12 ms·

Mozilla research: Browsing histories are unique enough to identify users

238 points by chris_f 6y ago

g42gregory 6y ago
Interesting. I also think that the browser signature, together with IP address, will probably come very close to uniquely identifying users.
- option 6y ago
  I’m sure that last 3-5 pageviews with exact timestamps is enough to uniquely identify any person
- lkbm 6y ago
  I noticed the other day that various chatbots (as in, a single service shared across multiple websites) call me "The University of Texas at Austin", presumably because I have a housemate who works there. I tried various VPN servers and got called by other company names[0]. It was a good reminder about how we're tracked, and our information may be shared, even with other users. [0] https://twitter.com/lkbm/status/1299408670325964802 https://twitter.com/lkbm/status/1299408670325964802
the_jeremy 6y ago
Who is able to get access to my browser history? I thought it was just my ISP/VPN, which can obviously track me better in other ways.
- slipheen 6y ago
  Consider for example, that many pages use remotely loaded resources. I would think things like Facebook/Twitter like buttons or Google Fonts might make it to assemble this history. Sites like FB are said to maintain "Shadow Profiles" of people, even when those people aren't using their service directly. I suppose in theory any sufficiently shared infrastructures such as AWS/Cloudflare could do so as well, but they are disincentivized to do so.
  - WilTimSon 6y ago
    Would using Firefox's 'Containers' help prevent this? As far as I understand they quarantine the Facebook pages so they can't get data from other websites you visit.
    - cma 6y ago
      DNS resolve measurement to see if it is cached by the OS can potentially breach that.
      - laumars 6y ago
        Can JavaScript measure DNS resolve time?
        cma 6y ago
        I think only indirectly, but if they control the endpoint they can ping you back, subtract rtt from initial request response time and then the difference from that can tell them whether initial request was cached in dns or not.
        laumars 6y ago
        Just so I understand correctly, does that mean you then need to control the end point of every site you want to use as part of fingerprinting? If so, wouldn’t that drastically reduce the effectiveness of using DNS resolve times as a work around for Firefox containers? Not trying to be argumentative here, just trying to understand how effective the sandboxing is, or whether I need to design more layers of indirection. :)
        danielheath 6y ago
        It can measure response time. If you host your own dns and web server you can vary their response times and record from js.
    - deleted 6y ago
      [deleted]
- Barrin92 6y ago
  extensions with the necessary permissions I think would be one obvious source.
- stefan_ 6y ago
  Malicious extensions are a likely culprit. This is the ultimate irony of the whole WebExtensions debacle; browser vendors wanted to stop the extensions from interacting with the browser because maintaining that interface is work, so now the most trivial extensions will request full access to all websites so they can inject scripts. To bring back "backspace navigates back" I have an extension that needs just that.
  - contravariant 6y ago
    Needing javascript that embeds in every page for basic mouse and keyboard behaviour is insane. No clue why they decided it should be the only viable option.
    - wizzwizz4 6y ago
      It isn't intended to be. But supporting the old APIs meant that they had to have Microsoft levels of backwards-compatibility. • You want to refactor XUL so it doesn't duplicate features of HTML5? Whoops; you broke all the extensions. • You want multi-threading? What a shame; that API over there assumes it'll always be called from the main thread. • Update that database table's schema to store more data? Bah. Make another table, or you'll break extensions When every implementation detail is part of your interface, bad things happen.
      - liability 6y ago
        Fine, XUL had to go. But where is the replacement? How many more years should we expect Mozilla to need to implement configurable bindings? It doesn't even need to be extension-accessible, just give users a tab in the preferences menu like damn near any other application has been doing since the dawn of GUIs. Do they even have one engineer working on this?
        wizzwizz4 6y ago
        Considering they fired half the people working on this, probably not.
- dheera 6y ago
  Facebook. Their embedded like buttons are all over the damn internet. Google Analytics. Google Fonts. Javascript CDNs. Image CDNs. Imgix. CDNs in general. Akamai. Cloudflare. Any of the several ads platforms. Disqus, or any of the commenting platforms. Youtube. Lots of people embed their video content. AWS, Google Cloud, Azure. Every time you visit a page that has an embedded content from a remote host, that host knows you visited that page.
