7 ms·

Browser Fingerprinting

146 points by dedalus 10y ago

nwrk 10y ago
http://valve.github.io/fingerprintjs2/ http://valve.github.io/fingerprintjs2/
0xmohit 10y ago
https://panopticlick.eff.org/ https://panopticlick.eff.org/
- Retr0spectrum 10y ago
  My font set was completely unique, which I partly expected. However, my canvas fingerprint was also completely unique, which did surprise me.
  - fractal618 10y ago
    Any idea where we can find the most common subset of system fonts? Isn't canvas fingerprint linked to your window size, if you maximize your browser, does that help?
- dandelion_lover 10y ago
  It's quite surprising that my disposable virtual machine's firefox in Qubes OS is unique among all tested so far...
  - chatmasta 10y ago
    Why is that surprising? That's going to be a unique fingerprint in most datasets. The average user is not using Qubes, Firefox or Linux. Qubes isn't designed to blend into all other users; it's designed to make you unlinkable to your other Qubes instances. A better experiment would be to run the test in two of your Qubes instances. Hopefully they will both be unique.
    - hrjet 10y ago
      Isn't Qubes OS just a hypervisor? The hosted OSes shouldn't leak that they are running under Qubes.
      - chatmasta 10y ago
        Yeah, but the point still stands most people are not running all the unique programs within the guest OSes (Linux, Firefox, Tor, ...). But granted it may be surprising there was no collision with another HN user.
- mpeg 10y ago
  Note that this is very outdated. Modern fingerprinting techniques can identify you much more accurately than panopticlick can.
mirimir 10y ago
Using multiple VMs with diverse connectivity, one can sidestep all "Explicitly assigned client-side identifiers" and "Machine-specific characteristics". For evading WebGL, VM OS diversity is essential. It's harder to obscure "User-dependent behaviors and preferences", especially mouse and keyboard stuff. But it helps to switch keyboards, and between using mouse and touchpad.
amelius 10y ago
Is there a way to easily change (some) browser plugins every five minutes, so fingerprinting becomes useless?
- elorant 10y ago
  You could load your browser through Selenium and explicitly choose which plugins to load but I wouldn't call it easy. Definitely not accessible to the average user.
  - amelius 10y ago
    Perhaps somebody could write a plugin which changes identity (as seen by the fingerprinter) every so often.
- executesorder66 10y ago
  On Chrome you can use this[0] user-agent spoofer(one example) It will randomize your user agent for each session, thus changing your fingerprint. I'm sure there are various other extensions that do similar things that randomize the parameters of whatever is used to fingerprint you. [0] https://chrome.google.com/webstore/detail/random-user-agent/einpaelgookohagofgnnkcfjbkkgepnp?utm_source=chrome-ntp-icon https://chrome.google.com/webstore/detail/random-user-agent/...
  - adrr 10y ago
    That will set off some fraud detection on sites as there will be mismatch between user agent and the browser being used. You can easily profile the DOM and Javascript features to figure out what browser a person is using.
- Accacin 10y ago
  On Firefox there is: https://addons.mozilla.org/firefox/addon/random-agent-spoofer/ https://addons.mozilla.org/firefox/addon/random-agent-spoofe...
- whamlastxmas 10y ago
franze 10y ago
Once talked with over a beer with a web performance head of company X, he said that you can use the web performance profile - without looking at any other browser identifiers - to pretty accurately do browser fingerprinting. When you then look additionally at the interaction speed within an webapp you can even profile different users.
- UltimateQandA 10y ago
  Jesus... is anyone actually doing this? Extremely interesting!
marco1 10y ago
In Firefox, you can control a lot via the `about:config` directives. You can put all that into a `user.js` for portability and reference, like this: https://github.com/delight-im/Secure-Firefox https://github.com/delight-im/Secure-Firefox But unfortunately, there are so many things that can contribute to identification of your browser, and many of them cannot reasonably be blocked. The important section of the Chromium list is "(2) Machine-specific characteristics". You need most of that, so you can't block or hide it. Privacy is not easy. Not to mention the situation for non-technical users.
- dao- 10y ago
