Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Online tracking: A 1-million-site measurement and analysis

webtransparency.cs.princeton.edu

Post reply on HN
Print view View original

91–100 of 272 posts

Re: Online tracking: A 1-million-site measurement and analysis

#91

Post by Freak_NL »

madeofpalk wrote: post #77
pmlnr wrote: post #36

So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular" browser fingerprinting. Is anyone aware of the existence of one?

The problem here is Canvas fingerprinting - that's what I found the most surprising and interesting. How do you prevent that, apart from working on 'fixing' browsers to create pixel-perfect renders across different browsers/platforms/configurations. Would that even be possible? Edit: > Tor Browser notifies the user for canvas read attempts and provides the option to return blank image data to prevent fingerprinting.…

> […] but being able to read pixel data out of a canvas is completely reasonable.

Not for every website. Most websites don't need canvas at all. One option would be to ask users to activate canvas support for a website that does need it, so users can judge for themselves if the request is legitimate. This is how the geo-location API works after all.

I am not convinced that this will work very well though.

Re: Online tracking: A 1-million-site measurement and analysis

#92

Post by robmcm »

madeofpalk wrote: post #77
pmlnr wrote: post #36

So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular" browser fingerprinting. Is anyone aware of the existence of one?

The problem here is Canvas fingerprinting - that's what I found the most surprising and interesting. How do you prevent that, apart from working on 'fixing' browsers to create pixel-perfect renders across different browsers/platforms/configurations. Would that even be possible? Edit: > Tor Browser notifies the user for canvas read attempts and provides the option to return blank image data to prevent fingerprinting.…

Disable canvas rendering from 3rd part domains? Prompt to enable canvas support for each domain?

Re: Online tracking: A 1-million-site measurement and analysis

#93

Post by chris_wot »

Freak_NL wrote: post #80
randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's pr…

What about time and date? I'm almost certain NetFlix uses this to detect geo-unblocking.

Re: Online tracking: A 1-million-site measurement and analysis

#94

Post by mpeg »

jordache wrote: post #89
Fradow wrote: post #65

Earlier quoted context omitted.

I'm going to answer the basic question: fingerprinting is about trying to identify your device as uniquely as possible using available APIs, in order to track you cross-site, without cookies. To do that, you first try to identify API that have different results depending on the browser or the device, and then track their result. For example, the User agent have some identifying information. It's not unique for each p…

Which API reveals my system fonts to a website? Edit: The fingerprint test at https://panopticlick.eff.org/ shows my System Fonts

You can't get installed fonts via javascript, but you can change the font of a known text and fingerprint the size to determine whether the font is installed or it defaulted to another font.

Re: Online tracking: A 1-million-site measurement and analysis

#95

Post by tangent128 »

jordache wrote: post #89
Fradow wrote: post #65

Earlier quoted context omitted.

I'm going to answer the basic question: fingerprinting is about trying to identify your device as uniquely as possible using available APIs, in order to track you cross-site, without cookies. To do that, you first try to identify API that have different results depending on the browser or the device, and then track their result. For example, the User agent have some identifying information. It's not unique for each p…

Which API reveals my system fonts to a website? Edit: The fingerprint test at https://panopticlick.eff.org/ shows my System Fonts

I don't think you can enumerate them these days, but you can test for them by trying to use them in CSS (which font is used would affect the width of a span of text, use a wildly different fallback font and you can guess which is installed) or (where you can inspect the actual pixels rendered).

Re: Online tracking: A 1-million-site measurement and analysis

#96

Post by mpeg »

detaro wrote: post #54
projectramo wrote: post #46

Earlier quoted context omitted.

I thought that was "Canvas-Font Fingerprinting" But now I see that is just seeing which fonts are available. Thanks for the explanation. Its just hard to believe devices are so different. I would think most versions of iOS would have roughly the same set of fonts etc.

I would assume that iOS devices are quite hard to tell apart using most of these techniques, yes. But I also wouldn't be too surprised if there were something that works for them, some kind of cookie that isn't cleared by default or ...

Yup HSTS supercookies or some kinds of network fingerprinting will work to distinguish between two otherwise identical iOS devices.

Re: Online tracking: A 1-million-site measurement and analysis

#97

Post by CyberDildonics »

buremba wrote: post #5

All these things make the websites the new apps. Most probably we won't need to use many desktop applications a few years later.

I'm not sure why this seems to be a controversial opinion. Webasm with good concurrency could mean well written webasm software actually running faster than poorly written desktop software unless there is hardware acceleration on the desktop side that can't be used on the web side.

Re: Online tracking: A 1-million-site measurement and analysis

#98

Post by boomlinde »

madeofpalk wrote: post #77
pmlnr wrote: post #36

So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular" browser fingerprinting. Is anyone aware of the existence of one?

The problem here is Canvas fingerprinting - that's what I found the most surprising and interesting. How do you prevent that, apart from working on 'fixing' browsers to create pixel-perfect renders across different browsers/platforms/configurations. Would that even be possible? Edit: > Tor Browser notifies the user for canvas read attempts and provides the option to return blank image data to prevent fingerprinting.…

If the "fingerprint" really is a checksum/crypto hash, an ever so slight random element in rendering output could help. Of course, together with other techniques, it might just identify your somewhat obfuscating browser.

Re: Online tracking: A 1-million-site measurement and analysis

#99

Post by anexprogrammer »

moron4hire wrote: post #79
anexprogrammer wrote: post #66

Colour me unsurprised. Disappointed though. I'm glad I disabled WebRTC when I first discovered it could be used to expose local IP on a VPN. These "extension" technologies should all be optional plugins. Preferably install on demand, but a simple, obvious way to disable would be acceptable. (ie more obvious than about:config) Not a great deal can be done about font metrics other than my belief that websites shouldn't…

What would anyone do with your internal network IP? Having these features as optional plugins means they are basically impossible to count on having in the basic web platform, meaning you're going to fight a losing battle to gain adoption for any applications that need them. And the open web platform is the only platform right now that is enabling developers to create cross-platform applications outside of the restri…

Not just internal network IP, but also public IP. There were quite a few test sites popped up when the issue came to light.

> Having these features as optional plugins means they are basically impossible to count on having

Funny. Didn't seem to prevent flash, acrobat or others becoming extensively adopted. If I want browser video chat I can install WebRTC etc.

If the cost of having that universal platform is compromising everyone's privacy, on any site that wants to check, it's not a fair or acceptable trade.

Seems to me we have this ass backwards.

Re: Online tracking: A 1-million-site measurement and analysis

#100

Post by dao- »

jordache wrote: post #89
Fradow wrote: post #65

Earlier quoted context omitted.

I'm going to answer the basic question: fingerprinting is about trying to identify your device as uniquely as possible using available APIs, in order to track you cross-site, without cookies. To do that, you first try to identify API that have different results depending on the browser or the device, and then track their result. For example, the User agent have some identifying information. It's not unique for each p…

Which API reveals my system fonts to a website? Edit: The fingerprint test at https://panopticlick.eff.org/ shows my System Fonts

Flash provides an API for that.

Edit: Disable Flash or make it click-to-activate and https://panopticlick.eff.org/ shouldn't list your fonts anymore.

Post reply on HN