5 ms·

I worked on designing tracking scripts for six months (Sorry. Fortunately they aren't in production). Fingerprinting was very difficult to pull off in practice:

I worked on designing tracking scripts for six months (Sorry. Fortunately they aren't in production). Fingerprinting was very difficult to pull off in practice: even with canvas fingerprinting, font enumeration, plugin enumeration, etc. most mobile phones are still indistinguishable. Desktops are easier to fingerprint because they often have unique browser plugins or a unique set of fonts installed. Even with desktops, fonts and other settings usually change within a matter of days, so its difficult to identify a user unless they're browsing from the same ip address you've seen them at before. What used to work really well were Flash cookies. Adobe had a security hole where Flash cookies weren't cleared when you cleared your regular cookies. The only way to clear your Flash cookies was to open the Flash application on your laptop and clear all content, or visit a special webpage Adobe built to help users clear their cookies. So for years marketers could store any cookies they wanted this way. This only ended when Chrome began embedding a version of Flash into the browser so Flash cookies could be deleted when other cookies are deleted. The other mechanism that was really interesting was ETag tracking. When you request a picture or other asset from a website, the website can send you an etag id which is supposed to signify the picture's version. When the client revisits the page, the client sends back the etag to confirm the version cached is the same as the version on the server. The security leak is that the etag protocol allows arbitrary text to be set as an etag, so to set an etag cookie all you have to do is place a 1x1 pixel on each page with a random GUID, and when the user revisits the page the browser will resend the tracking etag in its request for the 1x1 tracking pixel. This works for browsers with cookies disabled, and will remain when cookies are cleared. The only way to clear it is to clear all browsing history entirely, including cached images. Fortunately, Chrome now clears cached images by default when you clear your cookies.

