Online tracking: A 1-million-site measurement and analysis • Hacker News Board

Re: Online tracking: A 1-million-site measurement and analysis

#181

Post by superuser2 » Thu, May 19, 2016, 4:34 PM UTC

projectramo wrote: post #25

randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that wha…

No. Microphone requires permission.

Your browser can leak a ton of information about your computer silently: window size, screen resolution, pixel density, time zone, language, installed fonts, installed plugins, operating system and version, browser version, plugins and versions, etc. There are good reasons for all of this data to be available to JavaScript for legitimate purposes. The AND of all of these datapoints, however, may be unique (or close), particularly if you have ever done something like install a novelty font. The EFF runs a website that fingerprints you and tells you how unique your fingerprint is:

[0] https://panopticlick.eff.org/tracker

Re: Online tracking: A 1-million-site measurement and analysis

#182

Post by chriswarbo » Thu, May 19, 2016, 4:37 PM UTC

avar wrote: post #168

randomwalker wrote: post #88

Earlier quoted context omitted.

Personally I think there are so many of these APIs that for the browser to try to prevent the ability to fingerprint is putting the genie back in the bottle. But there is one powerful step browsers can take: put stronger privacy protections into private browsing mode, even at the expense of some functionality. Firefox has taken steps in this direction https://blog.mozilla.org/blog/2015/11/03/firefox-now-offers-... Tr…

Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting: https://bugs.chromium.org/p/chromium/issues/detail?id=142214... Don't you think this sort of thing warrants a separate sort of browsing mode? A lot of people who use the likes of incognito mode just use it for e.g. browsing porn where they don't want the local history to be preserved. Turning that mode in…

> Don't you think this sort of thing warrants a separate sort of browsing mode? A lot of people who use the likes of incognito mode just use it for e.g. browsing porn where they don't want the local history to be preserved.

Think about it this way, would those using incognito mode for porn be OK with their normal browsing being peppered with ads claiming to "Improve your with our range of "?

Whilst I think incognito mode's warnings about not hiding data from network operators should remain (i.e. your boss can find out what sites you were visiting at work), that doesn't mean efforts to prevent it shouldn't be made.

Re: Online tracking: A 1-million-site measurement and analysis

#183

Post by inthewoods » Thu, May 19, 2016, 4:38 PM UTC

randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

If the sites can be detected, wouldn't it be possible to come up with a browser extension to at least let people know this is happening?

Re: Online tracking: A 1-million-site measurement and analysis

#184

Post by Freak_NL » Thu, May 19, 2016, 4:41 PM UTC

Frondo wrote: post #135

Freak_NL wrote: post #80

Earlier quoted context omitted.

What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's pr…

I think the answer isn't technical, but legal and cultural. Make it unacceptable in the court of public opinion for companies to misuse this data, and strengthen privacy laws. These two things, of course, go hand-in-hand, but us techies tend to look, I think, for the technical solution because that's the place where it's easiest to see how we could have any sort of impact. The other stuff is a lot of talking to and l…

Legislation and regulation are necessary, and they tend to help to keep the really big boys in check, but how can you actually tell if a company is actively engaged in compiling profiles on you or not? I can ask my browser to pass the Do-Not-Track header indicating my objection that practice, but why would a company specialised in tracking users respect that header?

I have tried to convince the Dutch banks I use (ING and ABN AMRO, i.e., big banks) to stop employing tracking beacons and third party tracking services on their secured internet banking environments, but the responses I get range from 'yeah we need those to improve your customer experience' to 'you are welcome to block these trackers yourself' (I already do, thank you very much).

Re: Online tracking: A 1-million-site measurement and analysis

#185

Post by dsl » Thu, May 19, 2016, 4:42 PM UTC

codedokode wrote: post #85

Some methods of fingerprinting are probably used to distinct between real users and bots. Bots can use patched headless browsers that are masquaraded as desktop browsers (for example as latest Firefox or Chrome running on Windows). Subtle differences in font rendering or missing audio support can be useful to detect underlying libraries and platform. Hashing is used to hide exact matching algorithm from scammers. The…

As someone who has written code to detect bots, exactly this. We don't care about fingerprinting the user, we care about fingerprinting to verify the user agent you claim to be.

Re: Online tracking: A 1-million-site measurement and analysis

#186

Post by komali2 » Thu, May 19, 2016, 4:44 PM UTC

Fradow wrote: post #65

projectramo wrote: post #25

Earlier quoted context omitted.

