Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No-JavaScript Fingerprinting

noscriptfingerprint.com

Post reply on HN
Print view View original

51–60 of 107 posts

Re: No-JavaScript Fingerprinting

#51

Post by gtsop »

cookiengineer wrote: post #48

Note that among a sea of tracked browsers, the untrackable browser shines like a bright star. Statistical analysis of these values over time (matched with client hints, ETags, If-Modified-Since, and IPs) will make most browsers uniquely identifiable. If the malicious vendor is good, they even correlate the size and order of requests. Because that's unique as well and can identify TOR browsers pretty easily. It's like…

Wait, but the case for TOR isn't to hide you are using TOR, but to blend in with the crowd of TOR users. Does my TOR browser give a different fingerprint than yours?

Re: No-JavaScript Fingerprinting

#52

Post by omgitsabird »

cookiengineer wrote: post #48

Note that among a sea of tracked browsers, the untrackable browser shines like a bright star. Statistical analysis of these values over time (matched with client hints, ETags, If-Modified-Since, and IPs) will make most browsers uniquely identifiable. If the malicious vendor is good, they even correlate the size and order of requests. Because that's unique as well and can identify TOR browsers pretty easily. It's like…

I didn't review the linked projects, but isn't the "untrackable" browser one that does not implement or spoofs most APIs?

I think it would be, for the most part, trivial to make a text-based or extremely stripped down browser on top of existing projects, if you had the contracts mapped for appropriate code generation. There are IDLs for most Web APIs, so that is a head-start.

I think this would be achievable, but not as a browser that most people would want to use.

Re: No-JavaScript Fingerprinting

#53

Post by checkyoursudo »

1vuio0pswjnm7 wrote: post #50
notriddle wrote: post #45

Earlier quoted context omitted.

On many websites, you will literally be the only person doing that. This is a unique fingerprint. This might not matter to you, since it sounds like privacy isn’t your primary motivation here, but it is worth pointing out that custom patched browsers are going to be more fingerprinted, not less.

Yes, I understand some HN readers have this thought. I have gotten similar replies before. However, consider that I only send two to three headers: Host, Connection and (optionally) Cookie. There is nothing unique about the text-only browser by virtue of the patches. The TCP connetion and TLS is handled by a proxy. Sometimes I send the TCP requests with netcat, tcpclient, socat, etc. Then I open the HTML file with th…

Thanks for this comment. This is basically my position. While I prefer that sites would respect "do not track", ultimately I just don't want to see all the shitty ads. I don't really care if you're trying super hard to track me, though I think you're a fool if you do based on what I do online (read HN, wikipedia; download academic papers, mostly?).

I sympathize with the people who are going for pure anonymity. If I could be anonymous and still have a usable web, then I would do that. If you really think you'll learn something about me by tracking me, then whatever. I have still never been served a relevant ad in my life, so, uh, great job there. But in the end I just don't want to see all the shitty ads.

I would be interested to know what these people think they know about me. Based on my experience as a cognitive scientist, I suspect they know an awful lot less than they think they know ... or at least claim in their sales pitches to advertisers.

Re: No-JavaScript Fingerprinting

#54

Post by beebeepka »

lelandfe wrote: post #38
ravenstine wrote: post #32

Cool. I get a different fingerprint every time. Although that doesn't prove that I'm not fingerprintable by this approach (one difference may be responsible for changing the hash), I'm kind of pleased. My setup: - Firefox - Enhanced Tracking Protection - uBlock Origin - NoScript - Privacy Badger - Privacy Possum - HTTPS Everywhere - Clear URLs - Decentraleyes - Smart Referer - JavaScript Restrictor

Not familiar with Privacy Badger or Privacy Possum, but I'm guessing they are what's subverting this technique? The other ones probably don't come into play.

NoScript allows you to skip font loading for allowed and blocked domains.

Re: No-JavaScript Fingerprinting

#55

Post by emrex »

cmeacham98 wrote: post #4

I have Firefox RFP enabled, and as far as I know all these values will be the same across RFP users except the size of the browser window (which seems like a poor fingerprinting metric given the fact I can and do resize my browser during usage) - and maybe pixel density? (can't tell if this one is standardized or not). If there are any other RFP users out there compare to mine and see if you get anything different ot…

What if you are the only one in your area that uses FF RFP ?

Re: No-JavaScript Fingerprinting

#57

Post by zaik »

I wonder how unique this fingerprint really is. Getting the same fingerprint every time is only half of what makes a good fingerprint.

Fennec on Android: cdec914cb91d1a88fbd3e7834b7968c8

Re: No-JavaScript Fingerprinting

#59

Post by dsnr »

khalby786 wrote: post #56

How practical would this method of recognising your fingerprint with CSS be?

This, and also the power of tracking comes from being able to share data/track across domains. So the best way to mitigate this is not to dumb down our browsers but to fight cross domain access to this data. This can be done either by regulation (see GDPR) or technical measures (disabling cross-site scripting, cookies etc)

Re: No-JavaScript Fingerprinting

#60

Post by cookiengineer »

omgitsabird wrote: post #52
cookiengineer wrote: post #48

Note that among a sea of tracked browsers, the untrackable browser shines like a bright star. Statistical analysis of these values over time (matched with client hints, ETags, If-Modified-Since, and IPs) will make most browsers uniquely identifiable. If the malicious vendor is good, they even correlate the size and order of requests. Because that's unique as well and can identify TOR browsers pretty easily. It's like…

I didn't review the linked projects, but isn't the "untrackable" browser one that does not implement or spoofs most APIs? I think it would be, for the most part, trivial to make a text-based or extremely stripped down browser on top of existing projects, if you had the contracts mapped for appropriate code generation. There are IDLs for most Web APIs, so that is a head-start. I think this would be achievable, but not…

> WebIDLs

Exactly. One of the reasons was that WebKit implements its APIs based on the WebIDL schema files (iirc Firefox does this too since Aurora).

Though the C++ code generator is a real old perl script, it's generally feasible to spoof the APIs as they would behave while providing behaviour profiles of the most commonly used web browsers (e.g. chrome/edge on windows).

The real challenge is to implement behaviour profiles that are also timing specific because some Browsers have different timings in incognito mode vs. normal mode due to how the memory is allocated directly in-RAM. That's usually how incognito mode Browsers are identified by recaptcha.

Post reply on HN