trendia 10y ago
While you were working on it, how did you feel about the ethics of trying to unmask people who are clearly trying to browse privately?
- eatbitseveryday 10y ago
  Understanding how unmasking works by a benevolent party means we provide competition for the malevolent parties, for the benefit of those wanting to browse privately.
- retox 10y ago
  I understand where you're coming from. In a past life I trained defence people how to build better software for their killing machines. Sometimes you just have to pay the bills.
  - 3131s 10y ago
    That argument is terrible. If you are smart enough to program weapons systems for a defense contractor then you are smart enough to make money doing something else.
    - raverbashing 10y ago
      The issue is convincing the other people that someone who does that doesn't need to be an "Angular Ninja" or know by heart the complexity of several sorting algorithms
      - bartread 10y ago
        This. I understand that sometimes you might need somebody who can hit the ground running with a particular piece of technology but, most of the time, what you need is a competent engineer, regardless of whether they are currently intimately familiar with your technology du jour.
    - elastic_church 10y ago
      Only because it has no bounds, like most schools of ethics, but it is responsible financially in this society and Op doesnt work there anymore
    - retox 10y ago
      I was fresh out of uni, teaching Ada and C++ best practice, along with toolkit and processes. Literally spent my last penny getting to the job interview, then lived on credit and supermarket end-of-day markdowns for six months.
  - kozak 10y ago
    I live in a country which is fighting off an external aggression for the last several years, and here "making killing machines" for defence contractors is a noble thing because you are literally saving lives with your work. And it's close to volunteering because you won't get paid proper money on such a job (because the money paid to you would likely be donated by other citizens anyway).
- gregw134 10y ago
  I thought it was very questionable, but I was in debt and that was the only job I could get at the time. There's actually a positive use for browser fingerprinting in that it could theoretically detect Mitm attacks or stolen cookies. Basically, if you place a unique cookie on each device, and then a user/device shows up with that cookie but a totally different browser fingerprint, it's possible that the account was hacked. The client I was working for was a bank so I was pushing for it to be used in this way. But realistically, I knew it was probably going to be used for marketing or privacy invasion but felt like I needed to keep the job to pay the bills.
  - trendia 10y ago
    I appreciate your honesty, thanks for replying.
  - G3E9 10y ago
    The detecting of hijacked sessions with browser fingerprinting (mouse movements, typing speed, etc.) is a very neat idea - something that could be used to throw off red flags or have users sign-in again with the appropriate warnings and education.
  - unscaled 10y ago
    Besides stolen sessions, using browser fingerprinting for detecting login attempts with stolen passwords is even more useful.
- cookiecaper 10y ago
  Hello, I feel like taking some downvotes today. In the same way that a vendor can't force you to honor their intention for you to view, read, and seriously consider the ads sent alongside their content, you can't force them to honor your intention to maintain privacy when you're visiting their servers. If it's fair game for you to mangle their content inside the browser before it gets presented to you, it's fair game for them to ask your browser to send back some bits so they can derive benefit they want. It's your responsibility to select a browser/extension combo that is providing the level of privacy and anonymity that you desire. There's a bit of an escalatory reciprocal at work here; users demand more and more for free, and companies are left with fewer and fewer ways to get consumers to consciously pay for their goods and services. I have never worked in adtech or user tracking, but I understand the mindset of those who do, and I don't feel that it's at all inherently evil, as some people make it out to be. Part of the reason that sophisticated spam operations like private link rings and social media astroturfing are a required part of today's web marketing toolbox is because users are doing everything they possibly can to avoid seeing advertisements alongside their content. All this accomplishes is that ads migrate from explicitly-labeled boxes on the side of the page to the content sections, as "sponsored stories" on news sites, astroturfed comments on blogs, and stuffed product reviews on ecommerce sites. I don't think there's anything necessarily wrong with end-users running an ad blocker extension if that's what they want to do, and by no means am I suggesting any restriction on their freedom to do it. I run such an extension myself (though I usually wait until I come across a particularly egregious site to install it). But by the same token, I don't think there's anything wrong with a company attempting to extract what data they can from a user's interaction with them, as long as it's voluntarily given by the user or the user's browser. There is no reason that they shouldn't be free to attempt to fingerprint individual users who are visiting their site, especially since in most cases, the goal is to enhance user experience by providing ads they might actually find relevant instead of asinine. Just my two cents. I know it doesn't fit everyone's favorite narrative of "business trying to make money are evil", but I think this group of frequently-maligned developers deserve someone to stand up for them once in a while.
  - hueving 10y ago
    You are completely conflating two orthogonal topics: not wanting to view ads vs. wanting privacy. User A doesn't mind seeing ads, but user A doesn't want to be tracked by corporations that sell personal information so she clears cookies on each browser exit. User B hates ads because reason (malware, performance, distracting, etc), so he uses an ad blocker. He doesn't care about fingerprinting across sessions so he doesn't bother clearing cookies. Do you see how you are are throwing user A under the bus because you have a problem with user B? There is no excuse for trying to correlate users trying to maintain privacy as a response to an entirely different group of users using ublock.
- driverdan 10y ago
  I'm not OP but I worked on something similar that also never made it to production. In our case we were going to use fingerprinting to prevent sweepstakes fraud. People would enter multiple times despite the rules specifying you can only enter once. A lot of people were not sophisticated so much of it was easy to detect (eg same contact info but different email). Some were less easy to detect so I figured fingerprinting could help. I never finished it so it was never tested in a live environment. We wouldn't have shared the info with anyone except in the case of fraud so I don't see it being a problem.
smilliken 10y ago
> What used to work really well were Flash cookies. I heard from an adtech company that a patent troll was granted a patent on this (incredible, using an Adobe feature as designed wins a patent), and would wait until adtech companies reached a sufficient size before suing. They had a well known reputation of settling for a few million and weren't contested.
dorgo 10y ago
I came across a project that combines all possible ways to store cookies (can't find it now). If user deleted one type of cookie it was recovered from other types. The same information was encoded into 10 to 15 types of cookies (like flash cookie, image cache, etags, browser storage ..). I managed to defeat this supercookie - but it was not easy.
- kbenson 10y ago
  That sounds like evercookie[1] , which has been around for a while. 1: http://samy.pl/evercookie/ http://samy.pl/evercookie/
- gregw134 10y ago
  I took a look at that project too. In modern chrome at least, clearing your browsing history and cookies and cache clears all those cookies.
jfindley 10y ago
There are a whole BUNCH of other ways available. In practice, no single thing is even close to 100% accurate, but once you have enough distinct indicators you can fingerprint to a pretty high level of accuracy (for many advertisers 80% accuracy is enough, and it's probably not worth spending lots of effort to go above 90%). Clock skew, for example, is slightly different on each device, but on a given device doesn't change that quickly. Mouse/finger movement patterns, TLS negotiation timings, etc, etc. There are even technologies able to track users across different devices, but it's been too long since I worked in this area to be able to speak confidently about the methods used to implement that.

