8 ms·

Several people mention Ghostery[0] against trackers. It offers only partial protection. It is possible to fingerprint a browser without any custom tracking data

by pygy_ 14y ago

Several people mention Ghostery[0] against trackers. It offers only partial protection. It is possible to fingerprint a browser without any custom tracking data. https://panopticlick.eff.org/ https://panopticlick.eff.org/ <-- check how unique your browser is. Instead of a script to embed, these firms could provide an API to identify users from the server side. The scripts that captures the profile would be served by the sites themselves rather than from third party services. Toast. A possible solution would be anonymize the browser fingerprint, at least in private mode, ie lie about the details of the system. Google, Mozilla, Opera, can you hear me? -- [0] http://www.ghostery.com/ http://www.ghostery.com/

001sky 14y ago
A possible solution would be anonymize the browser fingerprint, at least in private mode, ie lie about the details of the system. Google, Mozilla, Opera, can you hear me? == This. The system needs to be fixed. Need to know (only) vs nice to know info exch, etc.
- deleted 14y ago
  [deleted]
- guessWhy 14y ago
  Yes, but it takes more than removing most of the identifying information. First, the precise browser version and OS can probably always be identified by checking for supported features, bugs etc. even if the extreme measure would be taken to remove the user agent string. Add the screen resolution, IP, timing and request patterns (+) and we are all screwed. (+) e.g. rule out users that are using other sites at the same time. Note that it would be possible to determine if a page is in the currently focused and visible browser tab and forward that information to the tracker.
  - sounds 14y ago
    But why make it easier for the site to track you? Force them to do detailed packet timing and their costs will go up, and it will become less economical for black hats to play around with your personal data. I don't know if nuking the user agent string is a horrible idea, but it's less of a problem today than it was 5 years ago: today, a website can assume all browsers conform pretty closely to a standard. Only really advanced features require user agent sniffing (arguably, if you're sniffing the UA you're doing it wrong). I think we should make that kind of fingerprinting opt-in, not opt-out.
    - guessWhy 14y ago
      I think changing the user agent to only report the major version would already go a long way.
  - jamesbritt 14y ago
    Yes, but it takes more than removing most of the identifying information. The trick is not to remove information, but to poison it. For example, Panopticlick sees that I have dozens of "system fonts", enough to stand out. I want my browser to lie about the fonts I have, based on settings I choose. There are many details about my browser and system that are irrelevant to what most sites need to do so lying about them should not interfere with viewing a site.
    - mrgreenfur 14y ago
      This is a great point. I totally agree, if you adjust simple things on each visit, then you can use their extra bits of identification against them, in a very obscure way, without limiting the actual checks of functionality that the sites use.
    - luchs 14y ago
      These system fonts are detected through Flash/Java. Disabling these will fix this.
      - jamesbritt 14y ago
        I don't want to provide less, but still accurate, data, I want to introduce suspect data. The end result should be that anyone collecting data on me without my consent should have no idea which of it are accurate such that all of it becomes useless.
- jval 14y ago
  > The system needs to be fixed. This is another problem with having an advertising company (Google) supply a browser that is very popular (Chrome). In fact, Safari and IE are also run by companies with large presences in the online ad market. I doubt Google in particular will risk antitrust suits by blocking these kinds of very, very unsettling but unfortunately legal trackers, which in part are not so technologically different to GA but combine a few more bits of tech which makes them awfully invasive. We might be able to hack technological solutions together here but this stuff rarely makes it out into people's mainstream browsers. The most important way of securing people's data over the next 10 years is going to be by way of the browser and the mobile OS, but the thing that is most easily achievable is to have a solid browser that people can trust on to implement privacy-preserving technologies. The only browser I can realistically see doing that is Firefox.
