When I saw the title, I thought it was going to be about the FBI trying to find the source of WikiLeaks material.
Race Is On to 'Fingerprint' Phones, PCs
11–20 of 42 posts
Re: Race Is On to 'Fingerprint' Phones, PCs
#12I foresee a future where the Adblock crowd runs a plugin that randomizes the data returned by browsers. It wouldn't take many variations in user agent strings, reported browser plugins, and system fonts to give you a quasi-anonymous footprint each time you visit a website.
Re: Race Is On to 'Fingerprint' Phones, PCs
#13The question we should all be asking is: why on Earth do browsers transmit all of this information to web servers in the first place?
A few details, window size for example, might have a legitimate purpose and could at least be requested by the web server and provided optionally. However, this sort of fingerprinting technique is pretty obvious to anyone who's ever stuck an analyser on their system and looked at what a typical HTTP transaction to fetch a web page looks like. As far as I can see, there is no need for most of it.
Re: Race Is On to 'Fingerprint' Phones, PCs
#14They could use TCP time stamps to estimate the clock skew of devices, as they access web services.
See "Remote physical device fingerprinting - Tadayoshi Kohno, Andre Broido, kc claffy"
Re: Race Is On to 'Fingerprint' Phones, PCs
#15Earlier quoted context omitted.
The EFF tested this themselves. They run a website, http://panopticlick.eff.org , comparing with computers that have visited in the past. They have over a million fingerprints at this point, and my Chrome install is "unique." It displays all data it lifted from your machine, along with how rare each datum appears to be. On my Chrome 7.0.517.44 install, I appear to be identifiable by my user agent (1 in 182,518), brow…
Even the default IE8 on my stock Windows 7 Enterprise appears to be unique. In that case it's the browser plugins which identifies it (1 in 1277688). My installed plugins are nothing out of the ordinary: Java, Flash and WindowsMediaplayer.
Sample size seems to be a significant issue here. I'm one of two people on the site that had my user agent (1 in 638851), and while it's rare, sure, there are obviously a lot more than two people in the world running chromium x64 opensuse. Looking at the data it seems like most of the responses are bog standard for my particular software install, so it's basically saying I'm unique because:
* user-agent * time zone * screen size
Surely my TZ=EST and screen=1366x768x24 can't be too helpful in a large sample size.
And once chromium updates yet again, I think I'll be lost to the EFF test. It'll still see me as unique, but I'll be a different "unique" than the last time.
It does seem like browsers could easily cut back on user-agent details to the benefit of their customers privacy and security. Is it really necessary to tell every website I visit that I'm x64 instead of i386 just in case I'm not smart enough to know which download now button to click? It's probably most useful to malware domains for determining which version of the latest flash 0-day to push to me. And are we sure we need the exact build number of every browser? Most revisions of chrome aren't changing anything in the rendering behavior.
Re: Race Is On to 'Fingerprint' Phones, PCs
#16Based on this article you can "fingerprint" a computer using the following combination of attributes: - Precise timestamp - Monitor size - User agent - Browser plugins - and fonts (!) Really?? I use several browsers, and switch out a few external displays for my laptop. Plugins come and go with the browser version. My system time is synced to a timeserver (as I imagine are many other computers) but sometimes not. Bas…
Probably works fine for PCs, but for iPhones, iPads and other devices that are more uniform, they'll probably have to stick with cookies. Do phones' timestamps differ?
I believe most mobile devices already have unique device IDs built in. Perhaps they're not accessible through JavaScript, but it sounds like this technology already goes beyond the web browser anyways.
Re: Race Is On to 'Fingerprint' Phones, PCs
#17The question we should all be asking is: why on Earth do browsers transmit all of this information to web servers in the first place? A few details, window size for example, might have a legitimate purpose and could at least be requested by the web server and provided optionally. However, this sort of fingerprinting technique is pretty obvious to anyone who's ever stuck an analyser on their system and looked at what…
In my experience, there's enough basic information in the HTTP transaction to identify a unique visitor for most forensic purposes. However, the level of detail available for fingerprinting goes far beyond this. I just performed a little experiment, disabling as much as I could in Firefox to affect my uniqueness at http://panopticlick.eff.org/. I was surprised when disabling plugins (font info comes from java & flash) and even cookies had virtually no effect. It wasn't until I disabled JavaScript before I dramatically lowered it from 7 figures to 5. I'm going to try surfing this way and adding exceptions to see if I can sustain the experience for a while.
