (do not track) header was a compromise but lacked any real regulation to make it effective. 3rd party cookies were fine but unfairly demonized and the default blocking of them pushed the industry to these deeper tactics. Ultimately this is a business process issue: if there was a standardized ID like IDFA but for browsers (or even better at the OS level) and privacy regulation that's actually enforced, that would be a good compromise. Sites and ad networks get a reliable ID and you get control over when and how that ID is refreshed. EDIT - All this stuff used by independent ad companies is just a tiny fraction of the industry. This barely covers ISPs who have very refined tracking abilities that you really cant avoid since they control the traffic. Comcast/Verizon has the AOL ad network using this. And the 2 biggest ad companies are Google and Facebook, both of which don't need fingerprinting because they already know who you are from just being logged in.
rdancer 10y ago
When everybody was running Windows on a smorgasbord of hardware / patchlevel / plugins / fonts, it was easy to fingerprint. Are we moving towards a more monolithic landscape where fingerprinting is less able to track individual users? * If I have a fleet of Chromebooks running the same version of Chrome OS, will they all have the same fingerprint? * Will, say, all iPhones 6 with the same hardware parts, running the same Mobile Safari and iOS version, have the same fingerprint? Thank you!
- greglindahl 10y ago
  Why yes, some monoculture has made fingerprinting harder. Try [0] with a few of those devices. 0: https://panopticlick.eff.org/ https://panopticlick.eff.org/
smartbit 10y ago
On iOS I use safari and disable access to location etc, also disable cookies, advertisementID, etc, etc. Then I feel quite save when using a VPN. Does that still hold?
- hendi_ 10y ago
  Yes. Changing common settings might in fact even make you stand out _more_. Check the EFF's Panopticlick [0] to see how your specific configurations leaks identifying information. [0] https://panopticlick.eff.org/ https://panopticlick.eff.org/
  - smartbit 10y ago
    This week’s http://www.heise.de/artikel-archiv/ct/2016/11/144_kiosk http://www.heise.de/artikel-archiv/ct/2016/11/144_kiosk states “Viele .. fingerprinting-verfarhen laufen auf Mobilgeräten ins Leere. … Zudem gibt es kein Mittel, mit dem man über gezielt gegen Fingerprinting über die Sensoreigenschaften vorgehen kan - weder unter iOS noch unter Android.” And then it concludes recommending Adblockers for Safari on iOS noting that it depends on the quality of the block-list. It also mentions that adblockers on iOS don’t work in Apps, other than in Android. IOW most fingerprinting fail on mobile devices and that sensors, eg batteries, are one of the few remains for fingerprining on iOS. Do you disagree with Heise? Could you please substantiate your statements regarding iOS fingerprinting?
    - atomwaffel 10y ago
      You're right that mobile devices are harder to fingerprint – too many people with the same screen size, operating system, browser version, timezone, and language/region settings. However, mobile devices have a bunch of sensors, some of which can be accessed by JavaScript without permission, namely the ones you wouldn't expect to yield identifying information (e.g. accelerometer). The problem is that no two sensors are alike – they all introduce noise into the data which can be enough to fingerprint a device. See here for a paper on the subject: https://crypto.stanford.edu/gyrophone/sensor_id.pdf https://crypto.stanford.edu/gyrophone/sensor_id.pdf
inthewoods 10y ago
If the sites can be detected, wouldn't it be possible to come up with a browser extension to at least let people know this is happening?
beeker87 10y ago
In your paper you say, "When using the headless configuration, we are able to run up to 10 stateful browser instances on an Amazon EC2 “c4.2xlarge” virtual machine." Also it seems like you ran the crawl only in the month of January this year, and crawled about 90 million pages. Were you able to do that on the single AWS instance, using Firefox via Selenium? What do you think the performance would have been just issuing raw requests? Just interested because I'm currently building a crawler and am trying to decide if Selenium would be worth it performance wise.
miley_cyrus 10y ago
nice Arvind!

