21–30 of 42 posts
If you're curious what kinds of information your browser gives to a remote server, creating a "test.php" file with the contents "", and opening that page in a browser is a good start. There are some other ingenious (read: I didn't think them up) methods, but I don't want to help the spammers n' spies.
These days, I use them in forensics.
The question we should all be asking is: why on Earth do browsers transmit all of this information to web servers in the first place? A few details, window size for example, might have a legitimate purpose and could at least be requested by the web server and provided optionally. However, this sort of fingerprinting technique is pretty obvious to anyone who's ever stuck an analyser on their system and looked at what…
In my experience, there's enough basic information in the HTTP transaction to identify a unique visitor for most forensic purposes. However, the level of detail available for fingerprinting goes far beyond this. I just performed a little experiment, disabling as much as I could in Firefox to affect my uniqueness at http://panopticlick.eff.org/ . I was surprised when disabling plugins (font info comes from java & flas…
Well that's just blatantly false.
I wonder if the same uproar will happen this time around?
I foresee a future where the Adblock crowd runs a plugin that randomizes the data returned by browsers. It wouldn't take many variations in user agent strings, reported browser plugins, and system fonts to give you a quasi-anonymous footprint each time you visit a website.
The question we should all be asking is: why on Earth do browsers transmit all of this information to web servers in the first place? A few details, window size for example, might have a legitimate purpose and could at least be requested by the web server and provided optionally. However, this sort of fingerprinting technique is pretty obvious to anyone who's ever stuck an analyser on their system and looked at what…
In my experience, there's enough basic information in the HTTP transaction to identify a unique visitor for most forensic purposes. However, the level of detail available for fingerprinting goes far beyond this. I just performed a little experiment, disabling as much as I could in Firefox to affect my uniqueness at http://panopticlick.eff.org/ . I was surprised when disabling plugins (font info comes from java & flas…
The question we should all be asking is: why on Earth do browsers transmit all of this information to web servers in the first place? A few details, window size for example, might have a legitimate purpose and could at least be requested by the web server and provided optionally. However, this sort of fingerprinting technique is pretty obvious to anyone who's ever stuck an analyser on their system and looked at what…
Things like http_accept, plugin details and fonts are necessary if you want to use the capabilities of the client - you need to know what they have. The time zone, screen size and (to a certain extent) user-agent let you customise the content you serve in an appropriate way.
Providing it "optionally" doesn't seem like a solution. If you were prompted every time then most people would turn it on anyway, and any ad network site would obviously ask for everything that it could possible get.
We have dozens of desktops running identically imaged copies of Windows/browser/plugins and all behind a single NATed IP. I imagine that they'd all look the same to one of these systems.
If they start serving up adverts then perhaps I'll start seeing ads targeted at something one of my co-workers has been searching for. That could get interesting!
The question we should all be asking is: why on Earth do browsers transmit all of this information to web servers in the first place? A few details, window size for example, might have a legitimate purpose and could at least be requested by the web server and provided optionally. However, this sort of fingerprinting technique is pretty obvious to anyone who's ever stuck an analyser on their system and looked at what…
The web server asking the browser "do you support X?" increases latency and doesn't help anonymity. Bad web servers could just ask, "Do you support X, Y, Z, and what's your screen size..." If each of these questions prompts the user, it's a usability nightmare. If the browser's answers are configurable, why not make current browser information configurable instead of inventing a new standard?
They could use TCP time stamps to estimate the clock skew of devices, as they access web services. See "Remote physical device fingerprinting - Tadayoshi Kohno, Andre Broido, kc claffy"
Doesn't nmap have a whole bunch of such fingerprints stored in a database?
e.g.
nmap -sV 127.0.0.1
Starting Nmap 5.00 ( http://nmap.org ) at 2010-12-01 18:28 GMT
Interesting ports on localhost (127.0.0.1):
Not shown: 997 closed ports
PORT STATE SERVICE VERSION
631/tcp open ipp CUPS 1.4
2000/tcp open callbook?
24800/tcp open kvm Synergy KVM