Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EFF's Panopticlick 2.0 Launches with Tracker Protection Tests

panopticlick.eff.org

Post reply on HN
Print view View original

21–30 of 37 posts

Re: EFF's Panopticlick 2.0 Launches with Tracker Protection Tests

#21

Post by verusfossa »

Dylan16807 wrote: post #14
pde3 wrote: post #6

Earlier quoted context omitted.

Spoofing your user agent on your own typically makes you easier to fingerprint, not harder. See footnote 3 of the Panopticlick 1.0 paper: https://panopticlick.eff.org/static/browser-uniqueness.pdf It's more plausible for a large population of browsers to share a single spoofed user agent; all of the Tor Browsers pretend to be a single specific version of Firefox for Windows.

Okay, has someone made an extension that lets me pretend to have the most common set of plugins on the most common version of firefox?

This kind of works. Set a UA for all sites.

https://addons.mozilla.org/en-US/firefox/addon/uacontrol/

https://addons.mozilla.org/en-us/firefox/addon/user-agent-js...

String...

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0

Update the string every now and then?

https://techblog.willshouse.com/2012/01/03/most-common-user-...

Disable all plugins.

Best I got, sorry.

Re: EFF's Panopticlick 2.0 Launches with Tracker Protection Tests

#22

Post by Dylan16807 »

pde3 wrote: post #18
Dylan16807 wrote: post #13

That was weird, the no-js version didn't work. It just sat there spinning. >Does your browser unblock 3rd parties that promise to honor Do Not Track? X no What, why would I unblock those? Edit: Thanks HN for deleting the fancy X unicode!

> That was weird, the no-js version didn't work. It just sat there spinning. What extensions do you have installed? There's a known and unfixable issue with browsers that both block JS and absolutely block all requests to tracking domains (eg AdAway, which modifies /etc/hosts). > What, why would I unblock those? To incentivise better behaviour by web publishers and advertisers!

ublock was stopping requests to third parties. Though the javascript version didn't care that third party requests were blocked, only the no-js version.

It's kind of weird for something specifically dedicated to measuring tracking to get so confused by an anti-tracking mechanism.

> To incentivise better behaviour by web publishers and advertisers!

Maybe if it could have some legal teeth to it, otherwise it's too easy to lie to get your tracker unblocked.

Re: EFF's Panopticlick 2.0 Launches with Tracker Protection Tests

#23

Post by dandelion_lover »

pde3 wrote: post #18
Dylan16807 wrote: post #13

That was weird, the no-js version didn't work. It just sat there spinning. >Does your browser unblock 3rd parties that promise to honor Do Not Track? X no What, why would I unblock those? Edit: Thanks HN for deleting the fancy X unicode!

> That was weird, the no-js version didn't work. It just sat there spinning. What extensions do you have installed? There's a known and unfixable issue with browsers that both block JS and absolutely block all requests to tracking domains (eg AdAway, which modifies /etc/hosts). > What, why would I unblock those? To incentivise better behaviour by web publishers and advertisers!

>To incentivise better behaviour by web publishers and advertisers!

I switched off "Do Not Track" in my options since only good-behaving websites listen to it, such as those using Piwik analytics, which respects privacy. Therefore I only would harm good people with Do Not Track on.

Re: EFF's Panopticlick 2.0 Launches with Tracker Protection Tests

#24

Post by Dylan16807 »

verusfossa wrote: post #21
Dylan16807 wrote: post #14

Earlier quoted context omitted.

Okay, has someone made an extension that lets me pretend to have the most common set of plugins on the most common version of firefox?

This kind of works. Set a UA for all sites. https://addons.mozilla.org/en-US/firefox/addon/uacontrol/ https://addons.mozilla.org/en-us/firefox/addon/user-agent-js... String... Mozilla/5.0 (Windows NT 6.1; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0 Update the string every now and then? https://techblog.willshouse.com/2012/01/03/most-common-user-... Disable all plugins. Best I got, sorry.

You can just use about:config if you're going to update it manually. But that's not nearly the worst part of fingerprinting, with plugins and fonts and apparently webgl, etc.

Is there a way to pretend plugins are disabled when they're on click to play?

Re: EFF's Panopticlick 2.0 Launches with Tracker Protection Tests

#25

Post by verusfossa »

Dylan16807 wrote: post #24
verusfossa wrote: post #21

Earlier quoted context omitted.

This kind of works. Set a UA for all sites. https://addons.mozilla.org/en-US/firefox/addon/uacontrol/ https://addons.mozilla.org/en-us/firefox/addon/user-agent-js... String... Mozilla/5.0 (Windows NT 6.1; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0 Update the string every now and then? https://techblog.willshouse.com/2012/01/03/most-common-user-... Disable all plugins. Best I got, sorry.