- afrcnc 6y ago
  Install one shady Android app and it will immediately dump your browsing history, rest assured.
  - lostmsu 6y ago
    How exactly would it do it? Android permissions prohibit access to other app data, except shared storage.
    - afrcnc 6y ago
      1. LPE/rooting exploit 2. Win
- gkoberger 6y ago
  Hmm this is a bit of an interesting question. The original study (2012) exploited a security bug, which let anyone see which sites you had visited. (Basically, by checking the color of links with JS to see if :visited styling had been applied.) That bug doesn't exist anymore, and the new survey just uses opt-in data to "confirm" it. So, I don't actually think this research is particularly relevant anymore? It can't really be exploited (and when it can, there's much better ways to track the person).
- throwaway2474 6y ago
  How do you imagine the ISP/VPN gets your browsing history for https traffic beyond domain names?
  - liability 6y ago
    > beyond domain names "..other than that, how was the play Mrs. Lincoln?"
- liability 6y ago
  Does Mozilla Pocket get browsing history if it isn't disabled? Last I heard it's not using E2E encryption and Mozilla still hasn't open sourced the server side of it.
  - ta95846893 6y ago
    My understanding of pocket recommendations is that it gets a list of articles from a server every day and uses a local algorithm to match them to your browsing history so your history never leaves the device. Idk if any metadata about which decisions it made is leaked though. https://help.getpocket.com/article/1142-firefox-new-tab-recommendations-faq#personalized https://help.getpocket.com/article/1142-firefox-new-tab-reco...
    - liability 6y ago
      I'm under the impression that syncing browsing history between instances of Firefox is a feature Mozilla provides through Pocket, but admittedly I don't have first-hand knowledge of this.
      - ta95846893 6y ago
        I think syncing is done with a Firefox account (Firefox Sync) and i can't find implementation details, but I did find: "Firefox Accounts uses your password to encrypt your data (such as bookmarks and passwords) for extra security. When you forget your password and have to reset it, this data could be erased. To prevent this from happening, generate your recovery key before having to reset your password."[1] So it appears they may be encrypting data locally and syncing encrypted data without having keys. I think you are right though, there are more website saving features available through pocket other than recommendations and I'm not sure how any of that works. [1] https://support.mozilla.org/en-US/kb/reset-your-firefox-account-password-recovery-keys https://support.mozilla.org/en-US/kb/reset-your-firefox-acco...
- MikusR 6y ago
  Mozilla was sending your Firefox history to Cliqz (in Germany). And currently is sending it to Cloudflare (in US).
  - tpxl 6y ago
    Got a source for that one?
- taneq 6y ago
  Anyone with a widely distributed analytics package or tracking beacon can track your hits on pages with that beacon. How many pages DON'T use Google Analytics or a Facebook 'like' button?
- gpvos 6y ago
  It's in the article. You can do some clever Javascript/CSS tricks to sniff the browser history. Browsers are not trying to block this.
  - gpvos 6y ago
    *now trying to block this (oops)
jedisct1 6y ago
So can DNS queries.
option 6y ago
so are amazon/itunes/appstore/googleplay/netflix-views/etc
LatteLazy 6y ago
Here in the UK, date of birth and post code is enough to identify something like 95% of people. Anonymised data sets are not really possible once you have more than a few varriables. Most people don't know this.
- MattGaiser 6y ago
  Isn’t a postal code about 50-100 houses? It really narrows things down. That particular variable really reduces things.
  - laurent123456 6y ago
    On average it's about 15 houses, so postcode + date of birth is indeed around 95% accurate.
    - deleted 6y ago
      [deleted]
  - White_Wolf 6y ago
    50-100 houses is not that much. You can find someone in those 100 houses with 1 DOB and post code. Maybe in very crowded areas you'll need one more var. Worst case scenario you'll end up with 2-3 people.
  - godelski 6y ago
    That's a bit insane. I looked up US numbers to check and got around 8k/zip code[0] [0] https://www.zip-codes.com/zip-code-statistics.asp https://www.zip-codes.com/zip-code-statistics.asp
    - patrickmcnamara 6y ago
      In Ireland, we use Eircode with one house per postcode. This is very handy because you don't need to type in your full address on a lot of websites, just the Eircode. The first three digits of an Eircode are more like a traditional postcode in that they indicate your area/town but the next four are randomised for each address.
Lordarminius 6y ago
