3 ms·
ETAG fingerprinting is perhaps the most reliable non JS approach.
by tyingq 5y ago
ETAG fingerprinting is perhaps the most reliable non JS approach.
- ranger_danger 5y agoCan you elaborate on this?
- tyingq 5y agoSure. Etag stands for "Entity Tag", and it's a header value that comes from the web server and related to caching. A normal implementation would use something like a CRC or MD5 hash of the requested page/image/etc to calculate a tag, and send it to the web browser. The browser stores it for later. The browser, if it's asked to retrieve that thing (image, page, etc) later, sends the "etag" back in the request via a If-None-Match header. The server then knows whether the image/page/etc has changed since the client last requested it. And, it can send back either the new version of the image/page/etc, or a "304 Not Modified" if the page hasn't changed...that is, the computed etag hash value is the same. Here's the problem. There's no spec for how an etag is computed or how it's used. So on the server side, I can use it like a marker tag. Say, I generate a known unique tag for every new visitor that doesn't send me If-None-Match, like a GUID. And I keep a table of those Etag values. You're now fingerprinted...your browser will send that value back every time you visit, no JavaScript required.
- ranger_danger 5y agoWhat if I am using an extension that blocks/ignores etag headers? And what if my browser sends requests via multiple proxies? Would the etag likely be different then as well?
- tyingq 5y agoYou can get around it, yes. But it's stealthy in the sense that nobody thinks about it being (ab)used this way.
- no_time 5y agoDoes private browsing in FF solve this by not caching between program starts?
- tyingq 5y agoSeems like it would, yes.