Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla research: Browsing histories are unique enough to identify users

zdnet.com

Post reply on HN
Print view View original

61–70 of 131 posts

Re: Mozilla research: Browsing histories are unique enough to identify users

#61

Post by 3np »

nemothekid wrote: post #60
3np wrote: post #41

To this me and a friend started sketching on a VPN/HTTP proxy that will have a set of say 100 outgoing IPs, look at the domains being connected to and distribute request destinations over IPs. So e.g. Google would always see the same IP, which would be different from the one Facebook sees. While access times cross-references and identification is still theoretically possible, it should be an entirely different game.…

I think an easier approach is that once you have good IPv6 connectivity you could do something like a unique address per day per host. Every device could have 100M ip addresses and it wouldn't touch the IPv6 address space (10 billion humans * 100 devices = 0.000005% of the IPv6 address space). Edit: My math is wrong. I thought IPv6 was 2^64, but it's actually 2^128, so that percentage is 10^20 times more miniscule.

In that scenario those 100 IPv6 addresses in the subnet would be practically equivalent to an IPv4 address today and would provide no extra benefit.

Re: Mozilla research: Browsing histories are unique enough to identify users

#62

Post by Fnoord »

nemothekid wrote: post #60
3np wrote: post #41

To this me and a friend started sketching on a VPN/HTTP proxy that will have a set of say 100 outgoing IPs, look at the domains being connected to and distribute request destinations over IPs. So e.g. Google would always see the same IP, which would be different from the one Facebook sees. While access times cross-references and identification is still theoretically possible, it should be an entirely different game.…

I think an easier approach is that once you have good IPv6 connectivity you could do something like a unique address per day per host. Every device could have 100M ip addresses and it wouldn't touch the IPv6 address space (10 billion humans * 100 devices = 0.000005% of the IPv6 address space). Edit: My math is wrong. I thought IPv6 was 2^64, but it's actually 2^128, so that percentage is 10^20 times more miniscule.

You get a range from your ISP (e.g. a /64). Everything within that range would be tied to "you" (rather, your connection, but something like user agent would tell its your wife's iPhone or your MacBook Pro).

Re: Mozilla research: Browsing histories are unique enough to identify users

#63

Post by MikusR »

the_jeremy wrote: post #3

Who is able to get access to my browser history? I thought it was just my ISP/VPN, which can obviously track me better in other ways.

Mozilla was sending your Firefox history to Cliqz (in Germany). And currently is sending it to Cloudflare (in US).

Re: Mozilla research: Browsing histories are unique enough to identify users

#64

Post by mulmen »

airstrike wrote: post #53
mulmen wrote: post #47

Earlier quoted context omitted.

If it’s truly random wouldn’t that make you even easier to identify?

Not if everyone else uses it too

Even if everyone else uses it.

If your random pages are a, b and c but my pages are d, e and f or even a, b and d then it’s still easy to fingerprint us.

Extensions like this might work if they visited the same sites all other users visit. Otherwise you’re just adding even more unique information for the trackers.

Re: Mozilla research: Browsing histories are unique enough to identify users

#66

Post by skinner927 »

3np wrote: post #41

To this me and a friend started sketching on a VPN/HTTP proxy that will have a set of say 100 outgoing IPs, look at the domains being connected to and distribute request destinations over IPs. So e.g. Google would always see the same IP, which would be different from the one Facebook sees. While access times cross-references and identification is still theoretically possible, it should be an entirely different game.…

Look up browser fingerprinting. It’s a lot more complicated than just obscuring IPs.

Re: Mozilla research: Browsing histories are unique enough to identify users

#67

Post by 3np »

skinner927 wrote: post #66
3np wrote: post #41

To this me and a friend started sketching on a VPN/HTTP proxy that will have a set of say 100 outgoing IPs, look at the domains being connected to and distribute request destinations over IPs. So e.g. Google would always see the same IP, which would be different from the one Facebook sees. While access times cross-references and identification is still theoretically possible, it should be an entirely different game.…

Look up browser fingerprinting. It’s a lot more complicated than just obscuring IPs.

Oh absolutely, it's not a silver bullet - just an attempt at alleviating that single dimension, which I still think is significant enough to take seriously.

IMO there will never be a complete solution but that means we have to tackle each issue or dimension individually within the larger context, not just throw our hands in the air and give up.

Maybe should have been more clear on the scope ambition in the OC but can't edit the comment anymore.

Re: Mozilla research: Browsing histories are unique enough to identify users

#68

Post by [deleted] »

WilTimSon wrote: post #11
slipheen wrote: post #4

Earlier quoted context omitted.

Consider for example, that many pages use remotely loaded resources. I would think things like Facebook/Twitter like buttons or Google Fonts might make it to assemble this history. Sites like FB are said to maintain "Shadow Profiles" of people, even when those people aren't using their service directly. I suppose in theory any sufficiently shared infrastructures such as AWS/Cloudflare could do so as well, but they ar…

Would using Firefox's 'Containers' help prevent this? As far as I understand they quarantine the Facebook pages so they can't get data from other websites you visit.

[deleted]

Re: Mozilla research: Browsing histories are unique enough to identify users

#69

Post by dralley »

godelski wrote: post #30
Groxx wrote: post #24

I feel inclined to say "... well yeah, obviously". Not in the "obvious in retrospect" way, but because browsers have been progressively blocking history-sniffing tactics for years precisely because advertisers were using it to identify visitors. Did this research... establish better numbers around it or something?

> Did this research... establish better numbers around it or something? >> However, this time around, since the data was collected from Firefox itself and not through a web page performing a time-lengthy CSS test, the data was much more accurate and reliable. Furthermore, the data Mozilla researchers collected is also about the same type of data that today's online analytics companies also collect about users — eithe…

Needs to be specified that this was an opt-in study that you had to agree to.

Re: Mozilla research: Browsing histories are unique enough to identify users

#70

Post by jefftk »

3np wrote: post #41

To this me and a friend started sketching on a VPN/HTTP proxy that will have a set of say 100 outgoing IPs, look at the domains being connected to and distribute request destinations over IPs. So e.g. Google would always see the same IP, which would be different from the one Facebook sees. While access times cross-references and identification is still theoretically possible, it should be an entirely different game.…

> While access times cross-references and identification is still theoretically possible, it should be an entirely different game.

How are you planning to handle communicating identity across sites with link decoration?

Post reply on HN