Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

181–190 of 524 posts

Re: Web fingerprinting is worse than I thought

#181

Post by throwaway202302 »

throwaway2056 wrote: post #169
throwaway202302 wrote: post #137

Earlier quoted context omitted.

Do these profiles clear their cookies after request? I assume if the service finds a matching cookie, it will prefer it, or at least use as an extra identifier.

Technically one can create this and launch a new profile everytime. It can still detect the device (there are some failures - if I change the screen resolution/dpi). May be after 3 or 4 times, the server may also detect that a certain ip address is trying the same thing. TEMP_DIR=$(mktemp -d /tmp/chromium.XXXXXXX) ; /usr/bin/chromium-browser --user-data-dir=$TEMP_DIR At the end as other say they use hardware informat…

But how could it distinguish different profile directories, if they use the same settings. I would assume profile id, directories, or others should not be exposed through the browser. I am not used to chromium-browser (is this chrome? forgive my incompetence), but I wonder what kind of profile-specific static identifiers despite cookies could leak out the browser?

Maybe these? https://browserleaks.com/webrtc But at least FF in private mode should randomize these IDs on restart.

Re: Web fingerprinting is worse than I thought

#182

Post by aembleton »

KoftaBob wrote: post #133

I was able to "trick" the fingerprint.com test by opening it first with firefox, then with tor browser. Gave two different visitor IDs. So as suspected, it largely relies on IP address.

A different browser with the same IP also gives you a different hash.

Re: Web fingerprinting is worse than I thought

#183

Post by richthegeek »

ale42 wrote: post #172
throwaway2056 wrote: post #37

It is interesting that the site can fingerprint individual profiles/dir easily: For example chromium-browser --user-data-dir=/tmp/profile_A chromium-browser --user-data-dir=/tmp/profile_A --incognito chromium-browser --user-data-dir=/tmp/profile_B chromium-browser --user-data-dir=/tmp/profile_B --incognito For each command + its incognito it can detect them as separate profiles. For ultimate privacy one needs to ever…

Is this _only_ figerprinting then? If the profiles are different, do they manage to extract some UID from the profile (which I would assume is a bug in the browser), or do they store data client-side using persistent storage APIs?

Chrome does give access to localStorage/sessionStorage in Incognito and this can be used to communicate between tabs on the same domain, but just like cookies and cache this data is wiped if you close the Incognito instance.

It's certainly a mystery, because you'd expect any capability fingerprinting (some combo of UA, extensions, CPU/GPU specs, IP etc) to give an identical result between profiles, so it does seem there's some per-profile difference. But I can't think of any browser API that exposes something like an ID...

Re: Web fingerprinting is worse than I thought

#184

Post by throwaway202302 »

ale42 wrote: post #173
throwaway202302 wrote: post #156

Earlier quoted context omitted.

Websites can access machine-id?

I guess they can't unless somebody had a great idea in the speficiation osome web API...

That there are os-level identifiers is I think a different discussion. I wonder why these were cited in context of fingerprint.com discussion.

Re: Web fingerprinting is worse than I thought

#185

Post by izacus »

than3 wrote: post #159
izacus wrote: post #116

Earlier quoted context omitted.

Can you provide any proof that "regulatory doesn't work"? Might be my European outlook, but consumer law has been stupidly effective at curbing abuses from companies here and was much more effective than playing the technology race USA is trying to fight. There's always a next side-step, the next abuse a company can invent - and you keep trying to push the responsibility of avoiding it to users (by adding more and mo…

You don't need proof you just need some sound reasoning about the trends. If it were as effective as you claim, progression in this area would have halted full stop. Ask yourself how long have those consumer laws been in effect. Has this technology problem progressed during that time (increased or decreased). Have the fines against the large tech companies actually been collected and were they sufficient to curb that…

Just so we're clear - the consumer law has mostly not been adjusted to cover data mining yet and you seem to be building your argument on the assumption that it has.

Am I correct?

