4 ms·
At the 33c3 I showed how you can often uniquely identify a single anonymized user from a dataset containing three million people by using publicly posted links
by ThePhysicist 10y ago
At the 33c3 I showed how you can often uniquely identify a single anonymized user from a dataset containing three million people by using publicly posted links from his/her Twitter timeline. I also showed that this is possible with other types of public information as well, such as YouTube video ratings or reviews on Google Maps.
The math behind it is quite simple and very reliable for many datasets, which makes it very easy to build robust fingerprints based on browsing / location / behavior data. In my opinion, this is what most big companies rely on today for identifying users, as this is more robust than cookie-based mechanisms, which become more ineffective as the use of multiple devices and blockers increases.
Here's the link to the video (you can choose the language in the menu, by default it's German but the talk is also available in English and French):
https://media.ccc.de/v/33c3-8034-build_your_own_nsa https://media.ccc.de/v/33c3-8034-build_your_own_nsa
- jacquesm 10y ago> In my opinion, this is what most big companies rely on today for identifying users, as this is more robust than cookie-based mechanisms, which become more ineffective as the use of multiple devices and blockers increases. Correct, another thing this is used for is to identify mobile/pc pairs belonging to the same person.
- Paul-ish 10y agoWhy not both though? I think the approach these days is to try to collect everything and put it into a model. It might be similar to what happened to passwords. Passwords are still important, but they are just one signal among multiple others.
- z3t4 10y agoAny idea on how the google translate URL ended up in a HTTP referer header ? Or how did they get the data !?
- retepnap 10y agoIt has been a couple of days since I watched the video, but if i recall correctly their point was not about the tracking by browser extensions (which is horrible and as mentioned above is in most cases blockable) but more about the ease with which these datasets can be used to de-anonymize users completely. Most large companies will be able to construct at least a partial data set from licensing various tracking providers.
- y4mi 10y agoi watched that video for the second time today and am still confused why they say its not really blockable by the enduser... isnt this fully blocked by a pi-hole (dns server with tracker/advertising rules)? even the extension tracking should be completely killed by that...
- ThePhysicist 10y agoSorry if this wasn't clear, what we mean is that client-side blocking won't help you to stay anonymous because even a server-side tracker can collect enough information about you to deanonymize you if enough of your "fundamental data" does not change (such as your IP). So in addition to using client-side blocking you should also use a VPN service to masquerade and (frequently) change your IP address.
- JessicaSu 10y agoThank you for the video! We will take a look.
- ThePhysicist 10y agoThis is great work btw, congrats on that paper!
- anotheryou 10y agoThis was the talk with the URLs that say showed if you are logged in and at your profile (worked with different services) right? What I didn't understand: how was this data captured? 3rd party tracking through ad-networks and alike? (Would I be safe with no-script or even some privacy aware adblock?)
- y4mi 10y agoseems you skipped most of the talk. they talk extensively about how it was (probably) captured. the tl;dw would probably amount to: 1. extensions like Web of Trust, CrossSite Requests (JS) and lesser sources like cookies if available.
- anotheryou 10y agoAh sorry, might have been that I joined the stream late. Thank you!
- grepthisab 10y agoI encountered something similar the other day. I was on a moving website to schedule a move across town. I put in my info, and they gave me a quote, but the process was weird. It wouldn't let me back out of the quote completely, and if I returned to the main page of the site, it still showed my quote. So I opened an incognito window and went through the process, no problems. Closed all incognito windows. Opened another, went to the site, and my quote was up, in a new incognito tab. It was jarring because it meant that they were tracking me somehow, obviously not through the standard mechanisms as I was incognito.