17 ms·

Cover Your Tracks

694 points by cpeterso 6y ago

n0nc3 6y ago
Browser fingerprints are turning up in court cases now. Probably not wise of EFF to frame it as "covering your tracks". It's more like "closing your blinds". https://www.theregister.com/2019/07/17/exmicrosoft_engineer_arrested_fraud/ https://www.theregister.com/2019/07/17/exmicrosoft_engineer_... https://regmedia.co.uk/2019/07/17/us_v_kvashuk.pdf https://regmedia.co.uk/2019/07/17/us_v_kvashuk.pdf
- filmgirlcw 6y ago
  Just a hunch, but I bet that a legal advocacy group chooses the names for their programs pretty carefully.
  - deleted 6y ago
    [deleted]
  - ksm1717 6y ago
    I mean it was formerly called panopticlick
    - surround 6y ago
      I never understood what that name meant.
      - kibwen 6y ago
        It was based on "panopticon": https://en.wikipedia.org/wiki/Panopticon https://en.wikipedia.org/wiki/Panopticon "Although it is physically impossible for the single guard to observe all the inmates' cells at once, the fact that the inmates cannot know when they are being watched means that they are motivated to act as though they are being watched at all times."
        FillardMillmore 6y ago
        First read about the Panopticon in Foucault's "Discipline and Punish". It was designed by Jeremy Bentham, the mind behind utilitarianism - in fact, I believe it was only put into practice in one prison, which Fidel Castro and Raul Castro were imprisoned in before the Cuban revolution. All this is somewhat tangential to the discussion at hand, but still quite interesting. The parallels between the Internet/modern security state and the Panopticon design are obvious. https://en.wikipedia.org/wiki/Presidio_Modelo https://en.wikipedia.org/wiki/Presidio_Modelo
    - deadwing0 6y ago
      That name didn't mean anything to me, either.
  - saagarjha 6y ago
    “Closing your blinds” doesn’t have “track” in its name.
- totalZero 6y ago
  Considering that it's an anti-tracker tool, I think it's an appropriate and easily justifiable name.
  - colechristensen 6y ago
    It’s not about being justifiable, it’s about what a jury will think when the prosecutor parades a “cover your tracks” tool you used in front of them. Sometimes you just don’t want to have to try to win that argument.
    - totalZero 6y ago
      I'd be happy to make that argument. It's circumstantial evidence at best, and would be a waste of time in a criminal trial. "Move to strike that so-called "evidence," your honor. It is irrelevant and thus inadmissible, because "Cover Your Tracks" is the name of a website that tells users whether their computers appear unique to advertising companies. Not to mention that the EFF regularly files friend-of-the-court briefs with the Supreme Court and is a trustworthy nonprofit dedicated to keeping the internet safe and fair." Juries are made of regular people. The overwhelming majority of households in the USA have broadband internet. Regular people understand that advertisers track internet users in order to sell more ads. Also, scare-mongering and preying on someone's lack of familiarity with a website is only useful when there isn't someone else present to quickly explain it to them.
      - n0nc3 6y ago
        Take a look at the linked case. The prosecutor made a big deal of the fact that the defendant used a subversion server for version control. It was doubly evil because it was a subversion server in gasp Germany. https://www.vanityfair.com/news/2013/09/michael-lewis-goldman-sachs-programmer https://www.vanityfair.com/news/2013/09/michael-lewis-goldma...
godelski 6y ago
I often see this stuff and every result from every person I've seen is that fingerprints are unique. Even with DNT enabled, tools like uBlock, privacy badger (an EFF tool!), etc people are still unique. How does one actually become not unique? I'm on Apple hardware, so I can't imagine my hardware is unique (other than silicon lottery) and using Firefox. Testing in Safari shows "nearly unique" (1 bit difference than my FF results) so I gotta imagine that near is myself. How does one actually make themselves non-unique? And can we make things more transparent? How many bits is enough?
- suifbwish 6y ago
  Are you kidding? Apple has all but stripped away the ability to make a profit from Apple users as they all identify as the same advertising ID now if you use the safari browser. Facebook stock took a huge hit right after that update.
- z3t4 6y ago
  We cant do anything about our fingerprints. But we can make sure no one knows who the fingerprint belongs to.
- n0nc3 6y ago
  You make yourself non-unique by looking like others. In that sense your privacy is limited by the precautions that others take. Turning off javascript is a very good thing to do. The more people that do it, the stronger a protection it will be.
  - alquemist 6y ago
    What I want for Christmas is javascript disabled by default, plus one-click ability to enable for specific sites. Random browsing => no javascript. Play a browser game => javascript. I have this today with Flash, would be nice to have it for all client-side code execution.
    - stickfigure 6y ago
      I use a Chrome extension called "Quick Javascript Switcher". If you click the icon in the bar, it switches JS off/on for the domain - using Chrome's built-in allow/block list for JS. I honestly could not live without it. At this point I have pretty much every news and recipe site on the internet blocked. Visiting a new site, as soon as I hear my fan spinning up I reach for the "no-JS" button and the page suddenly becomes responsive again. I'm not quite to the "no JS as default" level but I'm close.
nextos 6y ago
The question is how to protect against fingerprinting? Protecting yourself against some scripts is easy and convenient with uBlock Origin. Tracking by URLs can be handled by ClearURLs. Cookies are easy to address with containers, ideally temporary ones with per domain isolation. IP tracking can be addressed partially using a VPN or Tor. But fingerprinting is hard. Some Tor browser configurations go as far as fixing the window size. Things like timezone, user agent or available fonts leak a lot of unique information. Any simple setup that doesn't have too many caveats?
- eeZah7Ux 6y ago
  Tor browser does that.
  - gruez 6y ago
    Firefox with resistfingerprinting also works.
    - SubzeroCarnage 6y ago
      https://github.com/arkenfox/user.js https://github.com/arkenfox/user.js is militantly maintained. It documents and make it easy to use many of the features upstreamed into Firefox by the Tor Project.
    - t0astbread 6y ago
      Currently trying out resistFingerprinting and I really don't like that it resets my zoom level on every new tab. I understand that there might be scenarios where not doing so would pose a risk (e.g. when a site opens another site in a new tab and they exchange their observed zoom level behind the scenes) but I'm okay with that. Most of the time I'd zoom back in anyways, so is there a way to disable that specific feature of RFP?
  - tbiteteitb 6y ago
    I love tor-browser project, what I don't like it's the hostile web you uncover with it. Browsing with tor-browser has become a CAPTCHA minefield. Everything, everywhere there's a "human" captcha waiting for You. Sometimes I have to do the challenges 3 or more times. There's opportunities that even after a 4th attempt it just doesn't work.
systemvoltage 6y ago
I am of the belief, rather an insidious belief that not only do we need to block AdTech and other awful face-recog technologies, etc.; but to actively spread and feed it with fake data in order to completely confuse the algos, rendering them useless.
- DarthGhandi 6y ago
  The EFF considers data pollution to be fairly useless. They've spoken a bit about it.
- n0nc3 6y ago
  The practices should be banned. It's a federal felony to wiretap or open someone else's mail. In almost all states, it's a crime to record conversations without consent from at least one party. Earlier generations passed those laws because they viewed mass surveillance as a fundamentally Soviet activity with no place in a free society. According to some footnotes in Shoshana Zuboff's book, the FTC was on the path to ban these practices in 2001 but then 9/11 happened.
  - Sephr 6y ago