Mine certainly i, since I tend to visit the same ten sites over and over again
Groxx 6y ago
I feel inclined to say "... well yeah, obviously". Not in the "obvious in retrospect" way, but because browsers have been progressively blocking history-sniffing tactics for years precisely because advertisers were using it to identify visitors. Did this research... establish better numbers around it or something?
- godelski 6y ago
  > Did this research... establish better numbers around it or something? >> However, this time around, since the data was collected from Firefox itself and not through a web page performing a time-lengthy CSS test, the data was much more accurate and reliable. Furthermore, the data Mozilla researchers collected is also about the same type of data that today's online analytics companies also collect about users — either through data partnerships, mobile apps, online ads, or other mechanisms.
  - dralley 6y ago
    Needs to be specified that this was an opt-in study that you had to agree to.
    - godelski 6y ago
      Is no one in this thread going to read this article? Seriously, it isn't that long. RTFM >> The new experiment got underway between July 16 and August 13, 2019, when Mozilla prompted Firefox users to take part of this experiment. >> Mozilla researchers said that more than 52,000 users agreed to take part and agreed to provide anonymous browsing data.
      - ocdtrekkie 6y ago
        Clearly not actually anonymous browsing data in actuality though... which is why we should always take claims that telemetry data is anonymized with a grain of salt.
        6y ago
hkt 6y ago
Time for a browser plugin that will generate random noise - adding junk into history.
- giantrobot 6y ago
  Internet noise generator[0]. [0] https://makeinternetnoise.com/index.html https://makeinternetnoise.com/index.html
- mulmen 6y ago
  If it’s truly random wouldn’t that make you even easier to identify?
  - airstrike 6y ago
    Not if everyone else uses it too
    - mulmen 6y ago
      Even if everyone else uses it. If your random pages are a, b and c but my pages are d, e and f or even a, b and d then it’s still easy to fingerprint us. Extensions like this might work if they visited the same sites all other users visit. Otherwise you’re just adding even more unique information for the trackers.
      - airstrike 6y ago
        But if both our random pages are a, b and c, and the only difference is when or how often I accessed each of those, then making it random for both of us will effectively turn us into the same person.
        mulmen 6y ago
        What about all the other pages you visit? How does adding random traffic to your history make you any harder to identify? It just creates more datapoints.
ExcavateGrandMa 6y ago
I feel inclined to say "...well based on your own understanding of the space you occupying." It is extremely harsh to discover the numbers are what they are... :)
3np 6y ago
To this me and a friend started sketching on a VPN/HTTP proxy that will have a set of say 100 outgoing IPs, look at the domains being connected to and distribute request destinations over IPs. So e.g. Google would always see the same IP, which would be different from the one Facebook sees. While access times cross-references and identification is still theoretically possible, it should be an entirely different game. Would anyone else reading this be interested in working on this or joining in? I'm not thinking to make it a startup or business per se but 1) reliable IPs are a bit too expensive to make sense for just 1 person 2) anonymity in numbers. I'm thinking ideal would be something FOSS and easy to self-host and replicate so you can pool together a group of friends for a shared VPN among semi-trusted parties (at least the user should trust the operator to not index requests and sell the data, and the operator should trust users to not run botnets)
- nemothekid 6y ago
  I think an easier approach is that once you have good IPv6 connectivity you could do something like a unique address per day per host. Every device could have 100M ip addresses and it wouldn't touch the IPv6 address space (10 billion humans * 100 devices = 0.000005% of the IPv6 address space). Edit: My math is wrong. I thought IPv6 was 2^64, but it's actually 2^128, so that percentage is 10^20 times more miniscule.
  - 3np 6y ago
    In that scenario those 100 IPv6 addresses in the subnet would be practically equivalent to an IPv4 address today and would provide no extra benefit.
    - croon 6y ago
      It would if hundreds of different users came through those IPs, wouldn't it?
  - Fnoord 6y ago
    You get a range from your ISP (e.g. a /64). Everything within that range would be tied to "you" (rather, your connection, but something like user agent would tell its your wife's iPhone or your MacBook Pro).
wombatmobile 6y ago
