5 ms·

There is a big flaw in using browser information as an identification token in this way as browsers change. I visit this site at least once a month and every t

by nikcub 13y ago

There is a big flaw in using browser information as an identification token in this way as browsers change. I visit this site at least once a month and every time it picks me as 'unique'. That is because each time i've either installed a plugin, installed a font, my browser version changes every 5 days with automatic updates, installed a new browser, installed a different browser, am using multiple browsers, am accessing from my phone, ipad, work computer, etc. This makes it useless for actually tracking people. To make browser fingerprinting anything more than useless in tracking you need an algorithm that fingerprints but doesn't capture everything - such as how hardware-locked licensing works and Windows Genuine Advantage - you can change your soundcard or any minor device and your overall ID/fingerprint is still the same (i'm struggling to remember what this technique is called). When reading the NSA revelations I dug through everything with an eye on wanting to know if they used browser or machine fingerprints to track users. They don't. There is enough unique information in IP address, cookies and email accounts alone. And I bet most people who are concerned by tacking online and impressive demos like this are still using their real IP address online, still accepting cookies, etc.

vxcvcx 13y ago
This site uses the same code as http://browserspy.dk/ http://browserspy.dk/ uses to identify your fonts installed. Its a flash plugin, so disabling flash will make it unable to list fonts. Yet another reason to not use flash. Its good to know that this functionality is not built into the actual browser.
- nikcub 13y ago
  HTML5 has been good enough to switch flash off for a while now. Probably longer than two years. My main browser hasn't had flash in that long or longer and I haven't missed anything. Most video sites revert to html5 video. You are also telling developers who track their flash install base to update their site to be compatible by voting against flash with your browser. More important, i've been disabling flash on the computers of non-tech friends and they don't seem to notice it either. If you need Java for banking, setup a second or third browser where you only access that site, and by only entering in the URL directly.
- nilved 13y ago
  It's not that simple. The fact that you have Flash disabled is itself identifying information.
raycmorgan 13y ago
In the fraud detection and ad tracking spaces there are companies that use this technique. They are able to adapt to changes in the browser (using statistics, cookies as bridges, your favorite shopping site's userId, etc). In the tracking world there are no silver bullets, so the more ways to connect different sessions, the better.
nilved 13y ago
> There is a big flaw in using browser information as an identification token in this way as browsers change. > I visit this site at least once a month and every time it picks me as 'unique'. That is because each time i've either installed a plugin, installed a font, my browser version changes every 5 days with automatic updates, installed a new browser, installed a different browser, am using multiple browsers, am accessing from my phone, ipad, work computer, etc. > This makes it useless for actually tracking people. Not at all. This site isn't a demonstration of tracking you, it's simply a measure of how unique your browser is. Somebody who actually cared about tracking you could trivially track changes: a profile with a set of 191 particular fonts and a later profile that is identical but with 190 fonts is probably the same person.
mjolk 13y ago
>And I bet most people who are concerned by tacking online and impressive demos like this are still using their real IP address online, How would one use a 'fake' IP address and expect traffic to make it back to him/her?
- saraid216 13y ago
  You can proxy things. Not providing your real IP was one of the central benefits of using TOR, for instance. I'm not enough of an expert to go into more detail, but the google keyword you want is "proxy".
  - mjolk 13y ago
    Sharing a proxy is far more concerning, security-wise than having a website guess who you are based on metadata.
- arthulia 13y ago
  With a VPN or some other kind of proxy possibly? Traffic is completely encrypted between you and a VPN, and the websites you are visiting only see the VPNs IP.
- tghw 13y ago
  https://www.torproject.org/ https://www.torproject.org/
  - mjolk 13y ago
    Tor isn't secure, nor is it really anonymous for these purposes.
saraid216 13y ago
https://github.com/saizai/cssfingerprint https://github.com/saizai/cssfingerprint

by nikcub 13y ago

vxcvcx 13y ago

This site uses the same code as http://browserspy.dk/ http://browserspy.dk/ uses to identify your fonts installed. Its a flash plugin, so disabling flash will make it unable to list fonts. Yet another reason to not use flash. Its good to know that this functionality is not built into the actual browser.

nikcub 13y ago
HTML5 has been good enough to switch flash off for a while now. Probably longer than two years. My main browser hasn't had flash in that long or longer and I haven't missed anything. Most video sites revert to html5 video. You are also telling developers who track their flash install base to update their site to be compatible by voting against flash with your browser. More important, i've been disabling flash on the computers of non-tech friends and they don't seem to notice it either. If you need Java for banking, setup a second or third browser where you only access that site, and by only entering in the URL directly.
nilved 13y ago
It's not that simple. The fact that you have Flash disabled is itself identifying information.

raycmorgan 13y ago

In the fraud detection and ad tracking spaces there are companies that use this technique. They are able to adapt to changes in the browser (using statistics, cookies as bridges, your favorite shopping site's userId, etc). In the tracking world there are no silver bullets, so the more ways to connect different sessions, the better.

nilved 13y ago

> There is a big flaw in using browser information as an identification token in this way as browsers change. > I visit this site at least once a month and every time it picks me as 'unique'. That is because each time i've either installed a plugin, installed a font, my browser version changes every 5 days with automatic updates, installed a new browser, installed a different browser, am using multiple browsers, am accessing from my phone, ipad, work computer, etc. > This makes it useless for actually tracking people. Not at all. This site isn't a demonstration of tracking you, it's simply a measure of how unique your browser is. Somebody who actually cared about tracking you could trivially track changes: a profile with a set of 191 particular fonts and a later profile that is identical but with 190 fonts is probably the same person.

mjolk 13y ago

>And I bet most people who are concerned by tacking online and impressive demos like this are still using their real IP address online, How would one use a 'fake' IP address and expect traffic to make it back to him/her?

saraid216 13y ago
You can proxy things. Not providing your real IP was one of the central benefits of using TOR, for instance. I'm not enough of an expert to go into more detail, but the google keyword you want is "proxy".
- mjolk 13y ago
  Sharing a proxy is far more concerning, security-wise than having a website guess who you are based on metadata.
arthulia 13y ago
With a VPN or some other kind of proxy possibly? Traffic is completely encrypted between you and a VPN, and the websites you are visiting only see the VPNs IP.
tghw 13y ago
https://www.torproject.org/ https://www.torproject.org/
- mjolk 13y ago
  Tor isn't secure, nor is it really anonymous for these purposes.

saraid216 13y ago

https://github.com/saizai/cssfingerprint https://github.com/saizai/cssfingerprint