24 ms·

Websites can now fingerprint a device when multiple browser instances are used

176 points by antouank 10y ago

sleepychu 10y ago
Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?
- Aoyagi 10y ago
  When we get to critical mass? More like "if". I doubt the majority (crushing majority even) of active web browsers will ever get to that length. Especially noscript, which makes some sites completely useless.
  - coldpie 10y ago
    It makes many more completely usable. Floating headers and footers? Dead. Survey pop-ups? Dead. Pop-ups begging for your email address? Dead. Dumb fading in text and images? Dead. Needless whiz-bang animations? Dead. Site load times? Dramatically reduced. Browsing the web with NoScript is far more pleasant, even if I have to sometimes open a menu to enable a couple domains to make a poorly developed website usable. I'd highly recommend it to anyone even remotely technical.
    - pc86 10y ago
      TIL utilizing the most widely available programming language in the world makes a website "poorly developed."
      - coldpie 10y ago
        If your website requires active content in order to display plaintext, images and navigation, then yes, it is poorly developed. You failed to use the right tool for the job.
        pc86 10y ago
        Navigation is typically comprised of text and/or images. Some websites need more than text or images.
        zzzcpan 10y ago
        Very few websites, maybe 1 out of 100, most offenders are just rendering content in the browser for some reason. Although even bigger offenders are not individuals, but companies, outright blocking access to client's websites without javascript. So far it's mostly Cloudflare, I think most people using the web without javascript hate them the most, hopefully the trend won't continue.
        OJFord 10y ago
        Cloudflare blocks access to sites behind it to users with JS enabled? Even if there's no JS on the site? 1. Is there anything the site owner can do to turn that off? 2. Is it because they inject some kind of DDoS prevention/tracking thing? This suggests crawlers load JS, which I wouldn't have necessarily assumed.
        throwaway2048 10y ago
        cloudflare can whitelist crawlers like google. The fact it blocks other automatic robots is more of a feature than a flaw.
        OJFord 10y ago
        Requiring visitors to have JS enabled isn't (a very good) feature.
    - Jailout2000 10y ago
      I'd love to use NoScript, but even being as technical as I am, the UI/UX for it makes it completely unusable for me. I'm not a Firefox primary user, I primarily am on Chromium Opera these days. The equivalent of NoScript is an extension called NoScript Suite Lite: https://chrome.google.com/webstore/detail/no-script-suite-lite/ahnanjpbkghcdgmlchbcfoiefnifjeni https://chrome.google.com/webstore/detail/no-script-suite-li...
  - a_imho 10y ago
    Well, afaik Opera has content blocking by default, Firefox should do the same. MS and Apple could potentially add it.
- dest 10y ago
  As stated in the article, the Tor Browser Bundle seems a good candidate of a widely adopted fingerprint. But it's just Tor of course, not browsers in general.
  - xkxx 10y ago
    Hmm, a good idea would be to make it possible to use Tor Browser without Tor, for those who don't need strong anonymity, but still want to resist browser fingerprinting.
    - sleepychu 10y ago
      I really want to just use my browser though, if it's possible to make it work without confessing all the bits that make my fingerprint.
      - dest 10y ago
        I think those bits of information are closely tied to your browser functionalities. E.g. resolution, plugins installed. Keeping those bits for you would degrade your browsing experience. Have a look at the parameters that bring the highest amount of fingerprinting bits in your config https://panopticlick.eff.org/ https://panopticlick.eff.org/ then see if it possible to disable them. I think it's just plain hard.
        thinkling 10y ago
        It's plain hard because the moment the browser blocks some of the fingerprinting techniques, the fingerprint developers will look for something else and move on. Just like spam and ads, it's an arms race.
    - mirimir 10y ago
      That's not very hard.[0] > If you intend to test for leaks using other third-party sites, I recommend using Tor browser, because it's been hardened to block WebGL fingerprinting, and otherwise to report the same fingerprints for all users. But you obviously don't want to use Tor while testing your VPN. First, download Tor browser for your OS. Do that with your VPN connected, so your ISP doesn't see. After extracting, start Tor browser. You can probably accept all defaults. Go to advanced network settings, and select "No proxy". Browse about:config, and toggle both "extensions.torlauncher.starttor" and "network.proxy.socksremote_dns" to "false". Then browse check.torproject.org. You should see "Sorry. You are not using Tor." and your VPN exit IP address. 0) https://www.ivpn.net/privacy-guides/how-to-perform-a-vpn-leak-test https://www.ivpn.net/privacy-guides/how-to-perform-a-vpn-lea...
- taf2 10y ago
  I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. Sure you could disable JavaScript but then you have basically disabled any website that depends on it which might equivalently disable the parts of the internet you wanted to access. Also it becomes obvious that your location has a broken experience. Perhaps there is a balance of blocking and blending in. My view on this is what kind of websites are you visiting that make you feel you need to disable parts of it?
  - angry_octet 10y ago
    If the browser reports that your OS is GNU Hurd you could only be RMS, so fingerprinting would be redundant.
  - dagenleg 10y ago
    You can just enable those parts that you need while still avoiding vast majority of bloat. At least for Firefox there's uMatrix that allows for finetuning of what exactly you want to enable/disable.
  - sleepychu 10y ago
    So my two points are perhaps overlapping. I don't want people to track me on the internet, I think the main reason they bother is that they can show me ads that will be more interesting to me and make them more money. I can resist this by not showing the adverts to myself. I'd like to make it harder for them to track me at all, though this is always an arms war it seems like I'm labeling myself at the moment. I'm not familiar with the technology they use to detect adblockers, does it detect "U-Block Origin (Firefox) Ver 17.3" or does it just detect "I can't seem to see the ad I know should be here, this user is blocking my ads." if it's the latter then my proposal to adopt a blank/universal fingerprint is willing to confess the single bit of information of whether the user has decided to refuse adverts.
  - stymaar 10y ago
    > I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. In my generation (I'm 28), and even more in my cousins' (early twenties) it looks like the hurd is using an adblocker. And I'm talking about art students, acountants and chefs not IT engineers. You just can't spend hours on YouTube videos without an adblocker on …
- ptero 10y ago
  IMO the hope lies in the fact that many vendors do not depend on privacy invasions in their main business model, e.g. Amazon or Panera will sell me roughly the same stuff regardless of which photos I was staring at yesterday. Selling my info on the side is a profitable add-on, but not strictly required for their main business. Maybe unnecessary tracking will eventually be competed away (this does require that a much large fraction of users starts caring about privacy). One could also introduce confusers -- e.g., setup some "light anonymizing portals" that will add / swap / scramble non-critical cookie data. Done right it should be possible to keep almost all of web functionality intact without introducing a security nightmare, but to work well this also needs a viable business model.
  - nojvek 10y ago
    For a lot of single page applications, javascript makes sense. Less data to load from server on subsequent requests. Your app is a lot richer. Sure you can disable js, but for the majority the Web would be really broken without js. As a culture, tracking is everywhere. Disabling js still logs your up, referrer and a bunch of other things. I do like what uorigin/adblock and other extensions are doing.
- codingdave 10y ago
  Not all of those identifying bits have anything to do with the web. For example, your OS, your monitor size and color depth, the fonts you have installed. Those things make your overall computing experience useful, whether or not they improve your web experience. It might be more practical to work towards browsers that do not have access to data that is not relevant to the web experience. I do need to know the size of your browser window. I do not need to know anything more about your video capabilities. In an ideal world, I wouldn't even need to know your browser, I would just need to know its capabilities. Your browser needs to know which fonts it can display, but my web server doesn't need to know that.
