Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla research: Browsing histories are unique enough to identify users

zdnet.com

Post reply on HN
Print view View original

51–60 of 131 posts

Re: Mozilla research: Browsing histories are unique enough to identify users

#51

Post by mulmen »

Polylactic_acid wrote: post #46
mulmen wrote: post #44

Earlier quoted context omitted.

How does that work? If a friend of mine and I both took the bus to a movie and returned to our start how do you differentiate between us? Seems like this would come up a lot with commuters.

Of course that case will fail but for almost all cases if you know something like that you took x bus to work and then a week later you took one to the mall its now possible to find all of their trips. For someone you know somewhat well its not hard to find 2 trips they took and then be able to find all of their trips.

Ok, so two trips but not any two trips. It requires a lot more knowledge of the person. For someone you know well why would you even need to look at the data?

Re: Mozilla research: Browsing histories are unique enough to identify users

#52

Post by danielheath »

laumars wrote: post #26
cma wrote: post #21

Earlier quoted context omitted.

DNS resolve measurement to see if it is cached by the OS can potentially breach that.

Can JavaScript measure DNS resolve time?

It can measure response time. If you host your own dns and web server you can vary their response times and record from js.

Re: Mozilla research: Browsing histories are unique enough to identify users

#54

Post by marta_morena_25 »

wombatmobile wrote: post #49

If the study establishes that for all practical purposes, online anonymity is impossible to maintain for average users, what are the implications (a) for the average user; (b) for the economy; and (c) for society?

(a) The average user neither doesn't know nor care about anonymity. If you are talking about "the average hackernews user", things might be different. Welcome to the 0.1%!

(b) Lots and lots of money?

(c) Not soo many annoying ads popping up, but rather ones that seem at least vaguely relevant? Will make me less angry and more sociable.

Re: Mozilla research: Browsing histories are unique enough to identify users

#55

Post by aaron695 »

I think this is as stupid as it sounds from the paper - https://www.usenix.org/conference/soups2020/presentation/bir...

Why not "Mozilla research: We asked users for their name and address and the ones telling the truth we could identify"

TOR is fighting identifying users from the screen size of their window when maximised.

Here's the original paper which is more about how you can access the browsers histories - https://www.petsymposium.org/2012/papers/hotpets12-4-johnny....

Can you still access browsers histories? I'd have to guess no way without a zeroday. The original site is down. http://www.wtikay.com/ Firefox fixed it - https://bugzilla.mozilla.org/show_bug.cgi?id=147777

Re: Mozilla research: Browsing histories are unique enough to identify users

#56

Post by Multicomp »

the_pwner224 wrote: post #48
stefan_ wrote: post #7

Earlier quoted context omitted.

Malicious extensions are a likely culprit. This is the ultimate irony of the whole WebExtensions debacle; browser vendors wanted to stop the extensions from interacting with the browser because maintaining that interface is work, so now the most trivial extensions will request full access to all websites so they can inject scripts. To bring back "backspace navigates back" I have an extension that needs just that.

On Firefox you can go to about:config and set 'browser.backspace_action' to 0.

The number of times I have been bitten by backspacing when I thought I was in a web form and in fact navigated to a previous page is high.

I sympathize with the other user having to change a default setting or install an extension, but I'm glad that the felt behavior changed.

Re: Mozilla research: Browsing histories are unique enough to identify users

#57

Post by vlovich123 »

I suspect privacy would be better served by taking the approach of the security domain with responsible disclosure to vendors and a concerted effort to attack the problem holistically. Until then we’re just giving privacy attackers a heads up and by the time this issue is mitigated their onto the next avenue for bypassing privacy.

Re: Mozilla research: Browsing histories are unique enough to identify users

#58

Post by Polylactic_acid »

mulmen wrote: post #51
Polylactic_acid wrote: post #46

Earlier quoted context omitted.

Of course that case will fail but for almost all cases if you know something like that you took x bus to work and then a week later you took one to the mall its now possible to find all of their trips. For someone you know somewhat well its not hard to find 2 trips they took and then be able to find all of their trips.

Ok, so two trips but not any two trips. It requires a lot more knowledge of the person. For someone you know well why would you even need to look at the data?

Its almost any two trips. Its the exception that two people take the same trip together. I can think of a handful of people I could eventually find 2 trips for who wouldn't want me to have their entire travelling history.

Re: Mozilla research: Browsing histories are unique enough to identify users

#59

Post by harrisi »

mulmen wrote: post #51
Polylactic_acid wrote: post #46

Earlier quoted context omitted.

Of course that case will fail but for almost all cases if you know something like that you took x bus to work and then a week later you took one to the mall its now possible to find all of their trips. For someone you know somewhat well its not hard to find 2 trips they took and then be able to find all of their trips.

Ok, so two trips but not any two trips. It requires a lot more knowledge of the person. For someone you know well why would you even need to look at the data?

One could trivially establish multiple trips that anyone with even slightly public social media has taken.

Re: Mozilla research: Browsing histories are unique enough to identify users

#60

Post by nemothekid »

3np wrote: post #41

To this me and a friend started sketching on a VPN/HTTP proxy that will have a set of say 100 outgoing IPs, look at the domains being connected to and distribute request destinations over IPs. So e.g. Google would always see the same IP, which would be different from the one Facebook sees. While access times cross-references and identification is still theoretically possible, it should be an entirely different game.…

I think an easier approach is that once you have good IPv6 connectivity you could do something like a unique address per day per host. Every device could have 100M ip addresses and it wouldn't touch the IPv6 address space (10 billion humans * 100 devices = 0.000005% of the IPv6 address space).

Edit: My math is wrong. I thought IPv6 was 2^64, but it's actually 2^128, so that percentage is 10^20 times more miniscule.

Post reply on HN