  Hidden prefs are hidden for a reason and can be a foot-gun. The warning when opening about:config is no exaggeration, and copying-and-pasting a bunch of hidden prefs from an untrusted source is not a good idea. For instance: > user_pref("network.cookie.cookieBehavior", 1); If I remember correctly, this may break some sites. > user_pref("dom.battery.enabled", false); Questionable value for privacy / fingerprinting. If you plug-in your computer or pull the plug (a pretty common scenario), the site trying to identify you will suddenly think you're a different users. > user_pref("general.buildID.override", "20100101"); Pointless since 20100101 is already the default used in the user agent string. Makes me think this list is severely outdated or the author doesn't know what he's doing. > user_pref("browser.newtabpage.enabled", false); Little impact on privacy (is this about the "somebody opens a new tab in my profile and sees what sites I frequently visit" scenario?), no impact on fingerprinting. The readme says "Impacts on user experience should be minimized, erring on the side of convenience." How does disabling the new tab page satisfy that?
  - marco1 10y ago
    > The warning when opening about:config is no exaggeration If you feel uncomfortable in that section, feel free to avoid touching it. But if you know what you do, there are zero problems. Want to change your user agent? Do it there. No problems. The warning is for your average non-technical user, justifiably. Well, perhaps you need to read up on those a little bit again. > If I remember correctly, this may break some sites. Sure, everything may break some sites. But this is about blocking third party cookies, which blocks not a single site I know (Do you know a popular one?) while being one of the most effective measures against tracking (which uses fingerprinting) out there. > Questionable value for privacy / fingerprinting. If you plug-in your computer ... Sure, agreed for privacy. > Pointless since 20100101 is already the default used in the user agent string Yes, since late 2015 only, and keeping a default hardly does any harm. By the way, try outputting `navigator.buildID` in your JavaScript console -- oops, not even this setting helped. The real ID is right there. So it's not as easy as you might think. > is this about the "stranger opens a new tab in my profile and sees what sites I frequently visit" scenario? No. If I remember correctly, the "new tab" page is about the ads.
splatcollision 10y ago
In one of the sections: > for example, TCP/IP traffic will often reveal high-resolution system uptime data through TCP timestamps. Is this something that's on by default? Dependent on OS? Not deeply familiar with the details of the TCP stack, but have never hard of something like this being exposed via TCP requests!
- splatcollision 10y ago
  Did some research - it's off by default in recent macOS versions. Configurable via the "sysctl net.inet.icmp.timestamp" flag. http://superuser.com/questions/680200/os-x-how-to-make-it-reply-to-icmp-time-stamp-query http://superuser.com/questions/680200/os-x-how-to-make-it-re...
mbym 10y ago
"users who extensively tweak their settings from the defaults may be actually making their browsers considerably easier to uniquely fingerprint" ...interesting comment in section, "User-dependent behaviors and preferences"
the8472 10y ago
Mozilla and Tor devs are currently working on upstreaming some Tor Browser patches[0] that reduce fingerprinting surface. E.g. cookie isolation based the domain shown in the URL bar[1] and making canvas readback opt-in[2] [0] https://wiki.mozilla.org/Security/Tor_Uplift/Tracking https://wiki.mozilla.org/Security/Tor_Uplift/Tracking [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1299996 https://bugzilla.mozilla.org/show_bug.cgi?id=1299996 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=967895 https://bugzilla.mozilla.org/show_bug.cgi?id=967895
- rnhmjoj 10y ago
  What about these? https://www.browserleaks.com/firefox https://www.browserleaks.com/firefox https://bugzilla.mozilla.org/show_bug.cgi?id=863246 https://bugzilla.mozilla.org/show_bug.cgi?id=863246 https://bugzilla.mozilla.org/show_bug.cgi?id=903959 https://bugzilla.mozilla.org/show_bug.cgi?id=903959
  - the8472 10y ago
    Hence the "E.g."
Maydowf 10y ago
I really dislike fingerprinting.. I hope someday we find a significant reason (presumably a profitable one) to stop all this creepy shit. How do we make it advantageous for companies (groups/etc) to NOT want to do this? long term I mean.
fractal618 10y ago
I just tried this out, and it seems that "system fonts" are the biggest identifier of mine. Any idea where I can find the most common subset of system fonts?
- sspiff 10y ago
  I'd love a settings checkbox saying something like "Disable user-installed fonts".
deusex_ 10y ago
I don't see evercookie mentioned: http://samy.pl/evercookie/ http://samy.pl/evercookie/ which implements something similar
hackuser 10y ago
Related: Internet Tracking Has Moved Beyond Cookies https://fivethirtyeight.com/features/internet-tracking-has-moved-beyond-cookies/ https://fivethirtyeight.com/features/internet-tracking-has-m...