    You're not being "wiretapped" if the site you visit explicitly included tracking. As an analogy, the sites that you visit are already providing one-party consent (all that is needed with current federal wiretapping laws) by including said intentional tracking. In the case where non-essential sites are required to disclose what they track to the user, the user is arguably also providing consent on their end even if it's mandatory. Nobody is forcing you to visit non-essential sites.
    - n0nc3 6y ago
      If you told an American in 1995 that AT&T was selling their call records, or that Visa was selling their transaction records, they would have gone ballistic. The fact that all this tracking is still hush-hush means that most people would not react kindly if they were aware of the true scope of the tracking, and how widely distributed the data is.
keyle 6y ago
It's great, I got told I got browser fingerprinting, showed me how it does it, but not really how to prevent it... Which is kind of the point I did the test for.
Xxgunnardxx 6y ago
My pandemic project is https://www.dontwatchme.com https://www.dontwatchme.com trying to make a site that I would want to go to for privacy information.
- gtsop 6y ago
  This website is an ad minefield. Avoid
  - krzrak 6y ago
    ...and typo minefield ;)
diebeforei485 6y ago
Other than timezone and iOS version, how am I different from other users of my model of phone (eg. are all iPhone X users the same?)
- samename 6y ago
  Fellow iPhone X user here. Unfortunately, it seems because of the User Agent and hash of WebGL Fingerprint, our phones have unique fingerprints: > Within our dataset of several hundred thousand visitors tested in the past 45 days, only one in 71131.0 browsers have the same fingerprint as yours. > Currently, we estimate that your browser has a fingerprint that conveys 16.12 bits of identifying information.
  - diebeforei485 6y ago
    User Agent is the same for everyone on your iOS version, correct? I don't fully understand the WebGL fingerprinting stuff- why is it different on the same device model?
ketamine__ 6y ago
> We have also worked with browser vendors such as Brave to provide more accurate results for browsers that are employing novel anti-fingerprinting techniques. Brave is a force for good.
- surround 6y ago
  I’m afraid their fingerprint randomizing methods may be doing more harm then good. https://github.com/arkenfox/user.js/wiki/4.1-Extensions#small_orange_diamond-%EF%B8%8F-anti-fingerprinting-extensions-fk-no https://github.com/arkenfox/user.js/wiki/4.1-Extensions#smal...
  - antonok 6y ago
    There's one important distinction from that link: > remember: very, very, very few users use anti-fingerprinting measures At this point, Brave has 20-million-something monthly users, all of whom have fingerprint randomization enabled by default. Randomization definitely makes an individual stand out if nobody else is doing it, but it makes it almost impossible to distinguish from others using the same technique.
- saagarjha 6y ago
  This sounds like “our results looked bad for Brave so we changed them”…
Wowfunhappy 6y ago
I've been thinking for a while—what if the solution to fingerprinting wasn't making your browser less unique, but less constant? Take Canvas fingerprints. If you added a bit of randomness to how the browser renders pixels, the fingerprint would change each time you measured it. It would still be unique, but it would be a useless tracking tool. Presumably I'm not the first person to come up with this, is there a reason it isn't done?
- antonok 6y ago
  This is actually exactly what Brave does! Both for Canvas and WebAudio, which is also used for fingerprinting in a similar way. There's more info here if you're curious: https://brave.com/privacy-updates-4/ https://brave.com/privacy-updates-4/
  - igravious 6y ago
    But won't trackers start ignoring these cues? Here is Brave's take: https://brave.com/brave-fingerprinting-and-privacy-budgets/ https://brave.com/brave-fingerprinting-and-privacy-budgets/
- gtsop 6y ago
  This deserves to be heard. I will also add to this, since it is known we can use addons to disable tracking and fingerprinting but addons can themselves be used for fingerprinting, why don't we get a feature on firefox (or even one more addon) to prevent javascript from getting a true result when querying for known addons?
- kdrag0n 6y ago
  Bromite for Android does that: https://github.com/bromite/bromite/blob/73ef7f3ea1937f5ba8ebad2ca6b8cc345cfaa060/build/patches/Multiple-fingerprinting-mitigations.patch https://github.com/bromite/bromite/blob/73ef7f3ea1937f5ba8eb...
- surround 6y ago
  Randomizing fingerprints is generally a bad idea. See: https://github.com/arkenfox/user.js/wiki/4.1-Extensions#small_orange_diamond-%EF%B8%8F-anti-fingerprinting-extensions-fk-no https://github.com/arkenfox/user.js/wiki/4.1-Extensions#smal...
fnord77 6y ago
whelp, a quick check on my macbook - latest versions of everything. chrome w/ privacy badger: unique fingerprint firefox w/ privacy badger: unique fingerprint safari 14: nearly unique something like DNT actually make your score worse
- eindiran 6y ago
  Since virtually no one honors DNT, and its usually not set by default, choosing to set it is giving up a free bit. Instead try to do whatever the default behavior of your browser is.
ohazi 6y ago
What the fresh hell is this? > Our tests indicate that you have you have strong protection against Web tracking, though your software isn’t checking for Do Not Track policies. > Unblocking 3rd parties that honor Do Not Track? ..... No [marked in red, as if this were a bad thing] Are they suggesting that I unblock trackers when the provider posts a text file pinky swearing that they honor a do-not-track policy? This smells like another "acceptable ads" program.
- snazz 6y ago
  That's basically what DNT was supposed to be—browsers said "do not track me" and "legitimate" trackers respected it. I agree that it's dumb. Ironically, DNT is now just one more bit that makes fingerprinting your browser easier.
  - dudus 6y ago
    DNT was supposed to be that until Microsft decided to make it on by default pretending it to be a big privacy move on their part. Because it was no longer a user choice advertisers decided it was no longer reasonable to honor it. So they just ignore it most of the time. And thus DNT became completely obsolete.
    - saagarjha 6y ago
      > Because it was no longer a user choice advertisers decided it was no longer reasonable to honor it. More like it gave advertisers an excuse to get that tracking data they had been salivating over.
      - renewiltord 6y ago
        To be honest, users don't really care if you honour DNT. So it's best to just ignore that part of the spec.
- surround 6y ago
  I like the uBlock Origin philosophy: > DNT is essentially acknowledging that a 3rd-party is the one in control of your privacy in the 1st place, and you have to resort to asking this 3rd-party -- which has financial (or whatever) interests in tracking you -- to not track/data mine you, and trusting that they respect your wish, with no way for you to find out whether your request is respected. In short, it's BS, and supporting tracking/data mining is agreeing that tracking/data mining is the natural, expected behavior and thus an opt-out "feature". > Nobody should ever agree to this. > I see it differently: tracking is opt-in, and the ideal is that users are in full control of their privacy by default. Those who want to track/data mine you should ask you to opt-in, along with all the detailed information of how the data collated from you will be used and monetized (lists all entities to which your data is sold), in the spirit of informed consent. > Currently the way for users to enforce their privacy choice is to use all the tools at their disposal to prevent their data from ending up in the hands of the trackers/data miners, and DNT is not one of these tools. https://github.com/gorhill/uBlock/issues/827#issuecomment-153749923 https://github.com/gorhill/uBlock/issues/827#issuecomment-15...
surround 6y ago