  - 18pfsmt 14y ago
    I see both your points (browser vendors and extension distribution issues), and I think Mozilla has shown great respect for their users. However, Mozilla's primary revenue source is Google. Maybe taking a page out of the enterprise play book and using a proxy, like Squid, would make sense. From reading the Squid manual, it seems like it could play a role as it is quite extensible and sophisticated. Making it easy to setup and customize would be pretty difficult from what I can tell, unfortunately.
dsr_ 14y ago
Not only does panopticlick say my browser is unique, but it said that last time I visited it, several months ago. Maybe it's forgotten. Maybe it lies. Maybe every time I rev Firefox Nightly I change identity. What is true is that every time I leave an email address, it's tagged with the name of the site where I left it.
- cheald 14y ago
  > Maybe every time I rev Firefox Nightly I change identity. Indeed; the user agent is part of the fingerprint.
- guessWhy 14y ago
  You said it yourself: everytime your Firefox build is updated, you change identity.
  - georgemcbay 14y ago
    Considering the development model used by most modern web browsers, I'm pretty certain those who do this type of fingerprinting in the real world will long ago have adjusted their matching algorithms to be aware of this. I doubt they even care if they get a fully unique fingerprint, they probably just define some percentage of matching as being "close enough to a likely match" to report you as being someone they have seen before. Just mentioning this lest anyone get the wrong idea that setting your browser to update frequently might be a defense.
    - peterwwillis 14y ago
      Identity matching algorithms use a fuzzy match to identify users because the only way to get an exact match is with by storing an identifier on the user's machine, or in memory for the duration of the browsing session. A lot of factors can change and it may not significantly alter the weight of the match.
    - sparkie 14y ago
      One of the most effective methods of fingerprinting people is to enumerate the fonts they have installed on their machines (via flash). You don't even need the browser version number to uniquely identify most - the only solution is to disable flash.
andrewcooke 14y ago
if the data transfer is done from the client (and i bet it is, as it's much harder to persuade people to run code on their servers) then ghostery and the like still work, because they block the transfer (since the code to do the transfer must be loaded from the weasel site - same origin policy).
- pygy_ 14y ago
  Nah. +-------+ +----------------+ +------------+ |Browser|<==A==>| Visited server |<==B==>| ID service | +-------+ +----------------+ +------------+ The client data acquisition is done through A (AJAX), then that info is sent through B (API call) to get the identity. The browser doesn't interact directly with the ID service. The data acquisition scripts would be served directly by the web sites.
  - andrewcooke 14y ago
    did you read the article? they explicitly say it's implemented in the browser with "tracking code". you can certainly make something that is "ghostery proof", but (1) this isn't it and (2) it would be more complex to deploy and so gain less traction.
    - pygy_ 14y ago
      I read the article, and you didn't get my post. It wasn't about this very company, but tracking in general, which can be implemented without serving code from a third party server. If solutions like Ghostery become the norm, there are still workarounds, and they will catch up if nothing else works.
jdangu 14y ago
A good workaround for panopticlick would be to append a random string to the useragent for example, effectively making your fingerprint unique all the time.
- pygy_ 14y ago
  They'd just remove the random string... The browser UA is only one component of the fingerprint, and probably not the most important one.
  - jdangu 14y ago
