Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Panopticlick – How Unique, and Trackable, Is Your Browser?

panopticlick.eff.org

Post reply on HN
Print view View original

51–60 of 61 posts

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#51

Post by meowface »

chimeracoder wrote: post #49
meowface wrote: post #45

Earlier quoted context omitted.

Is your NoScript activated on the eff domain? If it isn't, that statistic is highly possible.

It's the Tor browser, so I haven't installed any extensions on it (the whole point of the Tor browser, as I understand it, is to present the same fingerprint to all browsers).

That is not the point of the Tor browser, though it is at times a goal.

That goal is absolutely impossible if you don't use NoScript, though. Tor browser includes NoScript by default, as well as many other extensions, but NoScript is initially set in "globally allow" mode which means it won't block any JS or Flash.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#53

Post by mikeash »

ams6110 wrote: post #33

Browser plugin that randomizes the user agent and other details with each request?

Perhaps the opposite would be better: pick a reasonable user-agent string and always return that for all users, always return the same (fake) monitor resolution, the same list of fonts, the same list of plugins, etc.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#55

Post by garrettgrimsley »

chimeracoder wrote: post #42

Interestingly, I just tired this using Vidalia (the Tor browser). > Your browser fingerprint appears to be unique among the 3,726,837 tested so far. I may be using an outdated version of Tor. Did they reset their data at some point? I can't believe I'm the first person to have tried the test using the Tor browser in my time zone.

Vidalia is control software for Tor.[1] The Tor Browser Bundle, what you likely used, ships with a slightly customized version of Firefox.

I would also recommend upgrading, as the bundle no longer ships with Vidalia.[2]

1. https://www.torproject.org/projects/vidalia.html.en2

2. https://blog.torproject.org/blog/tor-browser-bundle-35-relea...

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#56

Post by andymcsherry »

nivla wrote: post #30
bluesign wrote: post #20

Earlier quoted context omitted.

Also the funny thing is you cannot be tracked by this, because whenever you install a new font, update a plugin, install a plugin etc, you change your unique data.

Given that now ISPs give you an IP address that doesn't change for months, isn't it much easier to track someone via IP+OS+ScreenSize?

At my office, everyone uses the same model laptop. Thus, everyone has the same ip, os and screen size.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#57

Post by userbinator »

ds9 wrote: post #7

I'd like to have more control over the Javascript runtime in the browser. Defeating this identification trick is only one of the reasons. Suppose you had a list of options and could selectively disable, for example, monitoring of mouse movements on one site, or ajax on another. And for this in particular, something that would feed the site random values from a particular range for fonts installed, plugins installed,…

I'd like to have more control over my browser in general, and I think many here also share the same thought. The issue is that browser vendors seem to make it harder and harder to customise these sorts of things by removing configuration options etc. And requiring to install an extension/plugin to get this ability just makes it harder for the average user to become aware of and take control of this.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#58

Post by [deleted] »

hipsters_unite wrote: post #36
WiseWeasel wrote: post #8

Earlier quoted context omitted.

They didn't use any JavaScript to get this information. Most of it is sent by your browser in the request headers, and the font detection used Flash and Java. They could have used JavaScript to detect fonts as a fall-back when Java and Flash are disabled, but it's relatively complicated to do so (requiring you to know the rendered width of a string for each font you're trying to detect), and it was not included in th…

I have Java/Flash disabled by default and yet it was still able to populate a fonts list for me. Forgive my ignorance, but surely that's not possible?

[deleted]

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#60

Post by jamesaguilar »

skwirl wrote: post #28
bluesign wrote: post #20

Earlier quoted context omitted.

Also the funny thing is you cannot be tracked by this, because whenever you install a new font, update a plugin, install a plugin etc, you change your unique data.

I'm not sure how your conclusion follows from your premise. You are still trackable until you install a new font, update a plugin, install a plugin, etc. This may not happen for some time. Even when you do make a change, you could still easily be tracked in many cases. If I see a new signature that I have never seen before that differs from an existing signature only by the version of a plugin, I can probably safely…

> Even when you do make a change . . .

On top of that, if you use a resource that had only previously been used by your previous fingerprint, your identity can probably be smeared that way too. This is only measuring client-side entropy, but there is also server-side entropy that can be used to make inferences about clients.

Post reply on HN