> “Add-ons and browsers that randomize the results of fingerprinting metrics have the potential to confuse trackers and mitigate the effects of fingerprinting as a method of tracking.” I would like to dispute this. It is easy to detect when a user is spoofing certain settings. As such, randomizing fingerprint data increases entropy, making your browser more unique, not less. There is a reason why the Tor browser works so hard to make sure every user has the same fingerprint, rather than randomizing it. More on that here: https://github.com/arkenfox/user.js/wiki/4.1-Extensions#small_orange_diamond-%EF%B8%8F-anti-fingerprinting-extensions-fk-no https://github.com/arkenfox/user.js/wiki/4.1-Extensions#smal...
- ACow_Adonis 6y ago
  The key here is randomising them over time. If you browse website A and website B, with different randomised qualities at different times, and your non-randomised data isn't enough to sufficiently identify you, then although A and B might be able to identify that you're spoofing certain settings, they can't identify that you're the same entity browsing both websites. If you just set things to a weird or unlikely value, then you're as identifiable as a man who walks down the street in a mascot uniform that he never takes off. That is to say, although they don't know the 'person' behind the mask, all you need to look for is the dingus wearing the capital city goofball costume. Indeed, it makes you stand out more...
  - jobigoud 6y ago
    If not a lot of people do it the bit of information "this browser is spoofing certain settings" is also a very telling thing and combined with the non-randomized data may tip the balance towards uniqueness.
- renewiltord 6y ago
  But uniqueness is valuable only if you have identity. If you can't tell that dude A is also dude B then you just have a million dudes and you can't violate anyone's privacy.
- minitech 6y ago
lvs 6y ago
Any extensions that block probes for system fonts? That seems to be the most identifying piece of information.
- surround 6y ago
  Try disabling JavaScript. uBlock origin lets you do this on a per-site basis.
kayson 6y ago
Could fingerprinting be easily avoided by randomizing all of these parameters? Sure, you'd still have a unique fingerprint, but if every time you load a page you have a completely different unique fingerprint, wouldn't that solve the problem?
- ACow_Adonis 6y ago
  It 'solves' the problem in the theoretical sense, but in a practical sense websites may still require information from the browser for actual justified purposes. Think identifying the browser, OS, resolution and window size (non-exhaustive list and I'm a data-linking person but not a web person, so I'm just making them up). Indeed as long as browsers need to send actual information for successful implementation of whatever it is the website is doing, the potential for fingerprinting still exists. And as long as there are sufficiently non-random properties of the computer for the theoretical attacker to poll (via whatever mechanism they can), then fingerprinting will be a viable mechanism. Although as EFF points out, if MOST of the identifier obtainers require Javascript or connections to certain URLs to work, it might be that blocking javascript and URL blockers might be sufficient to stop most of them in practice? Edit: of course, every time I say theory and practice here we run into problems of how much people are willing to do or put up with in practice...
- minitech 6y ago
  Yes, as long as enough people randomize them along with you.
  - Threeve303 6y ago
    Put a browser inside a read only virtual machine and have everyone agree to use it. All temp folders can be mapped to RAM. Have the VM use a random VPN each time and never login to anything. Nearly everyone would have the same fingerprints even down to the browser resolution, root CA lists, installed fonts, etc. The only real difference being the sites you visit.
ping_pong 6y ago
I wonder why they claim that I'm uniquely identifiable. I'm using default settings for my Macbook, no additional extensions, and the latest update of Chrome. I would think that is relatively common, no?
- ramphastidae 6y ago
  Screen resolution * fonts * extensions * geography is usually enough.
  - saagarjha 6y ago
    Three of those are controlled in the scenario presented, and the last gives 4-5 bits of entropy. Not convincing.
- _jal 6y ago
  Lots of things effect the fingerprint. Install any non-stock fonts, possibly by installing an application?
- t0astbread 6y ago
  Well, I don't know what your result says of course but I suspect the default settings in browsers aren't strict enough to avoid "conventional" tracking and that's how you were identified.
- jacobwilliamroy 6y ago
  Nowadays you want to run a VM with a randomized mac and route all your traffic through something special like a pfsense box.
- minitech 6y ago
  Scroll down to the detailed results to find out!
deleted 6y ago
[deleted]
renewiltord 6y ago
Very interesting. Dual language Accept headers will completely wreck your anonymity.
- unhammer 6y ago
  One in x browsers have this value:290162.0 for me – that one alone is probably enough to make me unique. I got the exact same number for system fonts. I guess it's near-impossible to get the features of accept-language without fingerprinting you :-/ but why does js need to know what fonts I have?
walrus01 6y ago
I think this is a really bad name for a browser extension. Non technical users will install it and think it provides them with real anonymity on the Internet or something.
- audiometry 6y ago
  I agree. And it didn't even seem to be aware I was already running Privacy Badger. And inside Privacy Badger I saw no obvious options to decrease my browser footprint. Sort of lame.
- miked85 6y ago
  It isn't a browser extension.
foolinaround 6y ago
i recently switched to the Brave browser which comes with good defaults.
- TedDoesntTalk 6y ago
  Same. But on HR, many people conflate Brave’s built-in privacy with Brave’s ridiculous crypto thing. And so Brave is pooped on, laughed at, or at best ignored by many here. To me they are completely separate and although Brave has had privacy missteps, all browser vendors have. I believe in the leadership (Brendan Eich, creator of JavaScript) more than the leadership of any other browser vendor. I believe Brendan eats his own dog food.
- IceWreck 6y ago
  I refuse to use them until they remove all the crypto BS. Anything extra that Brave does can also be done using chrome or firefox extensions
  - totalZero 6y ago
    You can hide all of that.
- 66fm472tjy7 6y ago
  I tried out Brave a few years ago and soon noticed it did not completely clear history on close when configured to do so. While the history was not shown in the UI, you could see it was retained because URLs visited in previous sessions were shown in :visited style (links were purple instead of blue with default CSS. Note that this can also be queried via JS and thus allows sites to extract your browsing history). I reported the issue at the time but they said the won't fix it since they were moving away from brave-laptop. They still had issues[1] clearing forms of local storage year later. They are not taking privacy seriously. They also took crypto from users under the false pretense of taking payment on behalf of content creators[2]. [1] https://github.com/brave/brave-browser/issues/9929 https://github.com/brave/brave-browser/issues/9929 [2] https://en.wikipedia.org/w/index.php?title=Brave_(web_browser)&oldid=989628749#Brave_browser_collecting_donations_on_behalf_of_content_creators https://en.wikipedia.org/w/index.php?title=Brave_(web_browse...
Semaphor 6y ago
> Ad Blocker Used > False I wonder how they test that? I guess uBlock Origin or uMatrix block their detection.
fuzxi 6y ago
My screen resolution isn't shown accurately on this tool. It returns 1920x1080x32, but my actual window resolution is something like 1880x1020x32 (I use swaywm and leave gaps around windows for a border). If I resize the window to 300x700, the tool returns 1440x900x32. If I disable all my extensions and Firefox's enhanced tracking protection, it always returns 1920x1080x32. I'm using swaywm, so maybe this is an (unintentional?) feature of wayland.
- starky 6y ago
  I doubt it is your WM since my Windows 10 computer also displays 1920x1080x32 when the resolution should be 3840x2160x32
  - fuzxi 6y ago
    Interesting. Are you using firefox as well?
    - starky 6y ago
      Nope, Vivaldi.
kart23 6y ago
