26 ms·

What this means is not that google has found a privacy-friendly alternative. It means that Google has found out that among 1000 people, your browsing criteria

What this means is not that google has found a privacy-friendly alternative. It means that Google has found out that among 1000 people, your browsing criteria with HTTP headers alone is unique enough to identify you with 95% accuracy, which is actually even more frightening.

telesilla 6y ago
Would an extension that sets random headers be a solution to blurring identity?
- k_ 6y ago
  It might just be some easy to ignore noise. Worst thing is, unless this is used by a very large chunk of the population, it would even be another tool to identify you.
  - whiw 6y ago
    > it would even be another tool to identify you How exactly? It seems like a difficult problem for a website to me.
    - k_ 6y ago
      They can use "headers include random things" as a filter like they do with other headers presence/absence/value already. I don't think defining "random things" would be too hard for them.
      - whiw 6y ago
        1. Noise that looks like valid signal is the most difficult kind to remove. 2. They would have to track the noise over page requests to know that it was noise. The saving of and correlation of the saved state would be a pain.
- jvzr 6y ago
  Random would be even more unique. The solution (to this particular problem) is for a majority of users to set the exact same headers, regardless of the reality Some browser vendors have started to remove the specific version from the User Agent string, for instance. Tor browser window is an actual square specifically to make that value (browser width & height) the same across all its users and improve their privacy (by making that value useless in finding uniqueness) Hope that makes sense, sorry if I mis-explained some things
  - quicklime 6y ago
    Yes, random values would be more unique, but if those values are changed on each request, wouldn't that make me harder to track? For example suppose my user agent string (and canvas fingerprint, accept header, etc) was different on every request. Would this be enough to stop ad networks from correlating each of my very-unique requests, and prevent them from tracking me across different pages?
- cookiengineer 6y ago
  > Would an extension that sets random headers be a solution to blurring identity? Nope, because the order a Browser Engine loads assets is different in Chrome vs. Firefox vs. Edgium, too. Combine that with Firefox's messed up Accept header and you'll have them TOR Browser users, for sure. "@supports" in CSS is additionally a very unblockable way to track users, as it varies uniquely per-Browser-version as features of CSS get implemented and/or get fixed. Usually traffic analysis for a client (with a specific ETag header) is enough to uniquely find out whether it's the exact same machine, hence that's what the header is made for. The approach behind my browser tries to actively modify the contents of said malicious HTTP headers and to rewrite the HTML, CSS and other assets in order to force-cache everything and by laying off as much traffic as possible to surrounding peers. [1] But it's far from production-ready. There's also a frightening amount of CSS features that can be used to track users very easily. @supports, @media, and a combination of <link media=""> and "srcset" attributes in a quick prototype was enough to track every client with around 98.3% accuracy, and I decided to not release the fingerprint.css project due to concerns how it might be abused in the wild. Especially with unicode behaviour inside the CSS files themselves. CSS ident-tokens [2] are specified as "non-ASCII" so they can be emojis, too. And those have varying support across all Browser versions due to the ICU library being embedded in them (and being absolutely unique in every single subminor release I've tested so far). [1] https://github.com/tholian-network/stealth https://github.com/tholian-network/stealth [2] https://www.w3.org/TR/css-syntax-3/#tokenization https://www.w3.org/TR/css-syntax-3/#tokenization
  - ubercow13 6y ago
    I am not a web expert but these all sound like things that can uniquely identify a particular browser version only? That doesn't seem like such a big issue - if all that can be determined is that I'm using the latest stable Chrome/Firefox, that doesn't sound so bad. Does it matter that the TOR Browser is identifiable if everyone is using the same version? I thought their goal is to make every user of their browser look the same? Where does the 98.3% accuracy come from?
    - deleted 6y ago
      [deleted]
- sitkack 6y ago
  That is a great question and no, mixing in noise makes it harder but doesn't make it impossible. Mixing in noise feels like a solution because it is hard for a layperson to see how a signal can be extracted, proof by "difficulty to me". If you mix in noise that changes averages then you are removing signal. If you add in random noise, each individual measurement deviates, but the limit of the average will be the same value pre-mixing.
  - sitkack 6y ago
    BTW this is the same trap that folks fall into when they design random number generators off the cuff.
mywittyname 6y ago
This has been known for years though. There have been a few sites out there over the years which would tell you how identify-able you are based entirely on what headers your browser sends.
- b3kart 6y ago
  Interesting: could you point me to one of those sites?
  - geektips 6y ago
    https://coveryourtracks.eff.org https://coveryourtracks.eff.org
    - josefx 6y ago
      At least for me WebGL seems to be privacy cancer. Can't say I am surprised.
    - spupy 6y ago
      What is the use for the browser serving some of these details? Number of CPU cores, amount of RAM, installed browser plugins, GPU model?
- Triv888 6y ago
  Maybe Google was already using these methods but did make it public until cookies got a bad enough reputation.
brabel 6y ago
If you want to protect yourself against that, use FireFox with most of the recommendations from here: https://www.privacytools.io/browsers/#about_config https://www.privacytools.io/browsers/#about_config This seems to work pretty well for me (Google got really confused, thinks I am on Windows now - I am not). Just don't turn off media.gmp-widevinecdm if you want to keep watching DRM-protected content (e.g. Netflix)!
- cookiengineer 6y ago
  This is wrong advice. Firefox's unique handling of asset loading, including how ETag and Accept headers are processed (e.g. loading a png as a <script src> and as an <img src>) make Firefox always uniquely identifiable.
  - mike_d 6y ago
    Are you saying that you can identify Firefox among a group of different browsers, or me among a group of different users? If it is the latter, please file a bug against Firefox to get it fixed.
Ashanmaril 6y ago
Can Google tell me who these people are so we can start hanging out? These dudes sound sick

telesilla 6y ago

Would an extension that sets random headers be a solution to blurring identity?

