2 ms·

I was a little concerned when it said I had a unique fingerprint out of the 25k tested so far, but then I remembered I'm spoofing a new user-agent every few min

by kakarot 10y ago

I was a little concerned when it said I had a unique fingerprint out of the 25k tested so far, but then I remembered I'm spoofing a new user-agent every few minutes. It still managed to guess my true operating system of course :)

tmalsburg2 10y ago
Perhaps I misunderstand you but I think you're placing too much trust in changing the user agent. The method they are using doesn't depend on the user agent string and ignoring the user agent could even improve its performance. Further, I think it should be relatively easy to detect spoofing of user agent strings. For instance, if your user agent says your using a Linux browser but your fonts include nothing but the standard fonts on OSX, it's pretty clear then that your spoofing your user agent.
- kakarot 10y ago
  I'm okay with the spoofing being detectable. The important thing is obfuscating myself to ad agencies. It's OK if I have a unique fingerprint, if that unique fingerprint is morphing every few minutes. What is interesting is that my unspoofed user agent is 3x more rare than the spoofed one, even though the spoofed one usually throws browser versions that are out of date. Unfortunately, my browser is still unique to the set of 25k whether spoofed or not. Enabling javascript helps a little, but then I can be audio fingerprinted which defeats the purpose. I definitely have an exotic configuration. KVM / Firefox / No 3rd Party Cookies / Blacklisted social media sites / Addons (including NoScript) that take various steps to lock down information leaks and prevent loading of blocked resources. I don't allow web fonts which is probably fairly exotic as well. If more would use script blockers and ad blockers maybe I wouldn't be unique, but it seems to be a trade-off between privacy and security. And I just kind of assume that privacy is off the table for now, so at least I can work towards having security. If I have to choose between the two, I'm more concerned with malware and being tracked through 3rd party resources like Google Fonts, Google APIs (I cache them and prevent subsequent resource loading) than I am being fingerprinted.
  - Gaelan 10y ago
    https://xkcd.com/1105/ https://xkcd.com/1105/
    - kakarot 10y ago
      Haha I love that one, and of course it's very relevant.
  - greglindahl 10y ago
    The point of this project is to not use the user-agent for fingerprinting.
    - kakarot 10y ago
      Are you saying it isn't worth spoofing your user agent?
      - greglindahl 10y ago
        I'm saying that user agents are a completely separate issue from what Browserprint is measuring and using for fingerprinting. Browserprint's fingerprint of your browser doesn't change when you change your user agent. tmalsburg2 appears to have tried to make the same point.
        kakarot 10y ago
        I think we're all misunderstanding each other. I'm aware Browserprint isn't using user agents as their main source of information. It very clearly outlines the information they are using in the results. I was just remarking about the uniqueness of my spoofed user agent vs a non-spoofed agent. After my initial post I went back and found I was still unique even without a spoofed agent. That's really all there was to my comment, I'm not insinuating that I was surprised to find I was uniquely fingerprinted by other means like font and plugin enumeration.
Eiriksmal 10y ago
This tool provided some more insight into what the EFF already revealed about my browser: Yeah, my Fedora 24 Chrome UA string is fairly rare, but it's a unique (or nearly unique) font stack that rolls up into 18+ bits of entropy to nail my browser as me. EFF says my browser reveals enough information to be unique, out of their 260K+ tests they've run so far. Depressing. I can spoof the UA, but my fonts and plugins are giving me away. It's no surprise that Browserprint arrives at the same results with only 65K tests.
- kakarot 10y ago
  Yeah, and attempting to obfuscate your plugins give you away. AFAIK fonts are an unsolved problem. :(

by kakarot 10y ago

tmalsburg2 10y ago

Perhaps I misunderstand you but I think you're placing too much trust in changing the user agent. The method they are using doesn't depend on the user agent string and ignoring the user agent could even improve its performance. Further, I think it should be relatively easy to detect spoofing of user agent strings. For instance, if your user agent says your using a Linux browser but your fonts include nothing but the standard fonts on OSX, it's pretty clear then that your spoofing your user agent.

kakarot 10y ago
I'm okay with the spoofing being detectable. The important thing is obfuscating myself to ad agencies. It's OK if I have a unique fingerprint, if that unique fingerprint is morphing every few minutes. What is interesting is that my unspoofed user agent is 3x more rare than the spoofed one, even though the spoofed one usually throws browser versions that are out of date. Unfortunately, my browser is still unique to the set of 25k whether spoofed or not. Enabling javascript helps a little, but then I can be audio fingerprinted which defeats the purpose. I definitely have an exotic configuration. KVM / Firefox / No 3rd Party Cookies / Blacklisted social media sites / Addons (including NoScript) that take various steps to lock down information leaks and prevent loading of blocked resources. I don't allow web fonts which is probably fairly exotic as well. If more would use script blockers and ad blockers maybe I wouldn't be unique, but it seems to be a trade-off between privacy and security. And I just kind of assume that privacy is off the table for now, so at least I can work towards having security. If I have to choose between the two, I'm more concerned with malware and being tracked through 3rd party resources like Google Fonts, Google APIs (I cache them and prevent subsequent resource loading) than I am being fingerprinted.
- Gaelan 10y ago
  https://xkcd.com/1105/ https://xkcd.com/1105/
  - kakarot 10y ago
    Haha I love that one, and of course it's very relevant.
- greglindahl 10y ago
  The point of this project is to not use the user-agent for fingerprinting.
  - kakarot 10y ago
    Are you saying it isn't worth spoofing your user agent?
    - greglindahl 10y ago
      I'm saying that user agents are a completely separate issue from what Browserprint is measuring and using for fingerprinting. Browserprint's fingerprint of your browser doesn't change when you change your user agent. tmalsburg2 appears to have tried to make the same point.
      - kakarot 10y ago
        I think we're all misunderstanding each other. I'm aware Browserprint isn't using user agents as their main source of information. It very clearly outlines the information they are using in the results. I was just remarking about the uniqueness of my spoofed user agent vs a non-spoofed agent. After my initial post I went back and found I was still unique even without a spoofed agent. That's really all there was to my comment, I'm not insinuating that I was surprised to find I was uniquely fingerprinted by other means like font and plugin enumeration.

Eiriksmal 10y ago

This tool provided some more insight into what the EFF already revealed about my browser: Yeah, my Fedora 24 Chrome UA string is fairly rare, but it's a unique (or nearly unique) font stack that rolls up into 18+ bits of entropy to nail my browser as me. EFF says my browser reveals enough information to be unique, out of their 260K+ tests they've run so far. Depressing. I can spoof the UA, but my fonts and plugins are giving me away. It's no surprise that Browserprint arrives at the same results with only 65K tests.

kakarot 10y ago
Yeah, and attempting to obfuscate your plugins give you away. AFAIK fonts are an unsolved problem. :(