My graphics card really destroys my fingerprint. Why are browsers even showing websites the exact model of GPU that's running?
maCDzP 6y ago
I read comments about solving this problem by randomising the fingerprint. Is it possible to randomise the hardware by creating a sort of "ramdom VM-container" that runs the actual browser binary? It would randomises the VM so sometimes it's Linux and sometimes it's Windows.
kebman 6y ago
Meanwhile as money is becoming 100% digitized and reliant on banks, the ability to hide your tracks online is moot.
- samoa42 6y ago
  did you notice the unique alphanumeric id on every piece of paper money? the banks registers it and turns out the vast majority of money does only "one cycle" ie. from the bank to a (known) consumer/customer, to a shop/cashier and then back to the bank. so "they" already know were you spent it.
  - jobigoud 6y ago
    How can they really know it does just one cycle since any possible intermediate step doesn't store/track the number?
    - samoa42 6y ago
      right. they dont know for sure. but statistics give a reasonable good picture given the fact that the input/output points of the banking system are known.
  - kebman 6y ago
    That is not entirely true. They can only track end-points with that system, meaning those places where the note ID is inspected. Moreover it's usually only done by one bank; the central bank. In any case that is certainly not a great argument for giving away more of your freedom. Granted more and more shops now have machines that count all bills and change automatically and per transaction, under the guise of convenience and increased security towards theft or robbery. In the mean time, the notes may have travelled from hand-to-hand in a long chain that is completely shrouded in a dark—if not entirely black—economy that neither the bank nor the state can ever hope to fully track. That all changes with the advent of a fully digital system, especially if all transactions are sanctioned to be within that system by force of law. Which is exactly what the banks are pushing for, with various scares such as claims of the danger of money laundering, corruption, and so on. What they systematically fail to add, however, is how they themselves gain the ability to track full markets, and make sure-fire investments based upon surplus data gleanded from aggregating private purchases and trades, thus ensuring their full control over said market. Meanwhile they can use that same power to effectively shut down all opposition—and anyone who protests their actions—simply by finding a reason to freeze their accounts, just like they did to Julian Assange.[1] Thereby they get the power to effectively keep individuals they dislike from accessing the entire economy, unless perhaps they own some diamonds or a valuable goat... This has in turn given precedence to other financial institutions to shut down accounts or memberships based upon political affilations, such as is the case with Patreon, or because they somehow are construed to be in a competing position. As an example, a Norwegian crypto trader has effectively been barred by all the banks in Norway to get a business account.[2] The reasons given were vague claims that his completely legal business somehow supported nefarious and evil individuals who all wish to undertake in money laundering, without offering any solid evidence for it. However the banks all failed to mention that his business can in many ways be seen as being in direct competition with their own business model, namely that of manual and middle-man-laden banking. In any case, for all intents and purposes, Bitcoin transactions are far easier to track than bank notes. [1]: https://www.forbes.com/sites/andygreenberg/2010/12/07/visa-mastercard-move-to-choke-wikileaks/ https://www.forbes.com/sites/andygreenberg/2010/12/07/visa-m... [2]: Norwegian language article: https://e24.no/naeringsliv/i/oRgdW0/dn-bitcoin-toppen-tapte-i-retten-mot-nordea https://e24.no/naeringsliv/i/oRgdW0/dn-bitcoin-toppen-tapte-...
tsimionescu 6y ago
I never understand why browsers expose APIs to read the state of a canvas and WebGL results, or color depth of the screen. How often are they used for anything other than fingerprinting? Note: at least for my profile, those are the only things that truly seem to give significant data. Everything else is in the 1 in 2-300 range, just by using FF on Android with uBlock.
- tiborsaas 6y ago
  > I never understand why browsers expose APIs to read the state of a canvas and WebGL results That's the basis of any image manipulation. A write only canvas is not useful at all.
  - tsimionescu 6y ago
    Ok, so that's one use case. How many webapps are doing image manipulation (not to mention plain sites)? There should really be a prompt whenever a site tries to access this information, especially in privacy-conscious browsers (I wouldn't expect Chrome to want such an anti-feature for their customers, the ad companies).
    - tiborsaas 6y ago
      I used more than I can recall. The browser is a creative tool and being able to use all the creative features is great actually. Just editing your profile picture is a good idea to do on the client side, why waste CPU on your server for example? I do photo editing a lot in the browser. This is a feature that benefits everybody and the fact that it can be abused is unfortunate, but not as tragic as you paint it.
      - tsimionescu 6y ago
        Photo editing could be designed in such a way that the JS code does not actually get read access to the canvas - it just specifies transformations. It's becoming very clear I think that having this level of control for web apps is more detrimental than it is a positive. Leave rich apps to the OS, and keep the web as untrackable as possible.
jepper 6y ago
With uMatrix in "unless withlisted no js configuration" the test does not run. The noJS fallback does not progress. Probably means a pass :) Unique fingerprint is really interesting upon enabling first party js. Fonts and gpu give lots of unique information. Dont get the message to unblock ad providers that follow DNT. This trust is too easily betrayed.
szundi 6y ago
Genius
dcassett 6y ago
Using an old iPad with Safari, it endlessly spins on "testing your browser"
unnouinceput 6y ago
I've tested my Firefox. They said I don't have an Ad Blocker. Since I use uBlock Origin it means either my ad blocker is quite smart or their technology is poor which casts a shadow over this tool entirely. My 2 cents
defanor 6y ago
That's odd: the test claims that my user agent is Go-http-client/1.1, and that there's gzip in HTTP_ACCEPT, after I've followed the redirect trail manually (with s_client(1)), only providing a GET request line and a host.
sloshnmosh 6y ago
It’s next to impossible to stop a website from fingerprinting your browser and/or device. I found a heavily obfuscated script on the webpage of my cellphone data provider which I initially thought was a credit-card skimmer. After several rounds of de-obfuscation and beautification it turned out to be some really intensive tracking and fingerprinting script from Akamai. It used every single fingerprinting technique imaginable from pixels, cookies, webgl, webrtc, flash, vector drawings etc etc.
- 1996 6y ago
  Please share for 1) study and 2) counter measure implementation!
  - decko 6y ago
    It might their bot manager product
blindm 6y ago
I see a few people asking how you blend in among the crowd. My strategy is to use a common device like an iPhone 5 using the Safari browser, and for the connection I use a 4G connection that I seem to be sharing with loads of other subscribers. Apple's Advertising Identifier[0] AFAIK is not passed into Safari, as that only applies to other apps and not browsers like Safari. The only thing that could make me stand out is if I deviate from this basic setup and use different browsers on weird connections like a VPN (Yes - a VPN can make you stand out). Also: upgrading my phone to the latest model is probably an uncommon practice and used as another heuristic to track you, & I've heard many people like to stick to a certain phone model until it starts acting up. [0] https://developer.apple.com/documentation/adsupport/asidentifiermanager/1614151-advertisingidentifier https://developer.apple.com/documentation/adsupport/asidenti...

