12 ms·

No-JavaScript Fingerprinting

222 points by rzk 5y ago

remram 5y ago
Apart from window size and that Ubuntu-specific font, this mostly gets things openly sent in my User-Agent and Accept headers.
easrng 5y ago
This doesn't seem to work very well. Want a better scriptless cross-site tracking mechanism? Check out https://xsid2-demo.glitch.me https://xsid2-demo.glitch.me and https://xsid2-demo.easrng.net https://xsid2-demo.easrng.net and note how they both get the same id.
- diogenesjunior 5y ago
  This doesn't work very well. On the glitch website, I get f9703... On the easrng website, I get 8ecd6...
  - easrng 5y ago
    Hmm, what browser? I've tested normal Firefox, Chrome, and Bromite and it works on all of them.
    - kevincox 5y ago
      I get different results for each domain on Firefox Android.
      - easrng 5y ago
        It works on Fennec, even in private mode. (Fennec is the F-Droid Firefox build.) Do you have any addons? It works with uBlock Origin on desktop, haven't tried mobile.
        Arnavion 5y ago
        I'm on a desktop using FF with uBO, both with fairly locked-down configs, and it doesn't work for me. That is, both websites eventually lead to a broken page because of too many redirects, and the URLs in the URL bars of each tab do not contain the same ID. Without digging too deep into what your websites are doing, I did notice that they're trying to set / read cookies, which is a) being blocked by uMatrix in general, and b) perhaps being blocked by me having configured FF to block third-party cookies in particular.
        easrng 5y ago
        Oh yeah, it needs 1st party cookies enabled.
      - easrng 5y ago
        Can you try again? I've moved one of the parts off Glitch and onto my VPS which seems to have fixed the issue.
- tpfour 5y ago
  Ok sure, but how does it work? I clicked around your website but there doesn't seem to be a description.
  - easrng 5y ago
    I haven't written a description yet. Here's a diagram I just made (I'm on my phone rn, please forgive any spelling issues) https://owo.whats-th.is/56opvAS.html https://owo.whats-th.is/56opvAS.html
    - tpfour 5y ago
      Thank you, interesting!
- dfawcus 5y ago
  Neither of the above links do much for me. There was an initial screen, then a redirect to another page containing the text below, and appearing to depend upon JS being enabled. "Waking up To keep Glitch fast for everyone, inactive projects go to sleep and wake up on request." That redirect is different for the two initial URLs, but is of the form: https://xsid2.glitch.me/https%3A%2F%2Fxsid2-demo.glitch.me%2Fcb%2FHASH where HASH is a sequence of hex characters, different for the two original URLs. I'm using Firefox, with uMatrix having scripts and css disabled by default, but 1st party cookies enabled.
  - dfawcus 5y ago
    A second try loading each site in new tabs seemed to work, but this time each gave a different ID. One starting 3fa2, the other f918 Reloading each tab then gave two different numbers, 7eb6 and 6f83 Subsequent reloads did not change again. Loading the sites in to two more tabs, gave yet a different pair of numbers (1934 and 1667), reloads of those tabs yeilded another pair (b308 and 3df8)
    - easrng 5y ago
      Oh huh, I'm seeing this too. It worked at some point, not sure why it isn't now. I'll look into it. Edit: it looks like this happens when the sites have gone down and are being restarted on load. I'll move them to my VPS, that should fix it.
      - easrng 5y ago
        Ok, it should work more reliably now.
tyingq 5y ago
I thought it was going to use ETAG based fingerprinting/tracking, which I always thought was pretty clever. The etag header is supposed to be used to control caching, so it's typically a server-side generated hash of the requested resource's content. But, there's no requirement for it to be, so you can generate a unique one, and the client will send it back to you next time it asks for that uri. Sort of like a cookie. The fingerprint sources are here: https://github.com/fingerprintjs/blog-nojs-fingerprint-demo/blob/master/src/signal_sources.ts https://github.com/fingerprintjs/blog-nojs-fingerprint-demo/... Basically some css that uniquely identifies some browsers, then headers like user-agent, language, etc.
- chmod775 5y ago
  ETag based tracking shouldn't work across domains.
  - jefftk 5y ago
    Specifically, it won't work across sites -- all major browsers (now) shard the HTTP cache by site. While www.example.com and forums.example.com are different domains, they're the same site ("registrable domain" or "eTLD+1"; example.com in this case). See https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat for the list of eTLDs (parents of registrable domains).
    - cookiengineer 5y ago
      Note that CNAME cloaking is also an issue here, because Firefox is the only Browser with a userspace network stack whereas Chrome/Chromium relies on the OS...which means that Chromium or Electron based Browsers cannot protect themselves from CNAME cloaked domains. Adblockers like uBlock Origin just have a domain list of known CNAME cloaked domains, but that's not based on the DNS entries directly because there's no API for this for web/chrome extensions. Long story short: Sharding can be tricked with CNAME cloaking.
      - 5y ago
encryptluks2 5y ago
Well for one thing, an IP address is always going to be the easiest way to track a user, but also user agent information which browsers happily give away too much information.
- selcuka 5y ago
  > an IP address is always going to be the easiest way to track a user Note that an IP address is not unique to a single user (NAT, CGNAT, mobile networks) and may frequently change. > also user agent information All users who use the same version of a browser on the same OS typically share the same user agent string (unless modified with a plugin or an extension). It's an indicator, but can't be used as a fingerprint itself.
- czbond 5y ago
  Yes, for many. VPN's, mobile connections, and commercial work connections (using a proxy) will throw off IP address checks as they report a single IP for large pool groups. You'd have to also use MAC address, but mobile have MAC address swapping ,etc. I once wrote a tool that would capture all network requesters, and reverse fingerprint them through a connection of Operating system quirks responses to network oddities (eg: tcp fragmented frames), location, routers they connect through, etc combined with the other browser things avail.
