8 ms·
I'm going to answer the basic question: fingerprinting is about trying to identify your device as uniquely as possible using available APIs, in order to track y
by Fradow 10y ago
I'm going to answer the basic question: fingerprinting is about trying to identify your device as uniquely as possible using available APIs, in order to track you cross-site, without cookies.
To do that, you first try to identify API that have different results depending on the browser or the device, and then track their result. For example, the User agent have some identifying information. It's not unique for each person, but you can start having a bit of identifying information. Do that with multiple APIs (available fonts, installed plugins ...), and you start having enough identifying informations to uniquely identify some browsers, without having an actual ID provided by the browser.
To test your browser, you can visit https://panopticlick.eff.org/ https://panopticlick.eff.org/
- jordache 10y agoWhich API reveals my system fonts to a website? Edit: The fingerprint test at https://panopticlick.eff.org/ https://panopticlick.eff.org/ shows my System Fonts
- mpeg 10y agoYou can't get installed fonts via javascript, but you can change the font of a known text and fingerprint the size to determine whether the font is installed or it defaulted to another font.
- tangent128 10y agoI don't think you can enumerate them these days, but you can test for them by trying to use them in CSS (which font is used would affect the width of a span of text, use a wildly different fallback font and you can guess which is installed) or <canvas> (where you can inspect the actual pixels rendered).
- Freak_NL 10y agoOr use @font-face and detect calls to a remote URL — which happens when the named local font is missing: @font-face { font-family: "Roboto"; src: local("Roboto"), url("https://example.com/user-does-not-have-roboto") format("woff2"); }
- dao- 10y agoFlash provides an API for that. Edit: Disable Flash or make it click-to-activate and https://panopticlick.eff.org/ https://panopticlick.eff.org/ shouldn't list your fonts anymore.
- aub3bhat 10y agoI never understood panopticlick, even when I repeatedly visit it, it always tells me that "Your browser fingerprint appears to be unique among the 135,054 tested so far." Shouldn't it tell me that my browser is not unique during my 10th attempt considering it has recorded my previous attempts. This warning actually never changes, regardless of duration between consecutive attempts. That can only mean that the panopticlick is flawed or my browser signature is in constant flux (which would essentially make it useless from tracking perspective.)
- prof_hobart 10y agoI thought the same thing, so I did a bit of digging. Turns out they put a bunch of tracking cookies on your machine without asking you (it is mentioned in the about page though), which seem rather naughty for an organisation promoting online privacy. When I removed all 4 of them, I get down to being "almost unique". I'm currently down to having the same fingerprint as 1 in 45132.3333333 browsers.
- aub3bhat 10y agoThis is confusing, my incorrect assumption was 1 out n browsers meant n = total numbers of browsers evaluated by panopticlick. Rather what they mean is 1 out of k, where k is determined by unique bits. There might be other factor such as entropy of each fingerprint.
- komali2 10y agoHow are two sites sharing this fingerprint information in a way that says "yup, this is the same guy?" Like is there some sot of cabal of evil advertising companies running a bunch of sites, or what?
- cpeterso 10y agoYes.