If the study establishes that for all practical purposes, online anonymity is impossible to maintain for average users, what are the implications (a) for the average user; (b) for the economy; and (c) for society?
- marta_morena_25 6y ago
  (a) The average user neither doesn't know nor care about anonymity. If you are talking about "the average hackernews user", things might be different. Welcome to the 0.1%! (b) Lots and lots of money? (c) Not soo many annoying ads popping up, but rather ones that seem at least vaguely relevant? Will make me less angry and more sociable.
aaron695 6y ago
I think this is as stupid as it sounds from the paper - https://www.usenix.org/conference/soups2020/presentation/bird https://www.usenix.org/conference/soups2020/presentation/bir... Why not "Mozilla research: We asked users for their name and address and the ones telling the truth we could identify" TOR is fighting identifying users from the screen size of their window when maximised. Here's the original paper which is more about how you can access the browsers histories - https://www.petsymposium.org/2012/papers/hotpets12-4-johnny.pdf https://www.petsymposium.org/2012/papers/hotpets12-4-johnny.... Can you still access browsers histories? I'd have to guess no way without a zeroday. The original site is down. http://www.wtikay.com/ http://www.wtikay.com/ Firefox fixed it - https://bugzilla.mozilla.org/show_bug.cgi?id=147777 https://bugzilla.mozilla.org/show_bug.cgi?id=147777
vlovich123 6y ago
I suspect privacy would be better served by taking the approach of the security domain with responsible disclosure to vendors and a concerted effort to attack the problem holistically. Until then we’re just giving privacy attackers a heads up and by the time this issue is mitigated their onto the next avenue for bypassing privacy.
moonchild 6y ago
Wasn't it shown by aol researchers 20 years ago that search histories are uniquely identifying? If so, this seems hardly surprising, as browser history should be a superset of search history.
yalogin 6y ago
Intuitively there are tons of things we do on our computers that uniquely identify. I am sure the adware companies know a ton more and are not public too. The need for strict privacy preserving tech is needed across the whole stack.
axegon_ 6y ago
That's hardly surprising. I mean browsers hand out willingly plenty of information that could be used for pretty accurate identifications. Just scrolling through my scores on amiunique[1], many of the parameters put me in the 0.01% category. [1] https://amiunique.org/fp https://amiunique.org/fp
- wnbc 6y ago
  If you want to be less unique on amiunique.org/fp 1. Visit the site 2. Delete your browser cookies 3. Refresh 4. Repeat the steps until you're less unique
  - curiousgal 6y ago
    Or you know, just block JS.
    - squiggleblaz 6y ago
      Congratulations, you just broke 90% of the modern web. Might as well go directly to Gopher.
      - throwaway_pdp09 6y ago
        Congratualations on never actually bothering to block JS and find out - you know, facts. From actually doing so over many years, and so from actual experience I'd say completely non-functinal sites are about 25%.
        chrismorgan 6y ago
        I’d put the number quite a bit lower than that, probably comfortably under 10% of sites I interact with, though the trend is definitely upwards, drastically so among interactive things (which are probably worse than 50% broken these days).
      - Tarq0n 6y ago
amai 6y ago
As counterstrategy you can use tools like http://trackmenot.io/ http://trackmenot.io/ "TrackMeNot runs as a low-priority background process that periodically issues randomized search-queries to popular search engines, e.g., AOL, Yahoo!, Google, and Bing. It hides users' actual search trails in a cloud of 'ghost' queries, significantly increasing the difficulty of aggregating such data into accurate or identifying user profiles. "
- throwaway_pdp09 6y ago
  I use it as far as I can but it's stopped working in palemoon. The queries it produces aren't very intelligent when you see them and it wouldn't take much NSA/MI5 work to trim much of them out. I think TMN could be a fair bit smarter.
MaxBarraclough 6y ago
The Evercookie (hard-to-delete cookie-like system in JavaScript) and Panopticlick (browser fingerprinting) projects may also be of interest: https://en.wikipedia.org/wiki/Evercookie https://en.wikipedia.org/wiki/Evercookie https://panopticlick.eff.org/ https://panopticlick.eff.org/
dmos62 6y ago
By looking at all the data available to untrusted sites (as seen in https://amiunique.org/fp https://amiunique.org/fp) you can tell that Web is many many years away from being privacy conscious. List of fonts, canvas fingerprinting, timezone, OS, user agent... the list goes on and on. Those of us who are tech-literate know better than to create tech like this today, but there's just too much momentum (and shady interests) to hot-swap Web for something else.

