Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No-JavaScript Fingerprinting

noscriptfingerprint.com

Post reply on HN
Print view View original

71–80 of 107 posts

Re: No-JavaScript Fingerprinting

#71

Post by jokethrowaway »

gtsop wrote: post #51
cookiengineer wrote: post #48

Note that among a sea of tracked browsers, the untrackable browser shines like a bright star. Statistical analysis of these values over time (matched with client hints, ETags, If-Modified-Since, and IPs) will make most browsers uniquely identifiable. If the malicious vendor is good, they even correlate the size and order of requests. Because that's unique as well and can identify TOR browsers pretty easily. It's like…

Wait, but the case for TOR isn't to hide you are using TOR, but to blend in with the crowd of TOR users. Does my TOR browser give a different fingerprint than yours?

the browser fingerprint may be software / hardware dependant

TOR will hide your IP to interested parties (unless they have NSA resources / can buy a good part of the TOR network)

Re: No-JavaScript Fingerprinting

#72

Post by dfawcus »

easrng wrote: post #9

This doesn't seem to work very well. Want a better scriptless cross-site tracking mechanism? Check out https://xsid2-demo.glitch.me and https://xsid2-demo.easrng.net and note how they both get the same id.

Neither of the above links do much for me.

There was an initial screen, then a redirect to another page containing the text below, and appearing to depend upon JS being enabled.

"Waking up

To keep Glitch fast for everyone, inactive projects go to sleep and wake up on request."

That redirect is different for the two initial URLs, but is of the form:

    https://xsid2.glitch.me/https%3A%2F%2Fxsid2-demo.glitch.me%2Fcb%2FHASH
where HASH is a sequence of hex characters, different for the two original URLs.

I'm using Firefox, with uMatrix having scripts and css disabled by default, but 1st party cookies enabled.

Re: No-JavaScript Fingerprinting

#73

Post by dfawcus »

dfawcus wrote: post #72
easrng wrote: post #9

This doesn't seem to work very well. Want a better scriptless cross-site tracking mechanism? Check out https://xsid2-demo.glitch.me and https://xsid2-demo.easrng.net and note how they both get the same id.

Neither of the above links do much for me. There was an initial screen, then a redirect to another page containing the text below, and appearing to depend upon JS being enabled. "Waking up To keep Glitch fast for everyone, inactive projects go to sleep and wake up on request." That redirect is different for the two initial URLs, but is of the form: https://xsid2.glitch.me/https%3A%2F%2Fxsid2-demo.glitch.me%2Fcb%2FHAS…

A second try loading each site in new tabs seemed to work, but this time each gave a different ID. One starting 3fa2, the other f918

Reloading each tab then gave two different numbers, 7eb6 and 6f83

Subsequent reloads did not change again.

Loading the sites in to two more tabs, gave yet a different pair of numbers (1934 and 1667), reloads of those tabs yeilded another pair (b308 and 3df8)

Re: No-JavaScript Fingerprinting

#74

Post by Gwypaas »

niffydroid wrote: post #70

While this is cool and handy, sadly not of any use to me. According to Uk ICO (Information Commissioner Office) Fingerprinting has to have consent. https://ico.org.uk/for-organisations/guide-to-pecr/what-are-... "PECR also applies to ‘similar technologies’ like fingerprinting techniques. Therefore, unless an exemption applies, any use of device fingerprinting requires the provision of clear and comprehensive informat…

I would rather see it as a way to easily demonstrate why GPDR is not simply about cookies and their management. It concerns any method of creating an identifier which would allow for tracking.

Re: No-JavaScript Fingerprinting

#75

Post by kwhitefoot »

niffydroid wrote: post #70

While this is cool and handy, sadly not of any use to me. According to Uk ICO (Information Commissioner Office) Fingerprinting has to have consent. https://ico.org.uk/for-organisations/guide-to-pecr/what-are-... "PECR also applies to ‘similar technologies’ like fingerprinting techniques. Therefore, unless an exemption applies, any use of device fingerprinting requires the provision of clear and comprehensive informat…

Why sadly? Why would you want to fingerprint users browsers anyway?

Re: No-JavaScript Fingerprinting

#76

Post by captainmuon »

I wonder why we are not seeing more completely server-side analytics. With tricks like this you can get by with no or only minimal JavaScript. You can also set a session cookie to be more accurate. If the cookie is neccessary for the functioning of the site, you don't even need GDPR consent.

Practially, and I know this is cynical, but you don't really have to follow the GDPR, you just have to make sure there is no outside sign you are tracking users. And frankly, if I had a website, I would want accurate statistics, but I would want to avoid a cookie prompt, and I would want as little external javascript as possible. So it is weird that there is no black-hat stealth visitor analytics yet.

Re: No-JavaScript Fingerprinting

#77

Post by yeskia »

cush wrote: post #47
tyingq wrote: post #10

I thought it was going to use ETAG based fingerprinting/tracking, which I always thought was pretty clever. The etag header is supposed to be used to control caching, so it's typically a server-side generated hash of the requested resource's content. But, there's no requirement for it to be, so you can generate a unique one, and the client will send it back to you next time it asks for that uri. Sort of like a cookie…

You could just use any regular cookie then, in this case.

I suppose ETags could allow you to continue tracking someone even if they purged their cookies?

Re: No-JavaScript Fingerprinting

#78

Post by lelandfe »

beebeepka wrote: post #54
lelandfe wrote: post #38

Earlier quoted context omitted.

Not familiar with Privacy Badger or Privacy Possum, but I'm guessing they are what's subverting this technique? The other ones probably don't come into play.

NoScript allows you to skip font loading for allowed and blocked domains.

This is using local/system fonts, not remote ones.

Re: No-JavaScript Fingerprinting

#79

Post by coma_ »

cookiengineer wrote: post #65
gtsop wrote: post #51

Earlier quoted context omitted.

Wait, but the case for TOR isn't to hide you are using TOR, but to blend in with the crowd of TOR users. Does my TOR browser give a different fingerprint than yours?

The IPs of TOR exit nodes are publicly known. I'm not sure people using TOR are aware of how the concept and peer discovery mechanism works. I mean, at some point you gotta ask yourself why cloudflare shows all TOR users a captcha in a targeted manner :)

> I mean, at some point you gotta ask yourself why cloudflare shows all TOR users a captcha in a targeted manner :)

Because exit node IP address' are known, you have just said it.

How does it have anything to do with user fingerprinting? And how does it answer the question of @gtsop asking whether different users of ToR web browser have different distinguishable fingerprint or not?

Re: No-JavaScript Fingerprinting

#80

Post by farias0 »

zaik wrote: post #57

I wonder how unique this fingerprint really is. Getting the same fingerprint every time is only half of what makes a good fingerprint. Fennec on Android: cdec914cb91d1a88fbd3e7834b7968c8

Yep, this site should tell you if your fingerprint is unique among all the other visitors, like other fingerprint sites do. I know a positive would only be meaningful if the website gets popular, but a negative would say a lot regardless.
Post reply on HN