3 ms·

So in other words, it's a tracking script also serving as a captcha. "Google servers will receive and process, at least, the following information: Plug-i

So in other words, it's a tracking script also serving as a captcha. "Google servers will receive and process, at least, the following information: Plug-ins User-agent Screen resolution Execution time, timezone Number of click/keyboard/touch actions in the <iframe> of the captcha It tests the behavior of many browser-specific functions and CSS rules It checks the rendering of canvas elements Likely cookies server-side (it's executed on the www.google.com domain) And likely other stuff... " At least the old captcha was a more simpler image.

crxgames 12y ago
Some of this data is readily available in the user-agent string. The other does require some JS execution and sending the results back though. Check this out: https://valve.github.io/fingerprintjs/ https://valve.github.io/fingerprintjs/
- TheLoneWolfling 12y ago
  My browser fingerprint is... Nonexistant, because I don't allow arbitrary JS execution without consent. And my UA string is randomized (unless I override it for a particular site), so that doesn't do anything either. I wish someone could come up with a plugin that allowed a "safe" subset of JS to run without consent, though.
  - notatoad 12y ago
    congratulations, you're this guy: http://www.xkcd.com/1105/ http://www.xkcd.com/1105/ until there's a significant number of people doing the same thing, you're simply "that guy in <insert geoip lookup city here> with the randomized UA", and you're infinitely more fingerprintable than just about anybody else on the internet. got to EFF's panopticlick to see how unique your fingerprint is. using an iPad with up-to-date software gets me the same fingerprint as about 18000 other people in my geoip region, i haven't been able to do better than that yet.
    - TheLoneWolfling 12y ago
      You misunderstand what I mean by "randomized". It's a weighted random selection from a list of most common browser UAs, weighted by frequency of that UA. So they can try to fingerprint all they want - all it'll do is clog up their database with useless entries.
      - notatoad 12y ago
        if your other browser properties don't match the UA though, you're still showing up as a unique fingerprint. You'll be the guy with an IE8 UA sending an accept:image/webp header, or the guy with a Safari UA who's following link prefetching instructions that are only valid in chrome, or something else that makes you unique. or my personal favourite: sending the do-not-track header, something that only a small number of people send that makes you much easier to fingerprint.
        TheLoneWolfling 12y ago
        The combination of UA and accept headers need to be changed in sync. Good point - any other things like that that should be watched out for? And DNT is currently at around ~8%, so, although it does leak some information, it doesn't leak an absurd amount (~3.6 bits). (That's using data from here [1], which is FF-only. If you have a better source of data for this, please let me know.) [1] https://dnt-dashboard.mozilla.org/ https://dnt-dashboard.mozilla.org/
        anglebracket 12y ago
        Any number of things can out you as a fake. Whether or not the request's Accept-Encoding has sdch, can help you figure out if something's Chrome. You can also abuse parsing quirks to figure out which rendering engine's being used, or just try to use request-generating features that shouldn't be present in whatever browser you're saying you are (<svg>, <video>, styling on engine-specific psuedoelements, etc.) Here's an example[1] using just HTML+CSS that will request a different image depending on whether you use a webkit or gecko derivative. If you use neither, no image will be requested. Someone who says they're Chrome but requests Firefox's image is immediately outed as a liar. Same thing given something like `<img src="jar:http://example.com/ewwww_jar_uri!/baz">` http://example.com/ewwww_jar_uri!/baz">`. Gecko will make a request to http://example.com/ewwww_jar_uri http://example.com/ewwww_jar_uri while other browsers won't since they don't support the jar URI. I believe Mario Heiderich also posted some stuff using webkit's styleable scrollbars that could be used for fingerprinting screen sizes and how large certain elements are when rendered. The list goes on, but my point is that fingerprinting at the rendering / layout engine level is trivial, so you're better off being legitimately ordinary if you're worried about fingerprinting. [1]: http://codepen.io/anon/pen/YPwMmY http://codepen.io/anon/pen/YPwMmY

crxgames 12y ago

Some of this data is readily available in the user-agent string. The other does require some JS execution and sending the results back though. Check this out: https://valve.github.io/fingerprintjs/ https://valve.github.io/fingerprintjs/

TheLoneWolfling 12y ago
My browser fingerprint is... Nonexistant, because I don't allow arbitrary JS execution without consent. And my UA string is randomized (unless I override it for a particular site), so that doesn't do anything either. I wish someone could come up with a plugin that allowed a "safe" subset of JS to run without consent, though.
- notatoad 12y ago
  congratulations, you're this guy: http://www.xkcd.com/1105/ http://www.xkcd.com/1105/ until there's a significant number of people doing the same thing, you're simply "that guy in <insert geoip lookup city here> with the randomized UA", and you're infinitely more fingerprintable than just about anybody else on the internet. got to EFF's panopticlick to see how unique your fingerprint is. using an iPad with up-to-date software gets me the same fingerprint as about 18000 other people in my geoip region, i haven't been able to do better than that yet.
  - TheLoneWolfling 12y ago
    You misunderstand what I mean by "randomized". It's a weighted random selection from a list of most common browser UAs, weighted by frequency of that UA. So they can try to fingerprint all they want - all it'll do is clog up their database with useless entries.
    - notatoad 12y ago
      if your other browser properties don't match the UA though, you're still showing up as a unique fingerprint. You'll be the guy with an IE8 UA sending an accept:image/webp header, or the guy with a Safari UA who's following link prefetching instructions that are only valid in chrome, or something else that makes you unique. or my personal favourite: sending the do-not-track header, something that only a small number of people send that makes you much easier to fingerprint.
      - TheLoneWolfling 12y ago
        The combination of UA and accept headers need to be changed in sync. Good point - any other things like that that should be watched out for? And DNT is currently at around ~8%, so, although it does leak some information, it doesn't leak an absurd amount (~3.6 bits). (That's using data from here [1], which is FF-only. If you have a better source of data for this, please let me know.) [1] https://dnt-dashboard.mozilla.org/ https://dnt-dashboard.mozilla.org/
        anglebracket 12y ago
        Any number of things can out you as a fake. Whether or not the request's Accept-Encoding has sdch, can help you figure out if something's Chrome. You can also abuse parsing quirks to figure out which rendering engine's being used, or just try to use request-generating features that shouldn't be present in whatever browser you're saying you are (<svg>, <video>, styling on engine-specific psuedoelements, etc.) Here's an example[1] using just HTML+CSS that will request a different image depending on whether you use a webkit or gecko derivative. If you use neither, no image will be requested. Someone who says they're Chrome but requests Firefox's image is immediately outed as a liar. Same thing given something like `<img src="jar:http://example.com/ewwww_jar_uri!/baz">` http://example.com/ewwww_jar_uri!/baz">`. Gecko will make a request to http://example.com/ewwww_jar_uri http://example.com/ewwww_jar_uri while other browsers won't since they don't support the jar URI. I believe Mario Heiderich also posted some stuff using webkit's styleable scrollbars that could be used for fingerprinting screen sizes and how large certain elements are when rendered. The list goes on, but my point is that fingerprinting at the rendering / layout engine level is trivial, so you're better off being legitimately ordinary if you're worried about fingerprinting. [1]: http://codepen.io/anon/pen/YPwMmY http://codepen.io/anon/pen/YPwMmY