238 points by chris_f 6y ago

Interesting. I also think that the browser signature, together with IP address, will probably come very close to uniquely identifying users.

option 6y ago
I’m sure that last 3-5 pageviews with exact timestamps is enough to uniquely identify any person
lkbm 6y ago
I noticed the other day that various chatbots (as in, a single service shared across multiple websites) call me "The University of Texas at Austin", presumably because I have a housemate who works there. I tried various VPN servers and got called by other company names[0]. It was a good reminder about how we're tracked, and our information may be shared, even with other users. [0] https://twitter.com/lkbm/status/1299408670325964802 https://twitter.com/lkbm/status/1299408670325964802

the_jeremy 6y ago

Who is able to get access to my browser history? I thought it was just my ISP/VPN, which can obviously track me better in other ways.

slipheen 6y ago
Consider for example, that many pages use remotely loaded resources. I would think things like Facebook/Twitter like buttons or Google Fonts might make it to assemble this history. Sites like FB are said to maintain "Shadow Profiles" of people, even when those people aren't using their service directly. I suppose in theory any sufficiently shared infrastructures such as AWS/Cloudflare could do so as well, but they are disincentivized to do so.
- WilTimSon 6y ago
  Would using Firefox's 'Containers' help prevent this? As far as I understand they quarantine the Facebook pages so they can't get data from other websites you visit.
  - cma 6y ago
    DNS resolve measurement to see if it is cached by the OS can potentially breach that.
    - laumars 6y ago
      Can JavaScript measure DNS resolve time?
      - cma 6y ago
        I think only indirectly, but if they control the endpoint they can ping you back, subtract rtt from initial request response time and then the difference from that can tell them whether initial request was cached in dns or not.
        laumars 6y ago
        Just so I understand correctly, does that mean you then need to control the end point of every site you want to use as part of fingerprinting? If so, wouldn’t that drastically reduce the effectiveness of using DNS resolve times as a work around for Firefox containers? Not trying to be argumentative here, just trying to understand how effective the sandboxing is, or whether I need to design more layers of indirection. :)
      - danielheath 6y ago
        It can measure response time. If you host your own dns and web server you can vary their response times and record from js.
  - deleted 6y ago
    [deleted]
Barrin92 6y ago
extensions with the necessary permissions I think would be one obvious source.
stefan_ 6y ago
Malicious extensions are a likely culprit. This is the ultimate irony of the whole WebExtensions debacle; browser vendors wanted to stop the extensions from interacting with the browser because maintaining that interface is work, so now the most trivial extensions will request full access to all websites so they can inject scripts. To bring back "backspace navigates back" I have an extension that needs just that.
- contravariant 6y ago
  Needing javascript that embeds in every page for basic mouse and keyboard behaviour is insane. No clue why they decided it should be the only viable option.
  - wizzwizz4 6y ago
    It isn't intended to be. But supporting the old APIs meant that they had to have Microsoft levels of backwards-compatibility. • You want to refactor XUL so it doesn't duplicate features of HTML5? Whoops; you broke all the extensions. • You want multi-threading? What a shame; that API over there assumes it'll always be called from the main thread. • Update that database table's schema to store more data? Bah. Make another table, or you'll break extensions When every implementation detail is part of your interface, bad things happen.
    - liability 6y ago
      Fine, XUL had to go. But where is the replacement? How many more years should we expect Mozilla to need to implement configurable bindings? It doesn't even need to be extension-accessible, just give users a tab in the preferences menu like damn near any other application has been doing since the dawn of GUIs. Do they even have one engineer working on this?
      - wizzwizz4 6y ago
        Considering they fired half the people working on this, probably not.
dheera 6y ago
Facebook. Their embedded like buttons are all over the damn internet. Google Analytics. Google Fonts. Javascript CDNs. Image CDNs. Imgix. CDNs in general. Akamai. Cloudflare. Any of the several ads platforms. Disqus, or any of the commenting platforms. Youtube. Lots of people embed their video content. AWS, Google Cloud, Azure. Every time you visit a page that has an embedded content from a remote host, that host knows you visited that page.
afrcnc 6y ago
Install one shady Android app and it will immediately dump your browsing history, rest assured.
- lostmsu 6y ago
  How exactly would it do it? Android permissions prohibit access to other app data, except shared storage.
  - afrcnc 6y ago
    1. LPE/rooting exploit 2. Win
gkoberger 6y ago
Hmm this is a bit of an interesting question. The original study (2012) exploited a security bug, which let anyone see which sites you had visited. (Basically, by checking the color of links with JS to see if :visited styling had been applied.) That bug doesn't exist anymore, and the new survey just uses opt-in data to "confirm" it. So, I don't actually think this research is particularly relevant anymore? It can't really be exploited (and when it can, there's much better ways to track the person).
throwaway2474 6y ago
How do you imagine the ISP/VPN gets your browsing history for https traffic beyond domain names?
- liability 6y ago
  > beyond domain names "..other than that, how was the play Mrs. Lincoln?"
liability 6y ago
Does Mozilla Pocket get browsing history if it isn't disabled? Last I heard it's not using E2E encryption and Mozilla still hasn't open sourced the server side of it.
- ta95846893 6y ago
  My understanding of pocket recommendations is that it gets a list of articles from a server every day and uses a local algorithm to match them to your browsing history so your history never leaves the device. Idk if any metadata about which decisions it made is leaked though. https://help.getpocket.com/article/1142-firefox-new-tab-recommendations-faq#personalized https://help.getpocket.com/article/1142-firefox-new-tab-reco...
  - liability 6y ago
    I'm under the impression that syncing browsing history between instances of Firefox is a feature Mozilla provides through Pocket, but admittedly I don't have first-hand knowledge of this.
    - ta95846893 6y ago
      I think syncing is done with a Firefox account (Firefox Sync) and i can't find implementation details, but I did find: "Firefox Accounts uses your password to encrypt your data (such as bookmarks and passwords) for extra security. When you forget your password and have to reset it, this data could be erased. To prevent this from happening, generate your recovery key before having to reset your password."[1] So it appears they may be encrypting data locally and syncing encrypted data without having keys. I think you are right though, there are more website saving features available through pocket other than recommendations and I'm not sure how any of that works. [1] https://support.mozilla.org/en-US/kb/reset-your-firefox-account-password-recovery-keys https://support.mozilla.org/en-US/kb/reset-your-firefox-acco...
MikusR 6y ago
Mozilla was sending your Firefox history to Cliqz (in Germany). And currently is sending it to Cloudflare (in US).
- tpxl 6y ago
  Got a source for that one?
taneq 6y ago
Anyone with a widely distributed analytics package or tracking beacon can track your hits on pages with that beacon. How many pages DON'T use Google Analytics or a Facebook 'like' button?
gpvos 6y ago
It's in the article. You can do some clever Javascript/CSS tricks to sniff the browser history. Browsers are not trying to block this.
- gpvos 6y ago
  *now trying to block this (oops)