- jefftk 5y ago
  > IP address is always going to be the easiest way to track a user This is changing: Apple has rolled out Private Relay, and Chrome is planning some combination of willful IP blindness and near-path NAT. > user agent information which browsers happily give away too much information So is this: all the browsers are working on reducing how much they put in the UA.
RunSet 5y ago
This uses an extensive list of CSS options that each make a server request with url('URL/CONTAINING/TRACKING_CODE'); The view results button then points to https://noscriptfingerprint.com/compactResult/TRACKING_CODE https://noscriptfingerprint.com/compactResult/TRACKING_CODE How unique of a browser fingerprint is generated by the CSS options would require further consideration. An easy fix to this would be to disable url values for styles, though. Edit: Blocking CSS entirely in uMatrix causes it to mostly fail.
tentacleuno 5y ago
This reminds me of browser fingerprinting via CSS[0], which has come up quite a surprising amount of times. Sending the browser's width is a bit more convoluted though. From what I've seen, the popular (well, as popular as CSS-only fingerprinting is) method is to set a media query for each px value. When the user resizes the window, the new width is sent to the server. Obviously something like this would be generated code, not written by-hand. [0]: https://news.ycombinator.com/item?id=29794518 https://news.ycombinator.com/item?id=29794518
gmiller123456 5y ago
I just changed my preference for dark mode and got a different fingerprint. If it's not resilient to modest changes, it's not really that helpful at tracking anyone. There are already plugins to randomize some header data, so this type of thing has been known and protected against.
- spicybright 5y ago
  It depends on what settings actually change your finger print or not. If only 10% of people use dark mode toggle that's still 90% of users being tracked, which could be worth while.
- heavyset_go 5y ago
  If you have past data collected on the users, correlating users despite fingerprint changes should be pretty easy. If the fingerprint itself encodes data and isn't just a cryptographic hash, you don't even need to have past data collected, you just need fingerprints.
ReactiveJelly 5y ago
Any other Tor Browser users get b15acf0466e7b2da06cfea09b1ab2cda? TBB is of course meant to resist fingerprinting...
- ugjka 5y ago
  c4abc6d4de3c5ccb4e9b229f50ed85be Tor Browser 11.0.4
ravenstine 5y ago
Cool. I get a different fingerprint every time. Although that doesn't prove that I'm not fingerprintable by this approach (one difference may be responsible for changing the hash), I'm kind of pleased. My setup: - Firefox - Enhanced Tracking Protection - uBlock Origin - NoScript - Privacy Badger - Privacy Possum - HTTPS Everywhere - Clear URLs - Decentraleyes - Smart Referer - JavaScript Restrictor
- lelandfe 5y ago
  Not familiar with Privacy Badger or Privacy Possum, but I'm guessing they are what's subverting this technique? The other ones probably don't come into play.
  - beebeepka 5y ago
    NoScript allows you to skip font loading for allowed and blocked domains.
    - lelandfe 5y ago
      This is using local/system fonts, not remote ones.
1vuio0pswjnm7 5y ago
The text-only browser I am using does not support CSS. It does not send E-tag headers either. The local forward proxy removes all HTTP headers except Host and Connection, and Cookie where needed.
- lelandfe 5y ago
  Do you generally have a good time on the web with that?
  - 1vuio0pswjnm7 5y ago
    Yes. It is a relief from the times I must use the graphical browsers. For example, I can search for and consume information much faster and more efficiently, free from distraction. Perhaps one needs more than one client for the web. For example, I need a netcat-like program, some helper programs for working with HTTP and a text-only browser for viewing HTML. Plus a TLS proxy to deal with all the HTTPS. This is in addition to graphical, everything-but-the-kitchen-sink desktop or mobile browsers. Perhaps a single, large, graphical browser directly or indirectly funded by advertisers is insufficient for all web use. Other clients may work better in certain situations. Certainly this is true for me. The smaller programs are faster, more robust and offer me greater flexibility.
- makeworld 5y ago
  Which browser are you using?
  - 1vuio0pswjnm7 5y ago
    For text-only, I prefer Links. I use various versions compiled statically with personal patches.
- notriddle 5y ago
  On many websites, you will literally be the only person doing that. This is a unique fingerprint. This might not matter to you, since it sounds like privacy isn’t your primary motivation here, but it is worth pointing out that custom patched browsers are going to be more fingerprinted, not less.
a1371 5y ago
For me the fingerprint changed after the first refresh, but then it stayed the same. I wonder what's different in the first visit
deleted 5y ago
[deleted]
shp0ngle 5y ago
The actual blogpost is here https://fingerprintjs.com/blog/disabling-javascript-wont-stop-fingerprinting/ https://fingerprintjs.com/blog/disabling-javascript-wont-sto... basically they use CSS trickery together with server-side stuff. It's pretty clever. @font-face { font-family: 'Helvetica'; src: local('Helvetica'), url('/signal/(token)/fontHelvetica') format('truetype'); } to detect font (which detects OS), and @media (featureX: value1) { .css_probe_42 { background: url('/signal/(token)/featureX/value1'); } } to detect browser features (which detects browser)
- yamrzou 5y ago
  Thanks, I thought I saw the demo before on HN but I was not sure as I couldn't find the domain. Previous discussion: https://news.ycombinator.com/item?id=29042791 https://news.ycombinator.com/item?id=29042791
- capableweb 5y ago
  navigator.useragent will still have more precise answer as the amount of people who fake their useragent (or have JS disabled) are less than the amount of Windows/Linux users that have Helvetica (clone/real one) installed.
- 3pt14159 5y ago