dccoolgai 10y ago

This is much-needed research. Thank you for your work. Regarding the WebRTC tracking- would it be possible for WebRTC to work without exposing the local IP? I.e. is there any real reason that fingerprint needs to be there?

englehardt 10y ago
Other co-author here. Unfortunately there are good performance reasons for allowing WebRTC to access the local IP, see the lengthy discussion here: https://bugzilla.mozilla.org/show_bug.cgi?id=959893 https://bugzilla.mozilla.org/show_bug.cgi?id=959893. One use case is allowing two peers behind the same NAT to communicate directly without leaving the local network. The working group recommendation that we linked in the paper (https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling/ https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handli...) addresses some of the concerns that arise from that (namely the concern that a user behind a VPN or proxy will have their real, public address exposed), but still recommends that a single private IP address be returned by default and without user permission. However that's still quite identifying for some network configurations, e.g. a network which assigns non-RFC1918 IPs to users behind a NAT. Seems to me that putting access to the local IP address behind a permission would both remove the tracking risk and still allow the performance gains after the user grants permission.
- dccoolgai 10y ago
  Thanks for the response! If you're interested and it would be useful for your research, I have some really, really interesting privacy findings regarding Service Workers I'd be happy to share. I'm strongly in favor of an enhanced Open Web, but I'm not comfortable with the opaque nature in which tracking/privacy can be likewise enhanced with little user interaction or notification. Keep up the good work.
  - englehardt 10y ago
    Feel free to email us at the addresses listed on the bottom of the linked site.

projectramo 10y ago

I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that what you mean? If this is the case, how can the "canvas fingerprinting" work since I had to browse to a new page and all the old pixels from the previous page are no longer there. Anyway, if it is what I understand it to be, then it sounds very interesting. I bet some science fiction author wishes they had though to use it.

detaro 10y ago
Canvas fingerprinting uses differences in rendering e.g. of fonts. Output a text, hash resulting pixel values. Depending on exact version of the font(s) installed, anti-aliasing settings, default font sizes, operating system... you get slightly different results. So you don't rely on information stored on the device, but on repeatable behavior that differs between devices.
- projectramo 10y ago
  I thought that was "Canvas-Font Fingerprinting" But now I see that is just seeing which fonts are available. Thanks for the explanation. Its just hard to believe devices are so different. I would think most versions of iOS would have roughly the same set of fonts etc.
  - detaro 10y ago
    I would assume that iOS devices are quite hard to tell apart using most of these techniques, yes. But I also wouldn't be too surprised if there were something that works for them, some kind of cookie that isn't cleared by default or ...
    - mpeg 10y ago
      Yup HSTS supercookies or some kinds of network fingerprinting will work to distinguish between two otherwise identical iOS devices.

BinaryBullet 10y ago

Will you post insight into the data you've collected? Obviously I don't care about IP addresses, etc, but it would be nice to know how many people have submitted data vs how many unique hashes have been collected for say the "Fingerprint using DynamicsCompressor", etc. I also haven't checked every page on the site, so the data might already be there (and I'm missing it)...

englehardt 10y ago
Yes, we'll definitely do an analysis on this and write it up.

grav 10y ago

Why would two browsers with the exact same user agent (ie same, version, same OS, same arch) yield two different renditions of an audio fingerprint?

