Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Your Social Media Fingerprint (maybe NSFW)

robinlinus.github.io

Post reply on HN
Print view View original

241–250 of 258 posts

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#241

Post by tscs37 »

zerognowl wrote: post #235
Bartweiss wrote: post #118

Earlier quoted context omitted.

At risk of being depressing, it's worth knowing that a dedicated profiler can reconcile accounts across all of the protections you've mentioned - not just as a targeted attack, but algorithmically. There are a lot of fingerprinting tricks which transcend cookie restrictions and user profiles. The battery percent/value one will reconcile all accounts on one device (as will several other like fonts). If you log into on…

Indeed, you can take this a step further and assign each bucket its own VPN, with JS turned off to minimize fingerprintability. You can even setup multiple virtual machines with multiple screen resolutions on each to further divide up your sessions, making your surfing modified beyond recognition. It might take a weekend or two to wrap your head around VMs and VPNs, but it's worth it. Also, if you're paranoid about y…

but is that in itself not another signature in a fingerprint?

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#242

Post by DanielStraight »

I don't know if anyone will read this at this point, but if you're going to proof-of-concept an exploit, please make that clear in the title or have an opt-in step with an explanation of what it will do like the EFF uses on https://panopticlick.eff.org/

I do not appreciate being tricked into running your exploit proof of concept, especially when you put content in it that I otherwise would not have clicked.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#243

Post by Bartweiss »

derefr wrote: post #225
duaneb wrote: post #190

Earlier quoted context omitted.

It's very difficult to prevent side channel thumbprints—something as simple as traceroutes, wifi hotspots, caches (DNS, routing) can be uniquely identifiable. Add on top of this biometrics like how you type, how you move your mouse, etc, and it becomes very difficult to avoid concerted tracking efforts. Of course, if you're not pissing off state actors, you're probably fine with qubes/tails.

Presuming you are being pursued by a state actor, isn't using a computer at a library or Internet cafe enough to thwart most of that? Especially if you're using asynchronous store-and-forward protocols like NNTP or Freenet, where you can be long-gone from wherever the computer you used was, before anyone else ever sees "your" activity.

I remember at least one security expert commenting that if he ran an actual attack, his precautions would be "sitting in a computer lab using a stolen library card". Physical anonymity is by far the best cure for some of these things.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#244

Post by JeremyNT »

Ph0X wrote: post #204
Zeklandia wrote: post #189

Earlier quoted context omitted.

This one actually works for me! The other said that I was using Privacy Badger since it couldn't detect anything. I'm not, but I am using uBlock Origin. This one is only wrong about a couple (it doesn't register, for example, that I am logged in to G+, Khan Academy, Steam, Amazon, PayPal, or Skype).

Doesn't uBlock have a filter specifically for privacy (off by default I believe).

I actually had several of the extra filters enabled already, but only once I added "Fanboy's Enhanced Tracking List"[0] did uBlock Origin successfully block this technique. I'm not sure whether any of the other filters would accomplish the same result.

After enabling this filter, 0942v8653's version also failed.

[0] https://www.fanboy.co.nz/enhancedstats.txt

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#245

Post by turc1656 »

0942v8653 wrote: post #152
Pxtl wrote: post #123

FYI, it's very NSFW in the back-end. Your browser is sending requests to obvious porn servers when you hit this link so it can test if you're logged in to them.

A more SFW version (took out YouPorn): http://codepen.io/anon/pen/ALdqox/right/ This version connects to squareup.com, twitter.com, www.facebook.com, accounts.google.com, accounts.google.com, plus.google.com, login.skype.com, www.flickr.com, www.spotify.com, www.reddit.com, www.tumblr.com, www.expedia.de, www.dropbox.com, www.amazon.com, www.pinterest.com, www.netflix.com, de.foursquare.com, eu.battle.net, store.stea…

Thanks for the SFW version. Nice to see that uMatrix is doing it's job quite well and as expected.

