Why do these systems use hash-based fingerprinting? Wouldn't it be "better" to have a "browserspace vector", or "browser embedding"? So that if one fingerprint tactic fails in incognito, you don't completely lose the fingerprint, you just get a slightly different vector?
Web fingerprinting is worse than I thought
131–140 of 524 posts
Re: Web fingerprinting is worse than I thought
#132Earlier quoted context omitted.
I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built…
I'm pretty sure wget has plenty more users in addition to Stallman
I'm sure too! But there are some very important differences with Stallman's use and "my" use. Personally I use WGET all the time to get specific stuff, mainly downloads of binaries say for some UX system I'm setting up. I'm fairly certain that this is the most common use of WGET, so all that can easily be filtered out. This leaves Stallman's use case, and a few other secretive users, whom I'm sure can also be divided into separate categories, that can then be used to further identify each user's uniqueness. I'm not saying that it's easy, but I'm saying that he's got a higher chance of getting "caught" simply by revealing his rather unique use case.
Re: Web fingerprinting is worse than I thought
#133I was able to "trick" the fingerprint.com test by opening it first with firefox, then with tor browser. Gave two different visitor IDs. So as suspected, it largely relies on IP address.
Re: Web fingerprinting is worse than I thought
#134Earlier quoted context omitted.
... on a new computer, each time ordered from a different brand and reseller, paid with a unique type of cryptocurrency and delivered each time to a new dead drop in a different country.
How does the fingerprinting know the payment method you used to pay for the computer, is that stored somewhere in the operating system? How would they know it was a dead drop also? Genuinely curious.
It was a joke lmao
Re: Web fingerprinting is worse than I thought
#135Earlier quoted context omitted.
The short answer which should be obvious... regulatory doesn't work, legal doesn't currently work. The burden of proof is on the claimant, and with proper information control you can't ever meet that burden of proof. It becomes an ant versus a gorilla instead of David vs. Goliath. Tell me, how do you differentiate a simple random alpha-numeric string from another random string that may have been generated as a finger…
Can you provide any proof that "regulatory doesn't work"? Might be my European outlook, but consumer law has been stupidly effective at curbing abuses from companies here and was much more effective than playing the technology race USA is trying to fight. There's always a next side-step, the next abuse a company can invent - and you keep trying to push the responsibility of avoiding it to users (by adding more and mo…
I think it absolutely does work.
We need better regulation to temper capitalism.
Re: Web fingerprinting is worse than I thought
#136Earlier quoted context omitted.
The article describes "Fingerprinting as a Service. Some choice quotes: It doesn’t matter if you are using a VPN or Private Browsing mode, they can accurately identify you. Also note that VPNs does not help with fingerprinting. They only masks IP address.
right. but using a VPN plus a fresh VM running Ubuntu can mostly do the trick. In a pinch, just keep a few different versions of various browsers around when you plan to surf a site that you don't want associated with you. Or change your screen resolution or turn off your fonts. My point was that fingerprinting is much more practical and useful as a positive form of identity verification than it is as a tracking devi…
"Oh look it's that one dude with that weird Ubuntu device coming from an AWS IP again."
Re: Web fingerprinting is worse than I thought
#137It is interesting that the site can fingerprint individual profiles/dir easily: For example chromium-browser --user-data-dir=/tmp/profile_A chromium-browser --user-data-dir=/tmp/profile_A --incognito chromium-browser --user-data-dir=/tmp/profile_B chromium-browser --user-data-dir=/tmp/profile_B --incognito For each command + its incognito it can detect them as separate profiles. For ultimate privacy one needs to ever…
Do these profiles clear their cookies after request? I assume if the service finds a matching cookie, it will prefer it, or at least use as an extra identifier.
Re: Web fingerprinting is worse than I thought
#138Earlier quoted context omitted.
I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built…
I'm pretty sure wget has plenty more users in addition to Stallman
Not to mention it's programmatic use by tools and applications.
Re: Web fingerprinting is worse than I thought
#139Earlier quoted context omitted.
The real snag comes from putting text into a canvas. Nobody can agree on what fonts they have installed, and of course there are all kinds of subtle variations from one version of the “same” font to the next, and then everyone has different ideas about hinting, kerning, stem widths, etc, etc, etc. You can fingerprint basically everyone just from that information alone.
Sure fonts and text is hard. But none of that is needed for basic surfing of the web.
Either there is a complete and total consensus on every aspect of rendering or there are differences in how is rendered.
Re: Web fingerprinting is worse than I thought
#140Look, forget about threat models. It's relatively trivial these days to avoid fingerprinting attacks if you want to (as a private, web browsing individual). I use fingerprinting actively in enterprise apps as a form of silent 3FA. It's a useful backstop. If I have a user who forgot their password but retrieves it via email, I'll usually let them pass if their fingerprint matches one of their priors; otherwise my soft…
(1) Users should not receive passwords via e-mail. (2) How very enterprisey of you to even be able to send passwords, which one also should not be able to do. (3) Users can change or modify their browser, either to another browser entirely or through installation of addons. The fingerprint is not guaranteed at all to stay the same or similar.
This is an uncharitable reading of the comment. "Retrieve via email" can just as well be understood as reset using an email flow, as is common on most websites. And the comment does not claim they rely on fingerprints never changing, they say that if you do have a matching fingerprint, you can use that instead of another procedure.