5 ms·

I recall reading something on the internet that IP + browser fingerprint is good enough to unique identify a large number of people. Has this changed or otherwi

by dclusin 11y ago

I recall reading something on the internet that IP + browser fingerprint is good enough to unique identify a large number of people. Has this changed or otherwise untrue?

faitswulff 11y ago
A quick click here convinced me that this is still the case: https://panopticlick.eff.org/ https://panopticlick.eff.org/
- kbrosnan 11y ago
  This is a handful of GET requests for images. You would need a page to fingerprint. The site could get an IP, likely the user agent. Safe browsing requests are sandboxed from all the other Google cookies.
  - scottw 11y ago
    You sure those are images? All we know for certain is that those are GET requests.
    - girvo 11y ago
      I'd be willing to bet that Firefox would treat them as such, even if they returned something different. Still, those favicons should be bundled instead of making requests, IMO.
    - bmelton 11y ago
      Because we can see the sum of the requests, I think it's safe to say that they are probably just images. There's nothing to stop, say, ebay from serving PHP scripts on ICO extension, processing the request as a pageload and then ultimately returning the icon file, but for anything useful to have been gleaned, it would have generated more requests. Either it did generate more requests and Mozilla didn't honor them (in which case, yay), or it didn't generate more requests (in which case, yay). The former would be slightly preferred as the latter doesn't prevent ebay from later changing their strategy.
  - takeda 11y ago
    Geez did you guys even look at the URLs? https://safebrowsing.google.com/safebrowsing/downloads?client=Iceweasel&appver=38.1.0&pver=2.2&key=no-google-api-key https://safebrowsing.google.com/safebrowsing/downloads?clien... Isn't the API key your fingerprint? The key is not shown here, because the author was showing what the requests look like on first run, subsequent requests would contain your unique ID in them. Not picking on you specifically, I saw several responses saying the same thing.
    - magicalist 11y ago
      > Isn't the API key your fingerprint? No, it's a per-application key, so in this case it would be IceWeasel's key.
      - takeda 11y ago
        In that case why would it make a request with "key=no-google-api-key" then why not use the IceWeasel key right from the start?
        magicalist 11y ago
        No clue, but it's not like we have to guess about what it is. It's all covered in the Safe Browsing docs: https://developers.google.com/safe-browsing/lookup_guide#GettingStarted https://developers.google.com/safe-browsing/lookup_guide#Get...
duskwuff 11y ago
Getting the type of "browser fingerprint" they're depending on here requires a bunch of Javascript. You can't get that data from just looking at a single request, which is all that they're getting here.
- HappyTypist 11y ago
  I think IP + useragent + locale (which is sent with every HTTP request) is enough to pinpoint most users.
  - markvdb 11y ago
    Especially Debian users ("iceweasel" in the user agent string!)...
    - avian 11y ago
      I made an add-on that tries to help with that: https://github.com/avian2/thawed-weasel https://github.com/avian2/thawed-weasel
    - liviu- 11y ago
      It's not so much 'Debian users' as 'Iceweasel users' — you can install Firefox from source on Debian, and even use Mint's package repo to install it.
Manishearth 11y ago
Browser fingerprint requires at least Javascript, and to do it properly you need the ability to run Java/Flash too. These are HTTP requests, not HTML pages which are opened in the browser. Since its not using cookies, these requests only contain the user agent string, which is very far off from any useful kind of tracking-fingerprint.

by dclusin 11y ago

I recall reading something on the internet that IP + browser fingerprint is good enough to unique identify a large number of people. Has this changed or otherwise untrue?

faitswulff 11y ago

A quick click here convinced me that this is still the case: https://panopticlick.eff.org/ https://panopticlick.eff.org/

kbrosnan 11y ago
This is a handful of GET requests for images. You would need a page to fingerprint. The site could get an IP, likely the user agent. Safe browsing requests are sandboxed from all the other Google cookies.
- scottw 11y ago
  You sure those are images? All we know for certain is that those are GET requests.
  - girvo 11y ago
    I'd be willing to bet that Firefox would treat them as such, even if they returned something different. Still, those favicons should be bundled instead of making requests, IMO.
  - bmelton 11y ago
    Because we can see the sum of the requests, I think it's safe to say that they are probably just images. There's nothing to stop, say, ebay from serving PHP scripts on ICO extension, processing the request as a pageload and then ultimately returning the icon file, but for anything useful to have been gleaned, it would have generated more requests. Either it did generate more requests and Mozilla didn't honor them (in which case, yay), or it didn't generate more requests (in which case, yay). The former would be slightly preferred as the latter doesn't prevent ebay from later changing their strategy.
- takeda 11y ago
  Geez did you guys even look at the URLs? https://safebrowsing.google.com/safebrowsing/downloads?client=Iceweasel&appver=38.1.0&pver=2.2&key=no-google-api-key https://safebrowsing.google.com/safebrowsing/downloads?clien... Isn't the API key your fingerprint? The key is not shown here, because the author was showing what the requests look like on first run, subsequent requests would contain your unique ID in them. Not picking on you specifically, I saw several responses saying the same thing.
  - magicalist 11y ago
    > Isn't the API key your fingerprint? No, it's a per-application key, so in this case it would be IceWeasel's key.
    - takeda 11y ago
      In that case why would it make a request with "key=no-google-api-key" then why not use the IceWeasel key right from the start?
      - magicalist 11y ago
        No clue, but it's not like we have to guess about what it is. It's all covered in the Safe Browsing docs: https://developers.google.com/safe-browsing/lookup_guide#GettingStarted https://developers.google.com/safe-browsing/lookup_guide#Get...

duskwuff 11y ago

Getting the type of "browser fingerprint" they're depending on here requires a bunch of Javascript. You can't get that data from just looking at a single request, which is all that they're getting here.

HappyTypist 11y ago
I think IP + useragent + locale (which is sent with every HTTP request) is enough to pinpoint most users.
- markvdb 11y ago
  Especially Debian users ("iceweasel" in the user agent string!)...
  - avian 11y ago
    I made an add-on that tries to help with that: https://github.com/avian2/thawed-weasel https://github.com/avian2/thawed-weasel
  - liviu- 11y ago
    It's not so much 'Debian users' as 'Iceweasel users' — you can install Firefox from source on Debian, and even use Mint's package repo to install it.

Manishearth 11y ago

Browser fingerprint requires at least Javascript, and to do it properly you need the ability to run Java/Flash too. These are HTTP requests, not HTML pages which are opened in the browser. Since its not using cookies, these requests only contain the user agent string, which is very far off from any useful kind of tracking-fingerprint.