Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Online tracking: A 1-million-site measurement and analysis

webtransparency.cs.princeton.edu

Post reply on HN
Print view View original

121–130 of 272 posts

Re: Online tracking: A 1-million-site measurement and analysis

#121

Post by aub3bhat »

Fradow wrote: post #65
projectramo wrote: post #25

Earlier quoted context omitted.

I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that wha…

I'm going to answer the basic question: fingerprinting is about trying to identify your device as uniquely as possible using available APIs, in order to track you cross-site, without cookies. To do that, you first try to identify API that have different results depending on the browser or the device, and then track their result. For example, the User agent have some identifying information. It's not unique for each p…

I never understood panopticlick, even when I repeatedly visit it, it always tells me that

"Your browser fingerprint appears to be unique among the 135,054 tested so far."

Shouldn't it tell me that my browser is not unique during my 10th attempt considering it has recorded my previous attempts. This warning actually never changes, regardless of duration between consecutive attempts. That can only mean that the panopticlick is flawed or my browser signature is in constant flux (which would essentially make it useless from tracking perspective.)

Re: Online tracking: A 1-million-site measurement and analysis

#122

Post by hendi_ »

dao- wrote: post #104
hendi_ wrote: post #81

Earlier quoted context omitted.

They wouldn't. But the point of fingerprinting is that practically no two "browsers" are the same: - browser software and exact version - installed plugins - size of browser window - OS software and exact version (think of patches!) - language - time zone - screen resolution - ... - (and all the stuff mentioned in the submitted article!) See the EFF's Panopticlick to see _how_ unique your browser is. Be sure to click…

That doesn't really answer the question, because most of the factors you listed should be irrelevant for _audio_ fingerprinting.

It does.

> They wouldn't.

Re: Online tracking: A 1-million-site measurement and analysis

#123

Post by Freak_NL »

amluto wrote: post #117
Freak_NL wrote: post #80

Earlier quoted context omitted.

What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's pr…

The browser vendors could start taking the idea of asking for permission seriously. For WebRTC, browsers could block local addresses. uBlock Origin can do this on Firefox already. For battery: browsers could treat it like location and ask for permission. Why does the average site need to know my battery status? For fonts: browsers could standardize a list of system fonts available on each platform. It's 2016 already:…

> browsers could standardize a list of system fonts available on each platform.

It would probably make sense to completely disable support for local fonts unless permitted by the user (for legacy websites that depend on it). All modern browsers support @font-face, and without @font-face you can always depend on the special keywords serif, sans-serif, and monospace; these will load the system's default font for that category.

Re: Online tracking: A 1-million-site measurement and analysis

#124

Post by hendi_ »

richardwhiuk wrote: post #110
hendi_ wrote: post #81

Earlier quoted context omitted.

They wouldn't. But the point of fingerprinting is that practically no two "browsers" are the same: - browser software and exact version - installed plugins - size of browser window - OS software and exact version (think of patches!) - language - time zone - screen resolution - ... - (and all the stuff mentioned in the submitted article!) See the EFF's Panopticlick to see _how_ unique your browser is. Be sure to click…

But is any of this stuff stable enough to ensure a fingerprint -> user correlation which doesn't break every time? It's not very much use if all it does is create a unique fingerprint for each refresh?

Yes; the things I've mentioned above don't change on page refresh.

If you'd find some things do change too often to be relied upon you could either take that into account, or simply don't use that specific fingerprinting technique.

Re: Online tracking: A 1-million-site measurement and analysis

#125

Post by kbenson »

nickm50 wrote: post #86
projectramo wrote: post #47

Earlier quoted context omitted.

Wow, so are mic settings that different on different on, say, different iOS devices? If you and I have the same model iPhone with the same model iOS, is the audio stack that different?

I know iOS was just an example but just to clarify, the WebRTC spec isn't supported in-browser on iOS. To further clarify: it's not supported on iOS. As a developer, you can take advantage of the spec only if you're building a native app. There's frameworks that you can use if you do. But within Safari or Chrome you have zero WebRTC support. It's supported in modern versions of chrome on Android but won't be supporte…

> But within Safari or Chrome you have zero WebRTC support.

