3 ms·

You can test your device browser fingerprint here: https://coveryourtracks.eff.org https://coveryourtracks.eff.org

by hu3 6y ago

jb1991 6y ago
One thing I've never understood about fingerprinting is that Firefox is supposed to prevent it by mangling the fingerprint data if you have those settings turned on. However whenever I visit sites like this, they all those the same thing that never changes, which means my fingerprint is quite stable and shared easily.
- est31 6y ago
  Firefox's fingerprinting protections are useful, but they are not enough to prevent fingerprinting altogether.
- canofbars 6y ago
  The problem with all these anti-fingerprinting tools is you show up as a firefox user who went in to the settings and turned on fingerprint protections which no other user did so you are unique again. You need lots of users to have the same setting enabled to blend in.
dan-robertson 6y ago
I suspect that a few of the things in that report are more correlated than the report suggests.
josephg 6y ago
I just tested with my iPhone 12 in Safari (latest software) and it said I have a unique fingerprint. That really surprises me.
greggman3 6y ago
It's BS and has been since forever https://games.greggman.com/game/panopticlick-hyperbole/ https://games.greggman.com/game/panopticlick-hyperbole/ TL;DR they don't get enough traffic for the numbers to represent anything useful.
- xoa 6y ago
  It may be BS, but that analysis seems too shallow to be at all convincing either. My big question is how much resolution you can get out of things like canvas finger printing and WebGL (or even sheer JS speed). Those are places where the analog reality underlying everything we develop on may peek through unless explicit (and inherently performance reducing) measures are taken. Even if two CPUs/GPUs/SoCs are fabricated on the same process and make it into the same bin, that doesn't make them identical in performance at the level finger printing cares about. In terms of user experience, essentially nobody is going to care about +/- single digit megahertz, or exactly how quickly upclocks/downclocks happen, or sub-1 FPS changes in edge case rendering or the like. But those could certainly leak bits that are unique to a specific chip, even between two devices that are "the same". Silicon fabrication is a probabilistic process, and bins are normally a matter of economics and performance not privacy. Normally devs want everything running as fast as possible, and just leave it at that. But the more closely the software tracks the underlying hardware, the easier it would be to finger print too. And this is one area where iOS devices might well be at a disadvantage for a straight forward "best experience" implementation, precisely because they've put a lot of effort into minimizing things that can interfere with whatever is in the foreground. I don't disagree that the relatively small (and undoubtedly skewed from the general population) size of the EFF's overall dataset is a limit for them, but "I have no idea but it seems fishy because my iPhone should be identical because I say so" isn't an analysis.
  - gruez 6y ago
    >My big question is how much resolution you can get out of things like canvas finger printing and WebGL (or even sheer JS speed). Those are places where the analog reality underlying everything we develop on may peek through unless explicit (and inherently performance reducing) measures are taken. I'm not sure how the "analog reality" applies here. The CPUs and GPUs generate discrete results, and behave identically two other chips of the same model. You talked about variations in performance, but is there evidence that apple does this with iphones? They could very well running them at lower clocks than what they're capable of, ie. the chips come out of the fab being able to run at 1.6-1.8ghz, but apple runs all of them at 1.6ghz. Finally, even if the performance variation is there, the difference will have to be big enough that it doesn't get drowned out in the noise or other environmental variations. A phone that has been in a pocket would perform worse than one that's been sitting on a desk, because it's probably 10 degrees warmer, which means 10 less degrees of thermal headroom. >I don't disagree that the relatively small (and undoubtedly skewed from the general population) size of the EFF's overall dataset is a limit for them, but "I have no idea but it seems fishy because my iPhone should be identical because I say so" isn't an analysis. But the eff site tells you exactly what they're fingerprinting, and they're not fingerprinting performance. What you described might be possible, but is irrelevant to the discussion.
Daniel_sk 6y ago
It must still work to some extent because SDKs like Branch.io are able to deliver payload to your application after installing it from a "deep link". You click a link in Safari, which makes a fingerprint of your device from the browser (and bundles your IP) and sends a request to Branch.io, this redirects you to App Store and you install the app from the link. The app the uses Branch.io SDK to make the fingerprint again and asks the server to send the payload back to you. This way you can make deep links work even if you don't yet have the app installed. To my surprise it still works quite reliably on iOS 14. It has some issues with fingerprinting if there are multiple iPhones with similar fingerprint on same network (same IP).

