6 ms·

Guessing OS is pretty simple though, I recommend the book "Silence on the wire" [0] for a thorough explanation of passive network fingerprinting. TL;DR is that

by mpeg 9y ago

Guessing OS is pretty simple though, I recommend the book "Silence on the wire" [0] for a thorough explanation of passive network fingerprinting. TL;DR is that the each TCP stack has unique characteristics that are hard to spoof (you'd have to bypass the OS TCP stack and build your own that mimics another) and definitely out of reach for tools that run in sandboxed environments (like browser extensions) edit: Also, the author of that book, Michal Zalewski, made open source tool p0f [1] that implements some of those techniques to identify spoofed user agents. [0]: https://www.amazon.com/gp/product/1593270461 [1]: http://lcamtuf.coredump.cx/p0f3/

celim307 9y ago
Thanks for the book recommendation!
j_s 9y ago
Nice! https://amzn.com/dp/B008FRNHVY/ https://amzn.com/dp/B008FRNHVY/ $18
- pbhjpbhj 9y ago
  $24 for me, perhaps i have a richer looking browser ...
  - sleepychu 9y ago
    $18 on kindle
  - j_s 9y ago
    Thanks for the heads-up, I fixed the link to point to the Kindle edition! Amazon has indeed gotten called out for these types of shenanigans in the past but that was a long time ago! https://en.wikipedia.org/wiki/Amazon.com_controversies#Differential_pricing https://en.wikipedia.org/wiki/Amazon.com_controversies#Diffe... I missed this related discussion last month: The High-Speed Trading Behind an Amazon Purchase | https://news.ycombinator.com/item?id=13963743 https://news.ycombinator.com/item?id=13963743
  - woliveirajr 9y ago
    $24 paperback, $31.95 kindle :)
  - orbitingpluto 9y ago
    $13.60 Kindle. That's a lot of variation.
  - acqq 9y ago
    $19.55 kindle for me
  - titojankowski 9y ago
    $21.22 from Lisbon
- LeoPanthera 9y ago
  $17.25! Amazon thinks I'm cheap. It's not wrong.
deleted 9y ago
[deleted]
gsnedders 9y ago
Or just looking at what set of fonts the system has: that's pretty OS dependent. There are so many fairly trivial proxies for OS that detecting OS seems… uninteresting.
- mpeg 9y ago
  font enumeration is done by basically trying to use a certain font and then measuring the div it's writing to. Also can be done a bit fancier drawing to a canvas element and then taking a fingerprint of it (but presumably slower?). It can be spoofed from a browser extension by messing with the results from the measurement or hooking into core APIs. Plus you need a font list to begin with, you can't just look at the fonts the system has installed just from javascript.
  - gsnedders 9y ago
    Yes, indeed. But you know what fonts each OS ships out of the box, so all you need is the set that's the union of those and then you have your fingerprinting. (Canvas will probably be slower, but I expect not by as much as you might suspect.) I don't see how you can mess with the results of measuring successfully, though, at least not without breaking things. You'd have to make CSSOM lie all over the place to avoid it.
    - derefr 9y ago
      The simple thing would be for the browser to taint Javascript values derived (at whatever remove) from the CSSOM, and then block all network APIs from accepting such values.
      - pcwalton 9y ago
        I can think of fun ways around that. For example, using setTimeout() and then Date.now deltas to communicate numeric values. Or communicating data via UI events (you have to be able to send network requests in response to UI events, for obvious reasons). It wouldn't be possible to do that anyway without breaking important things like infinite scroll. Infinite scroll fundamentally requires network requests to be issued when an element is scrolled into view, but whether an element is in view depends on the results of layout, which depends on the user's installed fonts…
nosuchthing 9y ago
Sniffing (Firefox http website) traffic with Wireshark on Ubuntu vs OSX and you'll notice there's extra null flags unique to OSX. Can't imagine why..?
derefr 9y ago
> you'd have to bypass the OS TCP stack and build your own that mimics another So, the Snabb Switch sort of thing? I'm guessing that active layer-4-or-above proxies would also ruin your fingerprinting ability (so people behind corporate firewalls would be un-fingerprint-able.) And, possibly, API clients running on VM instances in clouds that use software-defined networking, might "look like" the SDN infrastructure, rather than like their VM.
userbinator 9y ago
TL;DR is that the each TCP stack has unique characteristics that are hard to spoof (you'd have to bypass the OS TCP stack and build your own that mimics another) and definitely out of reach for tools that run in sandboxed environments (like browser extensions) If you are behind a NAT, the TCP/IP stack of the NAT machine will probably present some of its characteristics too. It is also possible to modify your TCP/IP stack settings so it behaves like something else, a simple search for "defeat TCP fingerprinting" or similar will be a good place to start. I remember reading about a few universities whose networks would, via fingerprinting, identify your OS and only Windows machines would be required to install some --- intrusive, invasive, and flaky --- additional monitoring software, while Linuxes were allowed completely open access. The solution was obviously to make your machine look like Linux, and this was not hard to do with a few registry tweaks, if I remember correctly.