  - rileymat2 10y ago
    > In an ideal world, I wouldn't even need to know your browser, I would just need to know its capabilities. Isn't that info still enough for finger printing the browser, if they have enough different capabilities?
- spaceboy 10y ago
  > I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us? https://anonymous-proxy-servers.net/en/jondofox.html https://anonymous-proxy-servers.net/en/jondofox.html JonDofox with JS turned off and uBlock origin installed. There's actually a small pool of users with this config but it needs to be bigger. As you said, as soon as we get consensus on what config to use, we can all switch to it en-masse.
- samfisher83 10y ago
  Unless you disable JavaScript it would be to hard to stop the fingerprinting. If you shut off JavaScript a lot of sites won't work
  - inetknght 10y ago
    From firsthand experience, I've learned to live with broken websites and often end up _not_ using sites that rely heavily on javascript, and especially not sites that rely heavily on loading javascript from third-party domains. The worst offenders, by far, are news sites. Coming close are just about every startup that has a heavy focus on fancy web front end.
  - logfromblammo 10y ago
    Since many of those sites "work" by tracking you and relentlessly analyzing your behavior, I'd say that's a good thing. If a site shows me nothing but a blank screen when I load it up with scripts disabled, I am very reluctant to enable 14 different script domains just to see a paged article, or worse, a slide show. Allowing scripts to run only from whitelisted domains makes the web a better place.
  - pdkl95 10y ago
    If a website doesn't have at least minimal functionality (i.e. the article can be read), then the website is broken. Fortunately, most websites that aren't complete trash work ok without JS. Very few websites need to have their JS whitelisted, which only has to be done on the first visit. Running unknown programs from random hosts on the internet - even in a limited environment - is a bad idea. Fortunately, documents (including images, audio, video, etc.) do not need Turing completeness. A lot of people will react strongly against the idea of not using JS, often because their income depends on tricking users into running spyware/malware,
    - romaniv 10y ago
      >If a website doesn't have at least minimal functionality, then the website is broken. Curious. This goes completely against the sentiment in all of the discussions around modern SPA frameworks and JS libraries I've seen on this very website. It seems that for most fronted devs today JS is a natural prerequisite for using their product. Progressive enhancement is often sneered at[1] as impractical and unnecessary. This leads me to believe that there are two mostly disjoint groups of people commenting on this issue in different threads. --- [1] - Good example: https://www.viget.com/articles/the-case-against-progressive-enhancements-flimsy-moral-foundation https://www.viget.com/articles/the-case-against-progressive-...
- Balgair 10y ago
  This should help in addition to your suggestions: https://addons.mozilla.org/en-US/firefox/addon/random-agent-spoofer/ https://addons.mozilla.org/en-US/firefox/addon/random-agent-... https://addons.mozilla.org/en-US/firefox/addon/trackmenot/ https://addons.mozilla.org/en-US/firefox/addon/trackmenot/ https://addons.mozilla.org/en-US/firefox/addon/adnauseam/ https://addons.mozilla.org/en-US/firefox/addon/adnauseam/ (doesn't work well for me, though, YMMV)
- rsync 10y ago
  "Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can." For the fourth or fifth time this year, in response to a thread about browser privacy, I am reminded that what I really want is the ability to jail/chroot a browser. Firing up a full-blown VM for a browser ("banking profile", "twitter profile", "sketchy online store profile") is way too heavyweight and resource intensive. I want a totally, totally clean slate (restored to post-install defaults) to restart certain browsing sessions with (and dispose of when I am done) but a full virtual machine is too expensive in time and resources. But if I could jail a GUI application ... then there would be almost zero resource overhead and the jail would die quickly when you're done. jailing a GUI application is not that well developed of a use-case. Further, OSX doesn't even have a jail command. I wish this was an established use-case - I would really like a totally throwaway browser profile that I could reset and re-use.
  - dreamcompiler 10y ago
    Logging in to the Guest account on OSX accomplishes what you want, no?
    - thinkling 10y ago
      Some of the fingerprinting involves not the user-controlled configuration of the machine, but hardware-related aspects like the canvas fingerprinting which looks at pixel level details of a small rendered figure. That combined with IP address will go a long way.
    - rsync 10y ago
      "Logging in to the Guest account on OSX accomplishes what you want, no?" No ... That is, unless I can easily script the destruction and recreation of the guest account, and automated install and configuration of my chrome setup ... The idea here is that I set up chrome just how I want it and deploy and redeploy that "container" over and over - destroying it and recreating it after each use. Possibly with multiple instances running simultaneously ...
      - 10y ago
z123 10y ago
Tried their sandbox site from firefox and chrome on my Mac. They were able to calculate same 'Computer fingerprint'. Looks impressive from tech perspective.. though bad for privacy
lucaspiller 10y ago
I'd imagine for most home users the combination of the following is enough to track them across multiple browsers: {ip, device pixel ratio, screen resolution, time zone} You can then identify more unique browser features to track them across multiple locations. Even if it's not completely unique, you can build up a network graph that's probably good enough for most things - people living in the same house probably have similar interests.
- deckiedan 10y ago
  I imagine you could have a browser plugin that randomized the values that javascript sees for those, except for sites where they matter? (Very few, I'd guess).
- jampa 10y ago
  Probably not on mobile, carriers the tend to share IPv4 address, you would get the same fingerprint ID on every AT&T iPhone 7 in France, for example.
osoba 10y ago
Random idea: Couldn't browsers have two modes of browsing, one lightweight one where only the most basic of JS features are enabled by default (this is something that 99% of websites actually need) and the full version where everything is enabled. The lightweight one is the default state and the users can manually switch to full version. Or even better use logistic regression or a neural network to decide when a website genuinely needs advanced features and when it's just to track you. As a bonus the lightweight mode would also probably render much faster? How realistic is this? What would be the downside?
- nrki 10y ago
  This is why I use uMatrix.
  - pragone 10y ago
    Sometimes it's frustrating to get sites working with it, but it's nice to know I can have such fine grained control over every (I think?) connection each website is making. Sometimes I'm just astonished - some sites are making network requests to dozens and dozens of other domains!
    - coldpie 10y ago
      Observe, a local newspaper website: http://i.imgur.com/hmFaW3M.png http://i.imgur.com/hmFaW3M.png
- ioulian 10y ago
  These are my thoughts (as a webdeveloper): We have 5 big browsers and 3 OS's that we need to support (different rendering, different canvas rendering, not to mention 3d rendering quircks, different installed fonts), I think we don't need yet another way to make our lives difficult. I understand that privacy is a big issue, but think about "normal" web developers who just want to show a cool working website to their users, but need to display this message to them: "Thank you for looking at our website, but unfortunately your browser is in lite JavaScript mode. Please set it to full functionality again and restart your browser en go to our site once more.". I have already used dirty hacks to support the default setting of 3rd party cookies in Safari, while developing facebook apps or some apps inside an iframe that have different domains. It's there to make users feel more secure, but there are always ways around it. It would be better to add the functionality you are suggesting as an option and not by default, so people, who understand the "risks" of not viewing some sites properly in favor of more privacy, will turn it on by themselves.
deleted 10y ago
[deleted]
reirob 10y ago