Re: Web fingerprinting is worse than I thought

#186

Post by GuB-42 »

Technotroll wrote: post #100
zamubafoo wrote: post #63

As the years pass, I keep thinking back and realize that Richard Stallman was right all along: > For personal reasons, I do not browse the web from my computer. (I also have not net connection much of the time.) To look at page I send mail to a demon which runs wget and mails the page back to me. It is very efficient use of my time, but it is slow in real time.

I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built…

I actually did exactly that a while ago. Where I worked, we didn't have internet access but we had email access, so as a workaround, I made an email server on my home machine that fetched web pages for me. A coworker took it even further and made a proxy server that automated the process so you could actually browse the web, although very slowly. Just to say that Stallman is not the only one with this idea.

It was in the early 2000, and smartphones weren't a thing. It also was a time where companies were paranoid into letting employees access the internet, but at the same time had abysmal security. By that I mean viruses ran free on shared folders, undetected because their antivirus software was years outdated. Very different times...

Re: Web fingerprinting is worse than I thought

#188

Post by olabyne »

geysersam wrote: post #39
illiarian wrote: post #29

Earlier quoted context omitted.

It's enough to narrow you down to a specific bucket. E.g. "affluent white young male in his 30s in a specific neighbourhood" and serve you ads and news. Collate with a few other sites (even airline checkouts and boarding pages have tracking), and you have a close enough match. The worst part of this? Trying to hide from fingerprinting makes your fingerprint more unique

> Trying to hide from fingerprinting makes your fingerprint more unique Didn't seem so in the experiment in the article. Sure they'll be able to place you in the bucket "tor user", but is that really more narrow than what you'd get without Tor?

Using Tor might stop them to track you in a unique way, but they can for sure put you in the basket of the 0.1% of Tor users

Re: Web fingerprinting is worse than I thought

#189

Post by kuschku »

comboy wrote: post #170
hilbert42 wrote: post #69

Ha! I followed the instructions and went to fingerprint.com and it all 'crashed' because I had JavaScript turned off—that's my normal default setting. I have five different browsers on my smartphone and three on the PC all sans JS and none of them are Chrome. Also, normal operation is to automatically delete all cookies at session's end. My smartphone and PCs are de-googleized and firewalled and I never see ads in my…

The more you customize the more unique your session becomes.

Not if you disable JS, cause the website then can't see any of these customizations.

Re: Web fingerprinting is worse than I thought

#190

Post by than3 »

momentoftop wrote: post #42
suprjami wrote: post #28

Earlier quoted context omitted.

The likelihood that you have the same hash as other people is exceedingly small. So if I fingerprint you on a site which is using my commercial fingerprint service, then I can sell your hash to other places and tell them all about your browsing habits. The more places run my fingerprinting service, the more data I can collect on you.

I understand the principle. I'm saying that the test on this page isn't demonstrating uniqueness, and so isn't demonstrating fingerprinting. The first time I heard about fingerprinting was with EFF's panoptoclick, which stated how many hashes had been generated from visitors, and how many you shared with them.

I agree with you about uniqueness, but being unique doesn't matter with respect to their claims.

Any educated person with sufficient math knows the mathematical structure of a hash will never be unique. Its a Galois field, or 'finite field' after all.

The core of this issue is the flawed but convincing belief promoted by an entire industry that if the probability is sufficiently low, its unique, and following these axioms if its unique its an individual person (eyeball).

Under that assumption, all you need to do is collect fields of information that are variable, and group them together such that it yields to a sufficiently low threshold, I think currently that threshold is about 1 per million. Its a very clever way to defraud advertisers if you think about it. You create an exaggerated market, and charge for each advertisement view.

In my opinion its just flawed thinking but there are some real fanatics out there that subscribe to this dogmatically.

For example applied probability is used as part of the protocol design when accounting for binary erasure channels in things like cell phones. You shouldn't be able to have communications blocked in only one direction, or altered without it being noticeable, but stingrays may have the ability to do this according to the limited documentation that has been released so far.

Probabilities in general have real problems fundamentally with validity. I think the most common approach today is the Axiomatic approach, or the Frequentist Approach, both have significant limitations and often devolve when self reference is indirectly introduced.

So I guess I'll ask, are you a believer?

Post reply on HN