5 ms·

Couldn't most fingerprinting techniques be thwarted by just using a stock windows install in a frozen VM with a stock browser without changing anything? Wouldn'

Couldn't most fingerprinting techniques be thwarted by just using a stock windows install in a frozen VM with a stock browser without changing anything? Wouldn't that make you pretty boring as far as any potential variations go?

maeil 2y ago
Wouldn't a Macbook be the better platform to mimic as its hardware is so much more standardized? Considering techniques like Canvas fingerprinting.
- ranger_danger 2y ago
  My understanding is that a VM should already be mimicing standardized hardware, and that apple (especially desktop) users are such a small percentage compared to windows, that you wouldn't want to base anything trying to "blend in" on that.
- kccqzy 2y ago
  And by that logic an iPhone is an even better choice than a MacBook.
qqqult 2y ago
not really. webgl hardware parameters, canvas fingerprints, audio device fingerprints, javascript engine are pretty crazy. In addition if you use your device at all you probably have other fingerprints like custom fonts installed by you or apps, extensions & similar. Not to mention IP and session data like you being logged in in different services that any website can check. Try visiting something like https://abrahamjuliot.github.io/creepjs/ https://abrahamjuliot.github.io/creepjs/ [1] on "identical" incognito mobile devices or desktops and you'll get completely different fingerprint ids [1] this isn't even the best fingerprint extraction out there, just an eas to use open source one, there are some crazy advanced techniques not implemented in it
- ranger_danger 2y ago
  > this isn't even the best fingerprint extraction out there, just an eas to use open source one, there are some crazy advanced techniques not implemented in it What IS the best tool? What other techniques do you know of that it doesn't it implement? > you being logged in in different services that any website can check how so?
  - qqqult 2y ago
    > What IS the best tool? What other techniques do you know of that it doesn't it implement? The best fingerprinting tools aren't open source they're anti-botting services like CAPTCHA providers & probably ad networks. This particular service has implementations for several popular fignerprinting techniques but there are so many ways to measure the same thing that even if your fingerprint looks fine on one test a different test of the same measure could detect it as unique. For example a user font fingerprint could be implemented via JS tests, canvas rendering tests or CSS sheets (like in this paper). The tests that offer the highest degree of hardware variability and uniqueness that I've seen deal with rendering of test and images over canvas. > how so? By loading an image that can only be accessed if you're logged in your google / facebook / twitter accounts and checking if the image request returned an error. There's a repo that implements this for >30 different websites, but I can't remember it's name rn. I'll edit this comment later if I remember what it was called
    - ranger_danger 2y ago
      > an image that can only be accessed if you're logged in your google / facebook / twitter accounts I don't understand how this would work? Wouldn't there have to be some kind of cookie/storage that is accessible to third parties in order to know this? AFAIK this is exactly what angered people about Flash due to their use of cross-domain capable "super cookies".
      - qqqult 2y ago
        Here's one implementation: https://browserleaks.com/social#protection https://browserleaks.com/social#protection and https://robinlinus.github.io/socialmedia-leak/ https://robinlinus.github.io/socialmedia-leak/ Click the explanation & protection sections for info on how it works
michaelt 2y ago
Yes and no. If you go for a stock browser without changing anything - that means you can't install ublock origin, or noscript, or adjust the cookie settings. If the fingerprint detects you're running your browser in a VM? Because your canvas/webgl stuff reveals a graphics card that is only seen on VMs, or your mouse movement is characteristic of the way host OSes pass mouse movement to guest OSes? That's an unusual characteristic. If you freeze the VM and everyone else installs updates? Your configuration will gradually become unusual because of its age. And of course if you've got a 4k screen but you run your VM at 1920x1080, the gain in anonymity has come at the cost of most of your screen real estate. Also, if you do manage to completely resist tracking by IP address, by cookies, and by browser fingerprints? Your reward is that Cloudflare and Google ReCaptcha will give you endless tedious challenges. ReCaptcha has a special extra-slow mode, specifically to punish people like you. I hope you like clicking fire hydrants!
- LegionMammal978 2y ago
  FWIW, I've used a stock Windows VM + Chrome a few times for testing things. Of course you don't freeze it solid, you just take a snapshot before installing the browser, and revert to that snapshot whenever you want to update the OS. For the screen real-estate issue, just get a VM viewer that doesn't insist on showing the full screen. You also don't block cookies every second, you just wipe them regularly. The Captcha services don't particularly care, since obviously they don't want to punish people on a fresh system. They care far, far more about whether I'm going through a commercial VPN, doubly so if I'm using Tor. But if I'm really worried about IP tracking, I usually run it through my university network. Of course, a sufficiently-motivated fingerprinting service can surmount any barrier in theory, with typographic analysis and whatnot. But in practice, websites tend not to care to an extraordinary extent. E.g., I remember one person who was convinced that Google/YouTube used your specific IP address (not just your cookies, or your geo-IP location) as a major part of ad targeting. But lo and behold, the whole VM setup consistently gave me a generic set of ads, as did just wiping my browser cookies. Of course, their explanation was "Of course they're detecting that you're trying to sniff them out, so they're only giving you generic ads to uphold the conspiracy!" As if cookies + geo-IP weren't more than enough for 99.9% of users they want to display ads to.
dehrmann 2y ago
I used to work in this space. Your best bet is a recent iPhone. There are a lot of them out there, they're usually up-to-date, and Apple only releases a handful models with relevant differences per year.