tldr: "The new technique relies on code that instructs browsers to perform a variety of tasks. Those tasks, in turn, draw on operating-system and hardware resources—including graphics cards, multiple CPU cores, audio cards, and installed fonts—that are slightly different for each computer. For instance, the cross-browser fingerprinting carries out 20 carefully selected tasks that use the WebGL standard for rendering 3D graphics in browsers. In all, 36 new features work independent of a specific browser."
- basicplus2 10y ago
  And a bit more... "Specifically, because many of such OS and hardware level functions are exposed to JavaScript via browser APIs, we can extract features when asking the browser to perform certain tasks through these APIs. The extracted features can be used for both single- and cross-browser fingerprinting"
- tim333 10y ago
  The browsers should have an incognito mode that lies about that stuff - that just says it's a generic new macbook of something like that. 99% of sites would still work even with the wrong info on your OS, screen size etc.
na85 10y ago
I note without surprise that most of this tracking leverages JavaScript. When do we say that enough is enough? When do we finally agree that the web was better without JavaScript tracking us everywhere we go, and when do we finally admit that not all ideas (JavaScript) were good ideas? My browser works against me these days. Sad times.
- EGreg 10y ago
  It is similar to macros in Word documents
  - na85 10y ago
    Is it, though? To the best of my knowledge, macros don't execute by default, silently, and in so doing facilitate my being tracked by people wanting to sell me generic brand pharmaceuticals.
    - zeveb 10y ago
      Yes, JavaScript is worse than Word macros — and they are terrible!
      - EGreg 10y ago
        If it's so bad then turn it off :)
- netsharc 10y ago
  Throwing web-interactivity (via Javascript) away today is like throwing your computer away. Computers help you be more productive, but it also helps the people who want to profile you. What's the alternative? If it's not Javascript, any functionality that offers access to the hardware (via however many layers) to "apps" from the "cloud" can be exploited this way. Maybe we should disallow hardware access, how will YouTube play videos? Should we all install youtubeplayer.exe ?
  - 10y ago
anotheryou 10y ago
Does anyone actually bother to do this? I mean to ctach the 99% of normal users for advertising you don't have to go through any trouble.
erikrothoff 10y ago
I can see why the industry didn't adopt the Do Not Track header, as it would basically kill all targeting revenue goodness that's been built up over the years. Why not try and push for a unified IDFA instead, which has its benefits for targeting but also more control from a user perspective? I don't really see an industry adoption of these fingerprinting techniques. The linked page took 20 seconds and 100% CPU before getting a fingerprint ID, so running that at scale seems pretty useless?
- manigandham 10y ago
  Yes. Device/OS level "advertising ID" that can be reset at anytime by the client is sorely needed and would be used by every ad network, greatly improving privacy and performance of ads on the web.
Cieplak 10y ago
Time to start patching your browser or proxying requests to munge http headers and strip out all identifiable data, and to throw random garbage in there. Obviously you can detect this pattern as well, but it makes it harder. Browser vendors are not on our side. Spend a couple minutes with tcpdump and a fresh install of any modern browser, and you'll see what I mean.
EGreg 10y ago
Is there a point to third party cookie policies, given this? What is the extent of the ability to track a user between sites these days even if they blocked third party cookies? Meaning, given an advertiser with 1,000,000 users what are the chances it knows that you just visited sites A, B, C if it has ads installed on each one?
agotterer 10y ago
Would something like this even be legal under some of the more stringent cookie and tracking laws?
angry_octet 10y ago
Using WebGL while browsing with Tor? What could go wrong!
- coldtea 10y ago
  Nothing much. What do you think could go wrong?
  - mirimir 10y ago
    You get tracked, that's all. And perhaps linked to browsing on your default browser, without Tor. But maybe that doesn't concern you :)
  - 0xfeba 10y ago
    Letting a browser access video graphics processor is a terrible idea.
    - coldtea 10y ago
      It's also a useful idea if you want to have fast 3D graphics in your webapps. And the way you interact with the GPU is sandboxed anyway, and protected with various tactics (e.g. not enabled on known buggy cards etc). So? Not having access to the video graphics processor would be an even more terrible idea. And Tor is probably the most "privacy-theater" concept.
  - angry_octet 10y ago
    I don't know, maybe massive pwnage? I'm sure you know that and are just being difficult. Its because OpenGL/DirectX drivers run a large compiler in the kernel and then send the compiled code to the GPU. None of that code is inspectable. Drivers routinely have special hacks to tweak the performance of particular games or matching patterns of use that tweak special paths, making thorough testing particularly hard. https://medium.com/@afd_icl/hey-a-web-page-just-restarted-my-phone-c06d3db76542 https://medium.com/@afd_icl/hey-a-web-page-just-restarted-my... https://twitter.com/alexstamos/status/829124727289544704 https://twitter.com/alexstamos/status/829124727289544704
ikeboy 10y ago
1. Are ad companies ahead of the research and have been doing things like this all along? 2. In theory you can look at JavaScript served from ad sites and reverse engineer to see what they are tracking. Has anybody tried to make a database of which ad vendors run which things in browsers? (Similar to how malware is reverse engineered?)
- mpeg 10y ago
  Yes and yes. Take a look at the work of Steven Englehardt around cookie syncing and gpu fingerprinting [0] [1] [0]: https://freedom-to-tinker.com/2014/08/07/the-hidden-perils-of-cookie-syncing/ https://freedom-to-tinker.com/2014/08/07/the-hidden-perils-o... [1]: https://freedom-to-tinker.com/2016/01/12/retrospective-look-at-canvas-fingerprinting/ https://freedom-to-tinker.com/2016/01/12/retrospective-look-...
  - ikeboy 10y ago
    Checking what sites use specific techniques is not the same as reversing JS to find new techniques.
    - mpeg 10y ago
      There's no new techniques, this stuff all uses the same javascript APIs and that's what the crawlers that look for this stuff look for. People have been doing GPU fingerprinting since the canvas APIs were available, with accuracy rates of over 90%, this further refines it by exploiting subtle differences in 3D rendering via webgl but the API surface is pretty small And you really don't need to reverse JS, you can just run it in a controlled environment and hook into certain calls etc. not too different to how you'd do analysis of vm / packed binaries though some of the scripts that do this stuff will try to detect these sandboxed environments and deactivate themselves (google does that, for example, cause they run their fingerprinting inside a custom VM in javascript)
metafunctor 10y ago
For some reason, this didn't fully work for me. I tried Safari, Chrome, and Firefox on MacOS. The results for the Audio feature were the same for Chrome and Firefox, but different for Safari.
mirimir 10y ago
If you don't want to be tracked, the simplest solution is to disable WebGL and HTML5 stuff, and minimize use of Javascript. That's part of what Tor browser does. If you want that stuff, you can compartmentalize in multiple VMs. However, even that can be vulnerable. Browsers in all Debian-based VMs have the same HTML5 canvas fingerprint on given hardware. Because the fingerprint is based on both the VM's graphics driver and the host's graphics hardware. To avoid that, you can use unrelated OS in your VMs. In my experience, Windows, OSX, Fedora, PC-BSD and Debian VMs have distinct HTML5 canvas fingerprints on given hardware.
aluhut 10y ago
This script crashed here on FF: Skript: http://www.uniquemachine.org/fingerprint/js/fontdetect.js:61 http://www.uniquemachine.org/fingerprint/js/fontdetect.js:61
afpx 10y ago
Although I can't discuss much, I've seen similar techniques used years ago. Or, in other words, it's fairly easy to come up with new signiture producing schemes. That's why some people disable Javascript.
spaceboy 10y ago
JS increases the finerprintability a huge amount. It's worth looking at ClientJS to see how many bits of identifying information can be hoovered up with JS. [1] https://clientjs.org https://clientjs.org
swearfu 10y ago
How is this news? The adult and casino industries have been using this technology for years now to avoid fraud.
- sleepychu 10y ago
  What fraud attack do those industries share which is prevented by fingerprinting? To address your question, the technique is novel and more accurate.
  - swearfu 10y ago