    I think you always win in that cat and mouse game. Add some fake entries to the list of plugins, to the list of fonts, ...
- pkulak 14y ago
  It would have to be something a human couldn't engineer around. Like, adding one random extension that you don't have installed. Though, this could cause issues with legitimate sites. The problem is that if it's bogus noise, it can be removed. If it's legitimate information, it's going to screw up something legitimate that relies on it. Maybe make up an extension name that doesn't exist for every request?
ck2 14y ago
Also when you update Ghostery buglists, it whitelists some sites, you have to select all on purpose each time.
- pygy_ 14y ago
  good to know. Thanks.
- dcreemer 14y ago
  I think you can set Ghostery to block by default: see Ghostery prefs > Advanced > Auto Update > Block new elements by default.
wladimir 14y ago
I'm not sure about Ghostery, but the TOR Browser bundle (based on Firefox, see https://blog.torproject.org/blog/effs-panopticlick-and-torbutton https://blog.torproject.org/blog/effs-panopticlick-and-torbu...) does apply a few tricks to normalize the browser fingerprint.
Alaskan005 14y ago
A possible solution would be anonymize the browser fingerprint, at least in private mode, ie lie about the details of the system. Plus one for this. I wonder if a plugin alone could change enough info to fool the trackers?
alexkus 14y ago
> lie about the details of the system Rather than trying to hide everything another tactic is to provide random misinformation (different user-agent strings, only presenting a subset of fonts and plugins, etc). Enough to defeat the fuzzy matching that does go on. Sure you've got to be careful that you don't do things that may break some sites that rely on this information remaining stable during a session, but that's got far less common with the frequent browser upgrades that go on nowadays.
- Ziomislaw 14y ago
  doesn't this tactic make you even more unique? if a browser behaves differently than the rest of them... imho the best strategy would be to copy one behaviour everywhere, so that there could be no way to differentiate between users.
troels 14y ago
Instead of a script to embed, these firms could provide an API to identify users from the server side. The scripts that captures the profile would be served by the sites themselves rather than from third party services. ... Toast. Not really. If they share data on the server side, they wouldn't be able to share a cookie - they would have to rely on other means to identify you, such as IP address etc. Not entirely impossible, but not as precise either. And that is spoofable through proxies etc.
- d_j_s 14y ago
  Cookies are only used to track your return on that one particular domain. The matching of browser profiles won't be done on the client side. These scripts will only track you and not receive information.
  - troels 14y ago
    No, but the identification relies on a cookie placed on the 3rd-party site (leadlander.com). With that domain blocked, there would not longer be a way to identify the user across different sites, which is a key element of this thing working.
    - d_j_s 14y ago
      That's not correct, you as a user run a snippet of leadlander js code on your web page. This code has no access to the cookies on a leadlander domain. I've worked on a similar tracking snippet/system for http://www.projectcounter.org/ http://www.projectcounter.org/ and this was one of the first things we attempted. If you block the leadlander domain(s) the script will obviously not run and also consequently won't be able to send fingerprint details back.
scrrr 14y ago
I just played around with a Chrome-extension to mess around with panopticlick. In case anyone wants to continue: http://lukaszielinski.de/blog/posts/2012/12/12/panopticlick/ http://lukaszielinski.de/blog/posts/2012/12/12/panopticlick/
thinkling 14y ago
I'm quite surprised that panopticlick says I'm uniquely identifiable with Chrome based solely on the browser plugins reported, even though the ones I have are quite pedestrian: just Chrome PDF viewer, QuickTime, PepperFlash, and Flash. In Firefox, the plugins get them to 1 in 860,000 which leaves only 3 possibilities in their DB of 2.5 mln, even though Firefox loads only QuickTime and Flash. It must be the combination of codecs I have installed. How do I go about cleaning that up?