hendi_ 10y ago
They wouldn't. But the point of fingerprinting is that practically no two "browsers" are the same: - browser software and exact version - installed plugins - size of browser window - OS software and exact version (think of patches!) - language - time zone - screen resolution - ... - (and all the stuff mentioned in the submitted article!) See the EFF's Panopticlick to see _how_ unique your browser is. Be sure to click the "Show full results for fingerprinting" after the test to see all things it considers. [0] https://panopticlick.eff.org/ https://panopticlick.eff.org/
- dao- 10y ago
  That doesn't really answer the question, because most of the factors you listed should be irrelevant for _audio_ fingerprinting.
  - hendi_ 10y ago
    It does. > They wouldn't.
    - dao- 10y ago
      That's a pretty short answer, and it sounds wrong to me. Are you implying that browser version, OS type and version, and system architecture are all factors that matter for audio fingerprinting? If so, what would be the point of audio fingerprinting when you can just look at the user agent string?
      - hendi_ 10y ago
        Sorry, it seems I misunderstood your intention/question. The `AudioContext` API exposes several details about the host which may depend on the hardware (sound card, sound chip), software stack (OS, on Linux e.g. PulseAudio vs. ALSA), sound driver and its versions, and connected periphery (speakers? headphones?). Additionally, the audio API is used to generate a sound (which is muted before being played, but still generated before). Sound is hard, and so the browser vendors don't necessarily generate the "sound bits" themselves but ask the OS to so. Which might in fact ask its sound system to do so. Which might ask its sound driver... Some of these properties are fairly common or likely to change often. But chances are that combined they give you more bits of information then say the simple user agent string (which is shared by thousands - if not more! - other browsers).

Freak_NL 10y ago

What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's preferred language and claim en-US as your preference, and change the user agent string to blend in to the crowd). This is all assuming people don't run any third party plugins like Flash. Are browser vendors on track to figure out a solution to this problem that combines user friendliness with privacy? Or will anonymous browsing remain a privilege for those with the right amount of technical know-how? The problem it seems is that simply disabling JavaScript is not an option for normal web browsing, and even a requirement for interacting with the web services used by organisations you have a relation with (e.g., the government, insurance companies, banks, etcetera).

randomwalker 10y ago
Personally I think there are so many of these APIs that for the browser to try to prevent the ability to fingerprint is putting the genie back in the bottle. But there is one powerful step browsers can take: put stronger privacy protections into private browsing mode, even at the expense of some functionality. Firefox has taken steps in this direction https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-a-more-private-browsing-experience/ https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-... Traditionally all browsers viewed private browsing mode as protecting against local adversaries and not trackers / network adversaries, and in my opinion this was a mistake.
- avar 10y ago
  Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting: https://bugs.chromium.org/p/chromium/issues/detail?id=142214#c1 https://bugs.chromium.org/p/chromium/issues/detail?id=142214... Don't you think this sort of thing warrants a separate sort of browsing mode? A lot of people who use the likes of incognito mode just use it for e.g. browsing porn where they don't want the local history to be preserved. Turning that mode into one that's highly hardened against fingerprinting would in practice ruin the browsing experience for those users. Just look at what the Tor browser needs to do with fixed preset resolutions, no JavaScript etc.

manigandham 10y ago

Thanks for this research, really interesting to see. I do want to state for the record that instinctiveads.com was testing augur.io and that's why we're listed there. We don't use them anymore but unfortunate timing, especially considering we're trying to be a better ad network than the rest. Also I'd like to point out that one of the most pervasive tracking methods is done through form submissions. Anywhere you submit an email (login, purchase, etc) can be used as identification and first-party cookie matching.

kbenson 10y ago
Having the insight of of someone who works in online advertising would be interesting and informative. Is there anything you can share that we might find interesting?
- manigandham 10y ago
  I could talk about this for hours. Fundamentally, identity is important for the ad industry but it's not about your personal info, it's just a reliable ID that we're all after. A reliable ID allows for storing your ad history and interests to show you better ads and less of the same. This is proven since it's all math and data science and we can see the increase in metrics with better targeting. By the way, clicks are not the most important metric either, there's much more that goes into an ad campaign. Ironically, reliable IDs also allow for storing any opt-out settings since it's just a value attached to that ID. The email login I mentioned above is the most common way to track online, most of the big sites actually sell login data and fire tracking tags when you're logged in with the email address passed through (usually hashed but not always) so that providers can set their own cookies and recognize you again. Since emails are strongly unique, this is really effective. This tech is also used to combat ad fraud (which is what we were using it for). Fraud is a massive problem since it's so easy to start up botnets and churn through millions of ad impressions quickly. Unfortunately a lot of this new age of tracking is the result of politics, bad incentives, and a lack of regulation that's led to a wild west situation where these companies can do anything. Clearly the technical talent is capable (as seen in this research) but it's being put to the wrong use. The DNT (do not track) header was a compromise but lacked any real regulation to make it effective. 3rd party cookies were fine but unfairly demonized and the default blocking of them pushed the industry to these deeper tactics. Ultimately this is a business process issue: if there was a standardized ID like IDFA but for browsers (or even better at the OS level) and privacy regulation that's actually enforced, that would be a good compromise. Sites and ad networks get a reliable ID and you get control over when and how that ID is refreshed. EDIT - All this stuff used by independent ad companies is just a tiny fraction of the industry. This barely covers ISPs who have very refined tracking abilities that you really cant avoid since they control the traffic. Comcast/Verizon has the AOL ad network using this. And the 2 biggest ad companies are Google and Facebook, both of which don't need fingerprinting because they already know who you are from just being logged in.