694 points by cpeterso 6y ago

Browser fingerprints are turning up in court cases now. Probably not wise of EFF to frame it as "covering your tracks". It's more like "closing your blinds". https://www.theregister.com/2019/07/17/exmicrosoft_engineer_arrested_fraud/ https://www.theregister.com/2019/07/17/exmicrosoft_engineer_... https://regmedia.co.uk/2019/07/17/us_v_kvashuk.pdf https://regmedia.co.uk/2019/07/17/us_v_kvashuk.pdf

filmgirlcw 6y ago
Just a hunch, but I bet that a legal advocacy group chooses the names for their programs pretty carefully.
- deleted 6y ago
  [deleted]
- ksm1717 6y ago
  I mean it was formerly called panopticlick
  - surround 6y ago
    I never understood what that name meant.
    - kibwen 6y ago
      It was based on "panopticon": https://en.wikipedia.org/wiki/Panopticon https://en.wikipedia.org/wiki/Panopticon "Although it is physically impossible for the single guard to observe all the inmates' cells at once, the fact that the inmates cannot know when they are being watched means that they are motivated to act as though they are being watched at all times."
      - FillardMillmore 6y ago
        First read about the Panopticon in Foucault's "Discipline and Punish". It was designed by Jeremy Bentham, the mind behind utilitarianism - in fact, I believe it was only put into practice in one prison, which Fidel Castro and Raul Castro were imprisoned in before the Cuban revolution. All this is somewhat tangential to the discussion at hand, but still quite interesting. The parallels between the Internet/modern security state and the Panopticon design are obvious. https://en.wikipedia.org/wiki/Presidio_Modelo https://en.wikipedia.org/wiki/Presidio_Modelo
  - deadwing0 6y ago
    That name didn't mean anything to me, either.
- saagarjha 6y ago
  “Closing your blinds” doesn’t have “track” in its name.
totalZero 6y ago
Considering that it's an anti-tracker tool, I think it's an appropriate and easily justifiable name.
- colechristensen 6y ago
  It’s not about being justifiable, it’s about what a jury will think when the prosecutor parades a “cover your tracks” tool you used in front of them. Sometimes you just don’t want to have to try to win that argument.
  - totalZero 6y ago
    I'd be happy to make that argument. It's circumstantial evidence at best, and would be a waste of time in a criminal trial. "Move to strike that so-called "evidence," your honor. It is irrelevant and thus inadmissible, because "Cover Your Tracks" is the name of a website that tells users whether their computers appear unique to advertising companies. Not to mention that the EFF regularly files friend-of-the-court briefs with the Supreme Court and is a trustworthy nonprofit dedicated to keeping the internet safe and fair." Juries are made of regular people. The overwhelming majority of households in the USA have broadband internet. Regular people understand that advertisers track internet users in order to sell more ads. Also, scare-mongering and preying on someone's lack of familiarity with a website is only useful when there isn't someone else present to quickly explain it to them.
    - n0nc3 6y ago
      Take a look at the linked case. The prosecutor made a big deal of the fact that the defendant used a subversion server for version control. It was doubly evil because it was a subversion server in gasp Germany. https://www.vanityfair.com/news/2013/09/michael-lewis-goldman-sachs-programmer https://www.vanityfair.com/news/2013/09/michael-lewis-goldma...

godelski 6y ago

I often see this stuff and every result from every person I've seen is that fingerprints are unique. Even with DNT enabled, tools like uBlock, privacy badger (an EFF tool!), etc people are still unique. How does one actually become not unique? I'm on Apple hardware, so I can't imagine my hardware is unique (other than silicon lottery) and using Firefox. Testing in Safari shows "nearly unique" (1 bit difference than my FF results) so I gotta imagine that near is myself. How does one actually make themselves non-unique? And can we make things more transparent? How many bits is enough?

suifbwish 6y ago
Are you kidding? Apple has all but stripped away the ability to make a profit from Apple users as they all identify as the same advertising ID now if you use the safari browser. Facebook stock took a huge hit right after that update.
z3t4 6y ago
We cant do anything about our fingerprints. But we can make sure no one knows who the fingerprint belongs to.
n0nc3 6y ago
You make yourself non-unique by looking like others. In that sense your privacy is limited by the precautions that others take. Turning off javascript is a very good thing to do. The more people that do it, the stronger a protection it will be.
- alquemist 6y ago
  What I want for Christmas is javascript disabled by default, plus one-click ability to enable for specific sites. Random browsing => no javascript. Play a browser game => javascript. I have this today with Flash, would be nice to have it for all client-side code execution.
  - stickfigure 6y ago
    I use a Chrome extension called "Quick Javascript Switcher". If you click the icon in the bar, it switches JS off/on for the domain - using Chrome's built-in allow/block list for JS. I honestly could not live without it. At this point I have pretty much every news and recipe site on the internet blocked. Visiting a new site, as soon as I hear my fan spinning up I reach for the "no-JS" button and the page suddenly becomes responsive again. I'm not quite to the "no JS as default" level but I'm close.

nextos 6y ago

The question is how to protect against fingerprinting? Protecting yourself against some scripts is easy and convenient with uBlock Origin. Tracking by URLs can be handled by ClearURLs. Cookies are easy to address with containers, ideally temporary ones with per domain isolation. IP tracking can be addressed partially using a VPN or Tor. But fingerprinting is hard. Some Tor browser configurations go as far as fixing the window size. Things like timezone, user agent or available fonts leak a lot of unique information. Any simple setup that doesn't have too many caveats?

eeZah7Ux 6y ago
Tor browser does that.
- gruez 6y ago
  Firefox with resistfingerprinting also works.
  - SubzeroCarnage 6y ago
    https://github.com/arkenfox/user.js https://github.com/arkenfox/user.js is militantly maintained. It documents and make it easy to use many of the features upstreamed into Firefox by the Tor Project.
  - t0astbread 6y ago
    Currently trying out resistFingerprinting and I really don't like that it resets my zoom level on every new tab. I understand that there might be scenarios where not doing so would pose a risk (e.g. when a site opens another site in a new tab and they exchange their observed zoom level behind the scenes) but I'm okay with that. Most of the time I'd zoom back in anyways, so is there a way to disable that specific feature of RFP?
- tbiteteitb 6y ago
  I love tor-browser project, what I don't like it's the hostile web you uncover with it. Browsing with tor-browser has become a CAPTCHA minefield. Everything, everywhere there's a "human" captcha waiting for You. Sometimes I have to do the challenges 3 or more times. There's opportunities that even after a 4th attempt it just doesn't work.

systemvoltage 6y ago

I am of the belief, rather an insidious belief that not only do we need to block AdTech and other awful face-recog technologies, etc.; but to actively spread and feed it with fake data in order to completely confuse the algos, rendering them useless.

