4 ms·

Enabling click to play for plugins in Chrome is already possible and makes you much less trackable. You will get much less bits of identifying information in pa

by jannes 15y ago

Enabling click to play for plugins in Chrome is already possible and makes you much less trackable. You will get much less bits of identifying information in panopticlick because your fonts and some other things can't be read out without Flash or Java.

fjarlq 15y ago
You sure about that? I already do click-to-play for plugins in Chrome, and it doesn't seem to help much. According to Panopticlick, there are 19.75 bits of data in my Browser Plugin Details, and for the "value" it describes all the plugins I have enabled. Also with click-to-play enabled, Panopticlick can see my system fonts (20.75+ bits of data, one in 1,769,122 browsers has this value). Apparently Panopticlick is not using one of my plugins to get that data... I haven't whitelisted eff.org or otherwise enabled plugins there. Looks like Panopticlick is using JavaScript/CSS font detection methods: http://www.lalit.org/lab/javascript-css-font-detect/ http://www.lalit.org/lab/javascript-css-font-detect/ Hmm... Panopticlick reports "No Flash or Java fonts detected" when I try it with IE9 on the same system. Is IE9 doing something to block Javascript/CSS detection of those fonts, or does Panopticlick have a bug with IE9 or what? Looks like that method worked for IE6/7...
- fjarlq 15y ago
  Whoops, I have to take back what I wrote above. Somehow my Chrome had lost its click-to-play setting. I don't remember unsetting that... hrm. Anyway, with click-to-play enabled you are correct: Panopticlick cannot see my fonts. Sorry about the confusion. However, with click-to-play definitely enabled, Panopticlick can still see my Browser Plugin Details.
justinschuh 15y ago
IIRC click-to-play doesn't prevent detection of the plugin; it just prevents it from initializing. And you should also be able to get at fonts by using CSS, SVG, or canvas just to name a few. As for the larger question, I really don't think there's any way of preventing sites from uniquely fingerprinting a given browser installation. There are just so many places where fingerprints leak through (and the behavior is relied on) that I'd expect it would take a massive overhaul of the web as we know it. Although, I'm a security guy not a privacy guy, so maybe I'm just too pessimistic.

by jannes 15y ago

fjarlq 15y ago

You sure about that? I already do click-to-play for plugins in Chrome, and it doesn't seem to help much. According to Panopticlick, there are 19.75 bits of data in my Browser Plugin Details, and for the "value" it describes all the plugins I have enabled. Also with click-to-play enabled, Panopticlick can see my system fonts (20.75+ bits of data, one in 1,769,122 browsers has this value). Apparently Panopticlick is not using one of my plugins to get that data... I haven't whitelisted eff.org or otherwise enabled plugins there. Looks like Panopticlick is using JavaScript/CSS font detection methods: http://www.lalit.org/lab/javascript-css-font-detect/ http://www.lalit.org/lab/javascript-css-font-detect/ Hmm... Panopticlick reports "No Flash or Java fonts detected" when I try it with IE9 on the same system. Is IE9 doing something to block Javascript/CSS detection of those fonts, or does Panopticlick have a bug with IE9 or what? Looks like that method worked for IE6/7...

fjarlq 15y ago
Whoops, I have to take back what I wrote above. Somehow my Chrome had lost its click-to-play setting. I don't remember unsetting that... hrm. Anyway, with click-to-play enabled you are correct: Panopticlick cannot see my fonts. Sorry about the confusion. However, with click-to-play definitely enabled, Panopticlick can still see my Browser Plugin Details.

justinschuh 15y ago

IIRC click-to-play doesn't prevent detection of the plugin; it just prevents it from initializing. And you should also be able to get at fonts by using CSS, SVG, or canvas just to name a few. As for the larger question, I really don't think there's any way of preventing sites from uniquely fingerprinting a given browser installation. There are just so many places where fingerprints leak through (and the behavior is relied on) that I'd expect it would take a massive overhaul of the web as we know it. Although, I'm a security guy not a privacy guy, so maybe I'm just too pessimistic.