jedisct1 6y ago

So can DNS queries.

option 6y ago

so are amazon/itunes/appstore/googleplay/netflix-views/etc

LatteLazy 6y ago

Here in the UK, date of birth and post code is enough to identify something like 95% of people. Anonymised data sets are not really possible once you have more than a few varriables. Most people don't know this.

MattGaiser 6y ago
Isn’t a postal code about 50-100 houses? It really narrows things down. That particular variable really reduces things.
- laurent123456 6y ago
  On average it's about 15 houses, so postcode + date of birth is indeed around 95% accurate.
  - deleted 6y ago
    [deleted]
- White_Wolf 6y ago
  50-100 houses is not that much. You can find someone in those 100 houses with 1 DOB and post code. Maybe in very crowded areas you'll need one more var. Worst case scenario you'll end up with 2-3 people.
- godelski 6y ago
  That's a bit insane. I looked up US numbers to check and got around 8k/zip code[0] [0] https://www.zip-codes.com/zip-code-statistics.asp https://www.zip-codes.com/zip-code-statistics.asp
  - patrickmcnamara 6y ago
    In Ireland, we use Eircode with one house per postcode. This is very handy because you don't need to type in your full address on a lot of websites, just the Eircode. The first three digits of an Eircode are more like a traditional postcode in that they indicate your area/town but the next four are randomised for each address.

