Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No-JavaScript Fingerprinting

noscriptfingerprint.com

Post reply on HN
Print view View original

91–100 of 107 posts

Re: No-JavaScript Fingerprinting

#91

Post by notriddle »

1vuio0pswjnm7 wrote: post #50
notriddle wrote: post #45

Earlier quoted context omitted.

On many websites, you will literally be the only person doing that. This is a unique fingerprint. This might not matter to you, since it sounds like privacy isn’t your primary motivation here, but it is worth pointing out that custom patched browsers are going to be more fingerprinted, not less.

Yes, I understand some HN readers have this thought. I have gotten similar replies before. However, consider that I only send two to three headers: Host, Connection and (optionally) Cookie. There is nothing unique about the text-only browser by virtue of the patches. The TCP connetion and TLS is handled by a proxy. Sometimes I send the TCP requests with netcat, tcpclient, socat, etc. Then I open the HTML file with th…

> But seriously, what is the point of thinking about these things. Who is going to go to such lengths to try to "identify" me.

Nobody's going to very much trouble at all. They're just dumping every characteristic they can gather about you into an AI system, like a Bayesian classifier or a Convolution Neural Net. It doesn't require very much work to take into account clearly discrete data like the set of headers you submit, or the delay between switching pages, or parts of your IP address.

You hear a lot of stuff on HN about how inaccurate AI is, and much of it is true. But for figuring out when the set of HTTP headers correlates with your shopping habits, it should actually do a pretty good job, because it's basically just a matter of finding ways to correlate data together. No need to recognize when it's missing some form of outside context, because it doesn't "fail" or "succeed", it just does "worse" or "better." As long as it does better than a coin flip, it's worth it.

Right now, it's pretty effective to block ads by just not loading them, but there's no universal law that says it will always be that way. That already doesn't work on YouTube, which serves the ads from the same domain as the content, meaning that most ad blockers don't work on it. If ad blocking keeps becoming more popular, tactics like that will become more common. Once the ad serving becomes strictly first-party, relying on JavaScript looks like an increasingly terrible idea, not because of the minuscule number of people blocking JavaScript, but because you can't trust the potentially-malicious client to defend against click fraud.

Re: No-JavaScript Fingerprinting

#92

Post by notriddle »

captainmuon wrote: post #76

I wonder why we are not seeing more completely server-side analytics. With tricks like this you can get by with no or only minimal JavaScript. You can also set a session cookie to be more accurate. If the cookie is neccessary for the functioning of the site, you don't even need GDPR consent. Practially, and I know this is cynical, but you don't really have to follow the GDPR, you just have to make sure there is no ou…

> Practially, and I know this is cynical, but you don't really have to follow the GDPR, you just have to make sure there is no outside sign you are tracking users.

Why bother, then?

I mean this in the relatively broad philosophical sense. There are few who seek pain, simply because it is pain, and there are few who implement complex tracking schemes simply to implement complex tracking schemes. They only go through this much work if there is some pleasure or profit to be gained from it.

If you start doing significantly-meaningful ad targeting, someone might notice the striking correlation. If you're a big enough organization for the practice to become dangerous, then even if nobody on the outside notices, someone might leak. What's the point in gathering the information if you can't use it for fear of someone figuring out what you did?

Re: No-JavaScript Fingerprinting

#93

Post by easrng »

dfawcus wrote: post #73
dfawcus wrote: post #72

Earlier quoted context omitted.

Neither of the above links do much for me. There was an initial screen, then a redirect to another page containing the text below, and appearing to depend upon JS being enabled. "Waking up To keep Glitch fast for everyone, inactive projects go to sleep and wake up on request." That redirect is different for the two initial URLs, but is of the form: https://xsid2.glitch.me/https%3A%2F%2Fxsid2-demo.glitch.me%2Fcb%2FHAS…

A second try loading each site in new tabs seemed to work, but this time each gave a different ID. One starting 3fa2, the other f918 Reloading each tab then gave two different numbers, 7eb6 and 6f83 Subsequent reloads did not change again. Loading the sites in to two more tabs, gave yet a different pair of numbers (1934 and 1667), reloads of those tabs yeilded another pair (b308 and 3df8)

Oh huh, I'm seeing this too. It worked at some point, not sure why it isn't now. I'll look into it.

Edit: it looks like this happens when the sites have gone down and are being restarted on load. I'll move them to my VPS, that should fix it.

Re: No-JavaScript Fingerprinting

#94

Post by 1vuio0pswjnm7 »

checkyoursudo wrote: post #53
1vuio0pswjnm7 wrote: post #50

Earlier quoted context omitted.

