Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Online tracking: A 1-million-site measurement and analysis

webtransparency.cs.princeton.edu

Post reply on HN
Print view View original

191–200 of 272 posts

Re: Online tracking: A 1-million-site measurement and analysis

#191

Post by Freak_NL »

tangent128 wrote: post #95
jordache wrote: post #89

Earlier quoted context omitted.

Which API reveals my system fonts to a website? Edit: The fingerprint test at https://panopticlick.eff.org/ shows my System Fonts

I don't think you can enumerate them these days, but you can test for them by trying to use them in CSS (which font is used would affect the width of a span of text, use a wildly different fallback font and you can guess which is installed) or (where you can inspect the actual pixels rendered).

Or use @font-face and detect calls to a remote URL — which happens when the named local font is missing:

    @font-face {
      font-family: "Roboto";
      src: local("Roboto"), url("https://example.com/user-does-not-have-roboto") format("woff2");
    }

Re: Online tracking: A 1-million-site measurement and analysis

#192

Post by Freak_NL »

madeofpalk wrote: post #112
Freak_NL wrote: post #91

Earlier quoted context omitted.

> […] but being able to read pixel data out of a canvas is completely reasonable. Not for every website. Most websites don't need canvas at all. One option would be to ask users to activate canvas support for a website that does need it, so users can judge for themselves if the request is legitimate. This is how the geo-location API works after all. I am not convinced that this will work very well though.

Seems like just another vector to fingerprint that browser by :)

It is! But a disabled setting has a much lower entropy in terms of identifying bits than the hash generated with an active canvas.

Re: Online tracking: A 1-million-site measurement and analysis

#193

Post by lucb1e »

rdancer wrote: post #136
nailer wrote: post #21

Earlier quoted context omitted.

So a regular site using, say, mixpanel doesn't need to show a warning?

If you can set cookies, the user has already expressed their consent by enabling the cookies in the browser. As long as cookies' existence is common knowledge (it is by now), there is no need to duplicate browser UI within every website. This is the official stance of the ICO[1], the UK national authority: there was a need to educate users what cookies were when the directive was passed. No such need exists now. ICO…

> If you can set cookies, the user has already expressed their consent by enabling the cookies in the browser. As long as cookies' existence is common knowledge (it is by now), there is no need to duplicate browser UI within every website.

Wrong. If I disable cookies in my browser, I can't log in to websites anymore, so they need to be allowed. A whitelist would be very inconvenient. On top of that, it's not explicit allowance, it'd be implicit (i.e. opt-out instead of opt-in).

I don't know if British legislation is different, but this is illegal at least in the Netherlands.

Re: Online tracking: A 1-million-site measurement and analysis

#194

Post by jsprogrammer »

amluto wrote: post #117
Freak_NL wrote: post #80

Earlier quoted context omitted.

What can be done by the browser vendors such as Mozilla, Google, and Microsoft? To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's pr…

The browser vendors could start taking the idea of asking for permission seriously. For WebRTC, browsers could block local addresses. uBlock Origin can do this on Firefox already. For battery: browsers could treat it like location and ask for permission. Why does the average site need to know my battery status? For fonts: browsers could standardize a list of system fonts available on each platform. It's 2016 already:…

> For WebRTC, browsers could block local addresses.

That would defeat a huge selling point of WebRTC, the ability to create in-browser p2p connections over the user's local network.

Re: Online tracking: A 1-million-site measurement and analysis

#195

Post by kbenson »

cm3 wrote: post #174
WalterSear wrote: post #159

Earlier quoted context omitted.

I don't see why fonts are any different from images.

Fonts are different in that they're not as crucial to the content as images. You cannot replace an image with an alternative text form while retaining the content, but you can display the content completely with WOFF missing.

I think the logical conclusion of that argument is to also disable all CSS. Fonts are styling for text, CSS is styling for markup. I think most the arguments against disabling CSS can be used against disabling fonts (barring that people do crazy shit with CSS most often now, so it complicates the issue).