Lordarminius 6y ago

Mine certainly i, since I tend to visit the same ten sites over and over again

Groxx 6y ago

I feel inclined to say "... well yeah, obviously". Not in the "obvious in retrospect" way, but because browsers have been progressively blocking history-sniffing tactics for years precisely because advertisers were using it to identify visitors. Did this research... establish better numbers around it or something?

godelski 6y ago
> Did this research... establish better numbers around it or something? >> However, this time around, since the data was collected from Firefox itself and not through a web page performing a time-lengthy CSS test, the data was much more accurate and reliable. Furthermore, the data Mozilla researchers collected is also about the same type of data that today's online analytics companies also collect about users — either through data partnerships, mobile apps, online ads, or other mechanisms.
- dralley 6y ago
  Needs to be specified that this was an opt-in study that you had to agree to.
  - godelski 6y ago
    Is no one in this thread going to read this article? Seriously, it isn't that long. RTFM >> The new experiment got underway between July 16 and August 13, 2019, when Mozilla prompted Firefox users to take part of this experiment. >> Mozilla researchers said that more than 52,000 users agreed to take part and agreed to provide anonymous browsing data.
    - ocdtrekkie 6y ago
      Clearly not actually anonymous browsing data in actuality though... which is why we should always take claims that telemetry data is anonymized with a grain of salt.
      - 6y ago

hkt 6y ago

Time for a browser plugin that will generate random noise - adding junk into history.

giantrobot 6y ago
Internet noise generator[0]. [0] https://makeinternetnoise.com/index.html https://makeinternetnoise.com/index.html
mulmen 6y ago
If it’s truly random wouldn’t that make you even easier to identify?
- airstrike 6y ago
  Not if everyone else uses it too
  - mulmen 6y ago
    Even if everyone else uses it. If your random pages are a, b and c but my pages are d, e and f or even a, b and d then it’s still easy to fingerprint us. Extensions like this might work if they visited the same sites all other users visit. Otherwise you’re just adding even more unique information for the trackers.
    - airstrike 6y ago
      But if both our random pages are a, b and c, and the only difference is when or how often I accessed each of those, then making it random for both of us will effectively turn us into the same person.
      - mulmen 6y ago
        What about all the other pages you visit? How does adding random traffic to your history make you any harder to identify? It just creates more datapoints.

ExcavateGrandMa 6y ago

I feel inclined to say "...well based on your own understanding of the space you occupying." It is extremely harsh to discover the numbers are what they are... :)

3np 6y ago

To this me and a friend started sketching on a VPN/HTTP proxy that will have a set of say 100 outgoing IPs, look at the domains being connected to and distribute request destinations over IPs. So e.g. Google would always see the same IP, which would be different from the one Facebook sees. While access times cross-references and identification is still theoretically possible, it should be an entirely different game. Would anyone else reading this be interested in working on this or joining in? I'm not thinking to make it a startup or business per se but 1) reliable IPs are a bit too expensive to make sense for just 1 person 2) anonymity in numbers. I'm thinking ideal would be something FOSS and easy to self-host and replicate so you can pool together a group of friends for a shared VPN among semi-trusted parties (at least the user should trust the operator to not index requests and sell the data, and the operator should trust users to not run botnets)

nemothekid 6y ago
I think an easier approach is that once you have good IPv6 connectivity you could do something like a unique address per day per host. Every device could have 100M ip addresses and it wouldn't touch the IPv6 address space (10 billion humans * 100 devices = 0.000005% of the IPv6 address space). Edit: My math is wrong. I thought IPv6 was 2^64, but it's actually 2^128, so that percentage is 10^20 times more miniscule.
- 3np 6y ago
  In that scenario those 100 IPv6 addresses in the subnet would be practically equivalent to an IPv4 address today and would provide no extra benefit.
  - croon 6y ago
    It would if hundreds of different users came through those IPs, wouldn't it?
- Fnoord 6y ago
  You get a range from your ISP (e.g. a /64). Everything within that range would be tied to "you" (rather, your connection, but something like user agent would tell its your wife's iPhone or your MacBook Pro).

wombatmobile 6y ago

If the study establishes that for all practical purposes, online anonymity is impossible to maintain for average users, what are the implications (a) for the average user; (b) for the economy; and (c) for society?

