41–47 of 47 posts
So the "Do not track" header is another data point in the fingerprint worth ~1bit on its own. Has it actually had any benefits or should we just get rid of it?
DNT can't protect you against bad actors really. These are the people/companies that are honoring the DNT clause. http://donottrack.us/implementations
Earlier quoted context omitted.
No, that doesn't work. 1. If this were purely based on a 'may I do this' concept, the server would simply ignore you. 2., it's actually 99% client-based, it's using questions that you can't really deny since it makes rendering any webpage useless. Unless you like empty screens as websites, it will be possible to fingerprint you.
Since these questions are primarily used on the client side, better clients simply wouldn't forward the answers to the server.
Earlier quoted context omitted.
...collaborating with law enforcement to deanonimise Tor users (think pedophiles, not drugs) It would be interesting to see some reports on that question. Of course, the Law would never abide such accountability, but one can dream...
Well, in my experience it was done in a case-by-case basis and led through the great work of NGO "Thorn" (the one founded by Ashton Kutchen & Demi Moore) I don't know about accountability, but we provided support in a proactive way and never more than we were comfortable with (no carte blanche access to data for LEOs, etc.)
Earlier quoted context omitted.
Seems to be a problem with overload. But speaking of javascript, how many of the fingerprinting checks will not be possible if js is turned off? I could imagine that definitely all screen-related stuff is immediately killed.
Apparently my CSS font list alone can uniquely identify my browser out of those tested so far, which is rather concerning... Is there some Firefox extension I can use to spoof my font list to some subset of my existing font list to conform with some widely used system default? I do have some custom fonts installed, but I'd prefer random websites I visit to not know about them if possible. Also, the way plugins are ha…
The Firefox "Random Agent Spoofer"* helps with this site at least. The biggest leak that needs to be plugged is the browser plugin details. Any obscure plugins at all are worth a lot towards unique identification. Why any script should be able to enumerate all plugins is beyond me. * https://addons.mozilla.org/en-us/firefox/addon/random-agent-...
Turning everything off, or disabling plugins is a unique data point in itself; I am not sure we'd want to avoid leaking our plugin configuration as if that is the default, we are then a very unique data point. Instead, we would have to know what values are common, then report those to servers.
Edit: Also, the cited Firefox plugin doesn't seem to spoof the client's display resolution correctly[1]. With such plugins, I can imagine our profiles become increasingly unique, as it may present potentially numerous combinations of metrics to servers that are not typical in the wild.
The Firefox "Random Agent Spoofer"* helps with this site at least. The biggest leak that needs to be plugged is the browser plugin details. Any obscure plugins at all are worth a lot towards unique identification. Why any script should be able to enumerate all plugins is beyond me. * https://addons.mozilla.org/en-us/firefox/addon/random-agent-...
To anonymize ourselves, we must know what common values are used for specific points of measurement by servers. Unless we set up our own website (such as this) how else will we know we are increasing our anonymity? Turning everything off, or disabling plugins is a unique data point in itself; I am not sure we'd want to avoid leaking our plugin configuration as if that is the default, we are then a very unique data po…
Earlier quoted context omitted.
To anonymize ourselves, we must know what common values are used for specific points of measurement by servers. Unless we set up our own website (such as this) how else will we know we are increasing our anonymity? Turning everything off, or disabling plugins is a unique data point in itself; I am not sure we'd want to avoid leaking our plugin configuration as if that is the default, we are then a very unique data po…
If they can't get plugin information from any client.....