Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Online tracking: A 1-million-site measurement and analysis

webtransparency.cs.princeton.edu

Post reply on HN
Print view View original

151–160 of 272 posts

Re: Online tracking: A 1-million-site measurement and analysis

#151

Post by recursive »

cptskippy wrote: post #126
maxerickson wrote: post #16

Earlier quoted context omitted.

Users don't want to do this though. I mean, how many people are dealing with the hassle of noscript? That's probably most of the users that are going to do anything other than tell the browser to stop asking questions.

Users are familiar with managing permissions, they do it all of the time. Users have to manage location services and the camera in browser. iOS and Android also prompt for access to resources. Why is it unrealistic to expect the same for other interfaces like audio, video, WebRTC, and other potentially exploitable functionality?

Most permission management most users do is click the "accept" button when installing an app without reading anything on the list. I don't see how that helps.

Re: Online tracking: A 1-million-site measurement and analysis

#152

Post by rdancer »

randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

When everybody was running Windows on a smorgasbord of hardware / patchlevel / plugins / fonts, it was easy to fingerprint. Are we moving towards a more monolithic landscape where fingerprinting is less able to track individual users?

* If I have a fleet of Chromebooks running the same version of Chrome OS, will they all have the same fingerprint?

* Will, say, all iPhones 6 with the same hardware parts, running the same Mobile Safari and iOS version, have the same fingerprint?

Thank you!

Re: Online tracking: A 1-million-site measurement and analysis

#153

Post by cm3 »

cichli2 wrote: post #108
phaer wrote: post #23

Earlier quoted context omitted.

If you use Firefox or Iceweasel, you can disable most of those apis in about:config or user.js. For example, media.peerconnection.enabled = false, to disable WebRTC. dom.battery.enabled = false for battery, etc.

Or you could use the privacy settings addon, which adds a toolbar button to enable/disable most of those settings.

While that works, it's reset whenever you clear your history and data completely. Isn't there a way to whitelist this in user.js permanently?

Re: Online tracking: A 1-million-site measurement and analysis

#154

Post by cm3 »

TazeTSchnitzel wrote: post #40
pmlnr wrote: post #36

So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular" browser fingerprinting. Is anyone aware of the existence of one?

I think Tor Browser tries to do this for some types of fingerprinting.

I wish there was a Tor Browser without Tor but just things like fingerprinting fixes.

Re: Online tracking: A 1-million-site measurement and analysis

#155

Post by brudgers »

evan_ wrote: post #141
brudgers wrote: post #137

Google has a vested interest in information leakage. I have a suspicion that the Chromium project expresses a strategic desire to shape the direction of browser development away from stopping those leaks. The idea of signing into the browser with an identity is a core feature and in Google's branded version, Chrome, the big idea is that the user is signed into Google's services. Google only pitches the idea of multip…

Google is already really good at tracking people, why would it introduce vectors that would help other vendors catch up? You would have to demonstrate that Google itself was using these vectors for tracking.

What Google vends isn't browsers. It vends advertising.

It's competitors for data? To see how is Microsoft's "sign in to the web" is playing one might be tempted to Bing with IE, but statistically the odds favor another browser and another search service combination.

Re: Online tracking: A 1-million-site measurement and analysis

#156

Post by crispyambulance »

Brakenshire wrote: post #120
englehardt wrote: post #49

Earlier quoted context omitted.

Yes, no sound is recorded. Access to the user's mic isn't possible without a permission. If there are sections of the website or paper that seem to imply that, let me know and we'll clarify.

It seems strange that access to the audio stack isn't also behind the permission.

It does, and also as someone who has never heard of AudioContext before, I can't fathom why it would be necessary for a web application to generate an audio data stream that isn't output to speakers _AND_ _THEN_ analyze the result.

What is the typical use case for AudioContext?

The capabilities of AudioContext used in audio fingerprinting seem like they're beyond what is really necessary?

Re: Online tracking: A 1-million-site measurement and analysis

#157

Post by aub3bhat »

prof_hobart wrote: post #148
aub3bhat wrote: post #121

Earlier quoted context omitted.

