Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Online tracking: A 1-million-site measurement and analysis

webtransparency.cs.princeton.edu

Post reply on HN
Print view View original

171–180 of 272 posts

Re: Online tracking: A 1-million-site measurement and analysis

#171

Post by smartbit »

randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

On iOS I use safari and disable access to location etc, also disable cookies, advertisementID, etc, etc. Then I feel quite save when using a VPN. Does that still hold?

Re: Online tracking: A 1-million-site measurement and analysis

#172

Post by mtgx »

Freak_NL wrote: post #80
randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's pr…

How about using the permission system? You don't have to disable WebGL by default, but you can ask users for permission when it's needed (usually in a game).

Other stuff like GPS, camera, and microphone already require permission before being used.

Re: Online tracking: A 1-million-site measurement and analysis

#173

Post by benevol »

avar wrote: post #168
randomwalker wrote: post #88

Earlier quoted context omitted.

Personally I think there are so many of these APIs that for the browser to try to prevent the ability to fingerprint is putting the genie back in the bottle. But there is one powerful step browsers can take: put stronger privacy protections into private browsing mode, even at the expense of some functionality. Firefox has taken steps in this direction https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-... Tr…

Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting: https://bugs.chromium.org/p/chromium/issues/detail?id=142214... Don't you think this sort of thing warrants a separate sort of browsing mode? A lot of people who use the likes of incognito mode just use it for e.g. browsing porn where they don't want the local history to be preserved. Turning that mode in…

> Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting

Obviously. Google is in the business of destroying your privacy: Advertising revenue is maximized when the consumer is/remains completely tracked and profiled at all times.

Other browser vendors which are not in the ad business could use this as an opportunity to differentiate themselves from Google:

Introduce a 3rd browsing mode which kills fingerprinting (with the "cost" of reduced user friendliness).

Re: Online tracking: A 1-million-site measurement and analysis

#174

Post by cm3 »

WalterSear wrote: post #159
cm3 wrote: post #150

Earlier quoted context omitted.

I would go further and disable remote fonts as well since it's not crucial like images and is an attack vector that should have been avoided. The better solution would have been a shared set of web fonts distributed with browsers, just like certificates.

I don't see why fonts are any different from images.

Fonts are different in that they're not as crucial to the content as images. You cannot replace an image with an alternative text form while retaining the content, but you can display the content completely with WOFF missing.

Re: Online tracking: A 1-million-site measurement and analysis

#175

Post by ysleepy »

oblio wrote: post #15
ysleepy wrote: post #13

Well, who would have guessed. Surprise surprise. The web is such a shit technology.

And how would Silverlight or Java applets or Flash or any other client side technology be better in this regard? You have to expose capabilities and those capabilities can be used to create an unique fingerprint based on your device. How would you design the stack so that this kind of thing is impossible? Feel free to use your favorite tech stack as a base.

How about not developing applications in the browser? Its about linked documents. Not angular-17 MVVM async session persistence in indexdb with websql and asm.js rendering webgl for a spinning teapot.

Re: Online tracking: A 1-million-site measurement and analysis

#176

Post by blacksmith_tb »

amluto wrote: post #117
Freak_NL wrote: post #80

Earlier quoted context omitted.

What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's pr…

The browser vendors could start taking the idea of asking for permission seriously. For WebRTC, browsers could block local addresses. uBlock Origin can do this on Firefox already. For battery: browsers could treat it like location and ask for permission. Why does the average site need to know my battery status? For fonts: browsers could standardize a list of system fonts available on each platform. It's 2016 already:…

> Why does the average site need to know my battery status?

I would go further and suggest that really no site needs to know it (I am sure there could be a few reasonable uses, but still). Which makes me wonder if we could strike back by abusing the WebRTC spec and fuzzing values like these, instead of simply blocking them.

Re: Online tracking: A 1-million-site measurement and analysis

#177

Post by mikeash »

jfoster wrote: post #161
mikeash wrote: post #69

Earlier quoted context omitted.

Canvas fingerprinting by itself won't uniquely identify users. But the idea is that you can combine various different techniques, each one giving you more bits of uniqueness, until you have enough to do so. For example, say that canvas fingerprinting gives you one of 100 possibilities, and you combine it with other techniques that give you one of 10,000 possibilities, then combined (assuming they're not correlated) y…

What are some unexpected things that would differ between two iPhones of the same model running the same versions of the software stack?

Good question. I'm not particularly informed on this stuff, so take this with a grain of salt, but my understanding is that mobile devices in general and iPhones in particular are much harder to fingerprint reliably. Things like time zone, clock skew, and ping times might help differentiate users, but you probably can't get it down to a single person. I imagine there's still a use for fingerprinting which helps you differentiate groups of users even if you can't narrow it down to just one.

Re: Online tracking: A 1-million-site measurement and analysis

#178

Post by Freak_NL »

Klathmon wrote: post #147
Freak_NL wrote: post #123

Earlier quoted context omitted.

> browsers could standardize a list of system fonts available on each platform. It would probably make sense to completely disable support for local fonts unless permitted by the user (for legacy websites that depend on it). All modern browsers support @font-face, and without @font-face you can always depend on the special keywords serif , sans-serif , and monospace ; these will load the system's default font for tha…

I hope there is another way to solve it, as I have installed web-fonts to my PC to improve page loading speed for some common fonts I keep seeing (the most recent being the Roboto font stack from google). It would be a shame to have to keep re-downloading that every time.

You don't have to. Fonts should be (and usually are) offered to the web browser with the instruction to cache them indefinitely. You will only have to re-download them when your cache is cleaned up (due to its size, private browsing, or manually cleaning it). Upcoming technology WOFF2 helps further compress them by a significant margin as well (I've seen up to 50% improvement in size over plain WOFF).

The problem is that the behaviour you are describing is also one of the ways a fingerprinter gets its data on your fonts; by specifying an @font-face declaration that first tries for a local font, and only loads a remote font if that is not found. Do this for a short-list of popular but distinct fonts (such as Roboto), and you have a nice amount of bits of identifying data to add to the stack.

Also, tricks like these exist (using rendering metrics to detect fonts):

http://www.lalit.org/lab/javascript-css-font-detect/

Re: Online tracking: A 1-million-site measurement and analysis

#179

Post by sleepychu »

rdancer wrote: post #2

This is the kind of nonconsensual sureptitious user tracking that the EU privacy directive 2002/58/EC concerns itself with, not those redundant, stupid cookie consent overlays.

If you consent to the way things have always been, do nothing!

Re: Online tracking: A 1-million-site measurement and analysis

#180

Post by shawnz »

rdancer wrote: post #136
nailer wrote: post #21

Earlier quoted context omitted.

So a regular site using, say, mixpanel doesn't need to show a warning?

If you can set cookies, the user has already expressed their consent by enabling the cookies in the browser. As long as cookies' existence is common knowledge (it is by now), there is no need to duplicate browser UI within every website. This is the official stance of the ICO[1], the UK national authority: there was a need to educate users what cookies were when the directive was passed. No such need exists now. ICO…

I see a consent overlay on that very page.
Post reply on HN