DarthGhandi 6y ago
The EFF considers data pollution to be fairly useless. They've spoken a bit about it.
n0nc3 6y ago
The practices should be banned. It's a federal felony to wiretap or open someone else's mail. In almost all states, it's a crime to record conversations without consent from at least one party. Earlier generations passed those laws because they viewed mass surveillance as a fundamentally Soviet activity with no place in a free society. According to some footnotes in Shoshana Zuboff's book, the FTC was on the path to ban these practices in 2001 but then 9/11 happened.
- Sephr 6y ago
  You're not being "wiretapped" if the site you visit explicitly included tracking. As an analogy, the sites that you visit are already providing one-party consent (all that is needed with current federal wiretapping laws) by including said intentional tracking. In the case where non-essential sites are required to disclose what they track to the user, the user is arguably also providing consent on their end even if it's mandatory. Nobody is forcing you to visit non-essential sites.
  - n0nc3 6y ago
    If you told an American in 1995 that AT&T was selling their call records, or that Visa was selling their transaction records, they would have gone ballistic. The fact that all this tracking is still hush-hush means that most people would not react kindly if they were aware of the true scope of the tracking, and how widely distributed the data is.

keyle 6y ago

It's great, I got told I got browser fingerprinting, showed me how it does it, but not really how to prevent it... Which is kind of the point I did the test for.

Xxgunnardxx 6y ago

My pandemic project is https://www.dontwatchme.com https://www.dontwatchme.com trying to make a site that I would want to go to for privacy information.

gtsop 6y ago
This website is an ad minefield. Avoid
- krzrak 6y ago
  ...and typo minefield ;)

diebeforei485 6y ago

Other than timezone and iOS version, how am I different from other users of my model of phone (eg. are all iPhone X users the same?)

samename 6y ago
Fellow iPhone X user here. Unfortunately, it seems because of the User Agent and hash of WebGL Fingerprint, our phones have unique fingerprints: > Within our dataset of several hundred thousand visitors tested in the past 45 days, only one in 71131.0 browsers have the same fingerprint as yours. > Currently, we estimate that your browser has a fingerprint that conveys 16.12 bits of identifying information.
- diebeforei485 6y ago
  User Agent is the same for everyone on your iOS version, correct? I don't fully understand the WebGL fingerprinting stuff- why is it different on the same device model?

ketamine__ 6y ago

> We have also worked with browser vendors such as Brave to provide more accurate results for browsers that are employing novel anti-fingerprinting techniques. Brave is a force for good.

surround 6y ago
I’m afraid their fingerprint randomizing methods may be doing more harm then good. https://github.com/arkenfox/user.js/wiki/4.1-Extensions#small_orange_diamond-%EF%B8%8F-anti-fingerprinting-extensions-fk-no https://github.com/arkenfox/user.js/wiki/4.1-Extensions#smal...
- antonok 6y ago
  There's one important distinction from that link: > remember: very, very, very few users use anti-fingerprinting measures At this point, Brave has 20-million-something monthly users, all of whom have fingerprint randomization enabled by default. Randomization definitely makes an individual stand out if nobody else is doing it, but it makes it almost impossible to distinguish from others using the same technique.
saagarjha 6y ago
This sounds like “our results looked bad for Brave so we changed them”…

Wowfunhappy 6y ago

I've been thinking for a while—what if the solution to fingerprinting wasn't making your browser less unique, but less constant? Take Canvas fingerprints. If you added a bit of randomness to how the browser renders pixels, the fingerprint would change each time you measured it. It would still be unique, but it would be a useless tracking tool. Presumably I'm not the first person to come up with this, is there a reason it isn't done?

antonok 6y ago
This is actually exactly what Brave does! Both for Canvas and WebAudio, which is also used for fingerprinting in a similar way. There's more info here if you're curious: https://brave.com/privacy-updates-4/ https://brave.com/privacy-updates-4/
- igravious 6y ago
  But won't trackers start ignoring these cues? Here is Brave's take: https://brave.com/brave-fingerprinting-and-privacy-budgets/ https://brave.com/brave-fingerprinting-and-privacy-budgets/
gtsop 6y ago
This deserves to be heard. I will also add to this, since it is known we can use addons to disable tracking and fingerprinting but addons can themselves be used for fingerprinting, why don't we get a feature on firefox (or even one more addon) to prevent javascript from getting a true result when querying for known addons?
kdrag0n 6y ago
Bromite for Android does that: https://github.com/bromite/bromite/blob/73ef7f3ea1937f5ba8ebad2ca6b8cc345cfaa060/build/patches/Multiple-fingerprinting-mitigations.patch https://github.com/bromite/bromite/blob/73ef7f3ea1937f5ba8eb...
surround 6y ago
Randomizing fingerprints is generally a bad idea. See: https://github.com/arkenfox/user.js/wiki/4.1-Extensions#small_orange_diamond-%EF%B8%8F-anti-fingerprinting-extensions-fk-no https://github.com/arkenfox/user.js/wiki/4.1-Extensions#smal...

fnord77 6y ago

whelp, a quick check on my macbook - latest versions of everything. chrome w/ privacy badger: unique fingerprint firefox w/ privacy badger: unique fingerprint safari 14: nearly unique something like DNT actually make your score worse

eindiran 6y ago
Since virtually no one honors DNT, and its usually not set by default, choosing to set it is giving up a free bit. Instead try to do whatever the default behavior of your browser is.

ohazi 6y ago

What the fresh hell is this? > Our tests indicate that you have you have strong protection against Web tracking, though your software isn’t checking for Do Not Track policies. > Unblocking 3rd parties that honor Do Not Track? ..... No [marked in red, as if this were a bad thing] Are they suggesting that I unblock trackers when the provider posts a text file pinky swearing that they honor a do-not-track policy? This smells like another "acceptable ads" program.

snazz 6y ago
That's basically what DNT was supposed to be—browsers said "do not track me" and "legitimate" trackers respected it. I agree that it's dumb. Ironically, DNT is now just one more bit that makes fingerprinting your browser easier.
- dudus 6y ago
  DNT was supposed to be that until Microsft decided to make it on by default pretending it to be a big privacy move on their part. Because it was no longer a user choice advertisers decided it was no longer reasonable to honor it. So they just ignore it most of the time. And thus DNT became completely obsolete.
  - saagarjha 6y ago
    > Because it was no longer a user choice advertisers decided it was no longer reasonable to honor it. More like it gave advertisers an excuse to get that tracking data they had been salivating over.
    - renewiltord 6y ago
      To be honest, users don't really care if you honour DNT. So it's best to just ignore that part of the spec.
surround 6y ago
I like the uBlock Origin philosophy: > DNT is essentially acknowledging that a 3rd-party is the one in control of your privacy in the 1st place, and you have to resort to asking this 3rd-party -- which has financial (or whatever) interests in tracking you -- to not track/data mine you, and trusting that they respect your wish, with no way for you to find out whether your request is respected. In short, it's BS, and supporting tracking/data mining is agreeing that tracking/data mining is the natural, expected behavior and thus an opt-out "feature". > Nobody should ever agree to this. > I see it differently: tracking is opt-in, and the ideal is that users are in full control of their privacy by default. Those who want to track/data mine you should ask you to opt-in, along with all the detailed information of how the data collated from you will be used and monetized (lists all entities to which your data is sold), in the spirit of informed consent. > Currently the way for users to enforce their privacy choice is to use all the tools at their disposal to prevent their data from ending up in the hands of the trackers/data miners, and DNT is not one of these tools. https://github.com/gorhill/uBlock/issues/827#issuecomment-153749923 https://github.com/gorhill/uBlock/issues/827#issuecomment-15...

surround 6y ago

> “Add-ons and browsers that randomize the results of fingerprinting metrics have the potential to confuse trackers and mitigate the effects of fingerprinting as a method of tracking.” I would like to dispute this. It is easy to detect when a user is spoofing certain settings. As such, randomizing fingerprint data increases entropy, making your browser more unique, not less. There is a reason why the Tor browser works so hard to make sure every user has the same fingerprint, rather than randomizing it. More on that here: https://github.com/arkenfox/user.js/wiki/4.1-Extensions#small_orange_diamond-%EF%B8%8F-anti-fingerprinting-extensions-fk-no https://github.com/arkenfox/user.js/wiki/4.1-Extensions#smal...

