3 ms·

Why do the browsers let the website know which plugins I have? There are some things like Flash that should identify themselves, but those are few and far betw

Why do the browsers let the website know which plugins I have? There are some things like Flash that should identify themselves, but those are few and far between, and the check should be feature specific and handled by the plugin. Allowing every site to build a profile based on plugins [that is: a) fingerprint, and b) profile based on the plugins I use] is just an egregious violation of privacy. At the very least, if there is some reason to expose browsers, let it be configurable. Also, font testing should be made expensive [eg, one check per second]. Check if we have font "scrabble", OK, but not get list of all fonts.

dogma1138 10y ago
Because browsers need to be able to declare what content can be displayed to the user. If we only had Flash it would be simple, but considering the amount of content delivery systems that each browser implements and the fact that they are not consistent there isn't much way around it. It's not true to claim that the browsers let anyone know which plugins you are running, this is limited to a specific subset of plugins that handle content. There is no way to prevent "fingerprinting", infact what you suggest seems to indicate that you are thinking about it the wrong way. You can disable these plugins but that creates a fingerprint on it's own, if you only accept HTML (no HTML5 because it's also "evil") and no javascript well then you are a more unique fingerprint than your vanilla Chrome with Flash, PDF, and a few WebM and DRM plugins. The only effective way of disabling fingerprinting is make all browsers identical, and more importantly all hardware and software configurations that those browsers operate in also identical. You also need to understand the value of each fingerprint if you look at https://panopticlick.eff.org/ https://panopticlick.eff.org/ for example then most of the fingerprints produced are useless, half of them are shared between 30-80% of all browsers. The most unique one was the HTTP_ACCEPT Headers in my case which is unique for one out of ~1400 browsers so that is something I can now use to see if this is something that can be fixed. The plugin fingerprint in my case is 1 out of 48 browsers, that is not unique in any case and from what I've tested every latest Chrome install on Windows 10 without any additional content plugins (e.g. Java) has the same fingerprint.
- throwawayReply 10y ago
  You're missing that these things don't have to be taken in isolation. If you've got 4 metrics each of which slice about "1 in 50" then taking the combination you've got a metric that is unique between 1 in 50 and 1 in 6.25 million (depending on correlation). The "fingerprint" is all that information put together, not each taken in isolation.
  - dogma1138 10y ago
    That only works when you actually have variance in the fingerprints greater than OS/platform based. If I spin up 10 new Windows 10 machines install Chrome on them I would get the same fingerprints, oddly enough they would be identical to the fingerprints I'm getting on my own machine since I don't have any plugins installed (I do have multiple extensions). The only real change in the fingerprint I've seen so far from my own internal testing is the screen resolution, and WebGL fingerprint (Intel/NVIDIA seem to produce a pretty identical one, AMD differs a bit). However the main point i was trying to get across is that while trying to minimize your fingerprint or exposure you create your own unique fingerprint in the process. For example using adblockers these addons can easily leak not only which adblocker you are using but which lists / filters you have enabled, if you are a non-English native and you are using a localized list that exposes a lot of information. Addons / extensions that block things like HTML5 Canvas also leave a fingerprint - you run a modern browser by all accounts but don't support Canvas? whelp you are upto something! Same goes with WebGL and many other plugins/vectors. The problem here is that content delivery relies on the browser being interrogatable for certain information, if that information is not correct then the content will not be displayed properly (which on it's own can be detected), we want to move on from Flash, we want to move one from addons and plugins into more native stuff but this came at a cost of platforms being more unique and diverse which allows you to generate a more unique fingerprint. Creating a browser that generates random fingerprints also won't really help, unless everyone uses it you would again stand out of the crowd even more. That said however without specific targeted exploitation I have not yet seen a tool nor I managed to make one that creates a good fingerprint that can be easily used to identify a browser rather than just classify it and the platform it's running on.
gsnedders 10y ago
> Also, font testing should be made expensive [eg, one check per second]. Check if we have font "scrabble", OK, but not get list of all fonts. There's no way of doing that without making the whole browser really slow. Browsers don't expose any way to get a list of fonts: all you can do is try drawing some text with a given font "scrabble" and then see if it draws with different metrics to the fallback font. Therefore, you'd have to make every new font used on a page take a second before it got drawn, practically forcing every page to use a single font.
amelius 10y ago
> Why do the browsers let the website know which plugins I have? Just a guess: perhaps because sometimes, those plugins need to be interacted with from within javascript?

