Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Online tracking: A 1-million-site measurement and analysis

webtransparency.cs.princeton.edu

Post reply on HN
Print view View original

41–50 of 272 posts

Re: Online tracking: A 1-million-site measurement and analysis

#41

Post by jimktrains2 »

kapep wrote: post #26
jimktrains2 wrote: post #7

NoScript is an all-or-nothing approach. Are there any JS-blockers that allow API-level blocks?

By disabling specific APIs, you would make your browser even more identifiable. It would only work if many users have disabled exactly the same APIs as you and all other non-disabled APIs don't provide any information useful for fingerprinting.

Just like disabling is is identifying. It's less about identity and more about control.

If I could just feed it random data instead of fully disabling, that would also be fine.

Re: Online tracking: A 1-million-site measurement and analysis

#42

Post by MatekCopatek »

jimktrains2 wrote: post #7

NoScript is an all-or-nothing approach. Are there any JS-blockers that allow API-level blocks?

This would make absolute sense. Certain requests (like location) already trigger popups that ask you for permission. If it turns out other APIs can be equally revealing as far as privacy goes, it would make sense to present the same popup.

I mean, using a web app for the first time would be no different then installing a mobile app - I wouldn't be surprised if I had to give it a few permissions.

Re: Online tracking: A 1-million-site measurement and analysis

#44

Post by justJanne »

oblio wrote: post #15
ysleepy wrote: post #13

Well, who would have guessed. Surprise surprise. The web is such a shit technology.

And how would Silverlight or Java applets or Flash or any other client side technology be better in this regard? You have to expose capabilities and those capabilities can be used to create an unique fingerprint based on your device. How would you design the stack so that this kind of thing is impossible? Feel free to use your favorite tech stack as a base.

Simple: Seperate documents, interactivity, and programs.

If I browse the web, I usually want documents.

Sometimes I also want interactivity, like in comment forms, which could be a seperated widget which could only interact in limited ways, and only with the page and the server it connects to.

And then there would be programs, which could access even local files – but would have an installation process like browser extensions.

Giving documents access that normally just programs do is stupid, as we have seen in Word Macro-based malware, PDF-based malware, Browser-based malware (the pdf.js exploit, for example), and so on.

Re: Online tracking: A 1-million-site measurement and analysis

#45

Post by BinaryBullet »

idbehold wrote: post #19
jimktrains2 wrote: post #7

NoScript is an all-or-nothing approach. Are there any JS-blockers that allow API-level blocks?

It's kind of surprising that there isn't an extension to provide this functionality (at least in desktop browsers). All you'd have to do is monkey patch the methods that get called and throw up a confirm("are you sure you want to allow [X]")

Well, I just created a small POC:

http://plnkr.co/edit/hKvPpEZQGCSkCNKly5Z3?p=preview

It would need to remember your choice so you don't get prompted everytime, but that's a small/easy change to make.

Re: Online tracking: A 1-million-site measurement and analysis

#46

Post by projectramo »

detaro wrote: post #28
projectramo wrote: post #25

Earlier quoted context omitted.

I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that wha…

Canvas fingerprinting uses differences in rendering e.g. of fonts. Output a text, hash resulting pixel values. Depending on exact version of the font(s) installed, anti-aliasing settings, default font sizes, operating system... you get slightly different results. So you don't rely on information stored on the device, but on repeatable behavior that differs between devices.

I thought that was "Canvas-Font Fingerprinting"

But now I see that is just seeing which fonts are available.

Thanks for the explanation. Its just hard to believe devices are so different. I would think most versions of iOS would have roughly the same set of fonts etc.

Re: Online tracking: A 1-million-site measurement and analysis

#47

Post by projectramo »

crispyambulance wrote: post #39
projectramo wrote: post #25

Earlier quoted context omitted.

I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that wha…

I can see how you would be led to believe that interpretation. Looking at the "fingerprinting" webapp however, details that sound is NOT actually recorded-- only the uniqueness of your machine's audio processing stack. At least I hope that's the case. The idea of a microphone recording without permission upon visiting a website would cause quite a broo-ha-ha. https://audiofingerprint.openwpm.com/ > "This page tests b…

Wow, so are mic settings that different on different on, say, different iOS devices? If you and I have the same model iPhone with the same model iOS, is the audio stack that different?

Re: Online tracking: A 1-million-site measurement and analysis

#48

Post by projectramo »

ronjouch wrote: post #33
projectramo wrote: post #25

Earlier quoted context omitted.

I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that wha…

> "how can the "canvas fingerprinting" work since I had to browse to a new page and all the old pixels from the previous page are no longer there" The linked page answers this: "Differences in font rendering, smoothing, anti-aliasing, as well as other device features cause devices to draw the image differently." Put differently, the function measureText(canvas full of text with various fonts and bizarre features with…

Thanks for the explanation. I missed it because I never though these settings could be that unique.

Re: Online tracking: A 1-million-site measurement and analysis

#49

Post by englehardt »

crispyambulance wrote: post #39
projectramo wrote: post #25

Earlier quoted context omitted.

I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that wha…

I can see how you would be led to believe that interpretation. Looking at the "fingerprinting" webapp however, details that sound is NOT actually recorded-- only the uniqueness of your machine's audio processing stack. At least I hope that's the case. The idea of a microphone recording without permission upon visiting a website would cause quite a broo-ha-ha. https://audiofingerprint.openwpm.com/ > "This page tests b…

Yes, no sound is recorded. Access to the user's mic isn't possible without a permission. If there are sections of the website or paper that seem to imply that, let me know and we'll clarify.

Re: Online tracking: A 1-million-site measurement and analysis

#50

Post by brador »

TazeTSchnitzel wrote: post #40
pmlnr wrote: post #36

So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular" browser fingerprinting. Is anyone aware of the existence of one?

I think Tor Browser tries to do this for some types of fingerprinting.

The things you block and don't block could also be used to help form a fingerprint.
Post reply on HN