    Charge backs. For a long time those industries were dominated by affiliate programs, and so affiliates would hire firms in other countries to use stolen credit cards to inflate memberships, then charge back after the affiliate got their payout. By using shared networks of the finger prints we were able to identify computers already used for fraud on other sites or our own sites and refuse them the chance to even sign up. EDIT: Sorry, to be clear, the people using the stolen credit cards didn't charge back, the actual owners of the cards would. But this affected the industries two-fold, first in constantly having to battle with credit card and billing companies that didn't want to provide services for an industry with such a high charge back rate, but it also hurt us in paying out to affiliates who cost us money instead of bringing it in.
- mpeg 10y ago
  And advertising, and payments (most credit card companies will fingerprint you as part of the "verified by visa" prompt), and bot detection in general...
deltaprotocol 10y ago
Well, if we can't have privacy, at least lets make it clear that we DO want it and do what we can to have it. Not being able to defend ourselves doesn't mean that we should give up. A crowd can gather in front of a building and demand changes, unarmed and shouting. They may be heard or not, but still they fight. Sometimes the crowd is really huge and the other side has no option but to hear. Use Firefox. Use uBlock Origin. Use uMatrix or NoScript if you can. Use HTTPS Everywhere. Use DecentralEyes and Privacy Settings (an addon to streamline setting the cryptic browser settings in favor of your security and privacy). If you can, edit text fields through an external editor using things like Vimperator/Pentadactyl C-i command or extensions such as Its All Text or Wasavi. Use a firewall. Use a firewall in your phone as well. Search through DuckDuckGo or Startpage. Use F-Droid apps on your Android device, it even has a privacy conscious browser called Privacy Browser, a great and encryption friendly email client called K-9 and key wallet called OpenKeychain. Use Free Software. Drop the use of Google Drive and Dropbox in favor of solutions such as Syncthing. Use a password manager and strong passwords. Fight the good fight. Using this tools you can still enable resources for websites where you need them, literally unblocking the web with each use case. It works if you need to work and learn through browsers. For anything else, use Tor Browser. Maintain an installed version. Open it and update it often. Privacy is a right that we must fight for everyday and, sincerely, its an honor to be part of the resistance in this dark age. User rights actvists know how hard it can be to teach people the importance of this things. Its hard and not always effective and often backfires. If you are a developer, don't put your tail between your legs and accept that you must for monetary reasons circumvent user rights, talk with your team, be the guy with weird thoughts and be proud. You know the importance and they don't. Isn't it like this when a math teacher struggles with his younglings? They just don't know. Be patient. We can BE the change we want. Edit: Use Signal. Support Riot. SUPPORT THE EFF! There are so many beautiful people fighting the fight with us. Thanks to everyone involved in the development of this products and services, often left in the shadows and unpaid. You are love.
- eganist 10y ago
  Do all of this and you'll be fingerprinted as being in the fringe minority of privacy-craving web users, so for this effort to succeed, it might help for there to be some form of orchestration/automation and education to achieve all of these together with a wide population of people. That'd be a startup or nonprofit project, not necessarily anything any of us can individually do and not stick out like a sore thumb unless somebody capitalizes on anti-privacy revelations which can galvanize the population in favor of self-education on privacy hygiene. Paraphrasing (probably inaccurately) Bruce Schneier's answer to a question of mine on this topic at DEF CON: the best privacy solutions are the ones embraced by many people.
wtbob 10y ago
This is one of the reasons I disable JavaScript. The web is an interlinked web of documents called pages. It's not a distributed application platform: although it can be twisted into that, it turns out that no-one actually carefully considered all the potential security, privacy & performance implications of doing that — and it's no surprise that the security, privacy & performance of the single-page app web is abominably atrocious.
layer7burrito 10y ago
HackerNews does something like this. My original account was banned (unfairly) and I've tested various combinations of browsers and IP addresses and every new account I make is instabanned. It's pretty incredible actually. Proof: you won't see this unless you show dead.
manigandham 10y ago
Identity (as in a stable handle for your browser/device/profile) is an important part of the web. It's tied into all kinds of functionality and security. What we really need is a device/OS level "ID" that can be read by any app or website so that it is stable. Since it's controlled by the OS, resetting your identity is as simple as generating a new ID. This single change would improve security and performance across the web and remove the vast majority of fingerprinting being used today.
- I_am_neo 10y ago
  "Identity (as in a stable handle for your browser/device/profile) is an important part of the web" Not for me I feel that only for the egotistical and those with money flatulent to spare does identity on the web mean as much as identity in real life.
- Paul-ish 10y ago
  This wouldn't give us any more privacy. It would just become another signal in the tracker's model, they wouldn't solely rely on it. Cookies were the same idea limited to a single website. We were told to clear our cookies and we could prevent tracking. We have seen what cookies have become, with zombie cookies[1][2] raising from the dead after we think they are gone. At the end of the day, advertisers and trackers didn't really want us to have the capability to reset our identity with them. If you try to change the ID, trackers will use other things to try to keep tracking your browser session. [1] https://en.wikipedia.org/wiki/Zombie_cookie https://en.wikipedia.org/wiki/Zombie_cookie [2] https://en.wikipedia.org/wiki/Evercookie https://en.wikipedia.org/wiki/Evercookie
  - manigandham 10y ago
    The functionality (and corresponding machine implementation) matrix of a user will always give enough entropy to construct an identity, but much of this was created because of the lack of any other reliable and stable option. A stable ID would definitely be used since services now spend a considerable amount of time and effort in constantly figuring it out through other means. A single website is too narrow since things like ad networks (which are the economic backbone of the web) work across many sites. A single root domain is an outdated isolation model on the modern web. Outside of that, the only other answer is regulation. Something that is missing in many areas although some countries seem to be making good progress.
andai 10y ago
Does anyone know about any research for fingerprinting the host inside a virtual machine?
rxlim 10y ago
I have been browsing the web without Javascript enabled since 2006. The worst is that once in a while you will click on a link to read some text, but arrive at a completely blank page. Many times this can be solved by disabling CSS for that page or using the Google cache, but it's still annoying. I my view requiring Javascript just to display text or pictures is completely brain-dead, web "designers" that think this is a good idea should probably no be allowed to design anything. It also makes it hard for disabled people that rely on accessibility tools to use the web. I don't expect "web apps" like a video player to work without Javascript, but basic things like reading text, viewing pictures or clicking on links should never depend on it.
- rsync 10y ago
  I use ublock origin with chrome. Do I understand correctly that the simple tool to block javascript (noscript) is not available on chrome ? I'd like to disable javascript but the non-noscript recipes seem very complex ...
  - x1798DE 10y ago
    Try uMatrix. It's available on both Firefox and Chrome, and I actually like it better than NoScript.
  - navs 10y ago
    Chrome allows you to enable/disable javascript on a per domain basis. It's not an extension or very flexible but I've found it useful for most situations e.g whitelisting js for my bank website.
TazeTSchnitzel 10y ago
I wonder what “machine” means here in practice. It gives the same result for Firefox, Chrome and Safari on macOS, but if I booted into Windows, perhaps I'd get a different result. Or perhaps if I switched to the internal monitor.
ibogunov 10y ago
Just use iphone & default safari, its retardingly difficult to discern 2 iphones, they are literally the same hardware only IOS version can be a bit different. Problem solved.