marta_morena_25 6y ago
(a) The average user neither doesn't know nor care about anonymity. If you are talking about "the average hackernews user", things might be different. Welcome to the 0.1%! (b) Lots and lots of money? (c) Not soo many annoying ads popping up, but rather ones that seem at least vaguely relevant? Will make me less angry and more sociable.

aaron695 6y ago

I think this is as stupid as it sounds from the paper - https://www.usenix.org/conference/soups2020/presentation/bird https://www.usenix.org/conference/soups2020/presentation/bir... Why not "Mozilla research: We asked users for their name and address and the ones telling the truth we could identify" TOR is fighting identifying users from the screen size of their window when maximised. Here's the original paper which is more about how you can access the browsers histories - https://www.petsymposium.org/2012/papers/hotpets12-4-johnny.pdf https://www.petsymposium.org/2012/papers/hotpets12-4-johnny.... Can you still access browsers histories? I'd have to guess no way without a zeroday. The original site is down. http://www.wtikay.com/ http://www.wtikay.com/ Firefox fixed it - https://bugzilla.mozilla.org/show_bug.cgi?id=147777 https://bugzilla.mozilla.org/show_bug.cgi?id=147777

vlovich123 6y ago

I suspect privacy would be better served by taking the approach of the security domain with responsible disclosure to vendors and a concerted effort to attack the problem holistically. Until then we’re just giving privacy attackers a heads up and by the time this issue is mitigated their onto the next avenue for bypassing privacy.

moonchild 6y ago

Wasn't it shown by aol researchers 20 years ago that search histories are uniquely identifying? If so, this seems hardly surprising, as browser history should be a superset of search history.

yalogin 6y ago

Intuitively there are tons of things we do on our computers that uniquely identify. I am sure the adware companies know a ton more and are not public too. The need for strict privacy preserving tech is needed across the whole stack.

axegon_ 6y ago

That's hardly surprising. I mean browsers hand out willingly plenty of information that could be used for pretty accurate identifications. Just scrolling through my scores on amiunique[1], many of the parameters put me in the 0.01% category. [1] https://amiunique.org/fp https://amiunique.org/fp

wnbc 6y ago
If you want to be less unique on amiunique.org/fp 1. Visit the site 2. Delete your browser cookies 3. Refresh 4. Repeat the steps until you're less unique
- curiousgal 6y ago
  Or you know, just block JS.
  - squiggleblaz 6y ago
    Congratulations, you just broke 90% of the modern web. Might as well go directly to Gopher.
    - throwaway_pdp09 6y ago
      Congratualations on never actually bothering to block JS and find out - you know, facts. From actually doing so over many years, and so from actual experience I'd say completely non-functinal sites are about 25%.
      - chrismorgan 6y ago
        I’d put the number quite a bit lower than that, probably comfortably under 10% of sites I interact with, though the trend is definitely upwards, drastically so among interactive things (which are probably worse than 50% broken these days).
    - Tarq0n 6y ago

amai 6y ago

As counterstrategy you can use tools like http://trackmenot.io/ http://trackmenot.io/ "TrackMeNot runs as a low-priority background process that periodically issues randomized search-queries to popular search engines, e.g., AOL, Yahoo!, Google, and Bing. It hides users' actual search trails in a cloud of 'ghost' queries, significantly increasing the difficulty of aggregating such data into accurate or identifying user profiles. "

throwaway_pdp09 6y ago
I use it as far as I can but it's stopped working in palemoon. The queries it produces aren't very intelligent when you see them and it wouldn't take much NSA/MI5 work to trim much of them out. I think TMN could be a fair bit smarter.

MaxBarraclough 6y ago

The Evercookie (hard-to-delete cookie-like system in JavaScript) and Panopticlick (browser fingerprinting) projects may also be of interest: https://en.wikipedia.org/wiki/Evercookie https://en.wikipedia.org/wiki/Evercookie https://panopticlick.eff.org/ https://panopticlick.eff.org/

dmos62 6y ago

By looking at all the data available to untrusted sites (as seen in https://amiunique.org/fp https://amiunique.org/fp) you can tell that Web is many many years away from being privacy conscious. List of fonts, canvas fingerprinting, timezone, OS, user agent... the list goes on and on. Those of us who are tech-literate know better than to create tech like this today, but there's just too much momentum (and shady interests) to hot-swap Web for something else.