I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that wha…

I'm going to answer the basic question: fingerprinting is about trying to identify your device as uniquely as possible using available APIs, in order to track you cross-site, without cookies. To do that, you first try to identify API that have different results depending on the browser or the device, and then track their result. For example, the User agent have some identifying information. It's not unique for each p…

How are two sites sharing this fingerprint information in a way that says "yup, this is the same guy?" Like is there some sot of cabal of evil advertising companies running a bunch of sites, or what?

Re: Online tracking: A 1-million-site measurement and analysis

#187

Post by Freak_NL » Thu, May 19, 2016, 4:45 PM UTC

benevol wrote: post #173

avar wrote: post #168

Earlier quoted context omitted.

Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting: https://bugs.chromium.org/p/chromium/issues/detail?id=142214... Don't you think this sort of thing warrants a separate sort of browsing mode? A lot of people who use the likes of incognito mode just use it for e.g. browsing porn where they don't want the local history to be preserved. Turning that mode in…

> Google has explicitly WontFix'd bugs on the subject of expanding incognito to be hardened against fingerprinting Obviously. Google is in the business of destroying your privacy: Advertising revenue is maximized when the consumer is/remains completely tracked and profiled at all times. Other browser vendors which are not in the ad business could use this as an opportunity to differentiate themselves from Google: Int…

Or just let the user decide at the start of a private session. Firefox already does this with tracking protection. If Mozilla decides to improve tracking protection at the cost of usability (such as hiding you preferred language), than offering that as a toggle-able option on that page might be sufficient to empower the user to decide for on his own.

Re: Online tracking: A 1-million-site measurement and analysis

#188

Post by Klathmon » Thu, May 19, 2016, 4:49 PM UTC

Freak_NL wrote: post #178

Klathmon wrote: post #147

Earlier quoted context omitted.

I hope there is another way to solve it, as I have installed web-fonts to my PC to improve page loading speed for some common fonts I keep seeing (the most recent being the Roboto font stack from google). It would be a shame to have to keep re-downloading that every time.

You don't have to. Fonts should be (and usually are) offered to the web browser with the instruction to cache them indefinitely. You will only have to re-download them when your cache is cleaned up (due to its size, private browsing, or manually cleaning it). Upcoming technology WOFF2 helps further compress them by a significant margin as well (I've seen up to 50% improvement in size over plain WOFF). The problem is…

Browser caches are extremely unreliable and pretty small in the grand scheme of things.

On some mobile platforms the browser cache can be replaced entirely by some heavy pages!

Plus, even if we assumed "cached forever" actually worked for a significant amount of time, it still doesn't solve the problem that I am hoping to solve. I know many websites use the Roboto font. By installing it I no longer need to ever download that font again. It doesn't matter if it's the first time i'm seeing the site, if they use a CDN, if they link to the bold/light/regular version or their own packed font, etc...

I understand that it's a privacy issue, but I'm hoping there is a way to solve that privacy issue without removing that feature.

Re: Online tracking: A 1-million-site measurement and analysis

#189

Post by manigandham » Thu, May 19, 2016, 4:50 PM UTC

xg15 wrote: post #116

pjc50 wrote: post #101

I think it's time for HTML--, which would contain no active content at all and simply be a reflowable document display format.

SO basically AMP minus the Google-sourced JS...

...which is just HTML then.

Re: Online tracking: A 1-million-site measurement and analysis

#190

Post by dsl » Thu, May 19, 2016, 4:51 PM UTC

moron4hire wrote: post #79

anexprogrammer wrote: post #66

Colour me unsurprised. Disappointed though. I'm glad I disabled WebRTC when I first discovered it could be used to expose local IP on a VPN. These "extension" technologies should all be optional plugins. Preferably install on demand, but a simple, obvious way to disable would be acceptable. (ie more obvious than about:config) Not a great deal can be done about font metrics other than my belief that websites shouldn't…

What would anyone do with your internal network IP? Having these features as optional plugins means they are basically impossible to count on having in the basic web platform, meaning you're going to fight a losing battle to gain adoption for any applications that need them. And the open web platform is the only platform right now that is enabling developers to create cross-platform applications outside of the restri…

With your internal IP I can guess the brand of your router, determine if you are a home user or on a corp network, guess how many other machines might be on your network.

I can also assume that your router lives at .1 or .254 or similar, and use your browser to pivot and brute force the password while you browse cat pictures.