Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla research: Browsing histories are unique enough to identify users

zdnet.com

Post reply on HN
Print view View original

121–130 of 131 posts

Re: Mozilla research: Browsing histories are unique enough to identify users

#121

Post by godelski »

James_Henry wrote: post #118
OskarS wrote: post #99

Earlier quoted context omitted.

That's nothing to do with HN, that's just how the internet works.

HN is on the internet, no? Also, HN definitely has a particularly bad headline-only problem, or maybe it just shows worse than some other places because people here have a tendency to ask really basic questions that the article clearly answers.

I think the problem here is that HN has higher standards (and we should keep it that way). Reddit is far worse, but I don't want to deal with all the stupid there.

Re: Mozilla research: Browsing histories are unique enough to identify users

#122

Post by liability »

ta95846893 wrote: post #72
liability wrote: post #33

Earlier quoted context omitted.

Does Mozilla Pocket get browsing history if it isn't disabled? Last I heard it's not using E2E encryption and Mozilla still hasn't open sourced the server side of it.

My understanding of pocket recommendations is that it gets a list of articles from a server every day and uses a local algorithm to match them to your browsing history so your history never leaves the device. Idk if any metadata about which decisions it made is leaked though. https://help.getpocket.com/article/1142-firefox-new-tab-reco...

I'm under the impression that syncing browsing history between instances of Firefox is a feature Mozilla provides through Pocket, but admittedly I don't have first-hand knowledge of this.

Re: Mozilla research: Browsing histories are unique enough to identify users

#123

Post by ta95846893 »

liability wrote: post #122
ta95846893 wrote: post #72

Earlier quoted context omitted.

My understanding of pocket recommendations is that it gets a list of articles from a server every day and uses a local algorithm to match them to your browsing history so your history never leaves the device. Idk if any metadata about which decisions it made is leaked though. https://help.getpocket.com/article/1142-firefox-new-tab-reco...

I'm under the impression that syncing browsing history between instances of Firefox is a feature Mozilla provides through Pocket, but admittedly I don't have first-hand knowledge of this.

I think syncing is done with a Firefox account (Firefox Sync) and i can't find implementation details, but I did find:

"Firefox Accounts uses your password to encrypt your data (such as bookmarks and passwords) for extra security. When you forget your password and have to reset it, this data could be erased. To prevent this from happening, generate your recovery key before having to reset your password."[1]

So it appears they may be encrypting data locally and syncing encrypted data without having keys.

I think you are right though, there are more website saving features available through pocket other than recommendations and I'm not sure how any of that works.

[1] https://support.mozilla.org/en-US/kb/reset-your-firefox-acco...

Re: Mozilla research: Browsing histories are unique enough to identify users

#124

Post by airstrike »

mulmen wrote: post #64
airstrike wrote: post #53

Earlier quoted context omitted.

Not if everyone else uses it too

Even if everyone else uses it. If your random pages are a, b and c but my pages are d, e and f or even a, b and d then it’s still easy to fingerprint us. Extensions like this might work if they visited the same sites all other users visit. Otherwise you’re just adding even more unique information for the trackers.

But if both our random pages are a, b and c, and the only difference is when or how often I accessed each of those, then making it random for both of us will effectively turn us into the same person.

Re: Mozilla research: Browsing histories are unique enough to identify users

#125

Post by axegon_ »

wnbc wrote: post #88
axegon_ wrote: post #86

That's hardly surprising. I mean browsers hand out willingly plenty of information that could be used for pretty accurate identifications. Just scrolling through my scores on amiunique[1], many of the parameters put me in the 0.01% category. [1] https://amiunique.org/fp

If you want to be less unique on amiunique.org/fp 1. Visit the site 2. Delete your browser cookies 3. Refresh 4. Repeat the steps until you're less unique

Content language=en-US,en;q=0.9,bg;q=0.8,es;q=0.7

That's gonna take a lot of refreshing.....

Re: Mozilla research: Browsing histories are unique enough to identify users

#126

Post by mulmen »

airstrike wrote: post #124
mulmen wrote: post #64

Earlier quoted context omitted.

Even if everyone else uses it. If your random pages are a, b and c but my pages are d, e and f or even a, b and d then it’s still easy to fingerprint us. Extensions like this might work if they visited the same sites all other users visit. Otherwise you’re just adding even more unique information for the trackers.

But if both our random pages are a, b and c, and the only difference is when or how often I accessed each of those, then making it random for both of us will effectively turn us into the same person.

What about all the other pages you visit? How does adding random traffic to your history make you any harder to identify? It just creates more datapoints.

Re: Mozilla research: Browsing histories are unique enough to identify users

#127

Post by 3np »

jefftk wrote: post #120
3np wrote: post #74

Earlier quoted context omitted.

Could you elaborate on what you mean by this specifically? query params like fbclid? That could be stripped client-side, e.g. via a browser extension. There are already extensions that do this. Previous discussion: https://news.ycombinator.com/item?id=22386388

It sounds to me like your threat model here is that two sites (A and B) which would like to share identity, and you want to stop them? Perhaps A has identity (for example, you log in), A gives you links to B, and B runs some third-party JavaScript served from A. For example, A could be FB/Google/etc and B could be a news site. Site A can add any query parameter it wants to the outgoing link, and then parse it on B in…

Yeah, you summed it up pretty well I think.

It's definitely an arms race, and IMO it makes sense to push back on areas where one can. Are you implying that it's not a worthwhile effort and that the battle is lost?

I'm thinking 1) DNS control with block lists 2) browser extensions (restricting canvas, removing tracking parts of urls) 3) be restrictive of disclosing PIIs 4) IP obfuscation along the lines I laid about above should make it a lot less deterministic and decrease confidence in merging of datasets.

Rule lists obviously have to be continuously updated.

Only a sith deals in absolutes but from your perspective am I missing something?

Re: Mozilla research: Browsing histories are unique enough to identify users

#128

Post by 3np »

3np wrote: post #127
jefftk wrote: post #120

Earlier quoted context omitted.

It sounds to me like your threat model here is that two sites (A and B) which would like to share identity, and you want to stop them? Perhaps A has identity (for example, you log in), A gives you links to B, and B runs some third-party JavaScript served from A. For example, A could be FB/Google/etc and B could be a news site. Site A can add any query parameter it wants to the outgoing link, and then parse it on B in…

Yeah, you summed it up pretty well I think. It's definitely an arms race, and IMO it makes sense to push back on areas where one can. Are you implying that it's not a worthwhile effort and that the battle is lost? I'm thinking 1) DNS control with block lists 2) browser extensions (restricting canvas, removing tracking parts of urls) 3) be restrictive of disclosing PIIs 4) IP obfuscation along the lines I laid about a…

I know meta-talk like this is frowned upon, but to the people downvoting, I would really like to hear your thoughts.

Re: Mozilla research: Browsing histories are unique enough to identify users

#129

Post by gpvos »

gpvos wrote: post #101
the_jeremy wrote: post #3

Who is able to get access to my browser history? I thought it was just my ISP/VPN, which can obviously track me better in other ways.

It's in the article. You can do some clever Javascript/CSS tricks to sniff the browser history. Browsers are not trying to block this.

*now trying to block this (oops)

Re: Mozilla research: Browsing histories are unique enough to identify users

#130

Post by afrcnc »

lostmsu wrote: post #50
afrcnc wrote: post #16

Earlier quoted context omitted.

Install one shady Android app and it will immediately dump your browsing history, rest assured.

How exactly would it do it? Android permissions prohibit access to other app data, except shared storage.

1. LPE/rooting exploit 2. Win
Post reply on HN