Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Panopticlick – How Unique, and Trackable, Is Your Browser?

panopticlick.eff.org

Post reply on HN
Print view View original

11–20 of 61 posts

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#11

Post by gorhill »

WiseWeasel wrote: post #8
ds9 wrote: post #7

I'd like to have more control over the Javascript runtime in the browser. Defeating this identification trick is only one of the reasons. Suppose you had a list of options and could selectively disable, for example, monitoring of mouse movements on one site, or ajax on another. And for this in particular, something that would feed the site random values from a particular range for fonts installed, plugins installed,…

They didn't use any JavaScript to get this information. Most of it is sent by your browser in the request headers, and the font detection used Flash and Java. They could have used JavaScript to detect fonts as a fall-back when Java and Flash are disabled, but it's relatively complicated to do so (requiring you to know the rendered width of a string for each font you're trying to detect), and it was not included in th…

> "They didn't use any JavaScript to get this information"

Then what are the five "no javascript" messages I see?

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#12

Post by gorhill »

greenwalls wrote: post #10

Does anyone know any good Firefox/Chrome plugins that help make your browser less unique?

Well I am using my own extension, with which you can block selectively cookies/javascript (among other stuff) and...

With cookies/js/plugins enabled I get: 1 in 3,719,197.

With cookies/js/plugins disabled I get: 1 in less than 160,100

Extension: https://github.com/gorhill/httpswitchboard

EDIT: redid the tests with clearing cache before.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#13

Post by JoeAcchino »

WiseWeasel wrote: post #8
ds9 wrote: post #7

I'd like to have more control over the Javascript runtime in the browser. Defeating this identification trick is only one of the reasons. Suppose you had a list of options and could selectively disable, for example, monitoring of mouse movements on one site, or ajax on another. And for this in particular, something that would feed the site random values from a particular range for fonts installed, plugins installed,…

They didn't use any JavaScript to get this information. Most of it is sent by your browser in the request headers, and the font detection used Flash and Java. They could have used JavaScript to detect fonts as a fall-back when Java and Flash are disabled, but it's relatively complicated to do so (requiring you to know the rendered width of a string for each font you're trying to detect), and it was not included in th…

"They didn't use any JavaScript to get this information."

The list of installed plugins is retrieved via JS: window.navigator.plugins.

Not sure about fonts, though.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#14

Post by adrianmsmith »

The concept of a browser fingerprint being "unique" implies "worrying" in the sense that a user could then be tracked by their browser fingerprint.

But simply installing a font, changing screen resolutions, upgrading Java or Flash ("Browser Plugin details") or entering/leaving daylight savings time will result in the fingerprint changing.

So the browser fingerprint, as presented, isn't really a great way for websites to track users.

(And removing the aspects of the fingerprint subject to change, such as resolution and Browser Plugins etc., would then result in the fingerprint being less unique.)

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#16

Post by JoeAcchino »

I don't know how useful is this to track unique visitors, the next month I will probably have a different fingerprint.

All it takes is a new release of Firefox (different version in the User-Agent string) a new font or any plugin update.

So with that fingerprint you can possibly identify me now, but you cannot track me over time.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#18

Post by WiseWeasel »

JoeAcchino wrote: post #13
WiseWeasel wrote: post #8

Earlier quoted context omitted.

They didn't use any JavaScript to get this information. Most of it is sent by your browser in the request headers, and the font detection used Flash and Java. They could have used JavaScript to detect fonts as a fall-back when Java and Flash are disabled, but it's relatively complicated to do so (requiring you to know the rendered width of a string for each font you're trying to detect), and it was not included in th…

"They didn't use any JavaScript to get this information." The list of installed plugins is retrieved via JS: window.navigator.plugins. Not sure about fonts, though.

Ah, good catch. I guess the JS navigator.plugins list is quite a bit more thorough than the plugin information sent in your request headers (which I believe is limited to Java: yes/no).

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#19

Post by SamReidHughes »

adrianmsmith wrote: post #14

The concept of a browser fingerprint being "unique" implies "worrying" in the sense that a user could then be tracked by their browser fingerprint. But simply installing a font, changing screen resolutions, upgrading Java or Flash ("Browser Plugin details") or entering/leaving daylight savings time will result in the fingerprint changing. So the browser fingerprint, as presented, isn't really a great way for websites…

Installing a font, changing screen resolutions, or upgrading plugins doesn't suddenly make you unconnectable to the previous fingerprint.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#20

Post by bluesign »

engtech wrote: post #2

Forgive me if I'm wrong, but it looks like if you could install a system font on a computer then you could create a unique fingerprint for that computer that is detectable by any website? I am uniquely identifiable out of the 3.7 million samples because of my system fonts.

Also the funny thing is you cannot be tracked by this, because whenever you install a new font, update a plugin, install a plugin etc, you change your unique data.
Post reply on HN