Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Online tracking: A 1-million-site measurement and analysis

webtransparency.cs.princeton.edu

Post reply on HN
Print view View original

31–40 of 272 posts

Re: Online tracking: A 1-million-site measurement and analysis

#31

Post by com_kieffer »

nailer wrote: post #21
rdancer wrote: post #2

This is the kind of nonconsensual sureptitious user tracking that the EU privacy directive 2002/58/EC concerns itself with, not those redundant, stupid cookie consent overlays.

So a regular site using, say, mixpanel doesn't need to show a warning?

No, from my understanding cookies are allowed by default only if they are essential to the function of the site. If you only use the cookie to handle logins and sessions then you don't need the warning. I you use the cookie for tracking or analytics then you need the warning.

Note that you can use your webserver logs for analytics and that doesn't require the cookie banner.

Re: Online tracking: A 1-million-site measurement and analysis

#32

Post by MatekCopatek »

hsivonen wrote: post #27
jimktrains2 wrote: post #7

NoScript is an all-or-nothing approach. Are there any JS-blockers that allow API-level blocks?

If you disable a unique combination of APIs that combination becomes your fingerprint.

True, but the number of APIs is relatively small while having them enabled can allow for a much richer set of values, far more useful for fingerprinting.

Re: Online tracking: A 1-million-site measurement and analysis

#33

Post by ronjouch »

projectramo wrote: post #25
randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that wha…

> "how can the "canvas fingerprinting" work since I had to browse to a new page and all the old pixels from the previous page are no longer there"

The linked page answers this: "Differences in font rendering, smoothing, anti-aliasing, as well as other device features cause devices to draw the image differently."

Put differently, the function measureText(canvas full of text with various fonts and bizarre features with varying implementation) is a pretty good hashing function for a population of web users, because each of these web users have a pretty-unique [canvas rendering engine, underlying OS, installed fonts] combination.

Combine several of these techniques (webrtc, audio, list of plugins installed and their version, etc), and you go from a "pretty unique" to a "guaranteed unique" hash, which you can follow across the web.

Re: Online tracking: A 1-million-site measurement and analysis

#34

Post by kuschku »

nailer wrote: post #21
rdancer wrote: post #2

This is the kind of nonconsensual sureptitious user tracking that the EU privacy directive 2002/58/EC concerns itself with, not those redundant, stupid cookie consent overlays.

So a regular site using, say, mixpanel doesn't need to show a warning?

If the cookies are purely technical (say, login cookies), no.

If the cookies are used for tracking, like Google Analytics, then yes, it needs to ask the user for consent.

And that’s not a warning, but actual "yes/no", and in the no case, it may not set a tracking cookie, or have set a tracking cookie already.

Most sites (except for a few dozen German and Dutch ones) just redirect you somewhere else, though, if you refuse to be tracked.

Re: Online tracking: A 1-million-site measurement and analysis

#35

Post by kuschku »

kapep wrote: post #26
jimktrains2 wrote: post #7

NoScript is an all-or-nothing approach. Are there any JS-blockers that allow API-level blocks?

By disabling specific APIs, you would make your browser even more identifiable. It would only work if many users have disabled exactly the same APIs as you and all other non-disabled APIs don't provide any information useful for fingerprinting.

So, disable the same APIs as the TOR browser does.

Re: Online tracking: A 1-million-site measurement and analysis

#38

Post by englehardt »

dccoolgai wrote: post #12
randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

This is much-needed research. Thank you for your work. Regarding the WebRTC tracking- would it be possible for WebRTC to work without exposing the local IP? I.e. is there any real reason that fingerprint needs to be there?

Other co-author here. Unfortunately there are good performance reasons for allowing WebRTC to access the local IP, see the lengthy discussion here: https://bugzilla.mozilla.org/show_bug.cgi?id=959893. One use case is allowing two peers behind the same NAT to communicate directly without leaving the local network.

The working group recommendation that we linked in the paper (https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handli...) addresses some of the concerns that arise from that (namely the concern that a user behind a VPN or proxy will have their real, public address exposed), but still recommends that a single private IP address be returned by default and without user permission.

However that's still quite identifying for some network configurations, e.g. a network which assigns non-RFC1918 IPs to users behind a NAT. Seems to me that putting access to the local IP address behind a permission would both remove the tracking risk and still allow the performance gains after the user grants permission.

Re: Online tracking: A 1-million-site measurement and analysis

#39

Post by crispyambulance »

projectramo wrote: post #25
randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that wha…

I can see how you would be led to believe that interpretation. Looking at the "fingerprinting" webapp however, details that sound is NOT actually recorded-- only the uniqueness of your machine's audio processing stack. At least I hope that's the case. The idea of a microphone recording without permission upon visiting a website would cause quite a broo-ha-ha.

https://audiofingerprint.openwpm.com/

    > "This page tests browser-fingerprinting using the AudioContext and Canvas API. 
    > Using the AudioContext API to fingerprint does not collect sound played or
    > recorded by your machine - an AudioContext fingerprint is a property of your
    >  machine's audio stack itself. If you choose to see your fingerprint, we will
    >  collect the fingerprint along with a randomly assigned identifier, your IP
    > Address, and your User-Agent and store it in a private database so that we can
    > analyze the effectiveness of the technique. We will not release the raw data 
    > publicly. A cookie will be set in your browser to help in our analysis. We
    > also test a form of fingerprinting using Flash if you have Flash enabled."

Re: Online tracking: A 1-million-site measurement and analysis

#40

Post by TazeTSchnitzel »

pmlnr wrote: post #36

So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular" browser fingerprinting. Is anyone aware of the existence of one?

I think Tor Browser tries to do this for some types of fingerprinting.
Post reply on HN