Browserprint: are you uniquely identifiable? • Hacker News Board

Re: Browserprint: are you uniquely identifiable?

#21

Post by mpeg » Mon, Aug 01, 2016, 10:58 AM UTC

enthdegree wrote: post #9

arviewer wrote: post #7

Just wondering - would it be possible to send a header back to webservers forbidding them to fingerprint my browser? Would that have any chance legally?

If I understand it correctly, the way this fingerprinting works is just by using questions you need to show the website properly. 'What is your screen resolution? What HTML5 features do you support? Do you have this font/plugin?' Bar giving up all those facilities, the best you can do is ask and hope they comply....

There's browser extensions that will fake all of those to a standard value. The tricky part is that with fingerprinting, depending on your chosen faked value you could end up being more identifiable, if not enough people use it.

For instance, you can change your user agent and headers to some generic Windows Chrome one but a savvy tracker will fingerprint your TCP connection and realise you are actually on a Mac, and that can be used as a further source of entropy to better identify you.

I've spent more time than is healthy looking into ways to uniquely identify devices on the internet. While the company I was working for was always on the safe side in terms of privacy, the more blackhat methods can be useful in collaborating with law enforcement to deanonimise Tor users (think pedophiles, not drugs)

Tor Browser devs have in turn been really good at hardening fingerprinting attack vectors related to it (and rightly so, browsers don't rape people — people rape people) but unless you're super paranoid it's not a great experience for the average user.

I think a better solution will come (at least in the EU) from the proposal to extend cookie law to any kind of fingerprinting (regardless of storage), which takes use case in account and can be enforced through big fines.

Re: Browserprint: are you uniquely identifiable?

#22

Post by DavideNL » Mon, Aug 01, 2016, 11:07 AM UTC

tux1968 wrote: post #17

The Firefox "Random Agent Spoofer"* helps with this site at least. The biggest leak that needs to be plugged is the browser plugin details. Any obscure plugins at all are worth a lot towards unique identification. Why any script should be able to enumerate all plugins is beyond me. * https://addons.mozilla.org/en-us/firefox/addon/random-agent-...

> The biggest leak that needs to be plugged is the browser plugin details.

Check this: https://github.com/Mechazawa/Firefox-plugin-enum-disable (works in Chromium via Tampermonkey and Firefox via Greasemonkey)

EDIT: argh you wrote 'Plugins' not Addons...

Re: Browserprint: are you uniquely identifiable?

#23

Post by mirimir » Mon, Aug 01, 2016, 11:35 AM UTC

arviewer wrote: post #6

userbinator wrote: post #5

The server appears to be timing out but the title and concept reminds me of this: https://panopticlick.eff.org/

Is my browser uniquely identifiable? Yes! This is no surprise, not anymore at least. I pass the first three tests here, but fingerprinting does the trick. About one in 50k browsers has the same fonts as me. About one in 30k browsers have the same addons and plugins. I bet those two don't overlap. Then there are several other variables like language that narrow it down if that is still needed. They could try to explai…

I believe that Tor browser is least uniquely identifiable. That's a major Tor Project goal. Ideally, all Tor users would be using the same browser, with no modifications. There is a privacy/security slider, but there are only four settings.

Re: Browserprint: are you uniquely identifiable?

#24

Post by throwawayReply » Mon, Aug 01, 2016, 11:45 AM UTC

dogma1138 wrote: post #19

sam_goody wrote: post #18

Why do the browsers let the website know which plugins I have? There are some things like Flash that should identify themselves, but those are few and far between, and the check should be feature specific and handled by the plugin. Allowing every site to build a profile based on plugins [that is: a) fingerprint, and b) profile based on the plugins I use] is just an egregious violation of privacy. At the very least, i…

Because browsers need to be able to declare what content can be displayed to the user. If we only had Flash it would be simple, but considering the amount of content delivery systems that each browser implements and the fact that they are not consistent there isn't much way around it. It's not true to claim that the browsers let anyone know which plugins you are running, this is limited to a specific subset of plugin…

You're missing that these things don't have to be taken in isolation.

If you've got 4 metrics each of which slice about "1 in 50" then taking the combination you've got a metric that is unique between 1 in 50 and 1 in 6.25 million (depending on correlation).

The "fingerprint" is all that information put together, not each taken in isolation.

Re: Browserprint: are you uniquely identifiable?

#25

Post by throwawayReply » Mon, Aug 01, 2016, 11:46 AM UTC

mpeg wrote: post #20

arviewer wrote: post #7

Just wondering - would it be possible to send a header back to webservers forbidding them to fingerprint my browser? Would that have any chance legally?

In the EU there's a proposal to extend the law around consent for storage (AKA the cookie consent law) to fingerprinting, whether or not it accesses device storage. The law even has exemptions for security-related applications — your bank already fingerprints your device and uses it as a first line of protection against card theft.

I look forward to "We fingerprint you for totally legit reasons. Click OK to hide this message. By continuing to use this site you consent to this." on every page.

Re: Browserprint: are you uniquely identifiable?

#26

Post by pavel_lishin » Mon, Aug 01, 2016, 12:12 PM UTC

mpeg wrote: post #21

enthdegree wrote: post #9

Earlier quoted context omitted.

If I understand it correctly, the way this fingerprinting works is just by using questions you need to show the website properly. 'What is your screen resolution? What HTML5 features do you support? Do you have this font/plugin?' Bar giving up all those facilities, the best you can do is ask and hope they comply....

