It doesn't work in FireFox 85.0 x64 on Windows. I went to the site, did the demo, my number was A5 94 D6 7E 4A DE and when I came back in private mode it was 51 ED 26 D8 66 FC.
[deleted]
Supercookie: Browser Fingerprinting via Favicon
21–30 of 87 posts
Re: Supercookie: Browser Fingerprinting via Favicon
#22Earlier quoted context omitted.
The creator of supercookie.me made it sound like all versions of FireFox were vulnerable.
It may have been their intention, after reading the bugzilla report they made[1]. > I also think that it would have been appropriate to notify about the ulterior motive behind this defect report at the latest when the paper got published. This underhanded approach of reporting a defect just leaves a bad taste, really. The behavior may be an actual defect in the classical sense, but I'm just wondering what would have…
Honestly, this is a big deal here. A "security researcher" attempted to _introduce new vulnerabilities_ into a major open source project just so that they could report these vulnerabilities later.
How scammy can research get?
Re: Supercookie: Browser Fingerprinting via Favicon
#23> About me. I am a twenty year old student from 🇩🇪 Germany Impressive! Come work with me :) can’t wait to see what you do by the time you’re 30.
Really? LOL
Re: Supercookie: Browser Fingerprinting via Favicon
#24Link to discussion of the paper (55 comments): https://news.ycombinator.com/item?id=25868742
Thanks for posting this. I wouldn't have known otherwise of the attempt from the authors of the paper which this demo is based to introduce this vulnerability into Firefox[1]. Really leaves a sour taste in mouth from how irresponsible and unethical this was.
Re: Supercookie: Browser Fingerprinting via Favicon
#25Link to discussion of the paper (55 comments): https://news.ycombinator.com/item?id=25868742
Thanks for posting this. I wouldn't have known otherwise of the attempt from the authors of the paper which this demo is based to introduce this vulnerability into Firefox[1]. Really leaves a sour taste in mouth from how irresponsible and unethical this was. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1618257
Indeed one shouldn't do something like this. I hope they realize their mistake :).
Also thanks for pointing this out, I haven't read that thread that closely, only remembered it being on the hn front page recently.
FTR it seems that Jonas Strehle, author of this Github repo, is not affliated with the authors.
Re: Supercookie: Browser Fingerprinting via Favicon
#26It doesn't work in FireFox 85.0 x64 on Windows. I went to the site, did the demo, my number was A5 94 D6 7E 4A DE and when I came back in private mode it was 51 ED 26 D8 66 FC.
Same on Firefox on linux. I got a fingerprint on one tab, and when that finished, I opened a new tab and ran the demo again - which gave me a new fingerprint ID. Running privacy badger and ublock origin
Firefox blocks supercookies by default. It's not your addons.
Re: Supercookie: Browser Fingerprinting via Favicon
#27Wouldn't the browser do a HEAD first? Seems like you could also use uniquely generated ETAGS as cookies if it does. Which would be more effective with favicons than the general case, given the comments about how browsers cache them.
Browser does NOT do the HEAD request first. Only GET
The browser would presumably send the ETag in an If-None-Match in the GET request though.
Re: Supercookie: Browser Fingerprinting via Favicon
#28This is a neat approach, but I'm not sure I'd expect it to be used in the wild. ~32 consecutive document redirects every time you want to fingerprint a browser would be slow: twelve (?) redirects on my (~fast) internet takes about ten seconds. On 3g, I could imagine this taking much longer. You'd also likely need to do this at the (root) page level (i.e., it wouldn't work inside an iframe, since iframes don't have fa…
I you wanted to track just a handful of users for nefarious purposes tho...
Re: Supercookie: Browser Fingerprinting via Favicon
#29What's the best way to prevent this for Chrome? Can the F-Cache be disabled entirely? Otherwise, would
a Tampermonkey script or Chrome extension which just GETs /favicon.ico on every page load work?
EDIT: Seems to be preventable with a quick Tampermonkey hack: https://gist.github.com/lukepothier/1b18905039b1ed960efebec3...
Re: Supercookie: Browser Fingerprinting via Favicon
#30This is a neat approach, but I'm not sure I'd expect it to be used in the wild. ~32 consecutive document redirects every time you want to fingerprint a browser would be slow: twelve (?) redirects on my (~fast) internet takes about ten seconds. On 3g, I could imagine this taking much longer. You'd also likely need to do this at the (root) page level (i.e., it wouldn't work inside an iframe, since iframes don't have fa…
> Maybe if it was done in a popup?
Funny you mention that, one of my friends was on a torrent site the other day and had tiny popup that appeared to keep redirecting. I assumed it was redirecting through multiple pages to generate fake ad impressions, but this is another possibility.