11–20 of 107 posts
This doesn't seem to work very well. Want a better scriptless cross-site tracking mechanism? Check out https://xsid2-demo.glitch.me and https://xsid2-demo.easrng.net and note how they both get the same id.
On the glitch website, I get f9703...
On the easrng website, I get 8ecd6...
This doesn’t worry me too much, the value seems like it should be the exact same hash for any iOS Safari visitor with the same screen resolution and browser language? I’d be fingerprinted as part of a group of (probably) several hundred thousand. 8d666b05c42878d6d6d364c410a4eef2 It’s a shame that browsers leak things like font presence, but of course when sites can read back canvas contents without querying the user…
There’s likely enough info in the hash to figure out exactly what device I’m on since nothing else will have the same pixel density, screen height, and screen width: https://stackoverflow.com/questions/46313640/iphone-x-8-8-pl...
Dark mode adds on one more bit, but everything else should be the same across iOS devices. Not sure if that’s enough to track individuals among a small userbase every time their IP address changes.
This doesn't seem to work very well. Want a better scriptless cross-site tracking mechanism? Check out https://xsid2-demo.glitch.me and https://xsid2-demo.easrng.net and note how they both get the same id.
This doesn't work very well. On the glitch website, I get f9703... On the easrng website, I get 8ecd6...
I thought it was going to use ETAG based fingerprinting/tracking, which I always thought was pretty clever. The etag header is supposed to be used to control caching, so it's typically a server-side generated hash of the requested resource's content. But, there's no requirement for it to be, so you can generate a unique one, and the client will send it back to you next time it asks for that uri. Sort of like a cookie…
Earlier quoted context omitted.
This doesn't work very well. On the glitch website, I get f9703... On the easrng website, I get 8ecd6...
Hmm, what browser? I've tested normal Firefox, Chrome, and Bromite and it works on all of them.
Earlier quoted context omitted.
Even without RFP it seems to be very fragile, just resizing my window completely changes the result.
That's because it is including the dimensions of your window as part of your fingerprint. If your goal is to track users as they move across sites, matching browser size makes sense.
Earlier quoted context omitted.
Hmm, what browser? I've tested normal Firefox, Chrome, and Bromite and it works on all of them.
I get different results for each domain on Firefox Android.
The view results button then points to https://noscriptfingerprint.com/compactResult/TRACKING_CODE
How unique of a browser fingerprint is generated by the CSS options would require further consideration. An easy fix to this would be to disable url values for styles, though.
Edit: Blocking CSS entirely in uMatrix causes it to mostly fail.
Well for one thing, an IP address is always going to be the easiest way to track a user, but also user agent information which browsers happily give away too much information.
Note that an IP address is not unique to a single user (NAT, CGNAT, mobile networks) and may frequently change.
> also user agent information
All users who use the same version of a browser on the same OS typically share the same user agent string (unless modified with a plugin or an extension). It's an indicator, but can't be used as a fingerprint itself.