Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Underpants Project

lab.cubiq.org

Post reply on HN
Print view View original

41–50 of 87 posts

Re: The Underpants Project

#41

Post by Wilya »

brudgers wrote: post #12
franciscoapinto wrote: post #6

Earlier quoted context omitted.

https://panopticlick.eff.org/ You'd be surprised.

Not really. Currently, we estimate that your browser has a fingerprint that conveys 11.9 bits of identifying information.

That's a very low value. With JS off or blocked, my browsers convey between 16 and 21 bits (the latter meaning unicity in their dataset).

The amount of information conveyed by the HTTP_ACCEPT headers is especially preoccupying. There is nothing in there, apart from maybe the language, that should leak any info, on a modern browser. And certainly not 10 or 16 bits of info.

Re: The Underpants Project

#43

Post by shawabawa »

shpoonj wrote: post #35
Swizec wrote: post #5

I think it doesn't work. After typing "meow" and hitting enter. The copy paster url had this to say about me "It seems you didn't save the word. Go to lab.cubiq.org/underpants first." The unique fingerprint is also different. "93615388f7f54cd79d2f806ac3795c182217aa9b" somehow became "f37ec3fdd05c27c13cbb7fcdef95cc004297f62d" after copy-pasting. Other than that technical glitch for me (Linux, Chrome latest unstable ve…

I entered meow too. It also forget my word and fingerprint.

The first word I enter didn't work, my fingerprint changed, but the second time it did work.

Re: The Underpants Project

#45

Post by peterwwillis »

robterrell wrote: post #14

You can view source to see what they're using to generate the fingerprint: screenSize, devicePixelRatio, timezone, mimeTypes, plugins, httpAcceptHeaders, fonts. It's interesting that these are enough to generate a moderately unique fingerprint. I'm sure my fonts list is unique, so that's probably enough to ID me right there. However, not every computer I use has the same fonts installed, nor the same screen dimension…

Professional authentication managers such as RSA Adaptive Authentication can gather 40 or 50 data points from which to tell if a user is somewhat the same or not. They apply a ratio to the value generated by which a user can be redirected to a challenge question. It's not foolproof but it prevents a lot of automated phishing or botnet scams from being able to automatically log in with your credentials.

Re: The Underpants Project

#46

Post by delinka »

Keverw wrote: post #7
noonespecial wrote: post #4

Simply resizing my browser window before pasting the second url seems to thwart this (But I don't have flash installed). Without flash, it falls firmly into the "kinda-works sometimes if everything goes perfect" camp. So its another demonstration of flash being ridiculously insecure. These guys did it better, even defeating tor to reveal the origin IP. http://dl.packetstormsecurity.net/0610-advisories/Practical_...

Resizing my browser didn't go it but moving it to another screen it changed from "1ccf9e9301db4fb87b1d178d77edad5bfa598057" to "ab0e6beb449408b28473dd66a6f4501528087c0e". I don't think this method is prefect at all or should be used for anything reliable(like logins).

Reliability is not necessary. "Good enough" to sell ads- that's all they need.

Re: The Underpants Project

#48

Post by 1880 »

pwenzel wrote: post #34
noonespecial wrote: post #4

Simply resizing my browser window before pasting the second url seems to thwart this (But I don't have flash installed). Without flash, it falls firmly into the "kinda-works sometimes if everything goes perfect" camp. So its another demonstration of flash being ridiculously insecure. These guys did it better, even defeating tor to reveal the origin IP. http://dl.packetstormsecurity.net/0610-advisories/Practical_...

Interesting, I had Chrome Flash Block enabled but it did not seem to thwart this.

Enabling click-to-play in Chrome (and not one of those extensions that hide or remove from the DOM the element once it's loaded) just makes the fingerprint to have less bits, since it can't get the list of the installed fonts on your computer.

Re: The Underpants Project

#49

Post by eldude »

You could accomplish the same thing using local storage in an iframe with postmessage and it'd be a lot more robust with fairly significant browser support. (IE8+)

I built a demo a year ago that let you store personal data and exposed a postmessage API for storing and sharing permissions and personal data with sites as kind of the beginnings of a poor man's client-side only Oauth.

Post reply on HN