  Eh. It's been pretty easy to fingerprint browsers for a while now, including those types of CSS hacks. The real feat is doing so without looking like you're doing it and for it to be durable (survive OS upgrades, reboots, etc).
- redbell 5y ago
  Nice read though.. I was surprised by the amount of CSS tricks used for fingerprinting all while having js disabled. A few days ago, I came across this "GPU fingerprinting" called "DrawnApart" => https://blog.amiunique.org/an-explicative-article-on-drawnapart-a-gpu-fingerprinting-technique/ https://blog.amiunique.org/an-explicative-article-on-drawnap... and was thinking that this must be the most advanced fingerprinting approach so far but after reading your article, I have to reconsider!
cookiengineer 5y ago
Note that among a sea of tracked browsers, the untrackable browser shines like a bright star. Statistical analysis of these values over time (matched with client hints, ETags, If-Modified-Since, and IPs) will make most browsers uniquely identifiable. If the malicious vendor is good, they even correlate the size and order of requests. Because that's unique as well and can identify TOR browsers pretty easily. It's like saying "I can't be tracked, because I use Linux". Guess what, as long as nobody in your town uses Linux, you are the most trackable person. I decided to go with the "behave as the statistical norm expects you to behave" and created my browser/scraper [1] and forked WebKit into a webview [2] that doesn't support anything that can be used for tracking; with the idea that those tracking features can be shimmed and faked. I personally think this is the only way to be untrackable these days. Because let's be honest, nobody uses Firefox with ETP in my town anymore :( WebKit was a good start of this because at least some of the features were implemented behind compiler flags...whereas all other browsers and engines can't be built without say, WebRTC support, or say, without Audio Worklets which are for themselves enough to be uniquely identified. [1] https://github.com/tholian-network/stealth https://github.com/tholian-network/stealth [2] https://github.com/tholian-network/retrokit https://github.com/tholian-network/retrokit (both WIP)
- gtsop 5y ago
  Wait, but the case for TOR isn't to hide you are using TOR, but to blend in with the crowd of TOR users. Does my TOR browser give a different fingerprint than yours?
  - cookiengineer 5y ago
    The IPs of TOR exit nodes are publicly known. I'm not sure people using TOR are aware of how the concept and peer discovery mechanism works. I mean, at some point you gotta ask yourself why cloudflare shows all TOR users a captcha in a targeted manner :)
    - coma_ 5y ago
      > I mean, at some point you gotta ask yourself why cloudflare shows all TOR users a captcha in a targeted manner :) Because exit node IP address' are known, you have just said it. How does it have anything to do with user fingerprinting? And how does it answer the question of @gtsop asking whether different users of ToR web browser have different distinguishable fingerprint or not?
khalby786 5y ago
How practical would this method of recognising your fingerprint with CSS be?
- dsnr 5y ago
  This, and also the power of tracking comes from being able to share data/track across domains. So the best way to mitigate this is not to dumb down our browsers but to fight cross domain access to this data. This can be done either by regulation (see GDPR) or technical measures (disabling cross-site scripting, cookies etc)
  - zelphirkalt 5y ago
    They can simply exchange the data server side, no?
    - dsnr 5y ago
      In theory yes, but they can't use the data for legitimate business while also complying with the regulations.
zaik 5y ago
I wonder how unique this fingerprint really is. Getting the same fingerprint every time is only half of what makes a good fingerprint. Fennec on Android: cdec914cb91d1a88fbd3e7834b7968c8
- twhitmore 5y ago
  Agreed. It's not a "fingerprint" at all as in most cases, it won't be remotely unique. For example: every user in the world with the same screen size, browser & platform will get the same result. For desktop it's window size rather than screen, but coarsely bucketed. Thousands or millions will share the same fingerprint. It seems somewhat unrealistic to ascribe much advertisement or tracking value to this.
  - farias0 5y ago
    But this are not the only info. OS language, dark mode preferences, fonts installed, all this stuff goes a long way in helping pinpointing you.
- farias0 5y ago
  Yep, this site should tell you if your fingerprint is unique among all the other visitors, like other fingerprint sites do. I know a positive would only be meaningful if the website gets popular, but a negative would say a lot regardless.
ComodoHacker 5y ago
After 3+ months, they haven't published any data, or I just couldn't find it. Which kind of makes the whole endeavor meaningless.
scotty79 5y ago
DuckDuckGo android browser I'm currently using doesn't prevent me from getting consistently fingerprinted.
caaqil 5y ago
The fingerprint changes on every refresh for me. I have uBlock, Privacy Badger and similar extensions enabled if that matters.
niffydroid 5y ago
While this is cool and handy, sadly not of any use to me. According to Uk ICO (Information Commissioner Office) Fingerprinting has to have consent. https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/ https://ico.org.uk/for-organisations/guide-to-pecr/what-are-... "PECR also applies to ‘similar technologies’ like fingerprinting techniques. Therefore, unless an exemption applies, any use of device fingerprinting requires the provision of clear and comprehensive information as well as the consent of the user or subscriber."
- Gwypaas 5y ago
  I would rather see it as a way to easily demonstrate why GPDR is not simply about cookies and their management. It concerns any method of creating an identifier which would allow for tracking.
- kwhitefoot 5y ago
  Why sadly? Why would you want to fingerprint users browsers anyway?
captainmuon 5y ago
I wonder why we are not seeing more completely server-side analytics. With tricks like this you can get by with no or only minimal JavaScript. You can also set a session cookie to be more accurate. If the cookie is neccessary for the functioning of the site, you don't even need GDPR consent. Practially, and I know this is cynical, but you don't really have to follow the GDPR, you just have to make sure there is no outside sign you are tracking users. And frankly, if I had a website, I would want accurate statistics, but I would want to avoid a cookie prompt, and I would want as little external javascript as possible. So it is weird that there is no black-hat stealth visitor analytics yet.
