Browserprint: are you uniquely identifiable? • Hacker News Board

Re: Browserprint: are you uniquely identifiable?

#11

Post by lewisl9029 » Mon, Aug 01, 2016, 8:10 AM UTC

elcapitan wrote: post #8

microcolonel wrote: post #3

I bet it's really cool, however it seems the request never finishes. It could be that it only works if you have javascript and/or cookies enabled.

Seems to be a problem with overload. But speaking of javascript, how many of the fingerprinting checks will not be possible if js is turned off? I could imagine that definitely all screen-related stuff is immediately killed.

Apparently my CSS font list alone can uniquely identify my browser out of those tested so far, which is rather concerning...

Is there some Firefox extension I can use to spoof my font list to some subset of my existing font list to conform with some widely used system default? I do have some custom fonts installed, but I'd prefer random websites I visit to not know about them if possible.

Also, the way plugins are handled in Firefox has always bothered me quite a bit. I can disable them, but not remove them. What gives?

Re: Browserprint: are you uniquely identifiable?

#12

Post by notjosh » Mon, Aug 01, 2016, 8:12 AM UTC

userbinator wrote: post #5

The server appears to be timing out but the title and concept reminds me of this: https://panopticlick.eff.org/

The site loaded for me, and says:

> Browserprint is a free open source project designed to provide the same and better functionality as the original Panopticlick.

(Though I'm not sure exactly what they've done to make it better..but the hat tip is there at least!)

Re: Browserprint: are you uniquely identifiable?

#13

Post by Ntrails » Mon, Aug 01, 2016, 8:17 AM UTC

elcapitan wrote: post #8

microcolonel wrote: post #3

I bet it's really cool, however it seems the request never finishes. It could be that it only works if you have javascript and/or cookies enabled.

Seems to be a problem with overload. But speaking of javascript, how many of the fingerprinting checks will not be possible if js is turned off? I could imagine that definitely all screen-related stuff is immediately killed.

Based on the number of websites which flat out collapse in the face of NoScript - being fingerprinted is probably not a problem. Of course, if you actually want to see the content you're probably boned unless the tracking gubbinz is hosted from elsewhere.

Re: Browserprint: are you uniquely identifiable?

#14

Post by cm2187 » Mon, Aug 01, 2016, 8:22 AM UTC

userbinator wrote: post #5

The server appears to be timing out but the title and concept reminds me of this: https://panopticlick.eff.org/

And panopticlick isn't exactly new. Have browser vendors done anything to deal with browser fingerprinting? It is a little concerning that now pretty much all browsers are developed or sponsored by companies that aim at monetizing their users data (Google, Microsoft, Apple, Yahoo, etc).

Re: Browserprint: are you uniquely identifiable?

#15

Post by oneplane » Mon, Aug 01, 2016, 8:23 AM UTC

arviewer wrote: post #7

Just wondering - would it be possible to send a header back to webservers forbidding them to fingerprint my browser? Would that have any chance legally?

No, that doesn't work. 1. If this were purely based on a 'may I do this' concept, the server would simply ignore you. 2., it's actually 99% client-based, it's using questions that you can't really deny since it makes rendering any webpage useless. Unless you like empty screens as websites, it will be possible to fingerprint you.

Re: Browserprint: are you uniquely identifiable?

#16

Post by fovc » Mon, Aug 01, 2016, 8:38 AM UTC

So the "Do not track" header is another data point in the fingerprint worth ~1bit on its own. Has it actually had any benefits or should we just get rid of it?

Re: Browserprint: are you uniquely identifiable?

#17

Post by tux1968 » Mon, Aug 01, 2016, 8:39 AM UTC

The Firefox "Random Agent Spoofer"* helps with this site at least. The biggest leak that needs to be plugged is the browser plugin details. Any obscure plugins at all are worth a lot towards unique identification. Why any script should be able to enumerate all plugins is beyond me.

* https://addons.mozilla.org/en-us/firefox/addon/random-agent-...

Re: Browserprint: are you uniquely identifiable?

#18

Post by sam_goody » Mon, Aug 01, 2016, 9:18 AM UTC

Why do the browsers let the website know which plugins I have?

There are some things like Flash that should identify themselves, but those are few and far between, and the check should be feature specific and handled by the plugin.

Allowing every site to build a profile based on plugins [that is: a) fingerprint, and b) profile based on the plugins I use] is just an egregious violation of privacy.

At the very least, if there is some reason to expose browsers, let it be configurable.

Also, font testing should be made expensive [eg, one check per second]. Check if we have font "scrabble", OK, but not get list of all fonts.

Re: Browserprint: are you uniquely identifiable?

#19

Post by dogma1138 » Mon, Aug 01, 2016, 9:29 AM UTC

sam_goody wrote: post #18

Why do the browsers let the website know which plugins I have? There are some things like Flash that should identify themselves, but those are few and far between, and the check should be feature specific and handled by the plugin. Allowing every site to build a profile based on plugins [that is: a) fingerprint, and b) profile based on the plugins I use] is just an egregious violation of privacy. At the very least, i…

Because browsers need to be able to declare what content can be displayed to the user. If we only had Flash it would be simple, but considering the amount of content delivery systems that each browser implements and the fact that they are not consistent there isn't much way around it. It's not true to claim that the browsers let anyone know which plugins you are running, this is limited to a specific subset of plugins that handle content.

There is no way to prevent "fingerprinting", infact what you suggest seems to indicate that you are thinking about it the wrong way. You can disable these plugins but that creates a fingerprint on it's own, if you only accept HTML (no HTML5 because it's also "evil") and no javascript well then you are a more unique fingerprint than your vanilla Chrome with Flash, PDF, and a few WebM and DRM plugins. The only effective way of disabling fingerprinting is make all browsers identical, and more importantly all hardware and software configurations that those browsers operate in also identical.

You also need to understand the value of each fingerprint if you look at https://panopticlick.eff.org/ for example then most of the fingerprints produced are useless, half of them are shared between 30-80% of all browsers. The most unique one was the HTTP_ACCEPT Headers in my case which is unique for one out of ~1400 browsers so that is something I can now use to see if this is something that can be fixed. The plugin fingerprint in my case is 1 out of 48 browsers, that is not unique in any case and from what I've tested every latest Chrome install on Windows 10 without any additional content plugins (e.g. Java) has the same fingerprint.

Re: Browserprint: are you uniquely identifiable?

#20

Post by mpeg » Mon, Aug 01, 2016, 10:43 AM UTC

arviewer wrote: post #7

Just wondering - would it be possible to send a header back to webservers forbidding them to fingerprint my browser? Would that have any chance legally?

In the EU there's a proposal to extend the law around consent for storage (AKA the cookie consent law) to fingerprinting, whether or not it accesses device storage.

The law even has exemptions for security-related applications — your bank already fingerprints your device and uses it as a first line of protection against card theft.