ACow_Adonis 6y ago
The key here is randomising them over time. If you browse website A and website B, with different randomised qualities at different times, and your non-randomised data isn't enough to sufficiently identify you, then although A and B might be able to identify that you're spoofing certain settings, they can't identify that you're the same entity browsing both websites. If you just set things to a weird or unlikely value, then you're as identifiable as a man who walks down the street in a mascot uniform that he never takes off. That is to say, although they don't know the 'person' behind the mask, all you need to look for is the dingus wearing the capital city goofball costume. Indeed, it makes you stand out more...
- jobigoud 6y ago
  If not a lot of people do it the bit of information "this browser is spoofing certain settings" is also a very telling thing and combined with the non-randomized data may tip the balance towards uniqueness.
renewiltord 6y ago
But uniqueness is valuable only if you have identity. If you can't tell that dude A is also dude B then you just have a million dudes and you can't violate anyone's privacy.
minitech 6y ago

lvs 6y ago

Any extensions that block probes for system fonts? That seems to be the most identifying piece of information.

surround 6y ago
Try disabling JavaScript. uBlock origin lets you do this on a per-site basis.

kayson 6y ago

Could fingerprinting be easily avoided by randomizing all of these parameters? Sure, you'd still have a unique fingerprint, but if every time you load a page you have a completely different unique fingerprint, wouldn't that solve the problem?

ACow_Adonis 6y ago
It 'solves' the problem in the theoretical sense, but in a practical sense websites may still require information from the browser for actual justified purposes. Think identifying the browser, OS, resolution and window size (non-exhaustive list and I'm a data-linking person but not a web person, so I'm just making them up). Indeed as long as browsers need to send actual information for successful implementation of whatever it is the website is doing, the potential for fingerprinting still exists. And as long as there are sufficiently non-random properties of the computer for the theoretical attacker to poll (via whatever mechanism they can), then fingerprinting will be a viable mechanism. Although as EFF points out, if MOST of the identifier obtainers require Javascript or connections to certain URLs to work, it might be that blocking javascript and URL blockers might be sufficient to stop most of them in practice? Edit: of course, every time I say theory and practice here we run into problems of how much people are willing to do or put up with in practice...
minitech 6y ago
Yes, as long as enough people randomize them along with you.
- Threeve303 6y ago
  Put a browser inside a read only virtual machine and have everyone agree to use it. All temp folders can be mapped to RAM. Have the VM use a random VPN each time and never login to anything. Nearly everyone would have the same fingerprints even down to the browser resolution, root CA lists, installed fonts, etc. The only real difference being the sites you visit.

ping_pong 6y ago

I wonder why they claim that I'm uniquely identifiable. I'm using default settings for my Macbook, no additional extensions, and the latest update of Chrome. I would think that is relatively common, no?

ramphastidae 6y ago
Screen resolution * fonts * extensions * geography is usually enough.
- saagarjha 6y ago
  Three of those are controlled in the scenario presented, and the last gives 4-5 bits of entropy. Not convincing.
_jal 6y ago
Lots of things effect the fingerprint. Install any non-stock fonts, possibly by installing an application?
t0astbread 6y ago
Well, I don't know what your result says of course but I suspect the default settings in browsers aren't strict enough to avoid "conventional" tracking and that's how you were identified.
jacobwilliamroy 6y ago
Nowadays you want to run a VM with a randomized mac and route all your traffic through something special like a pfsense box.
minitech 6y ago
Scroll down to the detailed results to find out!

deleted 6y ago

[deleted]

renewiltord 6y ago

Very interesting. Dual language Accept headers will completely wreck your anonymity.

unhammer 6y ago
One in x browsers have this value:290162.0 for me – that one alone is probably enough to make me unique. I got the exact same number for system fonts. I guess it's near-impossible to get the features of accept-language without fingerprinting you :-/ but why does js need to know what fonts I have?

walrus01 6y ago

I think this is a really bad name for a browser extension. Non technical users will install it and think it provides them with real anonymity on the Internet or something.

audiometry 6y ago
I agree. And it didn't even seem to be aware I was already running Privacy Badger. And inside Privacy Badger I saw no obvious options to decrease my browser footprint. Sort of lame.
miked85 6y ago
It isn't a browser extension.

foolinaround 6y ago

i recently switched to the Brave browser which comes with good defaults.

TedDoesntTalk 6y ago
Same. But on HR, many people conflate Brave’s built-in privacy with Brave’s ridiculous crypto thing. And so Brave is pooped on, laughed at, or at best ignored by many here. To me they are completely separate and although Brave has had privacy missteps, all browser vendors have. I believe in the leadership (Brendan Eich, creator of JavaScript) more than the leadership of any other browser vendor. I believe Brendan eats his own dog food.
IceWreck 6y ago
I refuse to use them until they remove all the crypto BS. Anything extra that Brave does can also be done using chrome or firefox extensions
- totalZero 6y ago
  You can hide all of that.
66fm472tjy7 6y ago
I tried out Brave a few years ago and soon noticed it did not completely clear history on close when configured to do so. While the history was not shown in the UI, you could see it was retained because URLs visited in previous sessions were shown in :visited style (links were purple instead of blue with default CSS. Note that this can also be queried via JS and thus allows sites to extract your browsing history). I reported the issue at the time but they said the won't fix it since they were moving away from brave-laptop. They still had issues[1] clearing forms of local storage year later. They are not taking privacy seriously. They also took crypto from users under the false pretense of taking payment on behalf of content creators[2]. [1] https://github.com/brave/brave-browser/issues/9929 https://github.com/brave/brave-browser/issues/9929 [2] https://en.wikipedia.org/w/index.php?title=Brave_(web_browser)&oldid=989628749#Brave_browser_collecting_donations_on_behalf_of_content_creators https://en.wikipedia.org/w/index.php?title=Brave_(web_browse...

