5 ms·

Can the major browser vendors not get together and implement a set of standard values and defaults that can be activated to reduce one's fingerprint, at least e

Can the major browser vendors not get together and implement a set of standard values and defaults that can be activated to reduce one's fingerprint, at least enough to make it non-unique? Something like what Tor Browser does but expanded to include all the major browsers. The way is open, the question is if there is will.

givinguflac 8y ago
Apple has done this with safari, now we need other vendors to follow suit. I wouldn’t hold your breath given the near-monopoly chrome has as of late.
- user17843 8y ago
  it hasn't, it was PR. look up amiunique.org or panopticlick.eff.org with Safari.
  - Wowfunhappy 8y ago
    Yep, I was super disappointed when I tested this.
    - user17843 8y ago
      the marketing department probably decided that it needs to be done and the safari engineers realized this would completely destroy usability for a majority of users, so they quietly abandoned it. Especially as it isn't as simple as a standardized list of fonts when the Canvas hash is 100% unique for everyone. Still very disappointing.
      - jwandborg 8y ago
        The engineering department should have told the marketing department that they didn't implement it.
      - saagarjha 8y ago
        The Safari team has not "abandoned" this effort: they are still working on reducing the fingerprinting surface area (of recent note, Safari has removed its "do not track" preference, which was used as a fingerprinting datapoint, no longer presents installed third-party fonts to websites, and no longer supports most plugins). The issue is that they have not "solved" the issue yet.
        user17843 8y ago
        the test shows unique system fonts for me. Here's a quote: "There will also be new security measures to prevent digital fingerprinting, or the use of things like installed fonts and plug-ins to help track users across the internet even with privacy settings active. Websites will be given a stripped down, simplified system configuration so every user's Mac looks like every other user's Mac."
        saagarjha 8y ago
        This is what my modern Safari exposes: Andale Mono, Arial, Arial Black, Arial Hebrew, Arial Narrow, Arial Rounded MT Bold, Arial Unicode MS, Comic Sans MS, Courier, Courier New, Geneva, Georgia, Helvetica, Helvetica Neue, Impact, LUCIDA GRANDE, Microsoft Sans Serif, Monaco, Palatino, Tahoma, Times, Times New Roman, Trebuchet MS, Verdana, Wingdings, Wingdings 2, Wingdings 3 (via javascript) I have hundreds more fonts installed. Panopticlick says that about 1 in 14 browsers have this value, so your browser should have it too.
        user17843 8y ago
        I have to withdraw my original statement, Looks like I have the same set of fonts as you. So that part seems to work, I was just confused because the effect on overall uniqueness is very low. Still I applaud the efforts by the WebKit Team.
        tinus_hn 8y ago
        Intelligent Tracking Protection is a work in progress in which Apple actively checks what trackers are using and disables it. The next iOS/MacOS releases will have the next version with new restrictions on tracking. The issue will be solved when all tracking companies have collapsed and that industry is dead. Clearly we aren’t there yet.
    - zzzcpan 8y ago
      But this is how big companies behave. They have this unwritten policy to justify any anti-competitive, anti-user behavior with "security" and "privacy" PR.
  - merpnderp 8y ago
    How does this work? For instance I have an iPhone model, so why would screen resolution help increase identifying bits coupled with the user agent? Everyone with my phone version and OS version will have the exact same values.
    - gruez 8y ago
      >For instance I have an iPhone model, so why would screen resolution help increase identifying bits coupled with the user agent? Everyone with my phone version and OS version will have the exact same values. The user agent for mobile safari doesn't identify the iphone model, only that it's an iphone[1]. Knowing the precise model definitely helps to fingerprint more. [1] random search: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
  - benplumley 8y ago
    Apparently one in 900 browsers has my list of system fonts, by far the most identifying thing Panopticlick could detect. However, the font list looked completely vanilla to me. I wonder if there's a telltale one in there that I installed manually.
    - lmkg 8y ago
      Are they in alphabetical order? The order of installed fonts used to be a dominant attribute in browser fingerprinting, before some browsers took steps to normalize it. Other than that, things like presence/absence of common variants like bold, and possibly some common fonts come packaged with office software rather than the OS.
wongarsu 8y ago
You can have what Tof browser does by using Firefox and setting privacy.resistfingerprinting in about:config. But be prepared to solve a lot of recaptchas, and don't hold your breath on Google implementing something similar in Chrome. Google is still an adtech company. They didn't spend millions (if not billions) on making and promoting Chrome only to support fingerprint resistance.
- eeZah7Ux 8y ago
  That's what distributions are for: patching out anti-features among other things.
- muxator 7y ago
  Maybe minor nuisance (probably major for some): with privacy.resistfingerprinting, Wastsapp web does not even allow authentication.
tptacek 8y ago
Probably not; that task is equivalent to coordinating between browser vendors to make their software behave in every way identically, and these are generally radically different pieces of software.
- saagarjha 8y ago
  Ideally every browser implements web standards the same and looks identical…
  - tptacek 8y ago
    You can't even get TCP/IP implemented consistently, which is why we can passively identify operating systems just by observing packets. What hope do you have of getting browsers to be indistinguishable?
    - saagarjha 7y ago
      Practically, not much. Ideally, though…
      - tptacek 7y ago
        This is the problem with anti-fingerprinting. It's a genuinely hard problem, not in the "it takes a lot of code and a lot of will to get it done" sense, but in an "it's unclear what computer science has to say about this problem right now" sense. It's up there with DRM/antimalware (two sides of the same coin).
zzzcpan 8y ago
This will only shift efforts to extract uniquely identifiable information through side channels instead of directly. So you also need to disable javascript or redesign it to prevent side channel attacks (it's possible, but would be a completely new javascript compiler with not entirely compatible language, also this would mitigate spectre attacks). However first you need some serious regulations to split Google and take away its browser "business". As it is Google is doing everything to preserve and advance tracking and fingerprinting in web browsers.

