Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Your Social Media Fingerprint (maybe NSFW)

robinlinus.github.io

Post reply on HN
Print view View original

161–170 of 258 posts

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#161

Post by nitrogen »

antocv wrote: post #134
Bartweiss wrote: post #118

Earlier quoted context omitted.

At risk of being depressing, it's worth knowing that a dedicated profiler can reconcile accounts across all of the protections you've mentioned - not just as a targeted attack, but algorithmically. There are a lot of fingerprinting tricks which transcend cookie restrictions and user profiles. The battery percent/value one will reconcile all accounts on one device (as will several other like fonts). If you log into on…

Indeed. Another trick is to change or settle for one very common user-agent across all browsers, and to run them with differently sized windows.

Be sure to use a common window size, though. If you pick a nice size with your mouse (as I always do), your window size is almost certainly unique when paired with just a few more bits of info.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#162

Post by user5994461 »

Pxtl wrote: post #123

FYI, it's very NSFW in the back-end. Your browser is sending requests to obvious porn servers when you hit this link so it can test if you're logged in to them.

Tried it and... imagine my disappointment to find out it's ONLY connecting to youporn.

"very NSFW" and "serverS" were overstatements.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#163

Post by mp3geek »

fwn wrote: post #18
adregan wrote: post #5

Earlier quoted context omitted.

Thanks. I just enabled Fanboy’s Annoyance List in ublock origin. I've haven't spent any time digging through that filter list, but I'm now interested. Any other recommendations or resources?

Personally I went with EasyList and local EasyList against ads, Fanboy’s Annoyance and Anti-ThirdpartySocial because social media integrations generally annoy me. EasyPrivacy and Fanboy’s Enhanced Tracking List‎ for privacy as well as the Adblock Warning Removal List‎ and this cool thing against the EU cookie failure: https://raw.githubusercontent.com/r4vi/block-the-eu-cookie-s... It's not very complete, though.

Why does it generally annoy you?

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#164

Post by drvdevd »

throwanem wrote: post #140
ktta wrote: post #138

Earlier quoted context omitted.

I think it helps in conveying the fact that it is a vulnerability not a feature. So any website (even your own company's internal one) can check stuff like this. And you can't do anything about it. Other than always using private browsing for anything you don't want your company/anyone else to know about.

I mean, if somebody is logged into YouPorn from work, that's not a problem I expect the developer of a tool like this to solve. What I expect the developer of a tool like this to do is not create problems by just arbitrarily making HTTP requests to porn sites without a prompt or a chance to opt out. That's a dick move.

When I first read that it was making these requests here in the comments, my reaction was similar. But then upon reflection, I don't think there's a problem for the author here. Why? Because all I did was click the link. Meaning if I was behind a corporate firewall or the like, this sort of thing could be happening all the time and unless I was always tracing requests in my browser or via MITM or logging DNS, I'd have no way of knowing.

Personally I view this as a browser and/or protocol issue (the kind that has trickled down from the origins of the web) and really can't fault the author for it. In fact I think it's appropriate the author left these requests in as it reflects an actual attack scenario better perhaps.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#165

Post by Normal_gaussian »

mahyarm wrote: post #93
daleharvey wrote: post #60

Earlier quoted context omitted.

Its only in testing right now, but Firefox Nightly has "Containers" so you can exactly have different "buckets" for different types of browsing - https://wiki.mozilla.org/Security/Contextual_Identity_Projec...

What I really want is something like this and it opening containers automatically based on url sets. So going to facebook would go to the facebook set automatically and isolate facebook. But I don't have to manually open the "facebook profile" to do the switch. Same with twitter, amazon, google*, youtube, apple, etc. If you have multiple accounts, you can have the interface pop up a "choose your subcontainer" automat…

and deny other containers from embedding facebook urls?

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#167

Post by throwanem »

drvdevd wrote: post #164
throwanem wrote: post #140

Earlier quoted context omitted.

I mean, if somebody is logged into YouPorn from work, that's not a problem I expect the developer of a tool like this to solve. What I expect the developer of a tool like this to do is not create problems by just arbitrarily making HTTP requests to porn sites without a prompt or a chance to opt out. That's a dick move.

When I first read that it was making these requests here in the comments, my reaction was similar. But then upon reflection, I don't think there's a problem for the author here. Why? Because all I did was click the link. Meaning if I was behind a corporate firewall or the like, this sort of thing could be happening all the time and unless I was always tracing requests in my browser or via MITM or logging DNS, I'd hav…

The point I'm making is that it's not necessary to hit a porn site in order to get the point across, and there are HN users whose organizations observe and don't care for that kind of thing.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#168

Post by AgentME »

trendia wrote: post #91
amelius wrote: post #40

Shouldn't a browser not send cookies when the request comes from a different domain? That would seem like the most sensible solution to me. Unless somebody can show a caveat of course.

I believe that cross-site scripting [0] can be used to get around domain restrictions. [0] https://en.wikipedia.org/wiki/Cross-site_scripting [1] (This is not my area of expertise. If I'm not correct... please let me know!)

No, that's not really related. Cross-site scripting's name comes from the vulnerabilities which allow an attacker to insert a tag pointing at a script on another domain (or an inline script). It doesn't have to do with cookies and doesn't get around or really interact with the "block 3rd party cookies" setting.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#170

Post by Bartweiss »

brashrat wrote: post #160
Bartweiss wrote: post #118

Earlier quoted context omitted.

At risk of being depressing, it's worth knowing that a dedicated profiler can reconcile accounts across all of the protections you've mentioned - not just as a targeted attack, but algorithmically. There are a lot of fingerprinting tricks which transcend cookie restrictions and user profiles. The battery percent/value one will reconcile all accounts on one device (as will several other like fonts). If you log into on…

it found nothing for me and I don't do anything pathological

This page didn't, because it only profiles third party cookies - that is, your browser explicitly admitting which sites you're logged into. Privacy Badger, Disconnect, or uBlock will all handle that, as will simply disabling the browser setting.

That was pretty much my point: this is a "nice" profile. One that targets unintentionally identifying image like browser window dimensions can easily track you despite all of those precautions.

Post reply on HN