Re: Race Is On to 'Fingerprint' Phones, PCs
#18They could use TCP time stamps to estimate the clock skew of devices, as they access web services. See "Remote physical device fingerprinting - Tadayoshi Kohno, Andre Broido, kc claffy"
Doesn't nmap have a whole bunch of such fingerprints stored in a database?
Re: Race Is On to 'Fingerprint' Phones, PCs
#19Based on this article you can "fingerprint" a computer using the following combination of attributes: - Precise timestamp - Monitor size - User agent - Browser plugins - and fonts (!) Really?? I use several browsers, and switch out a few external displays for my laptop. Plugins come and go with the browser version. My system time is synced to a timeserver (as I imagine are many other computers) but sometimes not. Bas…
The EFF tested this themselves. They run a website, http://panopticlick.eff.org , comparing with computers that have visited in the past. They have over a million fingerprints at this point, and my Chrome install is "unique." It displays all data it lifted from your machine, along with how rare each datum appears to be. On my Chrome 7.0.517.44 install, I appear to be identifiable by my user agent (1 in 182,518), brow…
Panopticlick claims that my user agent (Firefox 4.0b7 on Windows XP) is about 1/15,000. That seems unlikely.
It claims that my http_accept (text/html, STAR/STAR ISO-8859-1,utf-8;q=0.7,STAR;q=0.7 identity en-gb,en;q=0.5 -- except that I've replaced asterisks with "STAR" to avoid HN formatting confusion) is about 1/19,000. That seems even more unlikely.
I suspect these have the same cause: they have this big database of browser information, gathered over time, and recent browsers are underrepresented. So anyone running a Firefox 4 beta, or a recent Chrome build, will show up as being very unusual in the database, but that's misleading because some of the older entries in the database will represent browsers that are no longer in the pool, whose users are now using something more recent.
On the other hand, I don't find it so hard to believe that my browser plugins give 20 bits or so of information. (Though some of the same bias will affect this figure.)
In case it isn't obvious, by the way, their figures are simply the fraction of records in their database that have the same user agent / browser plugins / system fonts as yours. The browser plugins figure is 1/1,277,632 (or, for me a little later, 1/1,277,946) because that's how many times the Panopticlick site has been used.
Hmm, I wonder how they defend against having the same user run their test twice in a row. (Answer, having tried it: they don't. Probably a good thing since the obvious non-privacy-compromising way could skew their figures a bit.)
Re: Race Is On to 'Fingerprint' Phones, PCs
#20Earlier quoted context omitted.
The EFF tested this themselves. They run a website, http://panopticlick.eff.org , comparing with computers that have visited in the past. They have over a million fingerprints at this point, and my Chrome install is "unique." It displays all data it lifted from your machine, along with how rare each datum appears to be. On my Chrome 7.0.517.44 install, I appear to be identifiable by my user agent (1 in 182,518), brow…
Panopticlick claims that my user agent (Firefox 4.0b7 on Windows XP) is about 1/15,000. That seems unlikely. It claims that my http_accept (text/html, STAR/STAR ISO-8859-1,utf-8;q=0.7,STAR;q=0.7 identity en-gb,en;q=0.5 -- except that I've replaced asterisks with "STAR" to avoid HN formatting confusion) is about 1/19,000. That seems even more unlikely. I suspect these have the same cause: they have this big database o…
Panopticlick shows if you can be uniquely identified, but it doesn't show if you have been uniquely identified. I'd find it useful for the site to show me a record of my past visits ("You last visited the site on...") as a proof of concept, but the EFF may be intentionally avoiding any privacy issues. This is important, as uniqueness isn't in itself a bad thing, if your unique identifiers change on every page load. For example, it would be enough for a user agent switcher plugin to append a random number for every page load to make you look like a first-time visitor every time.