givinguflac 8y ago

Apple has done this with safari, now we need other vendors to follow suit. I wouldn’t hold your breath given the near-monopoly chrome has as of late.

user17843 8y ago
it hasn't, it was PR. look up amiunique.org or panopticlick.eff.org with Safari.
- Wowfunhappy 8y ago
  Yep, I was super disappointed when I tested this.
  - user17843 8y ago
    the marketing department probably decided that it needs to be done and the safari engineers realized this would completely destroy usability for a majority of users, so they quietly abandoned it. Especially as it isn't as simple as a standardized list of fonts when the Canvas hash is 100% unique for everyone. Still very disappointing.
    - jwandborg 8y ago
      The engineering department should have told the marketing department that they didn't implement it.
    - saagarjha 8y ago
      The Safari team has not "abandoned" this effort: they are still working on reducing the fingerprinting surface area (of recent note, Safari has removed its "do not track" preference, which was used as a fingerprinting datapoint, no longer presents installed third-party fonts to websites, and no longer supports most plugins). The issue is that they have not "solved" the issue yet.
      - user17843 8y ago
        the test shows unique system fonts for me. Here's a quote: "There will also be new security measures to prevent digital fingerprinting, or the use of things like installed fonts and plug-ins to help track users across the internet even with privacy settings active. Websites will be given a stripped down, simplified system configuration so every user's Mac looks like every other user's Mac."
        saagarjha 8y ago
        This is what my modern Safari exposes: Andale Mono, Arial, Arial Black, Arial Hebrew, Arial Narrow, Arial Rounded MT Bold, Arial Unicode MS, Comic Sans MS, Courier, Courier New, Geneva, Georgia, Helvetica, Helvetica Neue, Impact, LUCIDA GRANDE, Microsoft Sans Serif, Monaco, Palatino, Tahoma, Times, Times New Roman, Trebuchet MS, Verdana, Wingdings, Wingdings 2, Wingdings 3 (via javascript) I have hundreds more fonts installed. Panopticlick says that about 1 in 14 browsers have this value, so your browser should have it too.
        user17843 8y ago
        I have to withdraw my original statement, Looks like I have the same set of fonts as you. So that part seems to work, I was just confused because the effect on overall uniqueness is very low. Still I applaud the efforts by the WebKit Team.
      - tinus_hn 8y ago
        Intelligent Tracking Protection is a work in progress in which Apple actively checks what trackers are using and disables it. The next iOS/MacOS releases will have the next version with new restrictions on tracking. The issue will be solved when all tracking companies have collapsed and that industry is dead. Clearly we aren’t there yet.
  - zzzcpan 8y ago
    But this is how big companies behave. They have this unwritten policy to justify any anti-competitive, anti-user behavior with "security" and "privacy" PR.
- merpnderp 8y ago
  How does this work? For instance I have an iPhone model, so why would screen resolution help increase identifying bits coupled with the user agent? Everyone with my phone version and OS version will have the exact same values.
  - gruez 8y ago
    >For instance I have an iPhone model, so why would screen resolution help increase identifying bits coupled with the user agent? Everyone with my phone version and OS version will have the exact same values. The user agent for mobile safari doesn't identify the iphone model, only that it's an iphone[1]. Knowing the precise model definitely helps to fingerprint more. [1] random search: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
- benplumley 8y ago
  Apparently one in 900 browsers has my list of system fonts, by far the most identifying thing Panopticlick could detect. However, the font list looked completely vanilla to me. I wonder if there's a telltale one in there that I installed manually.
  - lmkg 8y ago
    Are they in alphabetical order? The order of installed fonts used to be a dominant attribute in browser fingerprinting, before some browsers took steps to normalize it. Other than that, things like presence/absence of common variants like bold, and possibly some common fonts come packaged with office software rather than the OS.

wongarsu 8y ago

You can have what Tof browser does by using Firefox and setting privacy.resistfingerprinting in about:config. But be prepared to solve a lot of recaptchas, and don't hold your breath on Google implementing something similar in Chrome. Google is still an adtech company. They didn't spend millions (if not billions) on making and promoting Chrome only to support fingerprint resistance.

eeZah7Ux 8y ago
That's what distributions are for: patching out anti-features among other things.
muxator 7y ago
Maybe minor nuisance (probably major for some): with privacy.resistfingerprinting, Wastsapp web does not even allow authentication.

tptacek 8y ago

Probably not; that task is equivalent to coordinating between browser vendors to make their software behave in every way identically, and these are generally radically different pieces of software.

saagarjha 8y ago
Ideally every browser implements web standards the same and looks identical…
- tptacek 8y ago
  You can't even get TCP/IP implemented consistently, which is why we can passively identify operating systems just by observing packets. What hope do you have of getting browsers to be indistinguishable?
  - saagarjha 7y ago
    Practically, not much. Ideally, though…
    - tptacek 7y ago
      This is the problem with anti-fingerprinting. It's a genuinely hard problem, not in the "it takes a lot of code and a lot of will to get it done" sense, but in an "it's unclear what computer science has to say about this problem right now" sense. It's up there with DRM/antimalware (two sides of the same coin).

zzzcpan 8y ago

This will only shift efforts to extract uniquely identifiable information through side channels instead of directly. So you also need to disable javascript or redesign it to prevent side channel attacks (it's possible, but would be a completely new javascript compiler with not entirely compatible language, also this would mitigate spectre attacks). However first you need some serious regulations to split Google and take away its browser "business". As it is Google is doing everything to preserve and advance tracking and fingerprinting in web browsers.