I think it's time for HTML--, which would contain no active content at all and simply be a reflowable document display format.
Online tracking: A 1-million-site measurement and analysis
101–110 of 272 posts
Re: Online tracking: A 1-million-site measurement and analysis
#102Earlier quoted context omitted.
What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's pr…
What about time and date? I'm almost certain NetFlix uses this to detect geo-unblocking.
Netflix uses an up-to-date list of known VPN-endpoints in addition to a database of IP-ranges by country. They don't need to detect anything client-side. This list is constantly in flux though, so sometimes accessing Netflix via VPN works, sometimes it doesn't.
Re: Online tracking: A 1-million-site measurement and analysis
#103So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular" browser fingerprinting. Is anyone aware of the existence of one?
The problem here is Canvas fingerprinting - that's what I found the most surprising and interesting. How do you prevent that, apart from working on 'fixing' browsers to create pixel-perfect renders across different browsers/platforms/configurations. Would that even be possible? Edit: > Tor Browser notifies the user for canvas read attempts and provides the option to return blank image data to prevent fingerprinting.…
It seems possible to add heuristics like 'the canvas element has requested more than X fonts within about Y seconds' and then treat that as a tracking script and do something like prompt the user, or return the default font from then on.
Re: Online tracking: A 1-million-site measurement and analysis
#104Earlier quoted context omitted.
Why would two browsers with the exact same user agent (ie same, version, same OS, same arch) yield two different renditions of an audio fingerprint?
They wouldn't. But the point of fingerprinting is that practically no two "browsers" are the same: - browser software and exact version - installed plugins - size of browser window - OS software and exact version (think of patches!) - language - time zone - screen resolution - ... - (and all the stuff mentioned in the submitted article!) See the EFF's Panopticlick to see _how_ unique your browser is. Be sure to click…
That doesn't really answer the question, because most of the factors you listed should be irrelevant for _audio_ fingerprinting.
Re: Online tracking: A 1-million-site measurement and analysis
#105This is the kind of nonconsensual sureptitious user tracking that the EU privacy directive 2002/58/EC concerns itself with, not those redundant, stupid cookie consent overlays.
And there's already been an opinion to extend 2002/58/EC to fingerprinting[0]
[0]: http://ec.europa.eu/justice/data-protection/article-29/docum...
Re: Online tracking: A 1-million-site measurement and analysis
#106Colour me unsurprised. Disappointed though. I'm glad I disabled WebRTC when I first discovered it could be used to expose local IP on a VPN. These "extension" technologies should all be optional plugins. Preferably install on demand, but a simple, obvious way to disable would be acceptable. (ie more obvious than about:config) Not a great deal can be done about font metrics other than my belief that websites shouldn't…
> These "extension" technologies should all be optional plugins. But then still whether you installed an extension would contribute a bit of information to your fingerprint.
True enough, though I suspect not installed would be the majority case. I guess it should ask like browsers ask before location check.
Re: Online tracking: A 1-million-site measurement and analysis
#107Whoa, what's the use case for exposing battery information?
Some application want access to the battery info as they might want to disable some functionality in case your battery runs low. It would be smarter if instead of giving exact battery level it will get a callback once the battery runs low.
The Great Suspender is an example of this. Auto-sleeps browser tabs when on battery.
https://chrome.google.com/webstore/detail/the-great-suspende...
Re: Online tracking: A 1-million-site measurement and analysis
#108NoScript is an all-or-nothing approach. Are there any JS-blockers that allow API-level blocks?
If you use Firefox or Iceweasel, you can disable most of those apis in about:config or user.js. For example, media.peerconnection.enabled = false, to disable WebRTC. dom.battery.enabled = false for battery, etc.
Or you could use the privacy settings addon, which adds a toolbar button to enable/disable most of those settings.
Re: Online tracking: A 1-million-site measurement and analysis
#109Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.
Thanks for this research, really interesting to see.
I do want to state for the record that instinctiveads.com was testing augur.io and that's why we're listed there. We don't use them anymore but unfortunate timing, especially considering we're trying to be a better ad network than the rest.
Also I'd like to point out that one of the most pervasive tracking methods is done through form submissions. Anywhere you submit an email (login, purchase, etc) can be used as identification and first-party cookie matching.
Re: Online tracking: A 1-million-site measurement and analysis
#110Earlier quoted context omitted.
Why would two browsers with the exact same user agent (ie same, version, same OS, same arch) yield two different renditions of an audio fingerprint?
They wouldn't. But the point of fingerprinting is that practically no two "browsers" are the same: - browser software and exact version - installed plugins - size of browser window - OS software and exact version (think of patches!) - language - time zone - screen resolution - ... - (and all the stuff mentioned in the submitted article!) See the EFF's Panopticlick to see _how_ unique your browser is. Be sure to click…
But is any of this stuff stable enough to ensure a fingerprint -> user correlation which doesn't break every time? It's not very much use if all it does is create a unique fingerprint for each refresh?