k_ 6y ago
It might just be some easy to ignore noise. Worst thing is, unless this is used by a very large chunk of the population, it would even be another tool to identify you.
- whiw 6y ago
  > it would even be another tool to identify you How exactly? It seems like a difficult problem for a website to me.
  - k_ 6y ago
    They can use "headers include random things" as a filter like they do with other headers presence/absence/value already. I don't think defining "random things" would be too hard for them.
    - whiw 6y ago
      1. Noise that looks like valid signal is the most difficult kind to remove. 2. They would have to track the noise over page requests to know that it was noise. The saving of and correlation of the saved state would be a pain.
jvzr 6y ago
Random would be even more unique. The solution (to this particular problem) is for a majority of users to set the exact same headers, regardless of the reality Some browser vendors have started to remove the specific version from the User Agent string, for instance. Tor browser window is an actual square specifically to make that value (browser width & height) the same across all its users and improve their privacy (by making that value useless in finding uniqueness) Hope that makes sense, sorry if I mis-explained some things
- quicklime 6y ago
  Yes, random values would be more unique, but if those values are changed on each request, wouldn't that make me harder to track? For example suppose my user agent string (and canvas fingerprint, accept header, etc) was different on every request. Would this be enough to stop ad networks from correlating each of my very-unique requests, and prevent them from tracking me across different pages?
cookiengineer 6y ago
> Would an extension that sets random headers be a solution to blurring identity? Nope, because the order a Browser Engine loads assets is different in Chrome vs. Firefox vs. Edgium, too. Combine that with Firefox's messed up Accept header and you'll have them TOR Browser users, for sure. "@supports" in CSS is additionally a very unblockable way to track users, as it varies uniquely per-Browser-version as features of CSS get implemented and/or get fixed. Usually traffic analysis for a client (with a specific ETag header) is enough to uniquely find out whether it's the exact same machine, hence that's what the header is made for. The approach behind my browser tries to actively modify the contents of said malicious HTTP headers and to rewrite the HTML, CSS and other assets in order to force-cache everything and by laying off as much traffic as possible to surrounding peers. [1] But it's far from production-ready. There's also a frightening amount of CSS features that can be used to track users very easily. @supports, @media, and a combination of <link media=""> and "srcset" attributes in a quick prototype was enough to track every client with around 98.3% accuracy, and I decided to not release the fingerprint.css project due to concerns how it might be abused in the wild. Especially with unicode behaviour inside the CSS files themselves. CSS ident-tokens [2] are specified as "non-ASCII" so they can be emojis, too. And those have varying support across all Browser versions due to the ICU library being embedded in them (and being absolutely unique in every single subminor release I've tested so far). [1] https://github.com/tholian-network/stealth https://github.com/tholian-network/stealth [2] https://www.w3.org/TR/css-syntax-3/#tokenization https://www.w3.org/TR/css-syntax-3/#tokenization
- ubercow13 6y ago
  I am not a web expert but these all sound like things that can uniquely identify a particular browser version only? That doesn't seem like such a big issue - if all that can be determined is that I'm using the latest stable Chrome/Firefox, that doesn't sound so bad. Does it matter that the TOR Browser is identifiable if everyone is using the same version? I thought their goal is to make every user of their browser look the same? Where does the 98.3% accuracy come from?
  - deleted 6y ago
    [deleted]
sitkack 6y ago
That is a great question and no, mixing in noise makes it harder but doesn't make it impossible. Mixing in noise feels like a solution because it is hard for a layperson to see how a signal can be extracted, proof by "difficulty to me". If you mix in noise that changes averages then you are removing signal. If you add in random noise, each individual measurement deviates, but the limit of the average will be the same value pre-mixing.
- sitkack 6y ago
  BTW this is the same trap that folks fall into when they design random number generators off the cuff.

mywittyname 6y ago

This has been known for years though. There have been a few sites out there over the years which would tell you how identify-able you are based entirely on what headers your browser sends.

b3kart 6y ago
Interesting: could you point me to one of those sites?
- geektips 6y ago
  https://coveryourtracks.eff.org https://coveryourtracks.eff.org
  - josefx 6y ago
    At least for me WebGL seems to be privacy cancer. Can't say I am surprised.
  - spupy 6y ago
    What is the use for the browser serving some of these details? Number of CPU cores, amount of RAM, installed browser plugins, GPU model?
Triv888 6y ago
Maybe Google was already using these methods but did make it public until cookies got a bad enough reputation.

brabel 6y ago

If you want to protect yourself against that, use FireFox with most of the recommendations from here: https://www.privacytools.io/browsers/#about_config https://www.privacytools.io/browsers/#about_config This seems to work pretty well for me (Google got really confused, thinks I am on Windows now - I am not). Just don't turn off media.gmp-widevinecdm if you want to keep watching DRM-protected content (e.g. Netflix)!

cookiengineer 6y ago
This is wrong advice. Firefox's unique handling of asset loading, including how ETag and Accept headers are processed (e.g. loading a png as a <script src> and as an <img src>) make Firefox always uniquely identifiable.
- mike_d 6y ago
  Are you saying that you can identify Firefox among a group of different browsers, or me among a group of different users? If it is the latter, please file a bug against Firefox to get it fixed.

Ashanmaril 6y ago

Can Google tell me who these people are so we can start hanging out? These dudes sound sick