6 ms·

Someone else can answer better than me, but https://panopticlick.eff.org https://panopticlick.eff.org claims the canvas fingerprint provides 17 bits of identify

by noja 10y ago

Someone else can answer better than me, but https://panopticlick.eff.org https://panopticlick.eff.org claims the canvas fingerprint provides 17 bits of identifying information (click detailed results after testing)

muizelaar 10y ago
I think this is an over-estimation of the amount of entropy. If canvas hardware acceleration is disabled, the only things that can really have an impact on the output of the panopticlick canvas fingerprint are OS version, user-agent and available cpu vectorization instructions.
- drvdevd 10y ago
  Interesting. I wonder to what extent one could trap vectorization instructions in e.g. KVM. Presumably they are unprivileged instructions on x86?
  - dom0 10y ago
    > Presumably they are unprivileged instructions on x86? They're all unprivileged; having to go to the kernel would defeat the purpose most of the time. Also, trapping them wouldn't make a difference. Fixing the CPUID fields on the other hand (so that these code paths are not taken in the first place)...
deleted 10y ago
[deleted]
MR4D 10y ago
On mine, the System Fonts give 17 bits of info (1 in roughly 200,000 computers). User-Agent is next with only 8 bits. Based on that alone, it seems that just replying back with either a blank font list or the minimal standard font list (e.g. only Times & Arial) would solve most of this problem. I'd love to see the Firefox team fix that first.
- swsieber 10y ago
  I think they are working on the fonts problem.
- kibwen 10y ago
  Unless every browser in the world adopts the same list, replying with a fixed list of fonts would make users of a given browser immediately recognizable (especially for low-marketshare browsers like Tor). Seems like you'd want a system where the response to a list-of-fonts query would be semi-random and likely to overlap with the lists that are naturally produced by other browsers.
  - eslaught 10y ago
    But user agents already identify the browser, right? I agree that implementing this first in Tor is probably not a good idea, but if Firefox were to do it first, then I don't see the problem. "They're a Firefox user" isn't nearly as specific information.
    - dexterdog 10y ago
      User agent gives the browser version and platform version. Two macs with the same OS version and the latest version of Chrome will have the same user agent.
      - nsgi 10y ago
        That's the point. With this feature, two computers with the latest version of Firefox would have the same font list.
        dexterdog 10y ago
        Is that true? I thought the point of using the font list for fingerprinting is that it can vary widely from user to user.
  - MR4D 10y ago

by noja 10y ago

muizelaar 10y ago

I think this is an over-estimation of the amount of entropy. If canvas hardware acceleration is disabled, the only things that can really have an impact on the output of the panopticlick canvas fingerprint are OS version, user-agent and available cpu vectorization instructions.

drvdevd 10y ago
Interesting. I wonder to what extent one could trap vectorization instructions in e.g. KVM. Presumably they are unprivileged instructions on x86?
- dom0 10y ago
  > Presumably they are unprivileged instructions on x86? They're all unprivileged; having to go to the kernel would defeat the purpose most of the time. Also, trapping them wouldn't make a difference. Fixing the CPUID fields on the other hand (so that these code paths are not taken in the first place)...

deleted 10y ago

[deleted]

MR4D 10y ago

On mine, the System Fonts give 17 bits of info (1 in roughly 200,000 computers). User-Agent is next with only 8 bits. Based on that alone, it seems that just replying back with either a blank font list or the minimal standard font list (e.g. only Times & Arial) would solve most of this problem. I'd love to see the Firefox team fix that first.

swsieber 10y ago
I think they are working on the fonts problem.
kibwen 10y ago
Unless every browser in the world adopts the same list, replying with a fixed list of fonts would make users of a given browser immediately recognizable (especially for low-marketshare browsers like Tor). Seems like you'd want a system where the response to a list-of-fonts query would be semi-random and likely to overlap with the lists that are naturally produced by other browsers.
- eslaught 10y ago
  But user agents already identify the browser, right? I agree that implementing this first in Tor is probably not a good idea, but if Firefox were to do it first, then I don't see the problem. "They're a Firefox user" isn't nearly as specific information.
  - dexterdog 10y ago
    User agent gives the browser version and platform version. Two macs with the same OS version and the latest version of Chrome will have the same user agent.
    - nsgi 10y ago
      That's the point. With this feature, two computers with the latest version of Firefox would have the same font list.
      - dexterdog 10y ago
        Is that true? I thought the point of using the font list for fingerprinting is that it can vary widely from user to user.
- MR4D 10y ago