There's browser extensions that will fake all of those to a standard value. The tricky part is that with fingerprinting, depending on your chosen faked value you could end up being more identifiable, if not enough people use it. For instance, you can change your user agent and headers to some generic Windows Chrome one but a savvy tracker will fingerprint your TCP connection and realise you are actually on a Mac, and…

> There's browser extensions that will fake all of those to a standard value. The tricky part is that with fingerprinting, depending on your chosen faked value you could end up being more identifiable, if not enough people use it.

Couldn't this be worked around by reporting random values every time?

Re: Browserprint: are you uniquely identifiable?

#27

Post by ibogunov » Mon, Aug 01, 2016, 12:26 PM UTC

if you are so worried, tha you are identifiable - just use your iphone, same hardware, same browser - same fingerprint(beside ip which can be dynamic & useless) - so literally all iphone users are the same user. (i was trying to make some start-up which required fingerprinting, but we pivoted =))

Re: Browserprint: are you uniquely identifiable?

#28

Post by mpeg » Mon, Aug 01, 2016, 12:28 PM UTC

pavel_lishin wrote: post #26

mpeg wrote: post #21

Earlier quoted context omitted.

There's browser extensions that will fake all of those to a standard value. The tricky part is that with fingerprinting, depending on your chosen faked value you could end up being more identifiable, if not enough people use it. For instance, you can change your user agent and headers to some generic Windows Chrome one but a savvy tracker will fingerprint your TCP connection and realise you are actually on a Mac, and…

> There's browser extensions that will fake all of those to a standard value. The tricky part is that with fingerprinting, depending on your chosen faked value you could end up being more identifiable, if not enough people use it. Couldn't this be worked around by reporting random values every time?

Kinda, but then the random values just become a flag for "has x browser extension installed" and the trackers will still use the things you can't change, like the OS networking stack, GPU, audio, etc. to track you.

It's very hard to get away completely... even with Tor, if you are the only person who uses Tor to visit a certain site you are as trackable as anyone else for that site.

Re: Browserprint: are you uniquely identifiable?

#29

Post by gsnedders » Mon, Aug 01, 2016, 12:35 PM UTC

sam_goody wrote: post #18

Why do the browsers let the website know which plugins I have? There are some things like Flash that should identify themselves, but those are few and far between, and the check should be feature specific and handled by the plugin. Allowing every site to build a profile based on plugins [that is: a) fingerprint, and b) profile based on the plugins I use] is just an egregious violation of privacy. At the very least, i…

> Also, font testing should be made expensive [eg, one check per second]. Check if we have font "scrabble", OK, but not get list of all fonts.

There's no way of doing that without making the whole browser really slow. Browsers don't expose any way to get a list of fonts: all you can do is try drawing some text with a given font "scrabble" and then see if it draws with different metrics to the fallback font. Therefore, you'd have to make every new font used on a page take a second before it got drawn, practically forcing every page to use a single font.

Re: Browserprint: are you uniquely identifiable?

#30

Post by dogma1138 » Mon, Aug 01, 2016, 12:50 PM UTC

throwawayReply wrote: post #24

dogma1138 wrote: post #19

Earlier quoted context omitted.

Because browsers need to be able to declare what content can be displayed to the user. If we only had Flash it would be simple, but considering the amount of content delivery systems that each browser implements and the fact that they are not consistent there isn't much way around it. It's not true to claim that the browsers let anyone know which plugins you are running, this is limited to a specific subset of plugin…

You're missing that these things don't have to be taken in isolation. If you've got 4 metrics each of which slice about "1 in 50" then taking the combination you've got a metric that is unique between 1 in 50 and 1 in 6.25 million (depending on correlation). The "fingerprint" is all that information put together, not each taken in isolation.

That only works when you actually have variance in the fingerprints greater than OS/platform based.

If I spin up 10 new Windows 10 machines install Chrome on them I would get the same fingerprints, oddly enough they would be identical to the fingerprints I'm getting on my own machine since I don't have any plugins installed (I do have multiple extensions).

The only real change in the fingerprint I've seen so far from my own internal testing is the screen resolution, and WebGL fingerprint (Intel/NVIDIA seem to produce a pretty identical one, AMD differs a bit).

However the main point i was trying to get across is that while trying to minimize your fingerprint or exposure you create your own unique fingerprint in the process.

For example using adblockers these addons can easily leak not only which adblocker you are using but which lists / filters you have enabled, if you are a non-English native and you are using a localized list that exposes a lot of information.

Addons / extensions that block things like HTML5 Canvas also leave a fingerprint - you run a modern browser by all accounts but don't support Canvas? whelp you are upto something!

Same goes with WebGL and many other plugins/vectors.

The problem here is that content delivery relies on the browser being interrogatable for certain information, if that information is not correct then the content will not be displayed properly (which on it's own can be detected), we want to move on from Flash, we want to move one from addons and plugins into more native stuff but this came at a cost of platforms being more unique and diverse which allows you to generate a more unique fingerprint. Creating a browser that generates random fingerprints also won't really help, unless everyone uses it you would again stand out of the crowd even more.

That said however without specific targeted exploitation I have not yet seen a tool nor I managed to make one that creates a good fingerprint that can be easily used to identify a browser rather than just classify it and the platform it's running on.