- notriddle 5y ago
  > Practially, and I know this is cynical, but you don't really have to follow the GDPR, you just have to make sure there is no outside sign you are tracking users. Why bother, then? I mean this in the relatively broad philosophical sense. There are few who seek pain, simply because it is pain, and there are few who implement complex tracking schemes simply to implement complex tracking schemes. They only go through this much work if there is some pleasure or profit to be gained from it. If you start doing significantly-meaningful ad targeting, someone might notice the striking correlation. If you're a big enough organization for the practice to become dangerous, then even if nobody on the outside notices, someone might leak. What's the point in gathering the information if you can't use it for fear of someone figuring out what you did?
danuker 5y ago
With the latest Tor Browser (11.0.4 based on Mozilla Firefox 91.5.0esr) on Arch Linux, I get the following: * 9dfe9b69a9f18ef1c0d313aa4c013b52 in regular windowed mode * 0fa96aa3ae2698bc2d1187f39b79db36 in fullscreen mode (F11). Does anyone else get any of these fingerprints? If so, that is evidence that Tor Browser is well-designed. If not, that is evidence of some details overlooked.
mrob 5y ago
I am unpleasantly surprised that Firefox's "ui.prefersReducedMotion" preference is detectable from CSS. I expected a preference starting with "ui" to only affect the UI. It should be possible to reduce (or ideally remove) UI animations without affecting web pages.
- ChicagoBoy11 5y ago
  I'd figure most web-apps have UI-like interfaces (contrasting with just static pages), so I can see why it might be useful for sites to be able to minimize transitions/effects/motion/etc. that may exist on their page.
- XCSme 5y ago
  Isn't the main point of the user preference flag to allow the website developer to serve a reduced-motion version of the site?
  - mrob 5y ago
    AFAIK, all the other ui.* preference affect the Firefox UI, not websites, so it's a misleading name. And I have already disabled web page animations in userContent.css[0], which is the correct place for modifying CSS. I shouldn't have to choose between allowing annoying UI animations and allowing fingerprinting. [0]To disable web page animations, in Chrome/userContent.css in your Firefox profile directory: @namespace url(http://www.w3.org/1999/xhtml); *, :before, :after { transition: none !important; animation-delay: 0ms !important; animation-duration: 0ms !important; } This also requires setting toolkit.legacyUserProfileCustomizations.stylesheets to true in about:config
farzher 5y ago
win11, brave/chrome, 1440p 165hz: 9b93344ef597a0b8ef7184d4a693d548
v3ss0n 5y ago
That is quite shitty way to fingerprint. Imagine an Office full of old people who don't bother to install or configure their own OS/Browser/Fonts and they only use company provided Laptops whicha ll of them are same , with Default windows 10 ? (or 7) That would generate same fingerprint. What a uselsss way, Should not call it fingerprinting .
charcircuit 5y ago
My fingerprint is 05340cc39b7388b85993bd6117d4ebbb
alkonaut 5y ago
This doesn’t worry me too much, the value seems like it should be the exact same hash for any iOS Safari visitor with the same screen resolution and browser language? I’d be fingerprinted as part of a group of (probably) several hundred thousand. 8d666b05c42878d6d6d364c410a4eef2 It’s a shame that browsers leak things like font presence, but of course when sites can read back canvas contents without querying the user is when it all goes out the window.
- NavinF 5y ago
  Chrome (Safari) on iPhone 13 Pro Max: db9df4c8c770242aaf1e0efdd5cf8ab2 There’s likely enough info in the hash to figure out exactly what device I’m on since nothing else will have the same pixel density, screen height, and screen width: https://stackoverflow.com/questions/46313640/iphone-x-8-8-plus-css-media-queries#46313641 https://stackoverflow.com/questions/46313640/iphone-x-8-8-pl... Dark mode adds on one more bit, but everything else should be the same across iOS devices. Not sure if that’s enough to track individuals among a small userbase every time their IP address changes.
  - HWR_14 5y ago
    I'm pretty sure the Pro Max 12 has the same screen settings. I also wonder about maximized windows on a 1080p monitor. I know DPI of desktop monitors at one point was a constant returned value.
cmeacham98 5y ago
I have Firefox RFP enabled, and as far as I know all these values will be the same across RFP users except the size of the browser window (which seems like a poor fingerprinting metric given the fact I can and do resize my browser during usage) - and maybe pixel density? (can't tell if this one is standardized or not). If there are any other RFP users out there compare to mine and see if you get anything different other than browser window size: https://noscriptfingerprint.com/result/yiRFTom5qPpKPxOl https://noscriptfingerprint.com/result/yiRFTom5qPpKPxOl
- emrex 5y ago
  What if you are the only one in your area that uses FF RFP ?
- zelphirkalt 5y ago
  It says: "4. Click the toggle button until “true” changes to “false”" But for me there is no toggle button. It seems to not be able to do anything, with my blocker settings. When I allow the site, I see, that it did change the screen resolution result compared to yours.
- Urd- 5y ago
  Yes, my signals only differ by screen size.
- nieve 5y ago
  Even without RFP it seems to be very fragile, just resizing my window completely changes the result.
  - jefftk 5y ago
    That's because it is including the dimensions of your window as part of your fingerprint. If your goal is to track users as they move across sites, matching browser size makes sense.
    - c0balt 5y ago
      FYI, TOR browser has set a default browser resolution that ignore resizing to mitigate this issue. This might only make you blend in with other TOR users but this approach to resist device/ interface fingerprinting is quite interesting.