Yes, I understand some HN readers have this thought. I have gotten similar replies before. However, consider that I only send two to three headers: Host, Connection and (optionally) Cookie. There is nothing unique about the text-only browser by virtue of the patches. The TCP connetion and TLS is handled by a proxy. Sometimes I send the TCP requests with netcat, tcpclient, socat, etc. Then I open the HTML file with th…

Thanks for this comment. This is basically my position. While I prefer that sites would respect "do not track", ultimately I just don't want to see all the shitty ads. I don't really care if you're trying super hard to track me, though I think you're a fool if you do based on what I do online (read HN, wikipedia; download academic papers, mostly?). I sympathize with the people who are going for pure anonymity. If I c…

"Thanks for this comment."

Likewise.

What these replies about "uniqueness" seem to ignore is that the majority of traffic on the internet is so-called "bots". In other words, it is traffic from clients that are not Chrome, Safari, etc. It is ridicuously easy to be mistaken for a "bot" when submitting requests manually, if one does not know what they are doing. For example, editing a single HTTP header is often enough. "Bot detection" is more often than not based on laughably crude heuristics. What happens if the user makes a single request manually and that header is missing. There is nothing to check. In almost all cases, nothing happens. There is no penalty for reducing the amount of information sent. In any event, it is rather easy to unintentionally "blend in" with the majority of internet traffic, which comes from "bots".

Those professing to have superior knowledge about user behaviour, including Big Tech, still cannot tell if someone is submitting requests manually or not.^1 (Absent keylogging on the users computer.) Their superior knowledge of user behaviour only applies to users who use "modern" browsers that place high emphasis on graphics. Chrome, Safari, etc.

No one is going to try to advertise to a "bot", i.e., a non-graphical client. It would be ineffective. The online advertisig industry relies on graphical web browsers like Chrome and Safari.

Using a common browser with the default settings to try to "remain" anonymous comes at a cost. Default settings do not include installation of extensions, e.g., ad blockers.

1. Contrast this with the different question of determining whether or not a user is using a certain client, e.g., Chrome, Safari, etc. That is an easier question to answer. However detection of other clients is not done. I am never notified whether or not I am using, e.g., tcpclient, original netcat, socat, openssl, etc. How does one detect the difference. And assuming they could tell, then what. How will ads be served. The HN commenters replying about "uniqueness" fail to consider why there is so much effort to "fingerprint". It is driven by advertising which puts a monetary value on gathering user data. Using a modern browser, sending more data voluntarily to "belnd in", feeds the online advertising industry and ensures such surveillance efforts will only increase. As checkyoursudo suggests, the data collectors will "claim in their sales pitches to advertisers" that they know a great deal about users, regardless of whether the data they have collected is truly accurate or usefully informative. Feeding the data collectors "fake" or "non-unique" data is one idea, but another idea is not sending the data at all. For HTTP requests, the later works for me.

Re: No-JavaScript Fingerprinting

#95

Post by easrng »

easrng wrote: post #93
dfawcus wrote: post #73

Earlier quoted context omitted.

A second try loading each site in new tabs seemed to work, but this time each gave a different ID. One starting 3fa2, the other f918 Reloading each tab then gave two different numbers, 7eb6 and 6f83 Subsequent reloads did not change again. Loading the sites in to two more tabs, gave yet a different pair of numbers (1934 and 1667), reloads of those tabs yeilded another pair (b308 and 3df8)

Oh huh, I'm seeing this too. It worked at some point, not sure why it isn't now. I'll look into it. Edit: it looks like this happens when the sites have gone down and are being restarted on load. I'll move them to my VPS, that should fix it.

Ok, it should work more reliably now.

Re: No-JavaScript Fingerprinting

#96

Post by easrng »

kevincox wrote: post #16
easrng wrote: post #13

Earlier quoted context omitted.

Hmm, what browser? I've tested normal Firefox, Chrome, and Bromite and it works on all of them.

I get different results for each domain on Firefox Android.

Can you try again? I've moved one of the parts off Glitch and onto my VPS which seems to have fixed the issue.

Re: No-JavaScript Fingerprinting

#97

Post by 1vuio0pswjnm7 »

notriddle wrote: post #91
1vuio0pswjnm7 wrote: post #50

Earlier quoted context omitted.

