3 ms·

The New York Times uses libraries (versions) A,B,C, and D. Wikileaks uses A,B,D and F. I see that you have A,B,D and F cached - that allows me to rule out the N

The New York Times uses libraries (versions) A,B,C, and D. Wikileaks uses A,B,D and F. I see that you have A,B,D and F cached - that allows me to rule out the NYT and predict with some degree of confidence that you visited Wikileaks. You can make up theoretical models for how many popular libraries there are, or how many sites, and say this should or shouldn't be possible. I haven't seen any such models, but advertisers were definitely using this technique in the wild so the models that say it's impossible are all wrong. Adding noise to a small sample of requests doesn't buy you that much entropy - the signal is a little noisy anyway.

colordrops 5y ago
This would work if you only visited like 5 sites. If you visit thousands, and more like tens of thousands when you consider 3rd party embedded content, you can't figure out which sites a user visits, but rather only which ones they don't.
- EwanToo 5y ago
  It worked pretty effectively. Think about the 10,000s of JavaScript libraries out there, and the 100s of versions of each.
- madacol 5y ago
  number of libraries * number of versions ~= bits of information to classify you A good intuition is that although there's low certainty which site you have visited, there's high certainty which sites you HAVE NOT visited I think is easier to see how you can fingerprint someone based on the set of sites they HAVE NOT visited Edit: I'm not so sure anymore, I think that requires to test looots of libraries, it's not practical unless you are a really nasty ad company that tests hundreds of libraries in the background really sucking up your bandwidth
- madacol 5y ago
  I got a better idea Imagine ad companies choose libraries that are roughly used by 50% of users, if they test you with 10 of those, they learn ~10bits of entropy to classify you, i.e. which of the 1024 classifications you belong

colordrops 5y ago

This would work if you only visited like 5 sites. If you visit thousands, and more like tens of thousands when you consider 3rd party embedded content, you can't figure out which sites a user visits, but rather only which ones they don't.

EwanToo 5y ago
It worked pretty effectively. Think about the 10,000s of JavaScript libraries out there, and the 100s of versions of each.
madacol 5y ago
number of libraries * number of versions ~= bits of information to classify you A good intuition is that although there's low certainty which site you have visited, there's high certainty which sites you HAVE NOT visited I think is easier to see how you can fingerprint someone based on the set of sites they HAVE NOT visited Edit: I'm not so sure anymore, I think that requires to test looots of libraries, it's not practical unless you are a really nasty ad company that tests hundreds of libraries in the background really sucking up your bandwidth
madacol 5y ago
I got a better idea Imagine ad companies choose libraries that are roughly used by 50% of users, if they test you with 10 of those, they learn ~10bits of entropy to classify you, i.e. which of the 1024 classifications you belong