222 points by rzk 5y ago

Apart from window size and that Ubuntu-specific font, this mostly gets things openly sent in my User-Agent and Accept headers.

easrng 5y ago

This doesn't seem to work very well. Want a better scriptless cross-site tracking mechanism? Check out https://xsid2-demo.glitch.me https://xsid2-demo.glitch.me and https://xsid2-demo.easrng.net https://xsid2-demo.easrng.net and note how they both get the same id.

diogenesjunior 5y ago
This doesn't work very well. On the glitch website, I get f9703... On the easrng website, I get 8ecd6...
- easrng 5y ago
  Hmm, what browser? I've tested normal Firefox, Chrome, and Bromite and it works on all of them.
  - kevincox 5y ago
    I get different results for each domain on Firefox Android.
    - easrng 5y ago
      It works on Fennec, even in private mode. (Fennec is the F-Droid Firefox build.) Do you have any addons? It works with uBlock Origin on desktop, haven't tried mobile.
      - Arnavion 5y ago
        I'm on a desktop using FF with uBO, both with fairly locked-down configs, and it doesn't work for me. That is, both websites eventually lead to a broken page because of too many redirects, and the URLs in the URL bars of each tab do not contain the same ID. Without digging too deep into what your websites are doing, I did notice that they're trying to set / read cookies, which is a) being blocked by uMatrix in general, and b) perhaps being blocked by me having configured FF to block third-party cookies in particular.
        easrng 5y ago
        Oh yeah, it needs 1st party cookies enabled.
    - easrng 5y ago
      Can you try again? I've moved one of the parts off Glitch and onto my VPS which seems to have fixed the issue.
tpfour 5y ago
Ok sure, but how does it work? I clicked around your website but there doesn't seem to be a description.
- easrng 5y ago
  I haven't written a description yet. Here's a diagram I just made (I'm on my phone rn, please forgive any spelling issues) https://owo.whats-th.is/56opvAS.html https://owo.whats-th.is/56opvAS.html
  - tpfour 5y ago
    Thank you, interesting!
dfawcus 5y ago
Neither of the above links do much for me. There was an initial screen, then a redirect to another page containing the text below, and appearing to depend upon JS being enabled. "Waking up To keep Glitch fast for everyone, inactive projects go to sleep and wake up on request." That redirect is different for the two initial URLs, but is of the form: https://xsid2.glitch.me/https%3A%2F%2Fxsid2-demo.glitch.me%2Fcb%2FHASH where HASH is a sequence of hex characters, different for the two original URLs. I'm using Firefox, with uMatrix having scripts and css disabled by default, but 1st party cookies enabled.
- dfawcus 5y ago
  A second try loading each site in new tabs seemed to work, but this time each gave a different ID. One starting 3fa2, the other f918 Reloading each tab then gave two different numbers, 7eb6 and 6f83 Subsequent reloads did not change again. Loading the sites in to two more tabs, gave yet a different pair of numbers (1934 and 1667), reloads of those tabs yeilded another pair (b308 and 3df8)
  - easrng 5y ago
    Oh huh, I'm seeing this too. It worked at some point, not sure why it isn't now. I'll look into it. Edit: it looks like this happens when the sites have gone down and are being restarted on load. I'll move them to my VPS, that should fix it.
    - easrng 5y ago
      Ok, it should work more reliably now.

tyingq 5y ago

I thought it was going to use ETAG based fingerprinting/tracking, which I always thought was pretty clever. The etag header is supposed to be used to control caching, so it's typically a server-side generated hash of the requested resource's content. But, there's no requirement for it to be, so you can generate a unique one, and the client will send it back to you next time it asks for that uri. Sort of like a cookie. The fingerprint sources are here: https://github.com/fingerprintjs/blog-nojs-fingerprint-demo/blob/master/src/signal_sources.ts https://github.com/fingerprintjs/blog-nojs-fingerprint-demo/... Basically some css that uniquely identifies some browsers, then headers like user-agent, language, etc.

chmod775 5y ago
ETag based tracking shouldn't work across domains.
- jefftk 5y ago
  Specifically, it won't work across sites -- all major browsers (now) shard the HTTP cache by site. While www.example.com and forums.example.com are different domains, they're the same site ("registrable domain" or "eTLD+1"; example.com in this case). See https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat for the list of eTLDs (parents of registrable domains).
  - cookiengineer 5y ago
    Note that CNAME cloaking is also an issue here, because Firefox is the only Browser with a userspace network stack whereas Chrome/Chromium relies on the OS...which means that Chromium or Electron based Browsers cannot protect themselves from CNAME cloaked domains. Adblockers like uBlock Origin just have a domain list of known CNAME cloaked domains, but that's not based on the DNS entries directly because there's no API for this for web/chrome extensions. Long story short: Sharding can be tricked with CNAME cloaking.
    - 5y ago

encryptluks2 5y ago

Well for one thing, an IP address is always going to be the easiest way to track a user, but also user agent information which browsers happily give away too much information.

selcuka 5y ago
> an IP address is always going to be the easiest way to track a user Note that an IP address is not unique to a single user (NAT, CGNAT, mobile networks) and may frequently change. > also user agent information All users who use the same version of a browser on the same OS typically share the same user agent string (unless modified with a plugin or an extension). It's an indicator, but can't be used as a fingerprint itself.
czbond 5y ago
Yes, for many. VPN's, mobile connections, and commercial work connections (using a proxy) will throw off IP address checks as they report a single IP for large pool groups. You'd have to also use MAC address, but mobile have MAC address swapping ,etc. I once wrote a tool that would capture all network requesters, and reverse fingerprint them through a connection of Operating system quirks responses to network oddities (eg: tcp fragmented frames), location, routers they connect through, etc combined with the other browser things avail.
jefftk 5y ago
> IP address is always going to be the easiest way to track a user This is changing: Apple has rolled out Private Relay, and Chrome is planning some combination of willful IP blindness and near-path NAT. > user agent information which browsers happily give away too much information So is this: all the browsers are working on reducing how much they put in the UA.