146 points by dedalus 10y ago

nwrk 10y ago

http://valve.github.io/fingerprintjs2/ http://valve.github.io/fingerprintjs2/

0xmohit 10y ago

https://panopticlick.eff.org/ https://panopticlick.eff.org/

Retr0spectrum 10y ago
My font set was completely unique, which I partly expected. However, my canvas fingerprint was also completely unique, which did surprise me.
- fractal618 10y ago
  Any idea where we can find the most common subset of system fonts? Isn't canvas fingerprint linked to your window size, if you maximize your browser, does that help?
dandelion_lover 10y ago
It's quite surprising that my disposable virtual machine's firefox in Qubes OS is unique among all tested so far...
- chatmasta 10y ago
  Why is that surprising? That's going to be a unique fingerprint in most datasets. The average user is not using Qubes, Firefox or Linux. Qubes isn't designed to blend into all other users; it's designed to make you unlinkable to your other Qubes instances. A better experiment would be to run the test in two of your Qubes instances. Hopefully they will both be unique.
  - hrjet 10y ago
    Isn't Qubes OS just a hypervisor? The hosted OSes shouldn't leak that they are running under Qubes.
    - chatmasta 10y ago
      Yeah, but the point still stands most people are not running all the unique programs within the guest OSes (Linux, Firefox, Tor, ...). But granted it may be surprising there was no collision with another HN user.
mpeg 10y ago
Note that this is very outdated. Modern fingerprinting techniques can identify you much more accurately than panopticlick can.

mirimir 10y ago

Using multiple VMs with diverse connectivity, one can sidestep all "Explicitly assigned client-side identifiers" and "Machine-specific characteristics". For evading WebGL, VM OS diversity is essential. It's harder to obscure "User-dependent behaviors and preferences", especially mouse and keyboard stuff. But it helps to switch keyboards, and between using mouse and touchpad.

amelius 10y ago

Is there a way to easily change (some) browser plugins every five minutes, so fingerprinting becomes useless?

elorant 10y ago
You could load your browser through Selenium and explicitly choose which plugins to load but I wouldn't call it easy. Definitely not accessible to the average user.
- amelius 10y ago
  Perhaps somebody could write a plugin which changes identity (as seen by the fingerprinter) every so often.
executesorder66 10y ago
On Chrome you can use this[0] user-agent spoofer(one example) It will randomize your user agent for each session, thus changing your fingerprint. I'm sure there are various other extensions that do similar things that randomize the parameters of whatever is used to fingerprint you. [0] https://chrome.google.com/webstore/detail/random-user-agent/einpaelgookohagofgnnkcfjbkkgepnp?utm_source=chrome-ntp-icon https://chrome.google.com/webstore/detail/random-user-agent/...
- adrr 10y ago
  That will set off some fraud detection on sites as there will be mismatch between user agent and the browser being used. You can easily profile the DOM and Javascript features to figure out what browser a person is using.
Accacin 10y ago
On Firefox there is: https://addons.mozilla.org/firefox/addon/random-agent-spoofer/ https://addons.mozilla.org/firefox/addon/random-agent-spoofe...
whamlastxmas 10y ago

franze 10y ago

Once talked with over a beer with a web performance head of company X, he said that you can use the web performance profile - without looking at any other browser identifiers - to pretty accurately do browser fingerprinting. When you then look additionally at the interaction speed within an webapp you can even profile different users.

UltimateQandA 10y ago
Jesus... is anyone actually doing this? Extremely interesting!

marco1 10y ago

In Firefox, you can control a lot via the `about:config` directives. You can put all that into a `user.js` for portability and reference, like this: https://github.com/delight-im/Secure-Firefox https://github.com/delight-im/Secure-Firefox But unfortunately, there are so many things that can contribute to identification of your browser, and many of them cannot reasonably be blocked. The important section of the Chromium list is "(2) Machine-specific characteristics". You need most of that, so you can't block or hide it. Privacy is not easy. Not to mention the situation for non-technical users.