Really, in the end, all input accepted from the remote side (including text/html) needs to be vetted and processed by security conscious routines. I don't personally have a reason to assume a font library is more likely to be exploitable than an HTML+CSS parser and layout engine. Based on complexity, I would actually assume the opposite, which is probably right, except we've already found and fixed a lot of the exploits for the HTML parser and layout engine.

Re: Online tracking: A 1-million-site measurement and analysis

#196

Post by hendi_ »

smartbit wrote: post #171
randomwalker wrote: post #4

Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.

On iOS I use safari and disable access to location etc, also disable cookies, advertisementID, etc, etc. Then I feel quite save when using a VPN. Does that still hold?

Yes.

Changing common settings might in fact even make you stand out _more_.

Check the EFF's Panopticlick [0] to see how your specific configurations leaks identifying information.

[0] https://panopticlick.eff.org/

Re: Online tracking: A 1-million-site measurement and analysis

#197

Post by imtringued »

ultramancool wrote: post #115

As soon as I saw these APIs being added I immediately dropped into about:config and disabled them. How the hell do these people think this is a good idea to do without asking any permissions? Put these in your user prefs.js file on Firefox: user_pref("dom.battery.enabled", false); user_pref("device.sensors.enabled", false); user_pref("dom.vibrator.enabled", false); user_pref("dom.enable_performance", false); user_pre…

It's great that mozilla decided to remove about:permissions. I do enjoy the fact that I now have to visit every website whose permissions I want to change instead of managing all permissions from a single location.

Re: Online tracking: A 1-million-site measurement and analysis

#198

Post by cpeterso »

manigandham wrote: post #160
kbenson wrote: post #118

Earlier quoted context omitted.

Having the insight of of someone who works in online advertising would be interesting and informative. Is there anything you can share that we might find interesting?

I could talk about this for hours. Fundamentally, identity is important for the ad industry but it's not about your personal info, it's just a reliable ID that we're all after. A reliable ID allows for storing your ad history and interests to show you better ads and less of the same. This is proven since it's all math and data science and we can see the increase in metrics with better targeting. By the way, clicks ar…

> if there was a standardized ID like IDFA but for browsers (or even better at the OS level) and privacy regulation that's actually enforced, that would be a good compromise. Sites and ad networks get a reliable ID and you get control over when and how that ID is refreshed.

To detect ad fraud, would the ID need to be the same on all sites? Instead of sites dropping cookies on clients, what if browsers generated their own random per-site IDs? Users and browsers would have more control over managing and clearing cookies and user IDs.

Re: Online tracking: A 1-million-site measurement and analysis

#199

Post by cm3 »

kbenson wrote: post #195
cm3 wrote: post #174

Earlier quoted context omitted.

Fonts are different in that they're not as crucial to the content as images. You cannot replace an image with an alternative text form while retaining the content, but you can display the content completely with WOFF missing.

I think the logical conclusion of that argument is to also disable all CSS. Fonts are styling for text, CSS is styling for markup. I think most the arguments against disabling CSS can be used against disabling fonts (barring that people do crazy shit with CSS most often now, so it complicates the issue). Really, in the end, all input accepted from the remote side (including text/html) needs to be vetted and processed…

Of course you're right, and I didn't mention CSS but thought of it as another utilitarian piece.

I agree that the most complex parts are HTML+CSS+JS+DOM+GFX, but some parts cannot be reasonably disabled without breaking it completely.

Re: Online tracking: A 1-million-site measurement and analysis

#200

Post by cpeterso »

komali2 wrote: post #186
Fradow wrote: post #65

Earlier quoted context omitted.

I'm going to answer the basic question: fingerprinting is about trying to identify your device as uniquely as possible using available APIs, in order to track you cross-site, without cookies. To do that, you first try to identify API that have different results depending on the browser or the device, and then track their result. For example, the User agent have some identifying information. It's not unique for each p…

How are two sites sharing this fingerprint information in a way that says "yup, this is the same guy?" Like is there some sot of cabal of evil advertising companies running a bunch of sites, or what?

Yes.
Post reply on HN