10 seconds to id: -- ... It evidently takes about 40 connection attempts per counter-table entry to generate enough collisions, so about 10,000 attempts to id

10 seconds to id: -- ... It evidently takes about 40 connection attempts per counter-table entry to generate enough collisions, so about 10,000 attempts to identify a system. (The paper describes how to calculate "enough" but doesn't give a number). The time required to carry out this attack is about ten seconds, and the resources used are small enough that chances are good that it will go undetected. (Naturally, this discussion has passed over a lot of important details and is almost certainly wrong somewhere along the way; see the paper for the full story). This unique identifier has some interesting characteristics. It is entirely independent of the software being run, so it will remain the same even if the user switches browsers. or just fetches a page with a tool like curl. It is also the same regardless of the site that is being connected to, so it works well for tracking users across multiple sites. Different containers running on the same host will all have the same identifier. Even systems with identical hardware and software configurations will produce different identifiers. In other words, this ability to identify a system looks like a gift to the surveillance capitalists out there. It does have a few limitations, though. It does not work through networks like Tor, since connections are terminated within the Tor network and initiated anew at an exit node. Network-address translation (NAT) systems, which reassign port numbers, can also interfere with the identification. As the authors point out, though, increasing use of IPv6 is likely to reduce the use of NAT, making NAT interference less of a problem. ...