by mpeg 9y ago

celim307 9y ago

Thanks for the book recommendation!

j_s 9y ago

Nice! https://amzn.com/dp/B008FRNHVY/ https://amzn.com/dp/B008FRNHVY/ $18

pbhjpbhj 9y ago
$24 for me, perhaps i have a richer looking browser ...
- sleepychu 9y ago
  $18 on kindle
- j_s 9y ago
  Thanks for the heads-up, I fixed the link to point to the Kindle edition! Amazon has indeed gotten called out for these types of shenanigans in the past but that was a long time ago! https://en.wikipedia.org/wiki/Amazon.com_controversies#Differential_pricing https://en.wikipedia.org/wiki/Amazon.com_controversies#Diffe... I missed this related discussion last month: The High-Speed Trading Behind an Amazon Purchase | https://news.ycombinator.com/item?id=13963743 https://news.ycombinator.com/item?id=13963743
- woliveirajr 9y ago
  $24 paperback, $31.95 kindle :)
- orbitingpluto 9y ago
  $13.60 Kindle. That's a lot of variation.
- acqq 9y ago
  $19.55 kindle for me
- titojankowski 9y ago
  $21.22 from Lisbon
LeoPanthera 9y ago
$17.25! Amazon thinks I'm cheap. It's not wrong.

deleted 9y ago

[deleted]

gsnedders 9y ago

Or just looking at what set of fonts the system has: that's pretty OS dependent. There are so many fairly trivial proxies for OS that detecting OS seems… uninteresting.

mpeg 9y ago
font enumeration is done by basically trying to use a certain font and then measuring the div it's writing to. Also can be done a bit fancier drawing to a canvas element and then taking a fingerprint of it (but presumably slower?). It can be spoofed from a browser extension by messing with the results from the measurement or hooking into core APIs. Plus you need a font list to begin with, you can't just look at the fonts the system has installed just from javascript.
- gsnedders 9y ago
  Yes, indeed. But you know what fonts each OS ships out of the box, so all you need is the set that's the union of those and then you have your fingerprinting. (Canvas will probably be slower, but I expect not by as much as you might suspect.) I don't see how you can mess with the results of measuring successfully, though, at least not without breaking things. You'd have to make CSSOM lie all over the place to avoid it.
  - derefr 9y ago
    The simple thing would be for the browser to taint Javascript values derived (at whatever remove) from the CSSOM, and then block all network APIs from accepting such values.
    - pcwalton 9y ago
      I can think of fun ways around that. For example, using setTimeout() and then Date.now deltas to communicate numeric values. Or communicating data via UI events (you have to be able to send network requests in response to UI events, for obvious reasons). It wouldn't be possible to do that anyway without breaking important things like infinite scroll. Infinite scroll fundamentally requires network requests to be issued when an element is scrolled into view, but whether an element is in view depends on the results of layout, which depends on the user's installed fonts…

nosuchthing 9y ago

Sniffing (Firefox http website) traffic with Wireshark on Ubuntu vs OSX and you'll notice there's extra null flags unique to OSX. Can't imagine why..?

derefr 9y ago

> you'd have to bypass the OS TCP stack and build your own that mimics another So, the Snabb Switch sort of thing? I'm guessing that active layer-4-or-above proxies would also ruin your fingerprinting ability (so people behind corporate firewalls would be un-fingerprint-able.) And, possibly, API clients running on VM instances in clouds that use software-defined networking, might "look like" the SDN infrastructure, rather than like their VM.

userbinator 9y ago

TL;DR is that the each TCP stack has unique characteristics that are hard to spoof (you'd have to bypass the OS TCP stack and build your own that mimics another) and definitely out of reach for tools that run in sandboxed environments (like browser extensions) If you are behind a NAT, the TCP/IP stack of the NAT machine will probably present some of its characteristics too. It is also possible to modify your TCP/IP stack settings so it behaves like something else, a simple search for "defeat TCP fingerprinting" or similar will be a good place to start. I remember reading about a few universities whose networks would, via fingerprinting, identify your OS and only Windows machines would be required to install some --- intrusive, invasive, and flaky --- additional monitoring software, while Linuxes were allowed completely open access. The solution was obviously to make your machine look like Linux, and this was not hard to do with a few registry tweaks, if I remember correctly.