I never understood panopticlick, even when I repeatedly visit it, it always tells me that "Your browser fingerprint appears to be unique among the 135,054 tested so far." Shouldn't it tell me that my browser is not unique during my 10th attempt considering it has recorded my previous attempts. This warning actually never changes, regardless of duration between consecutive attempts. That can only mean that the panopti…

I thought the same thing, so I did a bit of digging. Turns out they put a bunch of tracking cookies on your machine without asking you (it is mentioned in the about page though), which seem rather naughty for an organisation promoting online privacy. When I removed all 4 of them, I get down to being "almost unique". I'm currently down to having the same fingerprint as 1 in 45132.3333333 browsers.

This is confusing, my incorrect assumption was 1 out n browsers meant n = total numbers of browsers evaluated by panopticlick. Rather what they mean is 1 out of k, where k is determined by unique bits. There might be other factor such as entropy of each fingerprint.

Re: Online tracking: A 1-million-site measurement and analysis

#158

Post by WalterSear »

rz2k wrote: post #132
amluto wrote: post #117

Earlier quoted context omitted.

The browser vendors could start taking the idea of asking for permission seriously. For WebRTC, browsers could block local addresses. uBlock Origin can do this on Firefox already. For battery: browsers could treat it like location and ask for permission. Why does the average site need to know my battery status? For fonts: browsers could standardize a list of system fonts available on each platform. It's 2016 already:…

Actually, that makes me wonder — if I spoof 5% battery charge will I get fewer annoying features on any sites?

You'll get more ads for chargers and laptop batteries.

Re: Online tracking: A 1-million-site measurement and analysis

#159

Post by WalterSear »

cm3 wrote: post #150
Freak_NL wrote: post #123

Earlier quoted context omitted.

> browsers could standardize a list of system fonts available on each platform. It would probably make sense to completely disable support for local fonts unless permitted by the user (for legacy websites that depend on it). All modern browsers support @font-face, and without @font-face you can always depend on the special keywords serif , sans-serif , and monospace ; these will load the system's default font for tha…

I would go further and disable remote fonts as well since it's not crucial like images and is an attack vector that should have been avoided. The better solution would have been a shared set of web fonts distributed with browsers, just like certificates.

I don't see why fonts are any different from images.

Re: Online tracking: A 1-million-site measurement and analysis

#160

Post by manigandham »

kbenson wrote: post #118
manigandham wrote: post #109

Earlier quoted context omitted.

Thanks for this research, really interesting to see. I do want to state for the record that instinctiveads.com was testing augur.io and that's why we're listed there. We don't use them anymore but unfortunate timing, especially considering we're trying to be a better ad network than the rest. Also I'd like to point out that one of the most pervasive tracking methods is done through form submissions. Anywhere you subm…

Having the insight of of someone who works in online advertising would be interesting and informative. Is there anything you can share that we might find interesting?

I could talk about this for hours. Fundamentally, identity is important for the ad industry but it's not about your personal info, it's just a reliable ID that we're all after.

A reliable ID allows for storing your ad history and interests to show you better ads and less of the same. This is proven since it's all math and data science and we can see the increase in metrics with better targeting. By the way, clicks are not the most important metric either, there's much more that goes into an ad campaign. Ironically, reliable IDs also allow for storing any opt-out settings since it's just a value attached to that ID.

The email login I mentioned above is the most common way to track online, most of the big sites actually sell login data and fire tracking tags when you're logged in with the email address passed through (usually hashed but not always) so that providers can set their own cookies and recognize you again. Since emails are strongly unique, this is really effective.

This tech is also used to combat ad fraud (which is what we were using it for). Fraud is a massive problem since it's so easy to start up botnets and churn through millions of ad impressions quickly.

Unfortunately a lot of this new age of tracking is the result of politics, bad incentives, and a lack of regulation that's led to a wild west situation where these companies can do anything. Clearly the technical talent is capable (as seen in this research) but it's being put to the wrong use. The DNT (do not track) header was a compromise but lacked any real regulation to make it effective. 3rd party cookies were fine but unfairly demonized and the default blocking of them pushed the industry to these deeper tactics.

Ultimately this is a business process issue: if there was a standardized ID like IDFA but for browsers (or even better at the OS level) and privacy regulation that's actually enforced, that would be a good compromise. Sites and ad networks get a reliable ID and you get control over when and how that ID is refreshed.

EDIT - All this stuff used by independent ad companies is just a tiny fraction of the industry. This barely covers ISPs who have very refined tracking abilities that you really cant avoid since they control the traffic. Comcast/Verizon has the AOL ad network using this. And the 2 biggest ad companies are Google and Facebook, both of which don't need fingerprinting because they already know who you are from just being logged in.

Post reply on HN