RunSet 5y ago

This uses an extensive list of CSS options that each make a server request with url('URL/CONTAINING/TRACKING_CODE'); The view results button then points to https://noscriptfingerprint.com/compactResult/TRACKING_CODE https://noscriptfingerprint.com/compactResult/TRACKING_CODE How unique of a browser fingerprint is generated by the CSS options would require further consideration. An easy fix to this would be to disable url values for styles, though. Edit: Blocking CSS entirely in uMatrix causes it to mostly fail.

tentacleuno 5y ago

This reminds me of browser fingerprinting via CSS[0], which has come up quite a surprising amount of times. Sending the browser's width is a bit more convoluted though. From what I've seen, the popular (well, as popular as CSS-only fingerprinting is) method is to set a media query for each px value. When the user resizes the window, the new width is sent to the server. Obviously something like this would be generated code, not written by-hand. [0]: https://news.ycombinator.com/item?id=29794518 https://news.ycombinator.com/item?id=29794518

gmiller123456 5y ago

I just changed my preference for dark mode and got a different fingerprint. If it's not resilient to modest changes, it's not really that helpful at tracking anyone. There are already plugins to randomize some header data, so this type of thing has been known and protected against.

spicybright 5y ago
It depends on what settings actually change your finger print or not. If only 10% of people use dark mode toggle that's still 90% of users being tracked, which could be worth while.
heavyset_go 5y ago
If you have past data collected on the users, correlating users despite fingerprint changes should be pretty easy. If the fingerprint itself encodes data and isn't just a cryptographic hash, you don't even need to have past data collected, you just need fingerprints.

ReactiveJelly 5y ago

Any other Tor Browser users get b15acf0466e7b2da06cfea09b1ab2cda? TBB is of course meant to resist fingerprinting...

ugjka 5y ago
c4abc6d4de3c5ccb4e9b229f50ed85be Tor Browser 11.0.4

ravenstine 5y ago

Cool. I get a different fingerprint every time. Although that doesn't prove that I'm not fingerprintable by this approach (one difference may be responsible for changing the hash), I'm kind of pleased. My setup: - Firefox - Enhanced Tracking Protection - uBlock Origin - NoScript - Privacy Badger - Privacy Possum - HTTPS Everywhere - Clear URLs - Decentraleyes - Smart Referer - JavaScript Restrictor

lelandfe 5y ago
Not familiar with Privacy Badger or Privacy Possum, but I'm guessing they are what's subverting this technique? The other ones probably don't come into play.
- beebeepka 5y ago
  NoScript allows you to skip font loading for allowed and blocked domains.
  - lelandfe 5y ago
    This is using local/system fonts, not remote ones.

1vuio0pswjnm7 5y ago

The text-only browser I am using does not support CSS. It does not send E-tag headers either. The local forward proxy removes all HTTP headers except Host and Connection, and Cookie where needed.

lelandfe 5y ago
Do you generally have a good time on the web with that?
- 1vuio0pswjnm7 5y ago
  Yes. It is a relief from the times I must use the graphical browsers. For example, I can search for and consume information much faster and more efficiently, free from distraction. Perhaps one needs more than one client for the web. For example, I need a netcat-like program, some helper programs for working with HTTP and a text-only browser for viewing HTML. Plus a TLS proxy to deal with all the HTTPS. This is in addition to graphical, everything-but-the-kitchen-sink desktop or mobile browsers. Perhaps a single, large, graphical browser directly or indirectly funded by advertisers is insufficient for all web use. Other clients may work better in certain situations. Certainly this is true for me. The smaller programs are faster, more robust and offer me greater flexibility.
makeworld 5y ago
Which browser are you using?
- 1vuio0pswjnm7 5y ago
  For text-only, I prefer Links. I use various versions compiled statically with personal patches.
notriddle 5y ago
On many websites, you will literally be the only person doing that. This is a unique fingerprint. This might not matter to you, since it sounds like privacy isn’t your primary motivation here, but it is worth pointing out that custom patched browsers are going to be more fingerprinted, not less.

a1371 5y ago

For me the fingerprint changed after the first refresh, but then it stayed the same. I wonder what's different in the first visit

deleted 5y ago

[deleted]

shp0ngle 5y ago

The actual blogpost is here https://fingerprintjs.com/blog/disabling-javascript-wont-stop-fingerprinting/ https://fingerprintjs.com/blog/disabling-javascript-wont-sto... basically they use CSS trickery together with server-side stuff. It's pretty clever. @font-face { font-family: 'Helvetica'; src: local('Helvetica'), url('/signal/(token)/fontHelvetica') format('truetype'); } to detect font (which detects OS), and @media (featureX: value1) { .css_probe_42 { background: url('/signal/(token)/featureX/value1'); } } to detect browser features (which detects browser)

yamrzou 5y ago
Thanks, I thought I saw the demo before on HN but I was not sure as I couldn't find the domain. Previous discussion: https://news.ycombinator.com/item?id=29042791 https://news.ycombinator.com/item?id=29042791
capableweb 5y ago
navigator.useragent will still have more precise answer as the amount of people who fake their useragent (or have JS disabled) are less than the amount of Windows/Linux users that have Helvetica (clone/real one) installed.
3pt14159 5y ago
Eh. It's been pretty easy to fingerprint browsers for a while now, including those types of CSS hacks. The real feat is doing so without looking like you're doing it and for it to be durable (survive OS upgrades, reboots, etc).
redbell 5y ago
Nice read though.. I was surprised by the amount of CSS tricks used for fingerprinting all while having js disabled. A few days ago, I came across this "GPU fingerprinting" called "DrawnApart" => https://blog.amiunique.org/an-explicative-article-on-drawnapart-a-gpu-fingerprinting-technique/ https://blog.amiunique.org/an-explicative-article-on-drawnap... and was thinking that this must be the most advanced fingerprinting approach so far but after reading your article, I have to reconsider!

