Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Online tracking: A 1-million-site measurement and analysis

webtransparency.cs.princeton.edu

Post reply on HN
Print view View original

61–70 of 272 posts

Re: Online tracking: A 1-million-site measurement and analysis

#61

Post by mediumdeviation »

projectramo wrote: post #46
detaro wrote: post #28

Earlier quoted context omitted.

Canvas fingerprinting uses differences in rendering e.g. of fonts. Output a text, hash resulting pixel values. Depending on exact version of the font(s) installed, anti-aliasing settings, default font sizes, operating system... you get slightly different results. So you don't rely on information stored on the device, but on repeatable behavior that differs between devices.

I thought that was "Canvas-Font Fingerprinting" But now I see that is just seeing which fonts are available. Thanks for the explanation. Its just hard to believe devices are so different. I would think most versions of iOS would have roughly the same set of fonts etc.

Actually, checking if a font is available does not require canvas (you can simply inject a piece of text into the page with a specific font stack set and check its width). Rather, what canvas is used for is to obtain the sub-pixel anti-aliasing of a given piece of text, which is different between browsers and OS even when the same font is present.

Re: Online tracking: A 1-million-site measurement and analysis

#62

Post by englehardt »

TazeTSchnitzel wrote: post #40
pmlnr wrote: post #36

So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular" browser fingerprinting. Is anyone aware of the existence of one?

I think Tor Browser tries to do this for some types of fingerprinting.

The Tor Browser folks have done some excellent work to reduce the fingerprintability of the browser. See "Specific Fingerprinting Defenses in the Tor Browser" here: https://www.torproject.org/projects/torbrowser/design/#finge....

For Firefox and Chrome there are canvas fingerprint blockers [1] and [2]. These are heuristic based, so you'll likely see a bit of false positives. uBlock Origin includes an option to prevent the leakage of local IP addresses [3].

[1] https://addons.mozilla.org/en-US/firefox/addon/canvasblocker...

[2]https://chrome.google.com/webstore/detail/canvasfingerprintb...

[3]https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...

Re: Online tracking: A 1-million-site measurement and analysis

#63

Post by BinaryBullet »

randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

Will you post insight into the data you've collected? Obviously I don't care about IP addresses, etc, but it would be nice to know how many people have submitted data vs how many unique hashes have been collected for say the "Fingerprint using DynamicsCompressor", etc. I also haven't checked every page on the site, so the data might already be there (and I'm missing it)...

Re: Online tracking: A 1-million-site measurement and analysis

#64

Post by jerf »

vertex-four wrote: post #58
projectramo wrote: post #47

Earlier quoted context omitted.

Wow, so are mic settings that different on different on, say, different iOS devices? If you and I have the same model iPhone with the same model iOS, is the audio stack that different?

Probably not - but basically, you add together your microphone stack with all the other data it can possibly find about your device, and that's your fingerprint. Check out https://panopticlick.eff.org - this will attempt to fingerprint your browser and see if it's unique.

If you'd like a lot more on this topic, check out https://33bits.org/sitemap/ and start clicking on the links.

Re: Online tracking: A 1-million-site measurement and analysis

#65

Post by Fradow »

projectramo wrote: post #25
randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that wha…

I'm going to answer the basic question: fingerprinting is about trying to identify your device as uniquely as possible using available APIs, in order to track you cross-site, without cookies.

To do that, you first try to identify API that have different results depending on the browser or the device, and then track their result. For example, the User agent have some identifying information. It's not unique for each person, but you can start having a bit of identifying information. Do that with multiple APIs (available fonts, installed plugins ...), and you start having enough identifying informations to uniquely identify some browsers, without having an actual ID provided by the browser.

To test your browser, you can visit https://panopticlick.eff.org/

Re: Online tracking: A 1-million-site measurement and analysis

#66

Post by anexprogrammer »

Colour me unsurprised. Disappointed though.

I'm glad I disabled WebRTC when I first discovered it could be used to expose local IP on a VPN.

These "extension" technologies should all be optional plugins. Preferably install on demand, but a simple, obvious way to disable would be acceptable. (ie more obvious than about:config)

Not a great deal can be done about font metrics other than my belief that websites shouldn't be able to ferret around my fonts to see what I have. Not like it's a critical need for any site.

Re: Online tracking: A 1-million-site measurement and analysis

#67

Post by beardog »

anexprogrammer wrote: post #66

Colour me unsurprised. Disappointed though. I'm glad I disabled WebRTC when I first discovered it could be used to expose local IP on a VPN. These "extension" technologies should all be optional plugins. Preferably install on demand, but a simple, obvious way to disable would be acceptable. (ie more obvious than about:config) Not a great deal can be done about font metrics other than my belief that websites shouldn't…

If your VPN is configured correctly, your IP will not be exposed.

Re: Online tracking: A 1-million-site measurement and analysis

#68

Post by amelius »

anexprogrammer wrote: post #66

Colour me unsurprised. Disappointed though. I'm glad I disabled WebRTC when I first discovered it could be used to expose local IP on a VPN. These "extension" technologies should all be optional plugins. Preferably install on demand, but a simple, obvious way to disable would be acceptable. (ie more obvious than about:config) Not a great deal can be done about font metrics other than my belief that websites shouldn't…

> These "extension" technologies should all be optional plugins.

But then still whether you installed an extension would contribute a bit of information to your fingerprint.

Re: Online tracking: A 1-million-site measurement and analysis

#69

Post by mikeash »

projectramo wrote: post #46
detaro wrote: post #28

Earlier quoted context omitted.

Canvas fingerprinting uses differences in rendering e.g. of fonts. Output a text, hash resulting pixel values. Depending on exact version of the font(s) installed, anti-aliasing settings, default font sizes, operating system... you get slightly different results. So you don't rely on information stored on the device, but on repeatable behavior that differs between devices.

I thought that was "Canvas-Font Fingerprinting" But now I see that is just seeing which fonts are available. Thanks for the explanation. Its just hard to believe devices are so different. I would think most versions of iOS would have roughly the same set of fonts etc.

Canvas fingerprinting by itself won't uniquely identify users. But the idea is that you can combine various different techniques, each one giving you more bits of uniqueness, until you have enough to do so. For example, say that canvas fingerprinting gives you one of 100 possibilities, and you combine it with other techniques that give you one of 10,000 possibilities, then combined (assuming they're not correlated) you get it to a million, letting you uniquely identify people with decent reliability from a decently large visitor pool.

Re: Online tracking: A 1-million-site measurement and analysis

#70

Post by dceddia »

metasean wrote: post #30
cptskippy wrote: post #9

Earlier quoted context omitted.

That's the line Apple took with iOS shortly before it introduced the App store. Mozilla, Palm/HP, and even Microsoft with it's Win 8 Metro Apps tried to make websites the new apps. It has some short comings. Web apps are definitely getting better, I haven't used an actual email client in 10 years, but they have a long way to go before they can replace dedicated clients entirely.

> Web apps are definitely getting better, ... but they have a long way to go before they can replace dedicated clients entirely. And yet, just yesterday there was a great discussion on Virtual Desktop Infrastructures, where entire operating systems are accessed and operated virtually through just the browser [0]. The current top comment indicates that while there are some setup hoops to jump through to use a specific…

That doesn't sound too far from Desktop Computing as a Service. It will be a sad day when I have to pay $9/month to be able to log into my desktop.
Post reply on HN