You can test your device browser fingerprint here: https://coveryourtracks.eff.org https://coveryourtracks.eff.org

by hu3 6y ago

You can test your device browser fingerprint here: https://coveryourtracks.eff.org https://coveryourtracks.eff.org

jb1991 6y ago

One thing I've never understood about fingerprinting is that Firefox is supposed to prevent it by mangling the fingerprint data if you have those settings turned on. However whenever I visit sites like this, they all those the same thing that never changes, which means my fingerprint is quite stable and shared easily.

est31 6y ago
Firefox's fingerprinting protections are useful, but they are not enough to prevent fingerprinting altogether.
canofbars 6y ago
The problem with all these anti-fingerprinting tools is you show up as a firefox user who went in to the settings and turned on fingerprint protections which no other user did so you are unique again. You need lots of users to have the same setting enabled to blend in.

dan-robertson 6y ago

I suspect that a few of the things in that report are more correlated than the report suggests.

josephg 6y ago

I just tested with my iPhone 12 in Safari (latest software) and it said I have a unique fingerprint. That really surprises me.

greggman3 6y ago

It's BS and has been since forever https://games.greggman.com/game/panopticlick-hyperbole/ https://games.greggman.com/game/panopticlick-hyperbole/ TL;DR they don't get enough traffic for the numbers to represent anything useful.

xoa 6y ago
It may be BS, but that analysis seems too shallow to be at all convincing either. My big question is how much resolution you can get out of things like canvas finger printing and WebGL (or even sheer JS speed). Those are places where the analog reality underlying everything we develop on may peek through unless explicit (and inherently performance reducing) measures are taken. Even if two CPUs/GPUs/SoCs are fabricated on the same process and make it into the same bin, that doesn't make them identical in performance at the level finger printing cares about. In terms of user experience, essentially nobody is going to care about +/- single digit megahertz, or exactly how quickly upclocks/downclocks happen, or sub-1 FPS changes in edge case rendering or the like. But those could certainly leak bits that are unique to a specific chip, even between two devices that are "the same". Silicon fabrication is a probabilistic process, and bins are normally a matter of economics and performance not privacy. Normally devs want everything running as fast as possible, and just leave it at that. But the more closely the software tracks the underlying hardware, the easier it would be to finger print too. And this is one area where iOS devices might well be at a disadvantage for a straight forward "best experience" implementation, precisely because they've put a lot of effort into minimizing things that can interfere with whatever is in the foreground. I don't disagree that the relatively small (and undoubtedly skewed from the general population) size of the EFF's overall dataset is a limit for them, but "I have no idea but it seems fishy because my iPhone should be identical because I say so" isn't an analysis.
- gruez 6y ago
  >My big question is how much resolution you can get out of things like canvas finger printing and WebGL (or even sheer JS speed). Those are places where the analog reality underlying everything we develop on may peek through unless explicit (and inherently performance reducing) measures are taken. I'm not sure how the "analog reality" applies here. The CPUs and GPUs generate discrete results, and behave identically two other chips of the same model. You talked about variations in performance, but is there evidence that apple does this with iphones? They could very well running them at lower clocks than what they're capable of, ie. the chips come out of the fab being able to run at 1.6-1.8ghz, but apple runs all of them at 1.6ghz. Finally, even if the performance variation is there, the difference will have to be big enough that it doesn't get drowned out in the noise or other environmental variations. A phone that has been in a pocket would perform worse than one that's been sitting on a desk, because it's probably 10 degrees warmer, which means 10 less degrees of thermal headroom. >I don't disagree that the relatively small (and undoubtedly skewed from the general population) size of the EFF's overall dataset is a limit for them, but "I have no idea but it seems fishy because my iPhone should be identical because I say so" isn't an analysis. But the eff site tells you exactly what they're fingerprinting, and they're not fingerprinting performance. What you described might be possible, but is irrelevant to the discussion.

Daniel_sk 6y ago

It must still work to some extent because SDKs like Branch.io are able to deliver payload to your application after installing it from a "deep link". You click a link in Safari, which makes a fingerprint of your device from the browser (and bundles your IP) and sends a request to Branch.io, this redirects you to App Store and you install the app from the link. The app the uses Branch.io SDK to make the fingerprint again and asks the server to send the payload back to you. This way you can make deep links work even if you don't yet have the app installed. To my surprise it still works quite reliably on iOS 14. It has some issues with fingerprinting if there are multiple iPhones with similar fingerprint on same network (same IP).