maeil 2y ago

Wouldn't a Macbook be the better platform to mimic as its hardware is so much more standardized? Considering techniques like Canvas fingerprinting.

ranger_danger 2y ago
My understanding is that a VM should already be mimicing standardized hardware, and that apple (especially desktop) users are such a small percentage compared to windows, that you wouldn't want to base anything trying to "blend in" on that.
kccqzy 2y ago
And by that logic an iPhone is an even better choice than a MacBook.

qqqult 2y ago

not really. webgl hardware parameters, canvas fingerprints, audio device fingerprints, javascript engine are pretty crazy. In addition if you use your device at all you probably have other fingerprints like custom fonts installed by you or apps, extensions & similar. Not to mention IP and session data like you being logged in in different services that any website can check. Try visiting something like https://abrahamjuliot.github.io/creepjs/ https://abrahamjuliot.github.io/creepjs/ [1] on "identical" incognito mobile devices or desktops and you'll get completely different fingerprint ids [1] this isn't even the best fingerprint extraction out there, just an eas to use open source one, there are some crazy advanced techniques not implemented in it

ranger_danger 2y ago
> this isn't even the best fingerprint extraction out there, just an eas to use open source one, there are some crazy advanced techniques not implemented in it What IS the best tool? What other techniques do you know of that it doesn't it implement? > you being logged in in different services that any website can check how so?
- qqqult 2y ago
  > What IS the best tool? What other techniques do you know of that it doesn't it implement? The best fingerprinting tools aren't open source they're anti-botting services like CAPTCHA providers & probably ad networks. This particular service has implementations for several popular fignerprinting techniques but there are so many ways to measure the same thing that even if your fingerprint looks fine on one test a different test of the same measure could detect it as unique. For example a user font fingerprint could be implemented via JS tests, canvas rendering tests or CSS sheets (like in this paper). The tests that offer the highest degree of hardware variability and uniqueness that I've seen deal with rendering of test and images over canvas. > how so? By loading an image that can only be accessed if you're logged in your google / facebook / twitter accounts and checking if the image request returned an error. There's a repo that implements this for >30 different websites, but I can't remember it's name rn. I'll edit this comment later if I remember what it was called
  - ranger_danger 2y ago
    > an image that can only be accessed if you're logged in your google / facebook / twitter accounts I don't understand how this would work? Wouldn't there have to be some kind of cookie/storage that is accessible to third parties in order to know this? AFAIK this is exactly what angered people about Flash due to their use of cross-domain capable "super cookies".
    - qqqult 2y ago
      Here's one implementation: https://browserleaks.com/social#protection https://browserleaks.com/social#protection and https://robinlinus.github.io/socialmedia-leak/ https://robinlinus.github.io/socialmedia-leak/ Click the explanation & protection sections for info on how it works

michaelt 2y ago

Yes and no. If you go for a stock browser without changing anything - that means you can't install ublock origin, or noscript, or adjust the cookie settings. If the fingerprint detects you're running your browser in a VM? Because your canvas/webgl stuff reveals a graphics card that is only seen on VMs, or your mouse movement is characteristic of the way host OSes pass mouse movement to guest OSes? That's an unusual characteristic. If you freeze the VM and everyone else installs updates? Your configuration will gradually become unusual because of its age. And of course if you've got a 4k screen but you run your VM at 1920x1080, the gain in anonymity has come at the cost of most of your screen real estate. Also, if you do manage to completely resist tracking by IP address, by cookies, and by browser fingerprints? Your reward is that Cloudflare and Google ReCaptcha will give you endless tedious challenges. ReCaptcha has a special extra-slow mode, specifically to punish people like you. I hope you like clicking fire hydrants!

LegionMammal978 2y ago
FWIW, I've used a stock Windows VM + Chrome a few times for testing things. Of course you don't freeze it solid, you just take a snapshot before installing the browser, and revert to that snapshot whenever you want to update the OS. For the screen real-estate issue, just get a VM viewer that doesn't insist on showing the full screen. You also don't block cookies every second, you just wipe them regularly. The Captcha services don't particularly care, since obviously they don't want to punish people on a fresh system. They care far, far more about whether I'm going through a commercial VPN, doubly so if I'm using Tor. But if I'm really worried about IP tracking, I usually run it through my university network. Of course, a sufficiently-motivated fingerprinting service can surmount any barrier in theory, with typographic analysis and whatnot. But in practice, websites tend not to care to an extraordinary extent. E.g., I remember one person who was convinced that Google/YouTube used your specific IP address (not just your cookies, or your geo-IP location) as a major part of ad targeting. But lo and behold, the whole VM setup consistently gave me a generic set of ads, as did just wiping my browser cookies. Of course, their explanation was "Of course they're detecting that you're trying to sniff them out, so they're only giving you generic ads to uphold the conspiracy!" As if cookies + geo-IP weren't more than enough for 99.9% of users they want to display ads to.

dehrmann 2y ago

I used to work in this space. Your best bet is a recent iPhone. There are a lot of them out there, they're usually up-to-date, and Apple only releases a handful models with relevant differences per year.