cookiengineer 5y ago

Note that among a sea of tracked browsers, the untrackable browser shines like a bright star. Statistical analysis of these values over time (matched with client hints, ETags, If-Modified-Since, and IPs) will make most browsers uniquely identifiable. If the malicious vendor is good, they even correlate the size and order of requests. Because that's unique as well and can identify TOR browsers pretty easily. It's like saying "I can't be tracked, because I use Linux". Guess what, as long as nobody in your town uses Linux, you are the most trackable person. I decided to go with the "behave as the statistical norm expects you to behave" and created my browser/scraper [1] and forked WebKit into a webview [2] that doesn't support anything that can be used for tracking; with the idea that those tracking features can be shimmed and faked. I personally think this is the only way to be untrackable these days. Because let's be honest, nobody uses Firefox with ETP in my town anymore :( WebKit was a good start of this because at least some of the features were implemented behind compiler flags...whereas all other browsers and engines can't be built without say, WebRTC support, or say, without Audio Worklets which are for themselves enough to be uniquely identified. [1] https://github.com/tholian-network/stealth https://github.com/tholian-network/stealth [2] https://github.com/tholian-network/retrokit https://github.com/tholian-network/retrokit (both WIP)

gtsop 5y ago
Wait, but the case for TOR isn't to hide you are using TOR, but to blend in with the crowd of TOR users. Does my TOR browser give a different fingerprint than yours?
- cookiengineer 5y ago
  The IPs of TOR exit nodes are publicly known. I'm not sure people using TOR are aware of how the concept and peer discovery mechanism works. I mean, at some point you gotta ask yourself why cloudflare shows all TOR users a captcha in a targeted manner :)
  - coma_ 5y ago
    > I mean, at some point you gotta ask yourself why cloudflare shows all TOR users a captcha in a targeted manner :) Because exit node IP address' are known, you have just said it. How does it have anything to do with user fingerprinting? And how does it answer the question of @gtsop asking whether different users of ToR web browser have different distinguishable fingerprint or not?

khalby786 5y ago

How practical would this method of recognising your fingerprint with CSS be?

dsnr 5y ago
This, and also the power of tracking comes from being able to share data/track across domains. So the best way to mitigate this is not to dumb down our browsers but to fight cross domain access to this data. This can be done either by regulation (see GDPR) or technical measures (disabling cross-site scripting, cookies etc)
- zelphirkalt 5y ago
  They can simply exchange the data server side, no?
  - dsnr 5y ago
    In theory yes, but they can't use the data for legitimate business while also complying with the regulations.

zaik 5y ago

I wonder how unique this fingerprint really is. Getting the same fingerprint every time is only half of what makes a good fingerprint. Fennec on Android: cdec914cb91d1a88fbd3e7834b7968c8

twhitmore 5y ago
Agreed. It's not a "fingerprint" at all as in most cases, it won't be remotely unique. For example: every user in the world with the same screen size, browser & platform will get the same result. For desktop it's window size rather than screen, but coarsely bucketed. Thousands or millions will share the same fingerprint. It seems somewhat unrealistic to ascribe much advertisement or tracking value to this.
- farias0 5y ago
  But this are not the only info. OS language, dark mode preferences, fonts installed, all this stuff goes a long way in helping pinpointing you.
farias0 5y ago
Yep, this site should tell you if your fingerprint is unique among all the other visitors, like other fingerprint sites do. I know a positive would only be meaningful if the website gets popular, but a negative would say a lot regardless.

ComodoHacker 5y ago

After 3+ months, they haven't published any data, or I just couldn't find it. Which kind of makes the whole endeavor meaningless.

scotty79 5y ago

DuckDuckGo android browser I'm currently using doesn't prevent me from getting consistently fingerprinted.

caaqil 5y ago

The fingerprint changes on every refresh for me. I have uBlock, Privacy Badger and similar extensions enabled if that matters.

niffydroid 5y ago

While this is cool and handy, sadly not of any use to me. According to Uk ICO (Information Commissioner Office) Fingerprinting has to have consent. https://ico.org.uk/for-organisations/guide-to-pecr/what-are-pecr/ https://ico.org.uk/for-organisations/guide-to-pecr/what-are-... "PECR also applies to ‘similar technologies’ like fingerprinting techniques. Therefore, unless an exemption applies, any use of device fingerprinting requires the provision of clear and comprehensive information as well as the consent of the user or subscriber."

