3 ms·
In that setup your browser fingerprint alone is enough to uniquely identify you, and it doesn't protect you from tracking by the first-party domains themselves.
by jerheinze 8y ago
In that setup your browser fingerprint alone is enough to uniquely identify you, and it doesn't protect you from tracking by the first-party domains themselves. See as well: https://www.torproject.org/projects/torbrowser/design/ https://www.torproject.org/projects/torbrowser/design/
> Site-specific or filter-based addons such as AdBlock Plus, Request Policy, Ghostery, Priv3, and Sharemenot are to be avoided. We believe that these addons do not add any real privacy to a proper implementation of the above privacy requirements, and that development efforts should be focused on general solutions that prevent tracking by all third parties, rather than a list of specific URLs or hosts.
> Implementing filter-based blocking directly into the browser, such as done with Firefox' Tracking Protection, does not alleviate the concerns mentioned in the previous paragraph. There is still just a list containing specific URLs and hosts which, in this case, are assembled by Disconnect and adapted by Mozilla.
> Trying to resort to filter methods based on machine learning does not solve the problem either: they don't provide a general solution to the tracking problem as they are working probabilistically. Even with a precision rate at 99% and a false positive rate at 0.1% trackers would be missed and sites would be wrongly blocked.
> Filter-based solutions in general can also introduce strange breakage and cause usability nightmares. For instance, there is a trend to observe that websites start detecting filer extensions and block access to content on them. Coping with this fallout easily leads to just whitelisting the affected domains, hoping that this helps, defeating the purpose of the filter in the first place. Filters will also fail to do their job if an adversary simply registers a new domain or creates a new URL path. Worse still, the unique filter sets that each user creates or installs will provide a wealth of fingerprinting targets.
- gregw134 8y agoIn practice IP address is the most important component of browser fingerprinting. Browser fingerprinting can tell advertisers things like: person x has a 2011 MacBook Pro, is running Firefox, and has installed these 3 plugins. If that person visits a coffeeshop, clears their cookies, then revisits the same coffeeshop they will be easy to identify because they're linked by an IP address and a fairly unique configuration. Once you take IP address and city out of the equation browser fingerprinting becomes much harder, because the chances that someone else in the world has the same configuration becomes much higher.
- jerheinze 8y ago> Once you take IP address and city out of the equation browser fingerprinting becomes much harder That's not true, see all the values that can be used to fingerprint a browser: https://fpcentral.tbb.torproject.org/fp https://fpcentral.tbb.torproject.org/fp https://browserprint.info https://browserprint.info https://www.torproject.org/projects/torbrowser/design/#fingerprinting-linkability https://www.torproject.org/projects/torbrowser/design/#finge...
- jandrese 8y agoThere is also Panopticlick https://panopticlick.eff.org/ https://panopticlick.eff.org/ My only complaint is that if you have canvas fingerprint randomization turned on it still counts as unique.
- jerheinze 8y ago> My only complaint is that if you have canvas fingerprint randomization turned on it still counts as unique. It's not a good idea to randomize it, see the Tor Browser design document for more details https://www.torproject.org/projects/torbrowser/design/#fingerprinting-linkability https://www.torproject.org/projects/torbrowser/design/#finge...
- jandrese 8y agoI was referring to WebGL and Canvas fingerprinting there, which the document seems to be in favor of, although they return a single value instead of a randomized value--presumably so all TOR browsers will look the same and muddy the data. At any rate, a randomized canvas or WebGL fingerprint shouldn't be very useful for tracking a particular browser.
- jerheinze 8y agoRead the "Strategies for Defense: Randomization versus Uniformity" part.