176 points by antouank 10y ago

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

Aoyagi 10y ago
When we get to critical mass? More like "if". I doubt the majority (crushing majority even) of active web browsers will ever get to that length. Especially noscript, which makes some sites completely useless.
- coldpie 10y ago
  It makes many more completely usable. Floating headers and footers? Dead. Survey pop-ups? Dead. Pop-ups begging for your email address? Dead. Dumb fading in text and images? Dead. Needless whiz-bang animations? Dead. Site load times? Dramatically reduced. Browsing the web with NoScript is far more pleasant, even if I have to sometimes open a menu to enable a couple domains to make a poorly developed website usable. I'd highly recommend it to anyone even remotely technical.
  - pc86 10y ago
    TIL utilizing the most widely available programming language in the world makes a website "poorly developed."
    - coldpie 10y ago
      If your website requires active content in order to display plaintext, images and navigation, then yes, it is poorly developed. You failed to use the right tool for the job.
      - pc86 10y ago
        Navigation is typically comprised of text and/or images. Some websites need more than text or images.
        zzzcpan 10y ago
        Very few websites, maybe 1 out of 100, most offenders are just rendering content in the browser for some reason. Although even bigger offenders are not individuals, but companies, outright blocking access to client's websites without javascript. So far it's mostly Cloudflare, I think most people using the web without javascript hate them the most, hopefully the trend won't continue.
        OJFord 10y ago
        Cloudflare blocks access to sites behind it to users with JS enabled? Even if there's no JS on the site? 1. Is there anything the site owner can do to turn that off? 2. Is it because they inject some kind of DDoS prevention/tracking thing? This suggests crawlers load JS, which I wouldn't have necessarily assumed.
        throwaway2048 10y ago
        cloudflare can whitelist crawlers like google. The fact it blocks other automatic robots is more of a feature than a flaw.
        OJFord 10y ago
        Requiring visitors to have JS enabled isn't (a very good) feature.
  - Jailout2000 10y ago
    I'd love to use NoScript, but even being as technical as I am, the UI/UX for it makes it completely unusable for me. I'm not a Firefox primary user, I primarily am on Chromium Opera these days. The equivalent of NoScript is an extension called NoScript Suite Lite: https://chrome.google.com/webstore/detail/no-script-suite-lite/ahnanjpbkghcdgmlchbcfoiefnifjeni https://chrome.google.com/webstore/detail/no-script-suite-li...
- a_imho 10y ago
  Well, afaik Opera has content blocking by default, Firefox should do the same. MS and Apple could potentially add it.
dest 10y ago
As stated in the article, the Tor Browser Bundle seems a good candidate of a widely adopted fingerprint. But it's just Tor of course, not browsers in general.
- xkxx 10y ago
  Hmm, a good idea would be to make it possible to use Tor Browser without Tor, for those who don't need strong anonymity, but still want to resist browser fingerprinting.
  - sleepychu 10y ago
    I really want to just use my browser though, if it's possible to make it work without confessing all the bits that make my fingerprint.
    - dest 10y ago
      I think those bits of information are closely tied to your browser functionalities. E.g. resolution, plugins installed. Keeping those bits for you would degrade your browsing experience. Have a look at the parameters that bring the highest amount of fingerprinting bits in your config https://panopticlick.eff.org/ https://panopticlick.eff.org/ then see if it possible to disable them. I think it's just plain hard.
      - thinkling 10y ago
        It's plain hard because the moment the browser blocks some of the fingerprinting techniques, the fingerprint developers will look for something else and move on. Just like spam and ads, it's an arms race.
  - mirimir 10y ago
    That's not very hard.[0] > If you intend to test for leaks using other third-party sites, I recommend using Tor browser, because it's been hardened to block WebGL fingerprinting, and otherwise to report the same fingerprints for all users. But you obviously don't want to use Tor while testing your VPN. First, download Tor browser for your OS. Do that with your VPN connected, so your ISP doesn't see. After extracting, start Tor browser. You can probably accept all defaults. Go to advanced network settings, and select "No proxy". Browse about:config, and toggle both "extensions.torlauncher.starttor" and "network.proxy.socksremote_dns" to "false". Then browse check.torproject.org. You should see "Sorry. You are not using Tor." and your VPN exit IP address. 0) https://www.ivpn.net/privacy-guides/how-to-perform-a-vpn-leak-test https://www.ivpn.net/privacy-guides/how-to-perform-a-vpn-lea...
taf2 10y ago
I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. Sure you could disable JavaScript but then you have basically disabled any website that depends on it which might equivalently disable the parts of the internet you wanted to access. Also it becomes obvious that your location has a broken experience. Perhaps there is a balance of blocking and blending in. My view on this is what kind of websites are you visiting that make you feel you need to disable parts of it?
- angry_octet 10y ago
  If the browser reports that your OS is GNU Hurd you could only be RMS, so fingerprinting would be redundant.
- dagenleg 10y ago
  You can just enable those parts that you need while still avoiding vast majority of bloat. At least for Firefox there's uMatrix that allows for finetuning of what exactly you want to enable/disable.
- sleepychu 10y ago
  So my two points are perhaps overlapping. I don't want people to track me on the internet, I think the main reason they bother is that they can show me ads that will be more interesting to me and make them more money. I can resist this by not showing the adverts to myself. I'd like to make it harder for them to track me at all, though this is always an arms war it seems like I'm labeling myself at the moment. I'm not familiar with the technology they use to detect adblockers, does it detect "U-Block Origin (Firefox) Ver 17.3" or does it just detect "I can't seem to see the ad I know should be here, this user is blocking my ads." if it's the latter then my proposal to adopt a blank/universal fingerprint is willing to confess the single bit of information of whether the user has decided to refuse adverts.
- stymaar 10y ago
  > I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. In my generation (I'm 28), and even more in my cousins' (early twenties) it looks like the hurd is using an adblocker. And I'm talking about art students, acountants and chefs not IT engineers. You just can't spend hours on YouTube videos without an adblocker on …
ptero 10y ago
IMO the hope lies in the fact that many vendors do not depend on privacy invasions in their main business model, e.g. Amazon or Panera will sell me roughly the same stuff regardless of which photos I was staring at yesterday. Selling my info on the side is a profitable add-on, but not strictly required for their main business. Maybe unnecessary tracking will eventually be competed away (this does require that a much large fraction of users starts caring about privacy). One could also introduce confusers -- e.g., setup some "light anonymizing portals" that will add / swap / scramble non-critical cookie data. Done right it should be possible to keep almost all of web functionality intact without introducing a security nightmare, but to work well this also needs a viable business model.
- nojvek 10y ago
  For a lot of single page applications, javascript makes sense. Less data to load from server on subsequent requests. Your app is a lot richer. Sure you can disable js, but for the majority the Web would be really broken without js. As a culture, tracking is everywhere. Disabling js still logs your up, referrer and a bunch of other things. I do like what uorigin/adblock and other extensions are doing.
codingdave 10y ago
Not all of those identifying bits have anything to do with the web. For example, your OS, your monitor size and color depth, the fonts you have installed. Those things make your overall computing experience useful, whether or not they improve your web experience. It might be more practical to work towards browsers that do not have access to data that is not relevant to the web experience. I do need to know the size of your browser window. I do not need to know anything more about your video capabilities. In an ideal world, I wouldn't even need to know your browser, I would just need to know its capabilities. Your browser needs to know which fonts it can display, but my web server doesn't need to know that.
- rileymat2 10y ago
  > In an ideal world, I wouldn't even need to know your browser, I would just need to know its capabilities. Isn't that info still enough for finger printing the browser, if they have enough different capabilities?
spaceboy 10y ago
> I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us? https://anonymous-proxy-servers.net/en/jondofox.html https://anonymous-proxy-servers.net/en/jondofox.html JonDofox with JS turned off and uBlock origin installed. There's actually a small pool of users with this config but it needs to be bigger. As you said, as soon as we get consensus on what config to use, we can all switch to it en-masse.
samfisher83 10y ago
Unless you disable JavaScript it would be to hard to stop the fingerprinting. If you shut off JavaScript a lot of sites won't work
- inetknght 10y ago
  From firsthand experience, I've learned to live with broken websites and often end up _not_ using sites that rely heavily on javascript, and especially not sites that rely heavily on loading javascript from third-party domains. The worst offenders, by far, are news sites. Coming close are just about every startup that has a heavy focus on fancy web front end.
- logfromblammo 10y ago
  Since many of those sites "work" by tracking you and relentlessly analyzing your behavior, I'd say that's a good thing. If a site shows me nothing but a blank screen when I load it up with scripts disabled, I am very reluctant to enable 14 different script domains just to see a paged article, or worse, a slide show. Allowing scripts to run only from whitelisted domains makes the web a better place.
- pdkl95 10y ago
  If a website doesn't have at least minimal functionality (i.e. the article can be read), then the website is broken. Fortunately, most websites that aren't complete trash work ok without JS. Very few websites need to have their JS whitelisted, which only has to be done on the first visit. Running unknown programs from random hosts on the internet - even in a limited environment - is a bad idea. Fortunately, documents (including images, audio, video, etc.) do not need Turing completeness. A lot of people will react strongly against the idea of not using JS, often because their income depends on tricking users into running spyware/malware,
  - romaniv 10y ago
    >If a website doesn't have at least minimal functionality, then the website is broken. Curious. This goes completely against the sentiment in all of the discussions around modern SPA frameworks and JS libraries I've seen on this very website. It seems that for most fronted devs today JS is a natural prerequisite for using their product. Progressive enhancement is often sneered at[1] as impractical and unnecessary. This leads me to believe that there are two mostly disjoint groups of people commenting on this issue in different threads. --- [1] - Good example: https://www.viget.com/articles/the-case-against-progressive-enhancements-flimsy-moral-foundation https://www.viget.com/articles/the-case-against-progressive-...
Balgair 10y ago
This should help in addition to your suggestions: https://addons.mozilla.org/en-US/firefox/addon/random-agent-spoofer/ https://addons.mozilla.org/en-US/firefox/addon/random-agent-... https://addons.mozilla.org/en-US/firefox/addon/trackmenot/ https://addons.mozilla.org/en-US/firefox/addon/trackmenot/ https://addons.mozilla.org/en-US/firefox/addon/adnauseam/ https://addons.mozilla.org/en-US/firefox/addon/adnauseam/ (doesn't work well for me, though, YMMV)
rsync 10y ago
"Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can." For the fourth or fifth time this year, in response to a thread about browser privacy, I am reminded that what I really want is the ability to jail/chroot a browser. Firing up a full-blown VM for a browser ("banking profile", "twitter profile", "sketchy online store profile") is way too heavyweight and resource intensive. I want a totally, totally clean slate (restored to post-install defaults) to restart certain browsing sessions with (and dispose of when I am done) but a full virtual machine is too expensive in time and resources. But if I could jail a GUI application ... then there would be almost zero resource overhead and the jail would die quickly when you're done. jailing a GUI application is not that well developed of a use-case. Further, OSX doesn't even have a jail command. I wish this was an established use-case - I would really like a totally throwaway browser profile that I could reset and re-use.
- dreamcompiler 10y ago
  Logging in to the Guest account on OSX accomplishes what you want, no?
  - thinkling 10y ago
    Some of the fingerprinting involves not the user-controlled configuration of the machine, but hardware-related aspects like the canvas fingerprinting which looks at pixel level details of a small rendered figure. That combined with IP address will go a long way.
  - rsync 10y ago
    "Logging in to the Guest account on OSX accomplishes what you want, no?" No ... That is, unless I can easily script the destruction and recreation of the guest account, and automated install and configuration of my chrome setup ... The idea here is that I set up chrome just how I want it and deploy and redeploy that "container" over and over - destroying it and recreating it after each use. Possibly with multiple instances running simultaneously ...
    - 10y ago