trendia 10y ago

While you were working on it, how did you feel about the ethics of trying to unmask people who are clearly trying to browse privately?

eatbitseveryday 10y ago
Understanding how unmasking works by a benevolent party means we provide competition for the malevolent parties, for the benefit of those wanting to browse privately.
retox 10y ago
I understand where you're coming from. In a past life I trained defence people how to build better software for their killing machines. Sometimes you just have to pay the bills.
- 3131s 10y ago
  That argument is terrible. If you are smart enough to program weapons systems for a defense contractor then you are smart enough to make money doing something else.
  - raverbashing 10y ago
    The issue is convincing the other people that someone who does that doesn't need to be an "Angular Ninja" or know by heart the complexity of several sorting algorithms
    - bartread 10y ago
      This. I understand that sometimes you might need somebody who can hit the ground running with a particular piece of technology but, most of the time, what you need is a competent engineer, regardless of whether they are currently intimately familiar with your technology du jour.
  - elastic_church 10y ago
    Only because it has no bounds, like most schools of ethics, but it is responsible financially in this society and Op doesnt work there anymore
  - retox 10y ago
    I was fresh out of uni, teaching Ada and C++ best practice, along with toolkit and processes. Literally spent my last penny getting to the job interview, then lived on credit and supermarket end-of-day markdowns for six months.
- kozak 10y ago
  I live in a country which is fighting off an external aggression for the last several years, and here "making killing machines" for defence contractors is a noble thing because you are literally saving lives with your work. And it's close to volunteering because you won't get paid proper money on such a job (because the money paid to you would likely be donated by other citizens anyway).
gregw134 10y ago
I thought it was very questionable, but I was in debt and that was the only job I could get at the time. There's actually a positive use for browser fingerprinting in that it could theoretically detect Mitm attacks or stolen cookies. Basically, if you place a unique cookie on each device, and then a user/device shows up with that cookie but a totally different browser fingerprint, it's possible that the account was hacked. The client I was working for was a bank so I was pushing for it to be used in this way. But realistically, I knew it was probably going to be used for marketing or privacy invasion but felt like I needed to keep the job to pay the bills.
- trendia 10y ago
  I appreciate your honesty, thanks for replying.
- G3E9 10y ago
  The detecting of hijacked sessions with browser fingerprinting (mouse movements, typing speed, etc.) is a very neat idea - something that could be used to throw off red flags or have users sign-in again with the appropriate warnings and education.
- unscaled 10y ago
  Besides stolen sessions, using browser fingerprinting for detecting login attempts with stolen passwords is even more useful.
cookiecaper 10y ago
Hello, I feel like taking some downvotes today. In the same way that a vendor can't force you to honor their intention for you to view, read, and seriously consider the ads sent alongside their content, you can't force them to honor your intention to maintain privacy when you're visiting their servers. If it's fair game for you to mangle their content inside the browser before it gets presented to you, it's fair game for them to ask your browser to send back some bits so they can derive benefit they want. It's your responsibility to select a browser/extension combo that is providing the level of privacy and anonymity that you desire. There's a bit of an escalatory reciprocal at work here; users demand more and more for free, and companies are left with fewer and fewer ways to get consumers to consciously pay for their goods and services. I have never worked in adtech or user tracking, but I understand the mindset of those who do, and I don't feel that it's at all inherently evil, as some people make it out to be. Part of the reason that sophisticated spam operations like private link rings and social media astroturfing are a required part of today's web marketing toolbox is because users are doing everything they possibly can to avoid seeing advertisements alongside their content. All this accomplishes is that ads migrate from explicitly-labeled boxes on the side of the page to the content sections, as "sponsored stories" on news sites, astroturfed comments on blogs, and stuffed product reviews on ecommerce sites. I don't think there's anything necessarily wrong with end-users running an ad blocker extension if that's what they want to do, and by no means am I suggesting any restriction on their freedom to do it. I run such an extension myself (though I usually wait until I come across a particularly egregious site to install it). But by the same token, I don't think there's anything wrong with a company attempting to extract what data they can from a user's interaction with them, as long as it's voluntarily given by the user or the user's browser. There is no reason that they shouldn't be free to attempt to fingerprint individual users who are visiting their site, especially since in most cases, the goal is to enhance user experience by providing ads they might actually find relevant instead of asinine. Just my two cents. I know it doesn't fit everyone's favorite narrative of "business trying to make money are evil", but I think this group of frequently-maligned developers deserve someone to stand up for them once in a while.
- hueving 10y ago
  You are completely conflating two orthogonal topics: not wanting to view ads vs. wanting privacy. User A doesn't mind seeing ads, but user A doesn't want to be tracked by corporations that sell personal information so she clears cookies on each browser exit. User B hates ads because reason (malware, performance, distracting, etc), so he uses an ad blocker. He doesn't care about fingerprinting across sessions so he doesn't bother clearing cookies. Do you see how you are are throwing user A under the bus because you have a problem with user B? There is no excuse for trying to correlate users trying to maintain privacy as a response to an entirely different group of users using ublock.
driverdan 10y ago
I'm not OP but I worked on something similar that also never made it to production. In our case we were going to use fingerprinting to prevent sweepstakes fraud. People would enter multiple times despite the rules specifying you can only enter once. A lot of people were not sophisticated so much of it was easy to detect (eg same contact info but different email). Some were less easy to detect so I figured fingerprinting could help. I never finished it so it was never tested in a live environment. We wouldn't have shared the info with anyone except in the case of fraud so I don't see it being a problem.

