Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Online tracking: A 1-million-site measurement and analysis

webtransparency.cs.princeton.edu

Post reply on HN
Print view View original

81–90 of 272 posts

Re: Online tracking: A 1-million-site measurement and analysis

#81

Post by hendi_ »

grav wrote: post #76
randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

Why would two browsers with the exact same user agent (ie same, version, same OS, same arch) yield two different renditions of an audio fingerprint?

They wouldn't.

But the point of fingerprinting is that practically no two "browsers" are the same:

  - browser software and exact version
  - installed plugins
  - size of browser window
  - OS software and exact version (think of patches!)
  - language
  - time zone
  - screen resolution
  - ...
  - (and all the stuff mentioned in the submitted article!)
See the EFF's Panopticlick to see _how_ unique your browser is. Be sure to click the "Show full results for fingerprinting" after the test to see all things it considers.

[0] https://panopticlick.eff.org/

Re: Online tracking: A 1-million-site measurement and analysis

#85

Post by codedokode »

Some methods of fingerprinting are probably used to distinct between real users and bots. Bots can use patched headless browsers that are masquaraded as desktop browsers (for example as latest Firefox or Chrome running on Windows). Subtle differences in font rendering or missing audio support can be useful to detect underlying libraries and platform. Hashing is used to hide exact matching algorithm from scammers.

There is a lot of people trying to earn on clicking ads with bots.

Edit: and by the way disabling JS is an effective method against most of the fingerprinting techniques.

Re: Online tracking: A 1-million-site measurement and analysis

#86

Post by nickm50 »

projectramo wrote: post #47
crispyambulance wrote: post #39

Earlier quoted context omitted.

I can see how you would be led to believe that interpretation. Looking at the "fingerprinting" webapp however, details that sound is NOT actually recorded-- only the uniqueness of your machine's audio processing stack. At least I hope that's the case. The idea of a microphone recording without permission upon visiting a website would cause quite a broo-ha-ha. https://audiofingerprint.openwpm.com/ > "This page tests b…

Wow, so are mic settings that different on different on, say, different iOS devices? If you and I have the same model iPhone with the same model iOS, is the audio stack that different?

I know iOS was just an example but just to clarify, the WebRTC spec isn't supported in-browser on iOS. To further clarify: it's not supported on iOS.

As a developer, you can take advantage of the spec only if you're building a native app. There's frameworks that you can use if you do. But within Safari or Chrome you have zero WebRTC support.

It's supported in modern versions of chrome on Android but won't be supported on iOS until apple does something about it.

Re: Online tracking: A 1-million-site measurement and analysis

#87

Post by syrrim »

hsivonen wrote: post #27
jimktrains2 wrote: post #7

NoScript is an all-or-nothing approach. Are there any JS-blockers that allow API-level blocks?

If you disable a unique combination of APIs that combination becomes your fingerprint.

Not if a large number of people all disable the same APIs

Re: Online tracking: A 1-million-site measurement and analysis

#88

Post by randomwalker »

Freak_NL wrote: post #80
randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's pr…

Personally I think there are so many of these APIs that for the browser to try to prevent the ability to fingerprint is putting the genie back in the bottle.

But there is one powerful step browsers can take: put stronger privacy protections into private browsing mode, even at the expense of some functionality. Firefox has taken steps in this direction https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-...

Traditionally all browsers viewed private browsing mode as protecting against local adversaries and not trackers / network adversaries, and in my opinion this was a mistake.

Re: Online tracking: A 1-million-site measurement and analysis

#89

Post by jordache »

Fradow wrote: post #65
projectramo wrote: post #25

Earlier quoted context omitted.

I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that wha…

I'm going to answer the basic question: fingerprinting is about trying to identify your device as uniquely as possible using available APIs, in order to track you cross-site, without cookies. To do that, you first try to identify API that have different results depending on the browser or the device, and then track their result. For example, the User agent have some identifying information. It's not unique for each p…

Which API reveals my system fonts to a website?

Edit: The fingerprint test at https://panopticlick.eff.org/ shows my System Fonts

Re: Online tracking: A 1-million-site measurement and analysis

#90

Post by MichaelGG »

WebRTC guys get around this by stating fingerprinting is game over, so don't even bother. They ignore that they are going against the explicitly defined networking (proxy) settings. Browsers are complicit in this. If the application asks "should I use a proxy", then ignores it, silently, wherever it wants, that's deceptive and broken.

There's still zero (0) use cases to have WebRTC data channels enabled in the background with no indicator.

If all these APIs are added, the web will turn into a bigger mess than it is. They can't prompt for permissions too much. So they'll skip that, like WebRTC does.

Post reply on HN