dogma1138 10y ago

Because browsers need to be able to declare what content can be displayed to the user. If we only had Flash it would be simple, but considering the amount of content delivery systems that each browser implements and the fact that they are not consistent there isn't much way around it. It's not true to claim that the browsers let anyone know which plugins you are running, this is limited to a specific subset of plugins that handle content. There is no way to prevent "fingerprinting", infact what you suggest seems to indicate that you are thinking about it the wrong way. You can disable these plugins but that creates a fingerprint on it's own, if you only accept HTML (no HTML5 because it's also "evil") and no javascript well then you are a more unique fingerprint than your vanilla Chrome with Flash, PDF, and a few WebM and DRM plugins. The only effective way of disabling fingerprinting is make all browsers identical, and more importantly all hardware and software configurations that those browsers operate in also identical. You also need to understand the value of each fingerprint if you look at https://panopticlick.eff.org/ https://panopticlick.eff.org/ for example then most of the fingerprints produced are useless, half of them are shared between 30-80% of all browsers. The most unique one was the HTTP_ACCEPT Headers in my case which is unique for one out of ~1400 browsers so that is something I can now use to see if this is something that can be fixed. The plugin fingerprint in my case is 1 out of 48 browsers, that is not unique in any case and from what I've tested every latest Chrome install on Windows 10 without any additional content plugins (e.g. Java) has the same fingerprint.

throwawayReply 10y ago
You're missing that these things don't have to be taken in isolation. If you've got 4 metrics each of which slice about "1 in 50" then taking the combination you've got a metric that is unique between 1 in 50 and 1 in 6.25 million (depending on correlation). The "fingerprint" is all that information put together, not each taken in isolation.
- dogma1138 10y ago
  That only works when you actually have variance in the fingerprints greater than OS/platform based. If I spin up 10 new Windows 10 machines install Chrome on them I would get the same fingerprints, oddly enough they would be identical to the fingerprints I'm getting on my own machine since I don't have any plugins installed (I do have multiple extensions). The only real change in the fingerprint I've seen so far from my own internal testing is the screen resolution, and WebGL fingerprint (Intel/NVIDIA seem to produce a pretty identical one, AMD differs a bit). However the main point i was trying to get across is that while trying to minimize your fingerprint or exposure you create your own unique fingerprint in the process. For example using adblockers these addons can easily leak not only which adblocker you are using but which lists / filters you have enabled, if you are a non-English native and you are using a localized list that exposes a lot of information. Addons / extensions that block things like HTML5 Canvas also leave a fingerprint - you run a modern browser by all accounts but don't support Canvas? whelp you are upto something! Same goes with WebGL and many other plugins/vectors. The problem here is that content delivery relies on the browser being interrogatable for certain information, if that information is not correct then the content will not be displayed properly (which on it's own can be detected), we want to move on from Flash, we want to move one from addons and plugins into more native stuff but this came at a cost of platforms being more unique and diverse which allows you to generate a more unique fingerprint. Creating a browser that generates random fingerprints also won't really help, unless everyone uses it you would again stand out of the crowd even more. That said however without specific targeted exploitation I have not yet seen a tool nor I managed to make one that creates a good fingerprint that can be easily used to identify a browser rather than just classify it and the platform it's running on.

gsnedders 10y ago

> Also, font testing should be made expensive [eg, one check per second]. Check if we have font "scrabble", OK, but not get list of all fonts. There's no way of doing that without making the whole browser really slow. Browsers don't expose any way to get a list of fonts: all you can do is try drawing some text with a given font "scrabble" and then see if it draws with different metrics to the fallback font. Therefore, you'd have to make every new font used on a page take a second before it got drawn, practically forcing every page to use a single font.

amelius 10y ago

> Why do the browsers let the website know which plugins I have? Just a guess: perhaps because sometimes, those plugins need to be interacted with from within javascript?