smilliken 10y ago

> What used to work really well were Flash cookies. I heard from an adtech company that a patent troll was granted a patent on this (incredible, using an Adobe feature as designed wins a patent), and would wait until adtech companies reached a sufficient size before suing. They had a well known reputation of settling for a few million and weren't contested.

dorgo 10y ago

I came across a project that combines all possible ways to store cookies (can't find it now). If user deleted one type of cookie it was recovered from other types. The same information was encoded into 10 to 15 types of cookies (like flash cookie, image cache, etags, browser storage ..). I managed to defeat this supercookie - but it was not easy.

kbenson 10y ago
That sounds like evercookie[1] , which has been around for a while. 1: http://samy.pl/evercookie/ http://samy.pl/evercookie/
gregw134 10y ago
I took a look at that project too. In modern chrome at least, clearing your browsing history and cookies and cache clears all those cookies.

jfindley 10y ago

There are a whole BUNCH of other ways available. In practice, no single thing is even close to 100% accurate, but once you have enough distinct indicators you can fingerprint to a pretty high level of accuracy (for many advertisers 80% accuracy is enough, and it's probably not worth spending lots of effort to go above 90%). Clock skew, for example, is slightly different on each device, but on a given device doesn't change that quickly. Mouse/finger movement patterns, TLS negotiation timings, etc, etc. There are even technologies able to track users across different devices, but it's been too long since I worked in this area to be able to speak confidently about the methods used to implement that.