z123 10y ago

Tried their sandbox site from firefox and chrome on my Mac. They were able to calculate same 'Computer fingerprint'. Looks impressive from tech perspective.. though bad for privacy

lucaspiller 10y ago

I'd imagine for most home users the combination of the following is enough to track them across multiple browsers: {ip, device pixel ratio, screen resolution, time zone} You can then identify more unique browser features to track them across multiple locations. Even if it's not completely unique, you can build up a network graph that's probably good enough for most things - people living in the same house probably have similar interests.

deckiedan 10y ago
I imagine you could have a browser plugin that randomized the values that javascript sees for those, except for sites where they matter? (Very few, I'd guess).
jampa 10y ago
Probably not on mobile, carriers the tend to share IPv4 address, you would get the same fingerprint ID on every AT&T iPhone 7 in France, for example.

osoba 10y ago

Random idea: Couldn't browsers have two modes of browsing, one lightweight one where only the most basic of JS features are enabled by default (this is something that 99% of websites actually need) and the full version where everything is enabled. The lightweight one is the default state and the users can manually switch to full version. Or even better use logistic regression or a neural network to decide when a website genuinely needs advanced features and when it's just to track you. As a bonus the lightweight mode would also probably render much faster? How realistic is this? What would be the downside?

nrki 10y ago
This is why I use uMatrix.
- pragone 10y ago
  Sometimes it's frustrating to get sites working with it, but it's nice to know I can have such fine grained control over every (I think?) connection each website is making. Sometimes I'm just astonished - some sites are making network requests to dozens and dozens of other domains!
  - coldpie 10y ago
    Observe, a local newspaper website: http://i.imgur.com/hmFaW3M.png http://i.imgur.com/hmFaW3M.png
ioulian 10y ago
These are my thoughts (as a webdeveloper): We have 5 big browsers and 3 OS's that we need to support (different rendering, different canvas rendering, not to mention 3d rendering quircks, different installed fonts), I think we don't need yet another way to make our lives difficult. I understand that privacy is a big issue, but think about "normal" web developers who just want to show a cool working website to their users, but need to display this message to them: "Thank you for looking at our website, but unfortunately your browser is in lite JavaScript mode. Please set it to full functionality again and restart your browser en go to our site once more.". I have already used dirty hacks to support the default setting of 3rd party cookies in Safari, while developing facebook apps or some apps inside an iframe that have different domains. It's there to make users feel more secure, but there are always ways around it. It would be better to add the functionality you are suggesting as an option and not by default, so people, who understand the "risks" of not viewing some sites properly in favor of more privacy, will turn it on by themselves.

deleted 10y ago

[deleted]

reirob 10y ago

tldr: "The new technique relies on code that instructs browsers to perform a variety of tasks. Those tasks, in turn, draw on operating-system and hardware resources—including graphics cards, multiple CPU cores, audio cards, and installed fonts—that are slightly different for each computer. For instance, the cross-browser fingerprinting carries out 20 carefully selected tasks that use the WebGL standard for rendering 3D graphics in browsers. In all, 36 new features work independent of a specific browser."

basicplus2 10y ago
And a bit more... "Specifically, because many of such OS and hardware level functions are exposed to JavaScript via browser APIs, we can extract features when asking the browser to perform certain tasks through these APIs. The extracted features can be used for both single- and cross-browser fingerprinting"
tim333 10y ago
The browsers should have an incognito mode that lies about that stuff - that just says it's a generic new macbook of something like that. 99% of sites would still work even with the wrong info on your OS, screen size etc.

na85 10y ago

I note without surprise that most of this tracking leverages JavaScript. When do we say that enough is enough? When do we finally agree that the web was better without JavaScript tracking us everywhere we go, and when do we finally admit that not all ideas (JavaScript) were good ideas? My browser works against me these days. Sad times.

