Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla research: Browsing histories are unique enough to identify users

zdnet.com

Post reply on HN
Print view View original

21–30 of 131 posts

Re: Mozilla research: Browsing histories are unique enough to identify users

#21

Post by cma »

WilTimSon wrote: post #11
slipheen wrote: post #4

Earlier quoted context omitted.

Consider for example, that many pages use remotely loaded resources. I would think things like Facebook/Twitter like buttons or Google Fonts might make it to assemble this history. Sites like FB are said to maintain "Shadow Profiles" of people, even when those people aren't using their service directly. I suppose in theory any sufficiently shared infrastructures such as AWS/Cloudflare could do so as well, but they ar…

Would using Firefox's 'Containers' help prevent this? As far as I understand they quarantine the Facebook pages so they can't get data from other websites you visit.

DNS resolve measurement to see if it is cached by the OS can potentially breach that.

Re: Mozilla research: Browsing histories are unique enough to identify users

#22

Post by laurent123456 »

MattGaiser wrote: post #19
LatteLazy wrote: post #14

Here in the UK, date of birth and post code is enough to identify something like 95% of people. Anonymised data sets are not really possible once you have more than a few varriables. Most people don't know this.

Isn’t a postal code about 50-100 houses? It really narrows things down. That particular variable really reduces things.

On average it's about 15 houses, so postcode + date of birth is indeed around 95% accurate.

Re: Mozilla research: Browsing histories are unique enough to identify users

#23

Post by White_Wolf »

MattGaiser wrote: post #19
LatteLazy wrote: post #14

Here in the UK, date of birth and post code is enough to identify something like 95% of people. Anonymised data sets are not really possible once you have more than a few varriables. Most people don't know this.

Isn’t a postal code about 50-100 houses? It really narrows things down. That particular variable really reduces things.

50-100 houses is not that much. You can find someone in those 100 houses with 1 DOB and post code. Maybe in very crowded areas you'll need one more var. Worst case scenario you'll end up with 2-3 people.

Re: Mozilla research: Browsing histories are unique enough to identify users

#24

Post by Groxx »

I feel inclined to say "... well yeah, obviously".

Not in the "obvious in retrospect" way, but because browsers have been progressively blocking history-sniffing tactics for years precisely because advertisers were using it to identify visitors.

Did this research... establish better numbers around it or something?

Re: Mozilla research: Browsing histories are unique enough to identify users

#25

Post by liability »

wizzwizz4 wrote: post #15
contravariant wrote: post #8

Earlier quoted context omitted.

Needing javascript that embeds in every page for basic mouse and keyboard behaviour is insane. No clue why they decided it should be the only viable option.

It isn't intended to be. But supporting the old APIs meant that they had to have Microsoft levels of backwards-compatibility. • You want to refactor XUL so it doesn't duplicate features of HTML5? Whoops; you broke all the extensions. • You want multi-threading? What a shame; that API over there assumes it'll always be called from the main thread. • Update that database table's schema to store more data? Bah. Make ano…

Fine, XUL had to go. But where is the replacement? How many more years should we expect Mozilla to need to implement configurable bindings? It doesn't even need to be extension-accessible, just give users a tab in the preferences menu like damn near any other application has been doing since the dawn of GUIs.

Do they even have one engineer working on this?

Re: Mozilla research: Browsing histories are unique enough to identify users

#26

Post by laumars »

cma wrote: post #21
WilTimSon wrote: post #11

Earlier quoted context omitted.

Would using Firefox's 'Containers' help prevent this? As far as I understand they quarantine the Facebook pages so they can't get data from other websites you visit.

DNS resolve measurement to see if it is cached by the OS can potentially breach that.

Can JavaScript measure DNS resolve time?

Re: Mozilla research: Browsing histories are unique enough to identify users

#27

Post by gkoberger »

the_jeremy wrote: post #3

Who is able to get access to my browser history? I thought it was just my ISP/VPN, which can obviously track me better in other ways.

Hmm this is a bit of an interesting question. The original study (2012) exploited a security bug, which let anyone see which sites you had visited. (Basically, by checking the color of links with JS to see if :visited styling had been applied.) That bug doesn't exist anymore, and the new survey just uses opt-in data to "confirm" it.

So, I don't actually think this research is particularly relevant anymore? It can't really be exploited (and when it can, there's much better ways to track the person).

Re: Mozilla research: Browsing histories are unique enough to identify users

#28

Post by wizzwizz4 »

liability wrote: post #25
wizzwizz4 wrote: post #15

Earlier quoted context omitted.

It isn't intended to be. But supporting the old APIs meant that they had to have Microsoft levels of backwards-compatibility. • You want to refactor XUL so it doesn't duplicate features of HTML5? Whoops; you broke all the extensions. • You want multi-threading? What a shame; that API over there assumes it'll always be called from the main thread. • Update that database table's schema to store more data? Bah. Make ano…

Fine, XUL had to go. But where is the replacement? How many more years should we expect Mozilla to need to implement configurable bindings? It doesn't even need to be extension-accessible, just give users a tab in the preferences menu like damn near any other application has been doing since the dawn of GUIs. Do they even have one engineer working on this?

Considering they fired half the people working on this, probably not.

Re: Mozilla research: Browsing histories are unique enough to identify users

#29

Post by dh5 »

jraph wrote: post #10
stefan_ wrote: post #7

Earlier quoted context omitted.

Malicious extensions are a likely culprit. This is the ultimate irony of the whole WebExtensions debacle; browser vendors wanted to stop the extensions from interacting with the browser because maintaining that interface is work, so now the most trivial extensions will request full access to all websites so they can inject scripts. To bring back "backspace navigates back" I have an extension that needs just that.

I am very much used to alt+left arrow to navigate back, in the unlikely case you were not aware of this shortcut and if you would like to drop this extension for whatever reason.

The point of the "backspace navigates back" extension is that alt+left is not how people were used to going back on websites.

Re: Mozilla research: Browsing histories are unique enough to identify users

#30

Post by godelski »

Groxx wrote: post #24

I feel inclined to say "... well yeah, obviously". Not in the "obvious in retrospect" way, but because browsers have been progressively blocking history-sniffing tactics for years precisely because advertisers were using it to identify visitors. Did this research... establish better numbers around it or something?

> Did this research... establish better numbers around it or something?

>> However, this time around, since the data was collected from Firefox itself and not through a web page performing a time-lengthy CSS test, the data was much more accurate and reliable. Furthermore, the data Mozilla researchers collected is also about the same type of data that today's online analytics companies also collect about users — either through data partnerships, mobile apps, online ads, or other mechanisms.

Post reply on HN