Supercookie: Browser Fingerprinting via Favicon • Hacker News Board

Re: Supercookie: Browser Fingerprinting via Favicon

#81

Post by jonsolo » Sun, Feb 07, 2021, 8:30 PM UTC

jonasstrehle wrote: post #79

jonsolo wrote: post #67

Can you read favicons from JavaScript or from the server side? I know you can set them from JS, don’t know about reading. If so could you use steganography to encode a unique ID into the icon itself, then read it back to retrieve the fingerprint.

This idea was indeed my first approach, but favicons on the client side cannot be loaded from the F-Cache via JavaScript, but are ALWAYS requested from the server via get-request, which fortunately thus does not allow fingerprinting. ~jonas

Makes sense, and I agree that is good behavior! Thanks for clarifying.

Re: Supercookie: Browser Fingerprinting via Favicon

#82

Post by happyconcepts » Mon, Feb 08, 2021, 8:24 AM UTC

jonasstrehle wrote: post #70

est31 wrote: post #25

Earlier quoted context omitted.

Indeed one shouldn't do something like this. I hope they realize their mistake :). Also thanks for pointing this out, I haven't read that thread that closely, only remembered it being on the hn front page recently. FTR it seems that Jonas Strehle, author of this Github repo, is not affliated with the authors.

Thanks for clarifying - I have also noticed the very doubtful action of the authors! But I can furthermore assure that I have nothing to do with the authors of the paper. ~ jonas

thank you for the clarification of no conflict.

Re: Supercookie: Browser Fingerprinting via Favicon

#83

Post by charsi » Mon, Feb 08, 2021, 10:33 AM UTC

oedmarap wrote: post #64

This only applies to browsing where the user's cache is present, yes? At least in Firefox 85.0.1 Desktop and 85.1.1 Android (when I tested) clearing the cache also nukes the favicons as well. Also, I get different hashes when I test on demo.supercookie.me after clearing my cache on mobile, and also across Private windows on desktop. The statement "[...] even in the browser's incognito mode and is not cleared by flush…

Tested on Firefox 85.0 on Linux mint. The id is different across a normal window and a private window. Also tried using a new profile using `about:profiles` and again the id was different.

Re: Supercookie: Browser Fingerprinting via Favicon

#84

Post by app4soft » Mon, Feb 08, 2021, 8:06 PM UTC

est31 wrote: post #2

Link to discussion of the paper (55 comments): https://news.ycombinator.com/item?id=25868742

Oh, this `favicon.ico` issues reminds me my old humorous article.[0]

[0] https://appsoft4fm.wordpress.com/2015/06/17/favicon-ico-mone...

Re: Supercookie: Browser Fingerprinting via Favicon

#85

Post by 1vuio0pswjnm7 » Tue, Feb 09, 2021, 9:37 AM UTC

I block favicon requests with a forward proxy. I cannot rely on "modern" browsers to do the right thing, but I can rely on the proxy to do what I tell it to do.

Re: Supercookie: Browser Fingerprinting via Favicon

#86

Post by power78 » Wed, Feb 10, 2021, 3:13 AM UTC

crashdelta wrote: post #5

It doesn't work in FireFox 85.0 x64 on Windows. I went to the site, did the demo, my number was A5 94 D6 7E 4A DE and when I came back in private mode it was 51 ED 26 D8 66 FC.

Same with Samsung Internet on Android

Re: Supercookie: Browser Fingerprinting via Favicon

#87

Post by frombody » Wed, Feb 10, 2021, 4:48 AM UTC

oedmarap wrote: post #64

This only applies to browsing where the user's cache is present, yes? At least in Firefox 85.0.1 Desktop and 85.1.1 Android (when I tested) clearing the cache also nukes the favicons as well. Also, I get different hashes when I test on demo.supercookie.me after clearing my cache on mobile, and also across Private windows on desktop. The statement "[...] even in the browser's incognito mode and is not cleared by flush…

According to the article it looks like they started to fix this between versions 84 and 85.

It's unsurprising that browser manufacturers are patching this.