rdancer 10y ago

When everybody was running Windows on a smorgasbord of hardware / patchlevel / plugins / fonts, it was easy to fingerprint. Are we moving towards a more monolithic landscape where fingerprinting is less able to track individual users? * If I have a fleet of Chromebooks running the same version of Chrome OS, will they all have the same fingerprint? * Will, say, all iPhones 6 with the same hardware parts, running the same Mobile Safari and iOS version, have the same fingerprint? Thank you!

greglindahl 10y ago
Why yes, some monoculture has made fingerprinting harder. Try [0] with a few of those devices. 0: https://panopticlick.eff.org/ https://panopticlick.eff.org/

smartbit 10y ago

On iOS I use safari and disable access to location etc, also disable cookies, advertisementID, etc, etc. Then I feel quite save when using a VPN. Does that still hold?

hendi_ 10y ago
Yes. Changing common settings might in fact even make you stand out _more_. Check the EFF's Panopticlick [0] to see how your specific configurations leaks identifying information. [0] https://panopticlick.eff.org/ https://panopticlick.eff.org/
- smartbit 10y ago
  This week’s http://www.heise.de/artikel-archiv/ct/2016/11/144_kiosk http://www.heise.de/artikel-archiv/ct/2016/11/144_kiosk states “Viele .. fingerprinting-verfarhen laufen auf Mobilgeräten ins Leere. … Zudem gibt es kein Mittel, mit dem man über gezielt gegen Fingerprinting über die Sensoreigenschaften vorgehen kan - weder unter iOS noch unter Android.” And then it concludes recommending Adblockers for Safari on iOS noting that it depends on the quality of the block-list. It also mentions that adblockers on iOS don’t work in Apps, other than in Android. IOW most fingerprinting fail on mobile devices and that sensors, eg batteries, are one of the few remains for fingerprining on iOS. Do you disagree with Heise? Could you please substantiate your statements regarding iOS fingerprinting?
  - atomwaffel 10y ago
    You're right that mobile devices are harder to fingerprint – too many people with the same screen size, operating system, browser version, timezone, and language/region settings. However, mobile devices have a bunch of sensors, some of which can be accessed by JavaScript without permission, namely the ones you wouldn't expect to yield identifying information (e.g. accelerometer). The problem is that no two sensors are alike – they all introduce noise into the data which can be enough to fingerprint a device. See here for a paper on the subject: https://crypto.stanford.edu/gyrophone/sensor_id.pdf https://crypto.stanford.edu/gyrophone/sensor_id.pdf

inthewoods 10y ago

If the sites can be detected, wouldn't it be possible to come up with a browser extension to at least let people know this is happening?

beeker87 10y ago

In your paper you say, "When using the headless configuration, we are able to run up to 10 stateful browser instances on an Amazon EC2 “c4.2xlarge” virtual machine." Also it seems like you ran the crawl only in the month of January this year, and crawled about 90 million pages. Were you able to do that on the single AWS instance, using Firefox via Selenium? What do you think the performance would have been just issuing raw requests? Just interested because I'm currently building a crawler and am trying to decide if Selenium would be worth it performance wise.

miley_cyrus 10y ago

nice Arvind!