This reminds me of browser fingerprinting via CSS[0], which has come up quite a surprising amount of times. Sending the browser's width is a bit more convoluted though. From what I've seen, the popular (well, as popular as CSS-only fingerprinting is) method is to set a media query for each px value. When the user resizes the window, the new width is sent to the server. Obviously something like this would be generated code, not written by-hand.
No-JavaScript Fingerprinting
21–30 of 107 posts
Re: No-JavaScript Fingerprinting
#22Apart from window size and that Ubuntu-specific font, this mostly gets things openly sent in my User-Agent and Accept headers.
Re: No-JavaScript Fingerprinting
#23This doesn't seem to work very well. Want a better scriptless cross-site tracking mechanism? Check out https://xsid2-demo.glitch.me and https://xsid2-demo.easrng.net and note how they both get the same id.
Ok sure, but how does it work? I clicked around your website but there doesn't seem to be a description.
Re: No-JavaScript Fingerprinting
#24I thought it was going to use ETAG based fingerprinting/tracking, which I always thought was pretty clever. The etag header is supposed to be used to control caching, so it's typically a server-side generated hash of the requested resource's content. But, there's no requirement for it to be, so you can generate a unique one, and the client will send it back to you next time it asks for that uri. Sort of like a cookie…
ETag based tracking shouldn't work across domains.
Specifically, it won't work across sites -- all major browsers (now) shard the HTTP cache by site. While www.example.com and forums.example.com are different domains, they're the same site ("registrable domain" or "eTLD+1"; example.com in this case). See https://publicsuffix.org/list/public_suffix_list.dat for the list of eTLDs (parents of registrable domains).
Re: No-JavaScript Fingerprinting
#25Well for one thing, an IP address is always going to be the easiest way to track a user, but also user agent information which browsers happily give away too much information.
Yes, for many. VPN's, mobile connections, and commercial work connections (using a proxy) will throw off IP address checks as they report a single IP for large pool groups. You'd have to also use MAC address, but mobile have MAC address swapping ,etc.
I once wrote a tool that would capture all network requesters, and reverse fingerprint them through a connection of Operating system quirks responses to network oddities (eg: tcp fragmented frames), location, routers they connect through, etc combined with the other browser things avail.
Re: No-JavaScript Fingerprinting
#26Well for one thing, an IP address is always going to be the easiest way to track a user, but also user agent information which browsers happily give away too much information.
> IP address is always going to be the easiest way to track a user
This is changing: Apple has rolled out Private Relay, and Chrome is planning some combination of willful IP blindness and near-path NAT.
> user agent information which browsers happily give away too much information
So is this: all the browsers are working on reducing how much they put in the UA.
Re: No-JavaScript Fingerprinting
#27I just changed my preference for dark mode and got a different fingerprint. If it's not resilient to modest changes, it's not really that helpful at tracking anyone. There are already plugins to randomize some header data, so this type of thing has been known and protected against.
Re: No-JavaScript Fingerprinting
#28I just changed my preference for dark mode and got a different fingerprint. If it's not resilient to modest changes, it's not really that helpful at tracking anyone. There are already plugins to randomize some header data, so this type of thing has been known and protected against.
It depends on what settings actually change your finger print or not. If only 10% of people use dark mode toggle that's still 90% of users being tracked, which could be worth while.
Re: No-JavaScript Fingerprinting
#29I just changed my preference for dark mode and got a different fingerprint. If it's not resilient to modest changes, it's not really that helpful at tracking anyone. There are already plugins to randomize some header data, so this type of thing has been known and protected against.
If you have past data collected on the users, correlating users despite fingerprint changes should be pretty easy. If the fingerprint itself encodes data and isn't just a cryptographic hash, you don't even need to have past data collected, you just need fingerprints.
Re: No-JavaScript Fingerprinting
#30This doesn't seem to work very well. Want a better scriptless cross-site tracking mechanism? Check out https://xsid2-demo.glitch.me and https://xsid2-demo.easrng.net and note how they both get the same id.
Ok sure, but how does it work? I clicked around your website but there doesn't seem to be a description.
I haven't written a description yet. Here's a diagram I just made (I'm on my phone rn, please forgive any spelling issues) https://owo.whats-th.is/56opvAS.html