FWIW, Spotify doesn't seem to get recognized properly. I am definitely logged in and it should show up when all my browser protections are disabled. HN showed up when I disabled everything, but not Spoitfy.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#246

Post by zerognowl »

tscs37 wrote: post #241
zerognowl wrote: post #235

Earlier quoted context omitted.

Indeed, you can take this a step further and assign each bucket its own VPN, with JS turned off to minimize fingerprintability. You can even setup multiple virtual machines with multiple screen resolutions on each to further divide up your sessions, making your surfing modified beyond recognition. It might take a weekend or two to wrap your head around VMs and VPNs, but it's worth it. Also, if you're paranoid about y…

but is that in itself not another signature in a fingerprint?

Not necessarily. The amount of bits needed to fingerprint somebody is substantially lowered doing this, and although you stand out by taking extra steps like this, it's substantially better than a large portion of the configurations you do see.

Of course if your threat model is such that nation states are targeting you, either passively, or actively, then TOR is fitting in most cases, but TOR can prove to be overkill in most cases.

For example, if I'm surfing a website which blocks TOR, I can use a JonDoFox[1] profile to visit a website with a VPN, and achieve better-than-most anonymity for my needs, albeit not as rigorous as what TOR provides, but at least my connection has rudimentary protection from passive eavesdropping.

Keep in mind, VPNs are a countermeasure only and do not provide perfect privacy, but you can lessen the information gathered using the techniques I outlined. Surf under generic domains, and block traffic downloaded en clair

[1] https://anonymous-proxy-servers.net/en/jondofox.html

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#247

Post by zerognowl »

antocv wrote: post #134
Bartweiss wrote: post #118

Earlier quoted context omitted.

At risk of being depressing, it's worth knowing that a dedicated profiler can reconcile accounts across all of the protections you've mentioned - not just as a targeted attack, but algorithmically. There are a lot of fingerprinting tricks which transcend cookie restrictions and user profiles. The battery percent/value one will reconcile all accounts on one device (as will several other like fonts). If you log into on…

Indeed. Another trick is to change or settle for one very common user-agent across all browsers, and to run them with differently sized windows.

https://anonymous-proxy-servers.net/en/jondofox.html

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#249

Post by ghurtado »

jacquesm wrote: post #174
ghurtado wrote: post #154

Earlier quoted context omitted.

A web filter / proxy does not have any way to tell whether any individual HTTP request was requested as a result of HTML embedding, bookmarking, user entry or clicking on a link.

Exactly. So it shouldn't be used to 'flag' any employees.

If your position is that monitoring HTTP traffic is useless because favicons can be embedded into webpages, what method would you propose to monitor employees browsing habits then?

Furthermore, how would you monitor the HTTP traffic of suspected terrorists? After all, anyone can embed an image to "www.isis.com/blackflag.jpg" into any webpage, so shouldn't we stop monitoring all such traffic?

Your original assertion was that "it's a pretty crappy check", but I think what you are missing here is that it's the only possible check, minor irrelevant flaws and all.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#250

Post by jacquesm »

ghurtado wrote: post #249
jacquesm wrote: post #174

Earlier quoted context omitted.

Exactly. So it shouldn't be used to 'flag' any employees.

If your position is that monitoring HTTP traffic is useless because favicons can be embedded into webpages, what method would you propose to monitor employees browsing habits then? Furthermore, how would you monitor the HTTP traffic of suspected terrorists? After all, anyone can embed an image to "www.isis.com/blackflag.jpg" into any webpage, so shouldn't we stop monitoring all such traffic? Your original assertion w…

No, it isn't the only possible check, but besides that the 'HTTP traffic of suspected terrorists' will be nicely encrypted in a way that you won't be able to intercept the URLS.

Lots of fearmongering here, if you want to monitor your employees browsing behavior then you're going to have to supply them with the hardware they do the browsing on, lock that hardware down and install some nannyware to do the monitoring. That way you won't have to MITM each and every connection and you'll have a more secure setup overall.

Post reply on HN