5 ms·

Based on this article you can "fingerprint" a computer using the following combination of attributes: - Precise timestamp - Monitor size - User agent - Brow

by holdenc 16y ago

Based on this article you can "fingerprint" a computer using the following combination of attributes: - Precise timestamp - Monitor size - User agent - Browser plugins - and fonts (!) Really?? I use several browsers, and switch out a few external displays for my laptop. Plugins come and go with the browser version. My system time is synced to a timeserver (as I imagine are many other computers) but sometimes not. Based on these data, it's hard to believe anyone could truly trace my hardware over time.

msy 16y ago
It doesn't matter whether it actually works anywhere near as well as the hyperbolic sales pitch as long as advertisers buy it. It's nothing more than cookies and metadata collected by javascript, probably hashed together to produce a unique ID.
nodata 16y ago
Yes. Fonts are the key. See the EFF site for a demo: https://panopticlick.eff.org/ https://panopticlick.eff.org/
dangrossman 16y ago
They don't really need to trace your hardware over time. They're selling the info against the device, not against the person. Someone might want to target ads to your activity profile at work, someone else might want to target ads to your activity profile on your laptop at night. It might actually be better for the advertisers to have separate profiles for those machines than one for you the person. You may switch browsers and displays and plugins all the time, but someone like you is very rare. More people have never strayed from their Windows XP and Internet Explorer for the past 9 years than not.
jakevoytko 16y ago
The EFF tested this themselves. They run a website, http://panopticlick.eff.org http://panopticlick.eff.org, comparing with computers that have visited in the past. They have over a million fingerprints at this point, and my Chrome install is "unique." It displays all data it lifted from your machine, along with how rare each datum appears to be. On my Chrome 7.0.517.44 install, I appear to be identifiable by my user agent (1 in 182,518), browser plugins (1 in 1,277,632) and system fonts (1 in 638,816).
- kolmogorovcmplx 16y ago
  Even the default IE8 on my stock Windows 7 Enterprise appears to be unique. In that case it's the browser plugins which identifies it (1 in 1277688). My installed plugins are nothing out of the ordinary: Java, Flash and WindowsMediaplayer.
  - trotsky 16y ago
    Sample size seems to be a significant issue here. I'm one of two people on the site that had my user agent (1 in 638851), and while it's rare, sure, there are obviously a lot more than two people in the world running chromium x64 opensuse. Looking at the data it seems like most of the responses are bog standard for my particular software install, so it's basically saying I'm unique because: * user-agent * time zone * screen size Surely my TZ=EST and screen=1366x768x24 can't be too helpful in a large sample size. And once chromium updates yet again, I think I'll be lost to the EFF test. It'll still see me as unique, but I'll be a different "unique" than the last time. It does seem like browsers could easily cut back on user-agent details to the benefit of their customers privacy and security. Is it really necessary to tell every website I visit that I'm x64 instead of i386 just in case I'm not smart enough to know which download now button to click? It's probably most useful to malware domains for determining which version of the latest flash 0-day to push to me. And are we sure we need the exact build number of every browser? Most revisions of chrome aren't changing anything in the rendering behavior.
- gjm11 16y ago
  Panopticlick claims that my user agent (Firefox 4.0b7 on Windows XP) is about 1/15,000. That seems unlikely. It claims that my http_accept (text/html, STAR/STAR ISO-8859-1,utf-8;q=0.7,STAR;q=0.7 identity en-gb,en;q=0.5 -- except that I've replaced asterisks with "STAR" to avoid HN formatting confusion) is about 1/19,000. That seems even more unlikely. I suspect these have the same cause: they have this big database of browser information, gathered over time, and recent browsers are underrepresented. So anyone running a Firefox 4 beta, or a recent Chrome build, will show up as being very unusual in the database, but that's misleading because some of the older entries in the database will represent browsers that are no longer in the pool, whose users are now using something more recent. On the other hand, I don't find it so hard to believe that my browser plugins give 20 bits or so of information. (Though some of the same bias will affect this figure.) In case it isn't obvious, by the way, their figures are simply the fraction of records in their database that have the same user agent / browser plugins / system fonts as yours. The browser plugins figure is 1/1,277,632 (or, for me a little later, 1/1,277,946) because that's how many times the Panopticlick site has been used. Hmm, I wonder how they defend against having the same user run their test twice in a row. (Answer, having tried it: they don't. Probably a good thing since the obvious non-privacy-compromising way could skew their figures a bit.)
keltex 16y ago
Probably works fine for PCs, but for iPhones, iPads and other devices that are more uniform, they'll probably have to stick with cookies. Do phones' timestamps differ?
- trun 16y ago
  I believe most mobile devices already have unique device IDs built in. Perhaps they're not accessible through JavaScript, but it sounds like this technology already goes beyond the web browser anyways.
golgo13 16y ago
-Your browser fingerprint appears to be unique among the 1,279,589 tested so far. Guess using Opera helps with my uniqueness! >_<

by holdenc 16y ago

msy 16y ago

It doesn't matter whether it actually works anywhere near as well as the hyperbolic sales pitch as long as advertisers buy it. It's nothing more than cookies and metadata collected by javascript, probably hashed together to produce a unique ID.

