4 ms·
I have had similar experiences. Others have already mentioned some cross-browser fingerprintig techniques. One of the worst that many people don't know about is
by TekMol 9y ago
I have had similar experiences. Others have already mentioned some cross-browser fingerprintig techniques. One of the worst that many people don't know about is that browsers hand over your local IP. Check this proof of concept:
http://net.ipcalf.com/ http://net.ipcalf.com/
The media device IDs the browsers provide look even worse:
https://jsfiddle.net/u4n4s296/ https://jsfiddle.net/u4n4s296/
I am not sure if these are unique to the device type (for example a certain soundcard model) or to the device itself. If it's the latter, then that is an indestructible cross-browser cookie right there. EDIT: As per icebraining's comment, in Firefox they are not not cross-domain, not cross-browser and get randomized when you delete your cookies.
- reaktivo 9y agoWhoa, for a moment I felt pretty sure you would be mistaken. Hadn't read about this particular vulnerability before.
- MichaelGG 9y agoWebRTC leaks have been known, and the WebRTC or Firefox people said they'd disable peer to peer data channels off if this technique became used for tracking. Because a permission prompt was too much. WebRTC folks couldn't even come up with a real use case for silent data channels.
- jfoutz 9y agoLove the comment. "In Chrome and Firefox your IP should display automatically, by the power of WebRTCskull."
- hood_syntax 9y agoHaha, wow. What is wrong with people nowadays, that they think this is reasonable behavior...
- anowlcalledjosh 9y agoInterestingly, this doesn't seem to work for me if I have uBlock Origin enabled. However, nothing is logged as blocked in uBO, so I can't tell what it's doing to break it.
- throwaway613834 9y agoSame with Privacy Badger. I think it's the "Prevent WebRTC from leaking local IP address" option in the General Settings, except that mine is unset, yet they say the "Default options" protect me so I'm not sure if it's partially set by default anyway.
- anowlcalledjosh 9y agoAh, it definitely is that option, in both uBO and Privacy Badger. The latter doesn't actually seem to stop the demo working, though. I vaguely remember reading something in uBO's documentation about only one extension (the first one to ask for it) getting access to some filtering feature, although I can't find the page now.
- icebraining 9y agoIn Firefox, the media device IDs are different for each site (origin): It is un-guessable by other applications and unique to the origin of the calling application. It is reset when the user clears cookies (for Private Browsing, a different identifier is used that is not persisted across sessions). https://developer.mozilla.org/en-US/docs/Web/API/MediaDeviceInfo/deviceId https://developer.mozilla.org/en-US/docs/Web/API/MediaDevice...
- dunham 9y agoIt looks like chrome is doing something similar. Each profile has a different value and each site has a different value, but the value is stable across restarts. Safari (tech preview or high sierra) seems to give a new value every time you reload the page.
- Angostura 9y agoJust tried this on iOS Safari (running iOS beta, haven’t checked earlier version). Those media ids change on every page load.