Gwypaas 5y ago
I would rather see it as a way to easily demonstrate why GPDR is not simply about cookies and their management. It concerns any method of creating an identifier which would allow for tracking.
kwhitefoot 5y ago
Why sadly? Why would you want to fingerprint users browsers anyway?

captainmuon 5y ago

I wonder why we are not seeing more completely server-side analytics. With tricks like this you can get by with no or only minimal JavaScript. You can also set a session cookie to be more accurate. If the cookie is neccessary for the functioning of the site, you don't even need GDPR consent. Practially, and I know this is cynical, but you don't really have to follow the GDPR, you just have to make sure there is no outside sign you are tracking users. And frankly, if I had a website, I would want accurate statistics, but I would want to avoid a cookie prompt, and I would want as little external javascript as possible. So it is weird that there is no black-hat stealth visitor analytics yet.

notriddle 5y ago
> Practially, and I know this is cynical, but you don't really have to follow the GDPR, you just have to make sure there is no outside sign you are tracking users. Why bother, then? I mean this in the relatively broad philosophical sense. There are few who seek pain, simply because it is pain, and there are few who implement complex tracking schemes simply to implement complex tracking schemes. They only go through this much work if there is some pleasure or profit to be gained from it. If you start doing significantly-meaningful ad targeting, someone might notice the striking correlation. If you're a big enough organization for the practice to become dangerous, then even if nobody on the outside notices, someone might leak. What's the point in gathering the information if you can't use it for fear of someone figuring out what you did?

danuker 5y ago

With the latest Tor Browser (11.0.4 based on Mozilla Firefox 91.5.0esr) on Arch Linux, I get the following: * 9dfe9b69a9f18ef1c0d313aa4c013b52 in regular windowed mode * 0fa96aa3ae2698bc2d1187f39b79db36 in fullscreen mode (F11). Does anyone else get any of these fingerprints? If so, that is evidence that Tor Browser is well-designed. If not, that is evidence of some details overlooked.

mrob 5y ago

I am unpleasantly surprised that Firefox's "ui.prefersReducedMotion" preference is detectable from CSS. I expected a preference starting with "ui" to only affect the UI. It should be possible to reduce (or ideally remove) UI animations without affecting web pages.

ChicagoBoy11 5y ago
I'd figure most web-apps have UI-like interfaces (contrasting with just static pages), so I can see why it might be useful for sites to be able to minimize transitions/effects/motion/etc. that may exist on their page.
XCSme 5y ago
Isn't the main point of the user preference flag to allow the website developer to serve a reduced-motion version of the site?
- mrob 5y ago
  AFAIK, all the other ui.* preference affect the Firefox UI, not websites, so it's a misleading name. And I have already disabled web page animations in userContent.css[0], which is the correct place for modifying CSS. I shouldn't have to choose between allowing annoying UI animations and allowing fingerprinting. [0]To disable web page animations, in Chrome/userContent.css in your Firefox profile directory: @namespace url(http://www.w3.org/1999/xhtml); *, :before, :after { transition: none !important; animation-delay: 0ms !important; animation-duration: 0ms !important; } This also requires setting toolkit.legacyUserProfileCustomizations.stylesheets to true in about:config

farzher 5y ago

win11, brave/chrome, 1440p 165hz: 9b93344ef597a0b8ef7184d4a693d548

v3ss0n 5y ago

That is quite shitty way to fingerprint. Imagine an Office full of old people who don't bother to install or configure their own OS/Browser/Fonts and they only use company provided Laptops whicha ll of them are same , with Default windows 10 ? (or 7) That would generate same fingerprint. What a uselsss way, Should not call it fingerprinting .

charcircuit 5y ago

My fingerprint is 05340cc39b7388b85993bd6117d4ebbb

alkonaut 5y ago

This doesn’t worry me too much, the value seems like it should be the exact same hash for any iOS Safari visitor with the same screen resolution and browser language? I’d be fingerprinted as part of a group of (probably) several hundred thousand. 8d666b05c42878d6d6d364c410a4eef2 It’s a shame that browsers leak things like font presence, but of course when sites can read back canvas contents without querying the user is when it all goes out the window.

NavinF 5y ago
Chrome (Safari) on iPhone 13 Pro Max: db9df4c8c770242aaf1e0efdd5cf8ab2 There’s likely enough info in the hash to figure out exactly what device I’m on since nothing else will have the same pixel density, screen height, and screen width: https://stackoverflow.com/questions/46313640/iphone-x-8-8-plus-css-media-queries#46313641 https://stackoverflow.com/questions/46313640/iphone-x-8-8-pl... Dark mode adds on one more bit, but everything else should be the same across iOS devices. Not sure if that’s enough to track individuals among a small userbase every time their IP address changes.
- HWR_14 5y ago
  I'm pretty sure the Pro Max 12 has the same screen settings. I also wonder about maximized windows on a 1080p monitor. I know DPI of desktop monitors at one point was a constant returned value.

cmeacham98 5y ago

I have Firefox RFP enabled, and as far as I know all these values will be the same across RFP users except the size of the browser window (which seems like a poor fingerprinting metric given the fact I can and do resize my browser during usage) - and maybe pixel density? (can't tell if this one is standardized or not). If there are any other RFP users out there compare to mine and see if you get anything different other than browser window size: https://noscriptfingerprint.com/result/yiRFTom5qPpKPxOl https://noscriptfingerprint.com/result/yiRFTom5qPpKPxOl

emrex 5y ago
What if you are the only one in your area that uses FF RFP ?
zelphirkalt 5y ago
It says: "4. Click the toggle button until “true” changes to “false”" But for me there is no toggle button. It seems to not be able to do anything, with my blocker settings. When I allow the site, I see, that it did change the screen resolution result compared to yours.
Urd- 5y ago
Yes, my signals only differ by screen size.
nieve 5y ago
Even without RFP it seems to be very fragile, just resizing my window completely changes the result.
- jefftk 5y ago
  That's because it is including the dimensions of your window as part of your fingerprint. If your goal is to track users as they move across sites, matching browser size makes sense.
  - c0balt 5y ago
    FYI, TOR browser has set a default browser resolution that ignore resizing to mitigate this issue. This might only make you blend in with other TOR users but this approach to resist device/ interface fingerprinting is quite interesting.