nodata 16y ago

Yes. Fonts are the key. See the EFF site for a demo: https://panopticlick.eff.org/ https://panopticlick.eff.org/

dangrossman 16y ago

They don't really need to trace your hardware over time. They're selling the info against the device, not against the person. Someone might want to target ads to your activity profile at work, someone else might want to target ads to your activity profile on your laptop at night. It might actually be better for the advertisers to have separate profiles for those machines than one for you the person. You may switch browsers and displays and plugins all the time, but someone like you is very rare. More people have never strayed from their Windows XP and Internet Explorer for the past 9 years than not.

jakevoytko 16y ago

The EFF tested this themselves. They run a website, http://panopticlick.eff.org http://panopticlick.eff.org, comparing with computers that have visited in the past. They have over a million fingerprints at this point, and my Chrome install is "unique." It displays all data it lifted from your machine, along with how rare each datum appears to be. On my Chrome 7.0.517.44 install, I appear to be identifiable by my user agent (1 in 182,518), browser plugins (1 in 1,277,632) and system fonts (1 in 638,816).

kolmogorovcmplx 16y ago
Even the default IE8 on my stock Windows 7 Enterprise appears to be unique. In that case it's the browser plugins which identifies it (1 in 1277688). My installed plugins are nothing out of the ordinary: Java, Flash and WindowsMediaplayer.
- trotsky 16y ago
  Sample size seems to be a significant issue here. I'm one of two people on the site that had my user agent (1 in 638851), and while it's rare, sure, there are obviously a lot more than two people in the world running chromium x64 opensuse. Looking at the data it seems like most of the responses are bog standard for my particular software install, so it's basically saying I'm unique because: * user-agent * time zone * screen size Surely my TZ=EST and screen=1366x768x24 can't be too helpful in a large sample size. And once chromium updates yet again, I think I'll be lost to the EFF test. It'll still see me as unique, but I'll be a different "unique" than the last time. It does seem like browsers could easily cut back on user-agent details to the benefit of their customers privacy and security. Is it really necessary to tell every website I visit that I'm x64 instead of i386 just in case I'm not smart enough to know which download now button to click? It's probably most useful to malware domains for determining which version of the latest flash 0-day to push to me. And are we sure we need the exact build number of every browser? Most revisions of chrome aren't changing anything in the rendering behavior.
gjm11 16y ago
Panopticlick claims that my user agent (Firefox 4.0b7 on Windows XP) is about 1/15,000. That seems unlikely. It claims that my http_accept (text/html, STAR/STAR ISO-8859-1,utf-8;q=0.7,STAR;q=0.7 identity en-gb,en;q=0.5 -- except that I've replaced asterisks with "STAR" to avoid HN formatting confusion) is about 1/19,000. That seems even more unlikely. I suspect these have the same cause: they have this big database of browser information, gathered over time, and recent browsers are underrepresented. So anyone running a Firefox 4 beta, or a recent Chrome build, will show up as being very unusual in the database, but that's misleading because some of the older entries in the database will represent browsers that are no longer in the pool, whose users are now using something more recent. On the other hand, I don't find it so hard to believe that my browser plugins give 20 bits or so of information. (Though some of the same bias will affect this figure.) In case it isn't obvious, by the way, their figures are simply the fraction of records in their database that have the same user agent / browser plugins / system fonts as yours. The browser plugins figure is 1/1,277,632 (or, for me a little later, 1/1,277,946) because that's how many times the Panopticlick site has been used. Hmm, I wonder how they defend against having the same user run their test twice in a row. (Answer, having tried it: they don't. Probably a good thing since the obvious non-privacy-compromising way could skew their figures a bit.)

keltex 16y ago

Probably works fine for PCs, but for iPhones, iPads and other devices that are more uniform, they'll probably have to stick with cookies. Do phones' timestamps differ?

trun 16y ago
I believe most mobile devices already have unique device IDs built in. Perhaps they're not accessible through JavaScript, but it sounds like this technology already goes beyond the web browser anyways.

golgo13 16y ago

-Your browser fingerprint appears to be unique among the 1,279,589 tested so far. Guess using Opera helps with my uniqueness! >_<