Yes, I understand some HN readers have this thought. I have gotten similar replies before. However, consider that I only send two to three headers: Host, Connection and (optionally) Cookie. There is nothing unique about the text-only browser by virtue of the patches. The TCP connetion and TLS is handled by a proxy. Sometimes I send the TCP requests with netcat, tcpclient, socat, etc. Then I open the HTML file with th…

> But seriously, what is the point of thinking about these things. Who is going to go to such lengths to try to "identify" me. Nobody's going to very much trouble at all. They're just dumping every characteristic they can gather about you into an AI system, like a Bayesian classifier or a Convolution Neural Net. It doesn't require very much work to take into account clearly discrete data like the set of headers you s…

These replies about "uniqueness" are in response to me disclosing I use a text-only browser or some non-graphical client to access websites. Why should "uniqueness" matter to me. As I said, I am just trying to avoid the annoyances of graphical web browsers. I am successful in doing that.

The majority of web use for me is not shopping. Why should I use the same browser for shopping that I use for recreational web use.

As for YouTube, this has been brought up many times. I cannot speak for other users, but I see zero ads when using YouTube. I search and download videos from the command line. With very few exceptions I never need to use youtube-dl because the signature values are already in the web page. There is no need for a "Javascript video player" to submit HTTP requests. The Javascript-enabled behavioural tracking on the YouTube website is insane. I use tiny shell scripts to search and download. I am aware of "SponsorBlock" which suggests some videos have ads embedded in them however I have never seen such a video. Most videos I watch are non-commercial.

"Click-fraud" is IMO secondary to fraud on the part of Big Tech and Big Tech wannabes who induce advertisers to purchase online advertising knowing, but not adequately disclosing, that it suffers from such inherent technical flaws.

Re: No-JavaScript Fingerprinting

#98

Post by [deleted] »

coma_ wrote: post #79
cookiengineer wrote: post #65

Earlier quoted context omitted.

The IPs of TOR exit nodes are publicly known. I'm not sure people using TOR are aware of how the concept and peer discovery mechanism works. I mean, at some point you gotta ask yourself why cloudflare shows all TOR users a captcha in a targeted manner :)

> I mean, at some point you gotta ask yourself why cloudflare shows all TOR users a captcha in a targeted manner :) Because exit node IP address' are known, you have just said it. How does it have anything to do with user fingerprinting? And how does it answer the question of @gtsop asking whether different users of ToR web browser have different distinguishable fingerprint or not?

[deleted]

Re: No-JavaScript Fingerprinting

#99

Post by cookiengineer »

jefftk wrote: post #24
chmod775 wrote: post #15

Earlier quoted context omitted.

ETag based tracking shouldn't work across domains.

Specifically, it won't work across sites -- all major browsers (now) shard the HTTP cache by site. While www.example.com and forums.example.com are different domains, they're the same site ("registrable domain" or "eTLD+1"; example.com in this case). See https://publicsuffix.org/list/public_suffix_list.dat for the list of eTLDs (parents of registrable domains).

Note that CNAME cloaking is also an issue here, because Firefox is the only Browser with a userspace network stack whereas Chrome/Chromium relies on the OS...which means that Chromium or Electron based Browsers cannot protect themselves from CNAME cloaked domains.

Adblockers like uBlock Origin just have a domain list of known CNAME cloaked domains, but that's not based on the DNS entries directly because there's no API for this for web/chrome extensions.

Long story short: Sharding can be tricked with CNAME cloaking.

Re: No-JavaScript Fingerprinting

#100

Post by notriddle »

1vuio0pswjnm7 wrote: post #97
notriddle wrote: post #91

Earlier quoted context omitted.

> But seriously, what is the point of thinking about these things. Who is going to go to such lengths to try to "identify" me. Nobody's going to very much trouble at all. They're just dumping every characteristic they can gather about you into an AI system, like a Bayesian classifier or a Convolution Neural Net. It doesn't require very much work to take into account clearly discrete data like the set of headers you s…

These replies about "uniqueness" are in response to me disclosing I use a text-only browser or some non-graphical client to access websites. Why should "uniqueness" matter to me. As I said, I am just trying to avoid the annoyances of graphical web browsers. I am successful in doing that. The majority of web use for me is not shopping. Why should I use the same browser for shopping that I use for recreational web use.…

> These replies about "uniqueness" are in response to me disclosing I use a text-only browser or some non-graphical client to access websites.

And your disclosure was in response to a CSS-based fingerprinting demo. If being fingerprinted doesn’t even matter to you, and you use a text-only browser just because you prefer the UX, then why bring it up on this article in the first place?

Post reply on HN