by pygy_ 14y ago

001sky 14y ago

A possible solution would be anonymize the browser fingerprint, at least in private mode, ie lie about the details of the system. Google, Mozilla, Opera, can you hear me? == This. The system needs to be fixed. Need to know (only) vs nice to know info exch, etc.

deleted 14y ago
[deleted]
guessWhy 14y ago
Yes, but it takes more than removing most of the identifying information. First, the precise browser version and OS can probably always be identified by checking for supported features, bugs etc. even if the extreme measure would be taken to remove the user agent string. Add the screen resolution, IP, timing and request patterns (+) and we are all screwed. (+) e.g. rule out users that are using other sites at the same time. Note that it would be possible to determine if a page is in the currently focused and visible browser tab and forward that information to the tracker.
- sounds 14y ago
  But why make it easier for the site to track you? Force them to do detailed packet timing and their costs will go up, and it will become less economical for black hats to play around with your personal data. I don't know if nuking the user agent string is a horrible idea, but it's less of a problem today than it was 5 years ago: today, a website can assume all browsers conform pretty closely to a standard. Only really advanced features require user agent sniffing (arguably, if you're sniffing the UA you're doing it wrong). I think we should make that kind of fingerprinting opt-in, not opt-out.
  - guessWhy 14y ago
    I think changing the user agent to only report the major version would already go a long way.
- jamesbritt 14y ago
  Yes, but it takes more than removing most of the identifying information. The trick is not to remove information, but to poison it. For example, Panopticlick sees that I have dozens of "system fonts", enough to stand out. I want my browser to lie about the fonts I have, based on settings I choose. There are many details about my browser and system that are irrelevant to what most sites need to do so lying about them should not interfere with viewing a site.
  - mrgreenfur 14y ago
    This is a great point. I totally agree, if you adjust simple things on each visit, then you can use their extra bits of identification against them, in a very obscure way, without limiting the actual checks of functionality that the sites use.
  - luchs 14y ago
    These system fonts are detected through Flash/Java. Disabling these will fix this.
    - jamesbritt 14y ago
      I don't want to provide less, but still accurate, data, I want to introduce suspect data. The end result should be that anyone collecting data on me without my consent should have no idea which of it are accurate such that all of it becomes useless.
jval 14y ago
> The system needs to be fixed. This is another problem with having an advertising company (Google) supply a browser that is very popular (Chrome). In fact, Safari and IE are also run by companies with large presences in the online ad market. I doubt Google in particular will risk antitrust suits by blocking these kinds of very, very unsettling but unfortunately legal trackers, which in part are not so technologically different to GA but combine a few more bits of tech which makes them awfully invasive. We might be able to hack technological solutions together here but this stuff rarely makes it out into people's mainstream browsers. The most important way of securing people's data over the next 10 years is going to be by way of the browser and the mobile OS, but the thing that is most easily achievable is to have a solid browser that people can trust on to implement privacy-preserving technologies. The only browser I can realistically see doing that is Firefox.
- 18pfsmt 14y ago
  I see both your points (browser vendors and extension distribution issues), and I think Mozilla has shown great respect for their users. However, Mozilla's primary revenue source is Google. Maybe taking a page out of the enterprise play book and using a proxy, like Squid, would make sense. From reading the Squid manual, it seems like it could play a role as it is quite extensible and sophisticated. Making it easy to setup and customize would be pretty difficult from what I can tell, unfortunately.

dsr_ 14y ago

Not only does panopticlick say my browser is unique, but it said that last time I visited it, several months ago. Maybe it's forgotten. Maybe it lies. Maybe every time I rev Firefox Nightly I change identity. What is true is that every time I leave an email address, it's tagged with the name of the site where I left it.

cheald 14y ago
> Maybe every time I rev Firefox Nightly I change identity. Indeed; the user agent is part of the fingerprint.
guessWhy 14y ago
You said it yourself: everytime your Firefox build is updated, you change identity.
- georgemcbay 14y ago
  Considering the development model used by most modern web browsers, I'm pretty certain those who do this type of fingerprinting in the real world will long ago have adjusted their matching algorithms to be aware of this. I doubt they even care if they get a fully unique fingerprint, they probably just define some percentage of matching as being "close enough to a likely match" to report you as being someone they have seen before. Just mentioning this lest anyone get the wrong idea that setting your browser to update frequently might be a defense.
  - peterwwillis 14y ago
    Identity matching algorithms use a fuzzy match to identify users because the only way to get an exact match is with by storing an identifier on the user's machine, or in memory for the duration of the browsing session. A lot of factors can change and it may not significantly alter the weight of the match.
  - sparkie 14y ago
    One of the most effective methods of fingerprinting people is to enumerate the fonts they have installed on their machines (via flash). You don't even need the browser version number to uniquely identify most - the only solution is to disable flash.

andrewcooke 14y ago

if the data transfer is done from the client (and i bet it is, as it's much harder to persuade people to run code on their servers) then ghostery and the like still work, because they block the transfer (since the code to do the transfer must be loaded from the weasel site - same origin policy).

pygy_ 14y ago
Nah. +-------+ +----------------+ +------------+ |Browser|<==A==>| Visited server |<==B==>| ID service | +-------+ +----------------+ +------------+ The client data acquisition is done through A (AJAX), then that info is sent through B (API call) to get the identity. The browser doesn't interact directly with the ID service. The data acquisition scripts would be served directly by the web sites.
- andrewcooke 14y ago
  did you read the article? they explicitly say it's implemented in the browser with "tracking code". you can certainly make something that is "ghostery proof", but (1) this isn't it and (2) it would be more complex to deploy and so gain less traction.
  - pygy_ 14y ago
    I read the article, and you didn't get my post. It wasn't about this very company, but tracking in general, which can be implemented without serving code from a third party server. If solutions like Ghostery become the norm, there are still workarounds, and they will catch up if nothing else works.