EGreg 10y ago
It is similar to macros in Word documents
- na85 10y ago
  Is it, though? To the best of my knowledge, macros don't execute by default, silently, and in so doing facilitate my being tracked by people wanting to sell me generic brand pharmaceuticals.
  - zeveb 10y ago
    Yes, JavaScript is worse than Word macros — and they are terrible!
    - EGreg 10y ago
      If it's so bad then turn it off :)
netsharc 10y ago
Throwing web-interactivity (via Javascript) away today is like throwing your computer away. Computers help you be more productive, but it also helps the people who want to profile you. What's the alternative? If it's not Javascript, any functionality that offers access to the hardware (via however many layers) to "apps" from the "cloud" can be exploited this way. Maybe we should disallow hardware access, how will YouTube play videos? Should we all install youtubeplayer.exe ?
- 10y ago

anotheryou 10y ago

Does anyone actually bother to do this? I mean to ctach the 99% of normal users for advertising you don't have to go through any trouble.

erikrothoff 10y ago

I can see why the industry didn't adopt the Do Not Track header, as it would basically kill all targeting revenue goodness that's been built up over the years. Why not try and push for a unified IDFA instead, which has its benefits for targeting but also more control from a user perspective? I don't really see an industry adoption of these fingerprinting techniques. The linked page took 20 seconds and 100% CPU before getting a fingerprint ID, so running that at scale seems pretty useless?

manigandham 10y ago
Yes. Device/OS level "advertising ID" that can be reset at anytime by the client is sorely needed and would be used by every ad network, greatly improving privacy and performance of ads on the web.

Cieplak 10y ago

Time to start patching your browser or proxying requests to munge http headers and strip out all identifiable data, and to throw random garbage in there. Obviously you can detect this pattern as well, but it makes it harder. Browser vendors are not on our side. Spend a couple minutes with tcpdump and a fresh install of any modern browser, and you'll see what I mean.

EGreg 10y ago

Is there a point to third party cookie policies, given this? What is the extent of the ability to track a user between sites these days even if they blocked third party cookies? Meaning, given an advertiser with 1,000,000 users what are the chances it knows that you just visited sites A, B, C if it has ads installed on each one?

agotterer 10y ago

Would something like this even be legal under some of the more stringent cookie and tracking laws?

angry_octet 10y ago

Using WebGL while browsing with Tor? What could go wrong!

coldtea 10y ago
Nothing much. What do you think could go wrong?
- mirimir 10y ago
  You get tracked, that's all. And perhaps linked to browsing on your default browser, without Tor. But maybe that doesn't concern you :)
- 0xfeba 10y ago
  Letting a browser access video graphics processor is a terrible idea.
  - coldtea 10y ago
    It's also a useful idea if you want to have fast 3D graphics in your webapps. And the way you interact with the GPU is sandboxed anyway, and protected with various tactics (e.g. not enabled on known buggy cards etc). So? Not having access to the video graphics processor would be an even more terrible idea. And Tor is probably the most "privacy-theater" concept.
- angry_octet 10y ago
  I don't know, maybe massive pwnage? I'm sure you know that and are just being difficult. Its because OpenGL/DirectX drivers run a large compiler in the kernel and then send the compiled code to the GPU. None of that code is inspectable. Drivers routinely have special hacks to tweak the performance of particular games or matching patterns of use that tweak special paths, making thorough testing particularly hard. https://medium.com/@afd_icl/hey-a-web-page-just-restarted-my-phone-c06d3db76542 https://medium.com/@afd_icl/hey-a-web-page-just-restarted-my... https://twitter.com/alexstamos/status/829124727289544704 https://twitter.com/alexstamos/status/829124727289544704

ikeboy 10y ago

1. Are ad companies ahead of the research and have been doing things like this all along? 2. In theory you can look at JavaScript served from ad sites and reverse engineer to see what they are tracking. Has anybody tried to make a database of which ad vendors run which things in browsers? (Similar to how malware is reverse engineered?)

mpeg 10y ago
Yes and yes. Take a look at the work of Steven Englehardt around cookie syncing and gpu fingerprinting [0] [1] [0]: https://freedom-to-tinker.com/2014/08/07/the-hidden-perils-of-cookie-syncing/ https://freedom-to-tinker.com/2014/08/07/the-hidden-perils-o... [1]: https://freedom-to-tinker.com/2016/01/12/retrospective-look-at-canvas-fingerprinting/ https://freedom-to-tinker.com/2016/01/12/retrospective-look-...
- ikeboy 10y ago
  Checking what sites use specific techniques is not the same as reversing JS to find new techniques.
  - mpeg 10y ago
    There's no new techniques, this stuff all uses the same javascript APIs and that's what the crawlers that look for this stuff look for. People have been doing GPU fingerprinting since the canvas APIs were available, with accuracy rates of over 90%, this further refines it by exploiting subtle differences in 3D rendering via webgl but the API surface is pretty small And you really don't need to reverse JS, you can just run it in a controlled environment and hook into certain calls etc. not too different to how you'd do analysis of vm / packed binaries though some of the scripts that do this stuff will try to detect these sandboxed environments and deactivate themselves (google does that, for example, cause they run their fingerprinting inside a custom VM in javascript)

metafunctor 10y ago

For some reason, this didn't fully work for me. I tried Safari, Chrome, and Firefox on MacOS. The results for the Audio feature were the same for Chrome and Firefox, but different for Safari.

mirimir 10y ago

If you don't want to be tracked, the simplest solution is to disable WebGL and HTML5 stuff, and minimize use of Javascript. That's part of what Tor browser does. If you want that stuff, you can compartmentalize in multiple VMs. However, even that can be vulnerable. Browsers in all Debian-based VMs have the same HTML5 canvas fingerprint on given hardware. Because the fingerprint is based on both the VM's graphics driver and the host's graphics hardware. To avoid that, you can use unrelated OS in your VMs. In my experience, Windows, OSX, Fedora, PC-BSD and Debian VMs have distinct HTML5 canvas fingerprints on given hardware.

aluhut 10y ago

This script crashed here on FF: Skript: http://www.uniquemachine.org/fingerprint/js/fontdetect.js:61 http://www.uniquemachine.org/fingerprint/js/fontdetect.js:61

afpx 10y ago

Although I can't discuss much, I've seen similar techniques used years ago. Or, in other words, it's fairly easy to come up with new signiture producing schemes. That's why some people disable Javascript.

spaceboy 10y ago

JS increases the finerprintability a huge amount. It's worth looking at ClientJS to see how many bits of identifying information can be hoovered up with JS. [1] https://clientjs.org https://clientjs.org

swearfu 10y ago

How is this news? The adult and casino industries have been using this technology for years now to avoid fraud.

