4 ms·

Would an extension that sets random headers be a solution to blurring identity?

k_ 6y ago
It might just be some easy to ignore noise. Worst thing is, unless this is used by a very large chunk of the population, it would even be another tool to identify you.
- whiw 6y ago
  > it would even be another tool to identify you How exactly? It seems like a difficult problem for a website to me.
  - k_ 6y ago
    They can use "headers include random things" as a filter like they do with other headers presence/absence/value already. I don't think defining "random things" would be too hard for them.
    - whiw 6y ago
      1. Noise that looks like valid signal is the most difficult kind to remove. 2. They would have to track the noise over page requests to know that it was noise. The saving of and correlation of the saved state would be a pain.
jvzr 6y ago
Random would be even more unique. The solution (to this particular problem) is for a majority of users to set the exact same headers, regardless of the reality Some browser vendors have started to remove the specific version from the User Agent string, for instance. Tor browser window is an actual square specifically to make that value (browser width & height) the same across all its users and improve their privacy (by making that value useless in finding uniqueness) Hope that makes sense, sorry if I mis-explained some things
- quicklime 6y ago
  Yes, random values would be more unique, but if those values are changed on each request, wouldn't that make me harder to track? For example suppose my user agent string (and canvas fingerprint, accept header, etc) was different on every request. Would this be enough to stop ad networks from correlating each of my very-unique requests, and prevent them from tracking me across different pages?
cookiengineer 6y ago
> Would an extension that sets random headers be a solution to blurring identity? Nope, because the order a Browser Engine loads assets is different in Chrome vs. Firefox vs. Edgium, too. Combine that with Firefox's messed up Accept header and you'll have them TOR Browser users, for sure. "@supports" in CSS is additionally a very unblockable way to track users, as it varies uniquely per-Browser-version as features of CSS get implemented and/or get fixed. Usually traffic analysis for a client (with a specific ETag header) is enough to uniquely find out whether it's the exact same machine, hence that's what the header is made for. The approach behind my browser tries to actively modify the contents of said malicious HTTP headers and to rewrite the HTML, CSS and other assets in order to force-cache everything and by laying off as much traffic as possible to surrounding peers. [1] But it's far from production-ready. There's also a frightening amount of CSS features that can be used to track users very easily. @supports, @media, and a combination of <link media=""> and "srcset" attributes in a quick prototype was enough to track every client with around 98.3% accuracy, and I decided to not release the fingerprint.css project due to concerns how it might be abused in the wild. Especially with unicode behaviour inside the CSS files themselves. CSS ident-tokens [2] are specified as "non-ASCII" so they can be emojis, too. And those have varying support across all Browser versions due to the ICU library being embedded in them (and being absolutely unique in every single subminor release I've tested so far). [1] https://github.com/tholian-network/stealth https://github.com/tholian-network/stealth [2] https://www.w3.org/TR/css-syntax-3/#tokenization https://www.w3.org/TR/css-syntax-3/#tokenization
- ubercow13 6y ago
  I am not a web expert but these all sound like things that can uniquely identify a particular browser version only? That doesn't seem like such a big issue - if all that can be determined is that I'm using the latest stable Chrome/Firefox, that doesn't sound so bad. Does it matter that the TOR Browser is identifiable if everyone is using the same version? I thought their goal is to make every user of their browser look the same? Where does the 98.3% accuracy come from?
  - deleted 6y ago
    [deleted]
sitkack 6y ago
That is a great question and no, mixing in noise makes it harder but doesn't make it impossible. Mixing in noise feels like a solution because it is hard for a layperson to see how a signal can be extracted, proof by "difficulty to me". If you mix in noise that changes averages then you are removing signal. If you add in random noise, each individual measurement deviates, but the limit of the average will be the same value pre-mixing.
- sitkack 6y ago
  BTW this is the same trap that folks fall into when they design random number generators off the cuff.

k_ 6y ago

It might just be some easy to ignore noise. Worst thing is, unless this is used by a very large chunk of the population, it would even be another tool to identify you.

whiw 6y ago
> it would even be another tool to identify you How exactly? It seems like a difficult problem for a website to me.
- k_ 6y ago
  They can use "headers include random things" as a filter like they do with other headers presence/absence/value already. I don't think defining "random things" would be too hard for them.
  - whiw 6y ago
    1. Noise that looks like valid signal is the most difficult kind to remove. 2. They would have to track the noise over page requests to know that it was noise. The saving of and correlation of the saved state would be a pain.

jvzr 6y ago

Random would be even more unique. The solution (to this particular problem) is for a majority of users to set the exact same headers, regardless of the reality Some browser vendors have started to remove the specific version from the User Agent string, for instance. Tor browser window is an actual square specifically to make that value (browser width & height) the same across all its users and improve their privacy (by making that value useless in finding uniqueness) Hope that makes sense, sorry if I mis-explained some things

quicklime 6y ago
Yes, random values would be more unique, but if those values are changed on each request, wouldn't that make me harder to track? For example suppose my user agent string (and canvas fingerprint, accept header, etc) was different on every request. Would this be enough to stop ad networks from correlating each of my very-unique requests, and prevent them from tracking me across different pages?

cookiengineer 6y ago

> Would an extension that sets random headers be a solution to blurring identity? Nope, because the order a Browser Engine loads assets is different in Chrome vs. Firefox vs. Edgium, too. Combine that with Firefox's messed up Accept header and you'll have them TOR Browser users, for sure. "@supports" in CSS is additionally a very unblockable way to track users, as it varies uniquely per-Browser-version as features of CSS get implemented and/or get fixed. Usually traffic analysis for a client (with a specific ETag header) is enough to uniquely find out whether it's the exact same machine, hence that's what the header is made for. The approach behind my browser tries to actively modify the contents of said malicious HTTP headers and to rewrite the HTML, CSS and other assets in order to force-cache everything and by laying off as much traffic as possible to surrounding peers. [1] But it's far from production-ready. There's also a frightening amount of CSS features that can be used to track users very easily. @supports, @media, and a combination of <link media=""> and "srcset" attributes in a quick prototype was enough to track every client with around 98.3% accuracy, and I decided to not release the fingerprint.css project due to concerns how it might be abused in the wild. Especially with unicode behaviour inside the CSS files themselves. CSS ident-tokens [2] are specified as "non-ASCII" so they can be emojis, too. And those have varying support across all Browser versions due to the ICU library being embedded in them (and being absolutely unique in every single subminor release I've tested so far). [1] https://github.com/tholian-network/stealth https://github.com/tholian-network/stealth [2] https://www.w3.org/TR/css-syntax-3/#tokenization https://www.w3.org/TR/css-syntax-3/#tokenization

ubercow13 6y ago
I am not a web expert but these all sound like things that can uniquely identify a particular browser version only? That doesn't seem like such a big issue - if all that can be determined is that I'm using the latest stable Chrome/Firefox, that doesn't sound so bad. Does it matter that the TOR Browser is identifiable if everyone is using the same version? I thought their goal is to make every user of their browser look the same? Where does the 98.3% accuracy come from?
- deleted 6y ago
  [deleted]

sitkack 6y ago

That is a great question and no, mixing in noise makes it harder but doesn't make it impossible. Mixing in noise feels like a solution because it is hard for a layperson to see how a signal can be extracted, proof by "difficulty to me". If you mix in noise that changes averages then you are removing signal. If you add in random noise, each individual measurement deviates, but the limit of the average will be the same value pre-mixing.

sitkack 6y ago
BTW this is the same trap that folks fall into when they design random number generators off the cuff.