jdangu 14y ago

A good workaround for panopticlick would be to append a random string to the useragent for example, effectively making your fingerprint unique all the time.

pygy_ 14y ago
They'd just remove the random string... The browser UA is only one component of the fingerprint, and probably not the most important one.
- jdangu 14y ago
  I think you always win in that cat and mouse game. Add some fake entries to the list of plugins, to the list of fonts, ...
pkulak 14y ago
It would have to be something a human couldn't engineer around. Like, adding one random extension that you don't have installed. Though, this could cause issues with legitimate sites. The problem is that if it's bogus noise, it can be removed. If it's legitimate information, it's going to screw up something legitimate that relies on it. Maybe make up an extension name that doesn't exist for every request?

ck2 14y ago

Also when you update Ghostery buglists, it whitelists some sites, you have to select all on purpose each time.

pygy_ 14y ago
good to know. Thanks.
dcreemer 14y ago
I think you can set Ghostery to block by default: see Ghostery prefs > Advanced > Auto Update > Block new elements by default.

wladimir 14y ago

I'm not sure about Ghostery, but the TOR Browser bundle (based on Firefox, see https://blog.torproject.org/blog/effs-panopticlick-and-torbutton https://blog.torproject.org/blog/effs-panopticlick-and-torbu...) does apply a few tricks to normalize the browser fingerprint.

Alaskan005 14y ago

A possible solution would be anonymize the browser fingerprint, at least in private mode, ie lie about the details of the system. Plus one for this. I wonder if a plugin alone could change enough info to fool the trackers?

alexkus 14y ago

> lie about the details of the system Rather than trying to hide everything another tactic is to provide random misinformation (different user-agent strings, only presenting a subset of fonts and plugins, etc). Enough to defeat the fuzzy matching that does go on. Sure you've got to be careful that you don't do things that may break some sites that rely on this information remaining stable during a session, but that's got far less common with the frequent browser upgrades that go on nowadays.

Ziomislaw 14y ago
doesn't this tactic make you even more unique? if a browser behaves differently than the rest of them... imho the best strategy would be to copy one behaviour everywhere, so that there could be no way to differentiate between users.

troels 14y ago

Instead of a script to embed, these firms could provide an API to identify users from the server side. The scripts that captures the profile would be served by the sites themselves rather than from third party services. ... Toast. Not really. If they share data on the server side, they wouldn't be able to share a cookie - they would have to rely on other means to identify you, such as IP address etc. Not entirely impossible, but not as precise either. And that is spoofable through proxies etc.

d_j_s 14y ago
Cookies are only used to track your return on that one particular domain. The matching of browser profiles won't be done on the client side. These scripts will only track you and not receive information.
- troels 14y ago
  No, but the identification relies on a cookie placed on the 3rd-party site (leadlander.com). With that domain blocked, there would not longer be a way to identify the user across different sites, which is a key element of this thing working.
  - d_j_s 14y ago
    That's not correct, you as a user run a snippet of leadlander js code on your web page. This code has no access to the cookies on a leadlander domain. I've worked on a similar tracking snippet/system for http://www.projectcounter.org/ http://www.projectcounter.org/ and this was one of the first things we attempted. If you block the leadlander domain(s) the script will obviously not run and also consequently won't be able to send fingerprint details back.

scrrr 14y ago

I just played around with a Chrome-extension to mess around with panopticlick. In case anyone wants to continue: http://lukaszielinski.de/blog/posts/2012/12/12/panopticlick/ http://lukaszielinski.de/blog/posts/2012/12/12/panopticlick/

thinkling 14y ago

I'm quite surprised that panopticlick says I'm uniquely identifiable with Chrome based solely on the browser plugins reported, even though the ones I have are quite pedestrian: just Chrome PDF viewer, QuickTime, PepperFlash, and Flash. In Firefox, the plugins get them to 1 in 860,000 which leaves only 3 possibilities in their DB of 2.5 mln, even though Firefox loads only QuickTime and Flash. It must be the combination of codecs I have installed. How do I go about cleaning that up?