sleepychu 10y ago
What fraud attack do those industries share which is prevented by fingerprinting? To address your question, the technique is novel and more accurate.
- swearfu 10y ago
  Charge backs. For a long time those industries were dominated by affiliate programs, and so affiliates would hire firms in other countries to use stolen credit cards to inflate memberships, then charge back after the affiliate got their payout. By using shared networks of the finger prints we were able to identify computers already used for fraud on other sites or our own sites and refuse them the chance to even sign up. EDIT: Sorry, to be clear, the people using the stolen credit cards didn't charge back, the actual owners of the cards would. But this affected the industries two-fold, first in constantly having to battle with credit card and billing companies that didn't want to provide services for an industry with such a high charge back rate, but it also hurt us in paying out to affiliates who cost us money instead of bringing it in.
mpeg 10y ago
And advertising, and payments (most credit card companies will fingerprint you as part of the "verified by visa" prompt), and bot detection in general...

deltaprotocol 10y ago

Well, if we can't have privacy, at least lets make it clear that we DO want it and do what we can to have it. Not being able to defend ourselves doesn't mean that we should give up. A crowd can gather in front of a building and demand changes, unarmed and shouting. They may be heard or not, but still they fight. Sometimes the crowd is really huge and the other side has no option but to hear. Use Firefox. Use uBlock Origin. Use uMatrix or NoScript if you can. Use HTTPS Everywhere. Use DecentralEyes and Privacy Settings (an addon to streamline setting the cryptic browser settings in favor of your security and privacy). If you can, edit text fields through an external editor using things like Vimperator/Pentadactyl C-i command or extensions such as Its All Text or Wasavi. Use a firewall. Use a firewall in your phone as well. Search through DuckDuckGo or Startpage. Use F-Droid apps on your Android device, it even has a privacy conscious browser called Privacy Browser, a great and encryption friendly email client called K-9 and key wallet called OpenKeychain. Use Free Software. Drop the use of Google Drive and Dropbox in favor of solutions such as Syncthing. Use a password manager and strong passwords. Fight the good fight. Using this tools you can still enable resources for websites where you need them, literally unblocking the web with each use case. It works if you need to work and learn through browsers. For anything else, use Tor Browser. Maintain an installed version. Open it and update it often. Privacy is a right that we must fight for everyday and, sincerely, its an honor to be part of the resistance in this dark age. User rights actvists know how hard it can be to teach people the importance of this things. Its hard and not always effective and often backfires. If you are a developer, don't put your tail between your legs and accept that you must for monetary reasons circumvent user rights, talk with your team, be the guy with weird thoughts and be proud. You know the importance and they don't. Isn't it like this when a math teacher struggles with his younglings? They just don't know. Be patient. We can BE the change we want. Edit: Use Signal. Support Riot. SUPPORT THE EFF! There are so many beautiful people fighting the fight with us. Thanks to everyone involved in the development of this products and services, often left in the shadows and unpaid. You are love.

eganist 10y ago
Do all of this and you'll be fingerprinted as being in the fringe minority of privacy-craving web users, so for this effort to succeed, it might help for there to be some form of orchestration/automation and education to achieve all of these together with a wide population of people. That'd be a startup or nonprofit project, not necessarily anything any of us can individually do and not stick out like a sore thumb unless somebody capitalizes on anti-privacy revelations which can galvanize the population in favor of self-education on privacy hygiene. Paraphrasing (probably inaccurately) Bruce Schneier's answer to a question of mine on this topic at DEF CON: the best privacy solutions are the ones embraced by many people.

wtbob 10y ago

This is one of the reasons I disable JavaScript. The web is an interlinked web of documents called pages. It's not a distributed application platform: although it can be twisted into that, it turns out that no-one actually carefully considered all the potential security, privacy & performance implications of doing that — and it's no surprise that the security, privacy & performance of the single-page app web is abominably atrocious.

layer7burrito 10y ago

HackerNews does something like this. My original account was banned (unfairly) and I've tested various combinations of browsers and IP addresses and every new account I make is instabanned. It's pretty incredible actually. Proof: you won't see this unless you show dead.

manigandham 10y ago

Identity (as in a stable handle for your browser/device/profile) is an important part of the web. It's tied into all kinds of functionality and security. What we really need is a device/OS level "ID" that can be read by any app or website so that it is stable. Since it's controlled by the OS, resetting your identity is as simple as generating a new ID. This single change would improve security and performance across the web and remove the vast majority of fingerprinting being used today.

I_am_neo 10y ago
"Identity (as in a stable handle for your browser/device/profile) is an important part of the web" Not for me I feel that only for the egotistical and those with money flatulent to spare does identity on the web mean as much as identity in real life.
Paul-ish 10y ago
This wouldn't give us any more privacy. It would just become another signal in the tracker's model, they wouldn't solely rely on it. Cookies were the same idea limited to a single website. We were told to clear our cookies and we could prevent tracking. We have seen what cookies have become, with zombie cookies[1][2] raising from the dead after we think they are gone. At the end of the day, advertisers and trackers didn't really want us to have the capability to reset our identity with them. If you try to change the ID, trackers will use other things to try to keep tracking your browser session. [1] https://en.wikipedia.org/wiki/Zombie_cookie https://en.wikipedia.org/wiki/Zombie_cookie [2] https://en.wikipedia.org/wiki/Evercookie https://en.wikipedia.org/wiki/Evercookie
- manigandham 10y ago
  The functionality (and corresponding machine implementation) matrix of a user will always give enough entropy to construct an identity, but much of this was created because of the lack of any other reliable and stable option. A stable ID would definitely be used since services now spend a considerable amount of time and effort in constantly figuring it out through other means. A single website is too narrow since things like ad networks (which are the economic backbone of the web) work across many sites. A single root domain is an outdated isolation model on the modern web. Outside of that, the only other answer is regulation. Something that is missing in many areas although some countries seem to be making good progress.

andai 10y ago

Does anyone know about any research for fingerprinting the host inside a virtual machine?

rxlim 10y ago

I have been browsing the web without Javascript enabled since 2006. The worst is that once in a while you will click on a link to read some text, but arrive at a completely blank page. Many times this can be solved by disabling CSS for that page or using the Google cache, but it's still annoying. I my view requiring Javascript just to display text or pictures is completely brain-dead, web "designers" that think this is a good idea should probably no be allowed to design anything. It also makes it hard for disabled people that rely on accessibility tools to use the web. I don't expect "web apps" like a video player to work without Javascript, but basic things like reading text, viewing pictures or clicking on links should never depend on it.

rsync 10y ago
I use ublock origin with chrome. Do I understand correctly that the simple tool to block javascript (noscript) is not available on chrome ? I'd like to disable javascript but the non-noscript recipes seem very complex ...
- x1798DE 10y ago
  Try uMatrix. It's available on both Firefox and Chrome, and I actually like it better than NoScript.
- navs 10y ago
  Chrome allows you to enable/disable javascript on a per domain basis. It's not an extension or very flexible but I've found it useful for most situations e.g whitelisting js for my bank website.

TazeTSchnitzel 10y ago

I wonder what “machine” means here in practice. It gives the same result for Firefox, Chrome and Safari on macOS, but if I booted into Windows, perhaps I'd get a different result. Or perhaps if I switched to the internal monitor.

ibogunov 10y ago

Just use iphone & default safari, its retardingly difficult to discern 2 iphones, they are literally the same hardware only IOS version can be a bit different. Problem solved.