Chrome is just a skin on Safari for iOS, because Apple doesn't allow third party browsers, right? I would think FF (or any other browser) wouldn't be able to on iOS either, given that constraint.

Re: Online tracking: A 1-million-site measurement and analysis

#126

Post by cptskippy »

maxerickson wrote: post #16
cptskippy wrote: post #6

All of this makes me wonder how some of these interfaces should be more closely guarded by the user agent. Perhaps instead of a site probing for capabilities, they should instead publish a list of what the site/page can leverage and what it absolutely needs to work. Maybe meta tags in the head or something like the robots.txt. Browsers can then pull the list and present it to the end user for white-listing. You could…

Users don't want to do this though. I mean, how many people are dealing with the hassle of noscript? That's probably most of the users that are going to do anything other than tell the browser to stop asking questions.

Users are familiar with managing permissions, they do it all of the time. Users have to manage location services and the camera in browser. iOS and Android also prompt for access to resources.

Why is it unrealistic to expect the same for other interfaces like audio, video, WebRTC, and other potentially exploitable functionality?

Re: Online tracking: A 1-million-site measurement and analysis

#127

Post by beardog »

throwanem wrote: post #113
beardog wrote: post #67

Earlier quoted context omitted.

If your VPN is configured correctly, your IP will not be exposed.

Not all of my devices make it possible to disable WebRTC, which makes defense in depth a necessity. Can you provide pointers to more information?

I don't experience webrtc leaks with Openvpn and this config: http://pastebin.com/raw/hiH1TZtS (I use IVPN, their client prevents webrtc leaks on windows by default, but had to manually configure openvpn on linux).

Of course, I keep webrtc disabled in Firefox anyway except when i need it, defense in depth like you said.

Re: Online tracking: A 1-million-site measurement and analysis

#128

Post by kbenson »

projectramo wrote: post #48
ronjouch wrote: post #33

Earlier quoted context omitted.

> "how can the "canvas fingerprinting" work since I had to browse to a new page and all the old pixels from the previous page are no longer there" The linked page answers this: "Differences in font rendering, smoothing, anti-aliasing, as well as other device features cause devices to draw the image differently." Put differently, the function measureText(canvas full of text with various fonts and bizarre features with…

Thanks for the explanation. I missed it because I never though these settings could be that unique.

Just imagine, if the audio stack exposes the volume level, that's roughly 7.5 bits of uniqueness to contribute to the 33 required to uniquely identity any person on Earth (not that you can expect it to be uniformly distributed, and thus fully usable).

Re: Online tracking: A 1-million-site measurement and analysis

#129

Post by moron4hire »

anexprogrammer wrote: post #99
moron4hire wrote: post #79

Earlier quoted context omitted.

What would anyone do with your internal network IP? Having these features as optional plugins means they are basically impossible to count on having in the basic web platform, meaning you're going to fight a losing battle to gain adoption for any applications that need them. And the open web platform is the only platform right now that is enabling developers to create cross-platform applications outside of the restri…

Not just internal network IP, but also public IP. There were quite a few test sites popped up when the issue came to light. > Having these features as optional plugins means they are basically impossible to count on having Funny. Didn't seem to prevent flash, acrobat or others becoming extensively adopted. If I want browser video chat I can install WebRTC etc. If the cost of having that universal platform is compromi…

You know every site you ever go to sees your public IP, right?

Seems to me you're just being paranoid.

Re: Online tracking: A 1-million-site measurement and analysis

#130

Post by maxerickson »

cptskippy wrote: post #126
maxerickson wrote: post #16

Earlier quoted context omitted.

Users don't want to do this though. I mean, how many people are dealing with the hassle of noscript? That's probably most of the users that are going to do anything other than tell the browser to stop asking questions.

Users are familiar with managing permissions, they do it all of the time. Users have to manage location services and the camera in browser. iOS and Android also prompt for access to resources. Why is it unrealistic to expect the same for other interfaces like audio, video, WebRTC, and other potentially exploitable functionality?

I'm not arguing against enabling users to manage the permissions.

I'm arguing it won't help a huge number of users because they will default to granting them.

Post reply on HN