Semaphor 6y ago

> Ad Blocker Used > False I wonder how they test that? I guess uBlock Origin or uMatrix block their detection.

fuzxi 6y ago

My screen resolution isn't shown accurately on this tool. It returns 1920x1080x32, but my actual window resolution is something like 1880x1020x32 (I use swaywm and leave gaps around windows for a border). If I resize the window to 300x700, the tool returns 1440x900x32. If I disable all my extensions and Firefox's enhanced tracking protection, it always returns 1920x1080x32. I'm using swaywm, so maybe this is an (unintentional?) feature of wayland.

starky 6y ago
I doubt it is your WM since my Windows 10 computer also displays 1920x1080x32 when the resolution should be 3840x2160x32
- fuzxi 6y ago
  Interesting. Are you using firefox as well?
  - starky 6y ago
    Nope, Vivaldi.

kart23 6y ago

My graphics card really destroys my fingerprint. Why are browsers even showing websites the exact model of GPU that's running?

maCDzP 6y ago

I read comments about solving this problem by randomising the fingerprint. Is it possible to randomise the hardware by creating a sort of "ramdom VM-container" that runs the actual browser binary? It would randomises the VM so sometimes it's Linux and sometimes it's Windows.

kebman 6y ago

Meanwhile as money is becoming 100% digitized and reliant on banks, the ability to hide your tracks online is moot.

samoa42 6y ago
did you notice the unique alphanumeric id on every piece of paper money? the banks registers it and turns out the vast majority of money does only "one cycle" ie. from the bank to a (known) consumer/customer, to a shop/cashier and then back to the bank. so "they" already know were you spent it.
- jobigoud 6y ago
  How can they really know it does just one cycle since any possible intermediate step doesn't store/track the number?
  - samoa42 6y ago
    right. they dont know for sure. but statistics give a reasonable good picture given the fact that the input/output points of the banking system are known.
- kebman 6y ago
  That is not entirely true. They can only track end-points with that system, meaning those places where the note ID is inspected. Moreover it's usually only done by one bank; the central bank. In any case that is certainly not a great argument for giving away more of your freedom. Granted more and more shops now have machines that count all bills and change automatically and per transaction, under the guise of convenience and increased security towards theft or robbery. In the mean time, the notes may have travelled from hand-to-hand in a long chain that is completely shrouded in a dark—if not entirely black—economy that neither the bank nor the state can ever hope to fully track. That all changes with the advent of a fully digital system, especially if all transactions are sanctioned to be within that system by force of law. Which is exactly what the banks are pushing for, with various scares such as claims of the danger of money laundering, corruption, and so on. What they systematically fail to add, however, is how they themselves gain the ability to track full markets, and make sure-fire investments based upon surplus data gleanded from aggregating private purchases and trades, thus ensuring their full control over said market. Meanwhile they can use that same power to effectively shut down all opposition—and anyone who protests their actions—simply by finding a reason to freeze their accounts, just like they did to Julian Assange.[1] Thereby they get the power to effectively keep individuals they dislike from accessing the entire economy, unless perhaps they own some diamonds or a valuable goat... This has in turn given precedence to other financial institutions to shut down accounts or memberships based upon political affilations, such as is the case with Patreon, or because they somehow are construed to be in a competing position. As an example, a Norwegian crypto trader has effectively been barred by all the banks in Norway to get a business account.[2] The reasons given were vague claims that his completely legal business somehow supported nefarious and evil individuals who all wish to undertake in money laundering, without offering any solid evidence for it. However the banks all failed to mention that his business can in many ways be seen as being in direct competition with their own business model, namely that of manual and middle-man-laden banking. In any case, for all intents and purposes, Bitcoin transactions are far easier to track than bank notes. [1]: https://www.forbes.com/sites/andygreenberg/2010/12/07/visa-mastercard-move-to-choke-wikileaks/ https://www.forbes.com/sites/andygreenberg/2010/12/07/visa-m... [2]: Norwegian language article: https://e24.no/naeringsliv/i/oRgdW0/dn-bitcoin-toppen-tapte-i-retten-mot-nordea https://e24.no/naeringsliv/i/oRgdW0/dn-bitcoin-toppen-tapte-...

tsimionescu 6y ago

I never understand why browsers expose APIs to read the state of a canvas and WebGL results, or color depth of the screen. How often are they used for anything other than fingerprinting? Note: at least for my profile, those are the only things that truly seem to give significant data. Everything else is in the 1 in 2-300 range, just by using FF on Android with uBlock.

tiborsaas 6y ago
> I never understand why browsers expose APIs to read the state of a canvas and WebGL results That's the basis of any image manipulation. A write only canvas is not useful at all.
- tsimionescu 6y ago
  Ok, so that's one use case. How many webapps are doing image manipulation (not to mention plain sites)? There should really be a prompt whenever a site tries to access this information, especially in privacy-conscious browsers (I wouldn't expect Chrome to want such an anti-feature for their customers, the ad companies).
  - tiborsaas 6y ago
    I used more than I can recall. The browser is a creative tool and being able to use all the creative features is great actually. Just editing your profile picture is a good idea to do on the client side, why waste CPU on your server for example? I do photo editing a lot in the browser. This is a feature that benefits everybody and the fact that it can be abused is unfortunate, but not as tragic as you paint it.
    - tsimionescu 6y ago
      Photo editing could be designed in such a way that the JS code does not actually get read access to the canvas - it just specifies transformations. It's becoming very clear I think that having this level of control for web apps is more detrimental than it is a positive. Leave rich apps to the OS, and keep the web as untrackable as possible.

jepper 6y ago

With uMatrix in "unless withlisted no js configuration" the test does not run. The noJS fallback does not progress. Probably means a pass :) Unique fingerprint is really interesting upon enabling first party js. Fonts and gpu give lots of unique information. Dont get the message to unblock ad providers that follow DNT. This trust is too easily betrayed.

szundi 6y ago

Genius

dcassett 6y ago

Using an old iPad with Safari, it endlessly spins on "testing your browser"

unnouinceput 6y ago

I've tested my Firefox. They said I don't have an Ad Blocker. Since I use uBlock Origin it means either my ad blocker is quite smart or their technology is poor which casts a shadow over this tool entirely. My 2 cents

defanor 6y ago

That's odd: the test claims that my user agent is Go-http-client/1.1, and that there's gzip in HTTP_ACCEPT, after I've followed the redirect trail manually (with s_client(1)), only providing a GET request line and a host.

sloshnmosh 6y ago

It’s next to impossible to stop a website from fingerprinting your browser and/or device. I found a heavily obfuscated script on the webpage of my cellphone data provider which I initially thought was a credit-card skimmer. After several rounds of de-obfuscation and beautification it turned out to be some really intensive tracking and fingerprinting script from Akamai. It used every single fingerprinting technique imaginable from pixels, cookies, webgl, webrtc, flash, vector drawings etc etc.

1996 6y ago
Please share for 1) study and 2) counter measure implementation!
- decko 6y ago
  It might their bot manager product

blindm 6y ago

I see a few people asking how you blend in among the crowd. My strategy is to use a common device like an iPhone 5 using the Safari browser, and for the connection I use a 4G connection that I seem to be sharing with loads of other subscribers. Apple's Advertising Identifier[0] AFAIK is not passed into Safari, as that only applies to other apps and not browsers like Safari. The only thing that could make me stand out is if I deviate from this basic setup and use different browsers on weird connections like a VPN (Yes - a VPN can make you stand out). Also: upgrading my phone to the latest model is probably an uncommon practice and used as another heuristic to track you, & I've heard many people like to stick to a certain phone model until it starts acting up. [0] https://developer.apple.com/documentation/adsupport/asidentifiermanager/1614151-advertisingidentifier https://developer.apple.com/documentation/adsupport/asidenti...