Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Underpants Project

lab.cubiq.org

Post reply on HN
Print view View original

81–87 of 87 posts

Re: The Underpants Project

#81

Post by ernesth »

justincormack wrote: post #78
noonespecial wrote: post #4

Simply resizing my browser window before pasting the second url seems to thwart this (But I don't have flash installed). Without flash, it falls firmly into the "kinda-works sometimes if everything goes perfect" camp. So its another demonstration of flash being ridiculously insecure. These guys did it better, even defeating tor to reveal the origin IP. http://dl.packetstormsecurity.net/0610-advisories/Practical_...

Works on the ipad though. No flash, and cant resize window. Must be working off timezone? Surely some more ipads in the UK?

iPads may be rotated. Rotating my smartphone made it unrecognized.

Re: The Underpants Project

#82

Post by [deleted] »

spiffytech wrote: post #73
TomGullen wrote: post #71

Earlier quoted context omitted.

Surely an IP comparison achieves everything this does, and is probably more than 90% reliable?

Just IP comparison only works if the user's IP is constant, which rules out many phones, tablets, and laptops that frequent coffee shops and restaurant wifi. It also doesn't allow you to tell when IP $a and IP $b are really the same person at home and work. Further, IP comparison doesn't let you distinguish between multiple users coming from the same home or office network, or from a proxy. Commercial implementations…

[deleted]

Re: The Underpants Project

#83

Post by jsanford »

xymostech wrote: post #68
rapidsnail wrote: post #9

I can see that even in chrome "incognito mode"

I would like to remind you that when you open incognito, it specifically says: "Going incognito doesn't affect the behavior of other people, servers, or software. Be wary of: - Websites that collect or share information about you" Incognito only prevents information from being stored on your computer, not anyone else's.

But more interesting is that the fingerprint in the normal window and the incognito window ends up being the same.

- Enter word in normal browser window - In an incognito window, go to the URL and retrieve your word.

Re: The Underpants Project

#84

Post by mrgreenfur »

In 2008 I worked at a major credit card company and they were building the exact same thing, only with more like 75 attributes. Of course it was all through a 3rd party so they wouldn't have any PII, but it was their design. They'd to this to build super-cookies and then track prospects across multiple products. It was awful.

Re: The Underpants Project

#85

Post by finalcut »

I must have a plugin or something that breaks this.

When I went I saved the word "what" against the fingerprint of 0e24f67890fb99dfd6fa147adc5634224e6cf509

Then, I opened a new tab, copied and pasted the url to ghosttouch and was given this fingerprint: 0373164e6053f6d4d1e0cea156be83e5a45e13d4

So, out of curiosity I copied and pasted the url in the same tab where I had "saved" my word:

0373164e6053f6d4d1e0cea156be83e5a45e13d4

It generated the same code.

So then I went back and re-saved my word, went to the ghosttouch site again and this time it loaded my word.

Something wonky in there but I'm not sure what.

Re: The Underpants Project

#86

Post by gbonanome »

masklinn wrote: post #21
robterrell wrote: post #14

You can view source to see what they're using to generate the fingerprint: screenSize, devicePixelRatio, timezone, mimeTypes, plugins, httpAcceptHeaders, fonts. It's interesting that these are enough to generate a moderately unique fingerprint. I'm sure my fonts list is unique, so that's probably enough to ID me right there. However, not every computer I use has the same fonts installed, nor the same screen dimension…

> This won't track me as I go from my desktop to mobile device. May not even track from one browser to the next. Camino and Safari generates different fingerprints on my machine.

Also for me, Firefox and Chrome, different fingerprints.
Post reply on HN