Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Online tracking: A 1-million-site measurement and analysis

webtransparency.cs.princeton.edu

Post reply on HN
Print view View original

161–170 of 272 posts

Re: Online tracking: A 1-million-site measurement and analysis

#161

Post by jfoster »

mikeash wrote: post #69
projectramo wrote: post #46

Earlier quoted context omitted.

I thought that was "Canvas-Font Fingerprinting" But now I see that is just seeing which fonts are available. Thanks for the explanation. Its just hard to believe devices are so different. I would think most versions of iOS would have roughly the same set of fonts etc.

Canvas fingerprinting by itself won't uniquely identify users. But the idea is that you can combine various different techniques, each one giving you more bits of uniqueness, until you have enough to do so. For example, say that canvas fingerprinting gives you one of 100 possibilities, and you combine it with other techniques that give you one of 10,000 possibilities, then combined (assuming they're not correlated) y…

What are some unexpected things that would differ between two iPhones of the same model running the same versions of the software stack?

Re: Online tracking: A 1-million-site measurement and analysis

#162

Post by carlesfe »

kuschku wrote: post #34
nailer wrote: post #21

Earlier quoted context omitted.

So a regular site using, say, mixpanel doesn't need to show a warning?

If the cookies are purely technical (say, login cookies), no. If the cookies are used for tracking, like Google Analytics, then yes, it needs to ask the user for consent. And that’s not a warning, but actual "yes/no", and in the no case, it may not set a tracking cookie, or have set a tracking cookie already. Most sites (except for a few dozen German and Dutch ones) just redirect you somewhere else, though, if you re…

That's true. The implementation differs on the country, for example in the UK it is enough to just show the annoying banner. Here in Spain you cannot set any tracking cookie (i.e. Analytics) without explicit consent. Of course, governmental websites totally break this law: http://cfenollosa.com/blog/the-ignorant-eu-cookie-law.html

However, OP is right, governments spy on our webcams and analyze our traffic, and that's ok, but we need a stupid banner that overrides browser preferences to avoid all but session cookies. Duh.

Re: Online tracking: A 1-million-site measurement and analysis

#163

Post by CyberDildonics »

tomkin wrote: post #84

Ahhh. Remember when this was just a Flash problem, and getting rid of Flash was going to rid the world of evil? Spoiler: that didn't happen.

Things like this happened with flash but you had no control over them since flash was all or nothing and closed source.

Re: Online tracking: A 1-million-site measurement and analysis

#164

Post by carlesfe »

rdancer wrote: post #143
JohnTHaller wrote: post #74

Earlier quoted context omitted.

Something that is best left to the browser to handle... by allowing the user to enable/disable 3rd party cookies. Which we already have. But no, the EU has stupid notifications on basically every single website as a result since everyone uses third party analytics. Why? If you want your analytics to be believed by anyone who wants to advertise with you, invest in you, partner with you, or buy you, they'd damn well be…

The EU Commission and the regulatory agencies actually agree with you. The stupidity is 100% with the web devs and customers.

What do you mean with "The stupidity is 100% with the web devs and customers"?

The law requires user consent, in form of a click on a banner or scrolling the page, before setting any cookie.

Re: Online tracking: A 1-million-site measurement and analysis

#165

Post by kibwen »

madeofpalk wrote: post #77
pmlnr wrote: post #36

So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular" browser fingerprinting. Is anyone aware of the existence of one?

The problem here is Canvas fingerprinting - that's what I found the most surprising and interesting. How do you prevent that, apart from working on 'fixing' browsers to create pixel-perfect renders across different browsers/platforms/configurations. Would that even be possible? Edit: > Tor Browser notifies the user for canvas read attempts and provides the option to return blank image data to prevent fingerprinting.…

  > apart from working on 'fixing' browsers to create pixel-
  > perfect renders
Alternatively, maybe have browsers slightly randomize canvas drawing results in ways that are essentially undetectable to a human eye.

Re: Online tracking: A 1-million-site measurement and analysis

#166

Post by makecheck »

Over 3,000 top sites using the font technique, and from the description this sounds really wasteful (choosing and drawing in a variety of fonts for no reason other than to sniff out the user).

Each font is probably associated with a non-trivial caching scheme and other OS resources, not to mention the use of anti-aliasing in rendering, etc. So a web page, doing something you don’t even want, is able to cause the OS to devote maybe 100x more resources to fonts than it otherwise would?

A simple solution would be to set a hard limit, such as “4 fonts maximum”, for any web site; and, to completely disallow linked domains from using more.

Re: Online tracking: A 1-million-site measurement and analysis

#167

Post by rasz_pl »

hvm wrote: post #57
MatekCopatek wrote: post #42

Earlier quoted context omitted.

This would make absolute sense. Certain requests (like location) already trigger popups that ask you for permission. If it turns out other APIs can be equally revealing as far as privacy goes, it would make sense to present the same popup. I mean, using a web app for the first time would be no different then installing a mobile app - I wouldn't be surprised if I had to give it a few permissions.

I was thinking the same thing. We need a permission system for websites. Preferably useable on a per-domain basis so I can disable those APIs on adnetworks' domains.

Thats what made Opera up to 12.xx great. “Edit site preferences…” menu let you tweak EVERY SINGLE option per domain.

Re: Online tracking: A 1-million-site measurement and analysis

#168

Post by avar »

randomwalker wrote: post #88
Freak_NL wrote: post #80

Earlier quoted context omitted.

What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's pr…

Personally I think there are so many of these APIs that for the browser to try to prevent the ability to fingerprint is putting the genie back in the bottle. But there is one powerful step browsers can take: put stronger privacy protections into private browsing mode, even at the expense of some functionality. Firefox has taken steps in this direction https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-... Tr…

Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting: https://bugs.chromium.org/p/chromium/issues/detail?id=142214...

Don't you think this sort of thing warrants a separate sort of browsing mode? A lot of people who use the likes of incognito mode just use it for e.g. browsing porn where they don't want the local history to be preserved.

Turning that mode into one that's highly hardened against fingerprinting would in practice ruin the browsing experience for those users. Just look at what the Tor browser needs to do with fixed preset resolutions, no JavaScript etc.

Re: Online tracking: A 1-million-site measurement and analysis

#169

Post by mccr8 »

ultramancool wrote: post #115

As soon as I saw these APIs being added I immediately dropped into about:config and disabled them. How the hell do these people think this is a good idea to do without asking any permissions? Put these in your user prefs.js file on Firefox: user_pref("dom.battery.enabled", false); user_pref("device.sensors.enabled", false); user_pref("dom.vibrator.enabled", false); user_pref("dom.enable_performance", false); user_pre…

Of course, now a site could potentially fingerprint you by the set of APIs you have disabled!

Re: Online tracking: A 1-million-site measurement and analysis

#170

Post by Zooper »

ultramancool wrote: post #115

As soon as I saw these APIs being added I immediately dropped into about:config and disabled them. How the hell do these people think this is a good idea to do without asking any permissions? Put these in your user prefs.js file on Firefox: user_pref("dom.battery.enabled", false); user_pref("device.sensors.enabled", false); user_pref("dom.vibrator.enabled", false); user_pref("dom.enable_performance", false); user_pre…

Thank you, user, for making your fingerprint hash more unique by disabling certain default features, given your user-agent string, thus opting into cat-facts.
Post reply on HN