You can just use about:config if you're going to update it manually. But that's not nearly the worst part of fingerprinting, with plugins and fonts and apparently webgl, etc. Is there a way to pretend plugins are disabled when they're on click to play?

I don't think so.

Also, being able to toggle the UA and setup lists to dynamically set it is helpful in my usecase.

Re: EFF's Panopticlick 2.0 Launches with Tracker Protection Tests

#26

Post by [deleted] »

brokentone wrote: post #10
relkor wrote: post #7

Earlier quoted context omitted.

I used to spoof user agents, randomly mutating. Then last month I started to run into sites that refused to load/render for incorrect strings. It appears the Google and other large companies are now sending customized versions of their page based on the user agent which I can only speculate is an attempt to save bandwidth. By taking advantage of implementation specific features, they not only eliminate all of the ext…

I've been known to do something like this (rejecting unusual UAs) to avoid the added load of rogue scrapers.

[deleted]

Re: EFF's Panopticlick 2.0 Launches with Tracker Protection Tests

#27

Post by XzetaU8 »

rocky1138 wrote: post #8
legind wrote: post #4

Earlier quoted context omitted.

"For day-to-day use, the best options are to run tools like Privacy Badger or Disconnect that will block some (but unfortunately not all) of the domains that try to perform fingerprinting, and/or to use a tool like NoScript for Firefox, which greatly reduces the amount of data available to fingerprinters." https://panopticlick.eff.org/about#defend-against

Will blocking them at the HOSTS file level decrease exposure as well? My gut says yes, but I wanted to check. Also, does this test check for that and/or give points for that? Here is the HOSTS file I use to block ads: http://winhelp2002.mvps.org/hosts.txt

If you're on Linux i recommend 'Hosts-Update'[1], it's a bash script that generates a Host file from multiple sources:

http://adaway.org/hosts.txt http://hosts-file.net/ad_servers.txt http://malwaredomains.lehigh.edu/files/justdomains http://pgl.yoyo.org/adservers http://someonewhocares.org/hosts/hosts http://winhelp2002.mvps.org/hosts.txt http://www.malwaredomainlist.com/hostslist/hosts.txt

[1]: https://github.com/zant95/hosts-update

Re: EFF's Panopticlick 2.0 Launches with Tracker Protection Tests

#28

Post by legind »

rocky1138 wrote: post #8
legind wrote: post #4

Earlier quoted context omitted.

"For day-to-day use, the best options are to run tools like Privacy Badger or Disconnect that will block some (but unfortunately not all) of the domains that try to perform fingerprinting, and/or to use a tool like NoScript for Firefox, which greatly reduces the amount of data available to fingerprinters." https://panopticlick.eff.org/about#defend-against

Will blocking them at the HOSTS file level decrease exposure as well? My gut says yes, but I wanted to check. Also, does this test check for that and/or give points for that? Here is the HOSTS file I use to block ads: http://winhelp2002.mvps.org/hosts.txt

Yes, our test does work for that and various hosts-based blockers are supported (like AdAway for Android, for example). In order for our test to give accurate results, the host-based blocker has to add our simulated trackers to its block list, which some lists may not have done yet.

Re: EFF's Panopticlick 2.0 Launches with Tracker Protection Tests

#29

Post by cpeterso »

relkor wrote: post #2

Is there any solid guide to preventing browser fingerprinting? Or is the only protection constantly changing your accept headers + user agent?

Mozilla has documented some of the ways trackers can fingerprint users (in 2010):

https://wiki.mozilla.org/Fingerprinting

The Tor project submitted some of their fingerprinting protection patches to Firefox. They can be enabled by setting the "privacy.resistFingerprinting" about:config pref.

https://bugzil.la/418986 - Bug 418986 - Resist fingerprinting by preventing exposure of screen and system info

And the W3C has shared some information about the obligations of W3C specification authors and working groups of new Web platform features:

http://www.w3.org/wiki/images/7/7d/Is_preventing_browser_fin...

Re: EFF's Panopticlick 2.0 Launches with Tracker Protection Tests

#30

Post by mpeg »

redwards510 wrote: post #19
Dylan16807 wrote: post #14

Earlier quoted context omitted.

Okay, has someone made an extension that lets me pretend to have the most common set of plugins on the most common version of firefox?

Yes, everyone knows you can change the user agent string, but how do you change the list of plugins returned by the browser? Do you have to actually patch the binary?!

navigator.__defineGetter__('plugins', function(){ return new Object(); });

Of course, you'd actually have to do a bit more work to make it bulletproof (otherwise fingerprinters could use the fact that you modified your default navigator object as a way to uniquely identify you !)

I imagine ultimately it's almost impossible to defeat fingerprinters in JS, as they could do tricky stuff like timing attacks to get you.

Use NoScript if you're concerned.

Post reply on HN