dao- 10y ago
Hidden prefs are hidden for a reason and can be a foot-gun. The warning when opening about:config is no exaggeration, and copying-and-pasting a bunch of hidden prefs from an untrusted source is not a good idea. For instance: > user_pref("network.cookie.cookieBehavior", 1); If I remember correctly, this may break some sites. > user_pref("dom.battery.enabled", false); Questionable value for privacy / fingerprinting. If you plug-in your computer or pull the plug (a pretty common scenario), the site trying to identify you will suddenly think you're a different users. > user_pref("general.buildID.override", "20100101"); Pointless since 20100101 is already the default used in the user agent string. Makes me think this list is severely outdated or the author doesn't know what he's doing. > user_pref("browser.newtabpage.enabled", false); Little impact on privacy (is this about the "somebody opens a new tab in my profile and sees what sites I frequently visit" scenario?), no impact on fingerprinting. The readme says "Impacts on user experience should be minimized, erring on the side of convenience." How does disabling the new tab page satisfy that?
- marco1 10y ago
  > The warning when opening about:config is no exaggeration If you feel uncomfortable in that section, feel free to avoid touching it. But if you know what you do, there are zero problems. Want to change your user agent? Do it there. No problems. The warning is for your average non-technical user, justifiably. Well, perhaps you need to read up on those a little bit again. > If I remember correctly, this may break some sites. Sure, everything may break some sites. But this is about blocking third party cookies, which blocks not a single site I know (Do you know a popular one?) while being one of the most effective measures against tracking (which uses fingerprinting) out there. > Questionable value for privacy / fingerprinting. If you plug-in your computer ... Sure, agreed for privacy. > Pointless since 20100101 is already the default used in the user agent string Yes, since late 2015 only, and keeping a default hardly does any harm. By the way, try outputting `navigator.buildID` in your JavaScript console -- oops, not even this setting helped. The real ID is right there. So it's not as easy as you might think. > is this about the "stranger opens a new tab in my profile and sees what sites I frequently visit" scenario? No. If I remember correctly, the "new tab" page is about the ads.

splatcollision 10y ago

In one of the sections: > for example, TCP/IP traffic will often reveal high-resolution system uptime data through TCP timestamps. Is this something that's on by default? Dependent on OS? Not deeply familiar with the details of the TCP stack, but have never hard of something like this being exposed via TCP requests!

splatcollision 10y ago
Did some research - it's off by default in recent macOS versions. Configurable via the "sysctl net.inet.icmp.timestamp" flag. http://superuser.com/questions/680200/os-x-how-to-make-it-reply-to-icmp-time-stamp-query http://superuser.com/questions/680200/os-x-how-to-make-it-re...

mbym 10y ago

"users who extensively tweak their settings from the defaults may be actually making their browsers considerably easier to uniquely fingerprint" ...interesting comment in section, "User-dependent behaviors and preferences"

the8472 10y ago

Mozilla and Tor devs are currently working on upstreaming some Tor Browser patches[0] that reduce fingerprinting surface. E.g. cookie isolation based the domain shown in the URL bar[1] and making canvas readback opt-in[2] [0] https://wiki.mozilla.org/Security/Tor_Uplift/Tracking https://wiki.mozilla.org/Security/Tor_Uplift/Tracking [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1299996 https://bugzilla.mozilla.org/show_bug.cgi?id=1299996 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=967895 https://bugzilla.mozilla.org/show_bug.cgi?id=967895

rnhmjoj 10y ago
What about these? https://www.browserleaks.com/firefox https://www.browserleaks.com/firefox https://bugzilla.mozilla.org/show_bug.cgi?id=863246 https://bugzilla.mozilla.org/show_bug.cgi?id=863246 https://bugzilla.mozilla.org/show_bug.cgi?id=903959 https://bugzilla.mozilla.org/show_bug.cgi?id=903959
- the8472 10y ago
  Hence the "E.g."

Maydowf 10y ago

I really dislike fingerprinting.. I hope someday we find a significant reason (presumably a profitable one) to stop all this creepy shit. How do we make it advantageous for companies (groups/etc) to NOT want to do this? long term I mean.

fractal618 10y ago

I just tried this out, and it seems that "system fonts" are the biggest identifier of mine. Any idea where I can find the most common subset of system fonts?

sspiff 10y ago
I'd love a settings checkbox saying something like "Disable user-installed fonts".

deusex_ 10y ago

I don't see evercookie mentioned: http://samy.pl/evercookie/ http://samy.pl/evercookie/ which implements something similar

hackuser 10y ago

Related: Internet Tracking Has Moved Beyond Cookies https://fivethirtyeight.com/features/internet-tracking-has-moved-beyond-cookies/ https://fivethirtyeight.com/features/internet-tracking-has-m...