4 ms·

The operational problem with these things is how do you deal with time? Over time folks upgrade plugins/browsers etc, making it not match the previous fingerpri

by ojilles 13y ago

The operational problem with these things is how do you deal with time? Over time folks upgrade plugins/browsers etc, making it not match the previous fingerprint. Therefore you won't be able to stitch two sessions together as belong to one person (who did the upgrade in between). Sounds to me directly opposing the core idea behind these techniques. (E.g. bringing it from unique identifier to persistent unique identifier)

Homunculiheaded 13y ago
If you read the actual paper referenced [0] you'll see that they explicitly mention this. Since they assumed that users were interactively trying to change their foot print, the looked at uses who had changed their settings within 1-2 hours: "We ran our algorithm over the set of users whose cookies indicated that they were returning to the site 1-2 hours or more after their first visit, and who now had a different fingerprint. Excluding users whose fingerprints changed because they disabled javascript (a common case in response to visiting panopticlick.eff.org, but perhaps not so common in the real world), our heuristic made a correct guess in 65% of cases, an incorrect guess in 0.56% of cases, and no guess in 35% of cases. 99.1% of guesses were correct, while the false positive rate was 0.86%. Our algorithm was clearly very crude, and no doubt could be significantly improved with effort." (any typos here are likely the result of copy/pasting from the pdf) 0. https://panopticlick.eff.org/browser-uniqueness.pdf https://panopticlick.eff.org/browser-uniqueness.pdf
- ojilles 13y ago
  Missed that, but basically confirms the point (not being able to track ~35% of the cases is quite a big gap)
fingerprinter 13y ago
This was/is a tough issue. The easiest way, tbh, is to look at patterns for that fingerprint(s) rather than assume they are all unique. This is where a rules engine comes into play. The "real" way to do this is to track upgrading components (like plugins etc) and create new fingerprints as they evolve, associate them with the old ones and over time sunset old fingerprints. This is harder to do in practice, though. Also, some fingerprinting approaches track things like monitor resolution, which is tough b/c a docked laptop has a different fingerprint than the same undocked laptop. So the approach differs based on what you track.

by ojilles 13y ago

Homunculiheaded 13y ago

If you read the actual paper referenced [0] you'll see that they explicitly mention this. Since they assumed that users were interactively trying to change their foot print, the looked at uses who had changed their settings within 1-2 hours: "We ran our algorithm over the set of users whose cookies indicated that they were returning to the site 1-2 hours or more after their first visit, and who now had a different fingerprint. Excluding users whose fingerprints changed because they disabled javascript (a common case in response to visiting panopticlick.eff.org, but perhaps not so common in the real world), our heuristic made a correct guess in 65% of cases, an incorrect guess in 0.56% of cases, and no guess in 35% of cases. 99.1% of guesses were correct, while the false positive rate was 0.86%. Our algorithm was clearly very crude, and no doubt could be significantly improved with effort." (any typos here are likely the result of copy/pasting from the pdf) 0. https://panopticlick.eff.org/browser-uniqueness.pdf https://panopticlick.eff.org/browser-uniqueness.pdf

ojilles 13y ago
Missed that, but basically confirms the point (not being able to track ~35% of the cases is quite a big gap)

fingerprinter 13y ago

This was/is a tough issue. The easiest way, tbh, is to look at patterns for that fingerprint(s) rather than assume they are all unique. This is where a rules engine comes into play. The "real" way to do this is to track upgrading components (like plugins etc) and create new fingerprints as they evolve, associate them with the old ones and over time sunset old fingerprints. This is harder to do in practice, though. Also, some fingerprinting approaches track things like monitor resolution, which is tough b/c a docked laptop has a different fingerprint than the same undocked laptop. So the approach differs based on what you track.