Live data from Hacker News

Panopticlick – How Unique, and Trackable, Is Your Browser?

panopticlick.eff.org

21–30 of 61 posts

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#21

I don't know how useful is this to track unique visitors, the next month I will probably have a different fingerprint. All it takes is a new release of Firefox (different version in the User-Agent string) a new font or any plugin update. So with that fingerprint you can possibly identify me now, but you cannot track me over time.

Yes you can. A user agent string, plugin string, or individual font update is only part of the fingerprint.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#22
I'm somewhat surprised to see that Chrome on my Nexus 10 shows up as unique, based primarily on user agent and screen size/color depth. Both seem to be surprisingly less common than I'd expect inasmuch as they would seem to be identical across all such devices.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#23

I don't know how useful is this to track unique visitors, the next month I will probably have a different fingerprint. All it takes is a new release of Firefox (different version in the User-Agent string) a new font or any plugin update. So with that fingerprint you can possibly identify me now, but you cannot track me over time.

This just shows that even when shielding successfully against all other known mean of tracking [1], ultimately fingerprinting still can accomplish something re. tracking. Of course if a user doesn't care about other means of tracking, it's rather useless to worry about EFF's demonstration of fingerprinting.

[1] For example, see "evercookie": http://samy.pl/evercookie/

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#24

The concept of a browser fingerprint being "unique" implies "worrying" in the sense that a user could then be tracked by their browser fingerprint. But simply installing a font, changing screen resolutions, upgrading Java or Flash ("Browser Plugin details") or entering/leaving daylight savings time will result in the fingerprint changing. So the browser fingerprint, as presented, isn't really a great way for websites…

This only becomes troublesome if you have a website into which you login. Any time your fingerprint changes, it can be updated provided you login to a controlled website before changing it again. This allows a fingerprint to be associated with an account or person. So facebook, gmail and this website could track the websites you visit given the fingerprint data as long as it is relatively unique.

Let's now imagine an entity that scrapes most of the internet traffic and has connections within facebook, google, etc. This company could easily figure out what pages you visit using a combination of browser fingerprint from the request header and IP. This can be tied to a person using accounts. They can even identify who within a household with the same IP visits which website.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#25

The concept of a browser fingerprint being "unique" implies "worrying" in the sense that a user could then be tracked by their browser fingerprint. But simply installing a font, changing screen resolutions, upgrading Java or Flash ("Browser Plugin details") or entering/leaving daylight savings time will result in the fingerprint changing. So the browser fingerprint, as presented, isn't really a great way for websites…

How often do people on TFT displays change their screen resolution? I don't have either Java or Flash installed and I'm still unique.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#26

I don't know how useful is this to track unique visitors, the next month I will probably have a different fingerprint. All it takes is a new release of Firefox (different version in the User-Agent string) a new font or any plugin update. So with that fingerprint you can possibly identify me now, but you cannot track me over time.

You can account for those factors by parsing only certain bits of the User Agent string, and allowing for the addition of fonts to the list (most typically don't uninstall fonts). With the plugins, you can ignore the version number and just go by the names. There are bits like browser name, OS name, screen resolution and the presence of all previously detected fonts and plugin names that you can be pretty sure won't change for most users. As long as you can uniquely match by certain factors, it'll be enough to link you to your previous session.

For a purpose like ad tracking, the period of time you need to track people is likely pretty short, as in from when they click on a banner or text link until they complete a purchase, so you can compare lots of data points to identify them. If you need to track for longer periods, like to retarget an ad to people who have completed purchases for x, then you would need to compare fewer, more stable points and hope you find a unique match.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#27
post #2

Forgive me if I'm wrong, but it looks like if you could install a system font on a computer then you could create a unique fingerprint for that computer that is detectable by any website? I am uniquely identifiable out of the 3.7 million samples because of my system fonts.

Also the funny thing is you cannot be tracked by this, because whenever you install a new font, update a plugin, install a plugin etc, you change your unique data.

I don't think the majority of those who track you (e.g. retargeting advertisers) would need to track you for more than a month, that is, unless you are setting up your system or tweaking your IDE, it is very unlikely that you will change your set of fonts within that time.

Also, they aren't particularly picky about keeping you, the trackee, forever uniquely-identifiable.

Consider this: when was the last time you (the non-average) or your grandmother (the average) installed a font?

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#28
post #2

Forgive me if I'm wrong, but it looks like if you could install a system font on a computer then you could create a unique fingerprint for that computer that is detectable by any website? I am uniquely identifiable out of the 3.7 million samples because of my system fonts.

Also the funny thing is you cannot be tracked by this, because whenever you install a new font, update a plugin, install a plugin etc, you change your unique data.

I'm not sure how your conclusion follows from your premise. You are still trackable until you install a new font, update a plugin, install a plugin, etc. This may not happen for some time.

Even when you do make a change, you could still easily be tracked in many cases. If I see a new signature that I have never seen before that differs from an existing signature only by the version of a plugin, I can probably safely assume it's the same person, especially if I see that the plugin was updated between the last time I saw the existing signature and now.

I have a feeling that web developers are extra vulnerable to this type of tracking because we tend to install several useful developer extensions, and many of us have our own unique combination of extensions.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#29
post #28

Earlier quoted context omitted.

Also the funny thing is you cannot be tracked by this, because whenever you install a new font, update a plugin, install a plugin etc, you change your unique data.

I'm not sure how your conclusion follows from your premise. You are still trackable until you install a new font, update a plugin, install a plugin, etc. This may not happen for some time. Even when you do make a change, you could still easily be tracked in many cases. If I see a new signature that I have never seen before that differs from an existing signature only by the version of a plugin, I can probably safely…

If I upgrade my browser - which is something that happens quite often, my fingerprint would change.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#30
post #2

Forgive me if I'm wrong, but it looks like if you could install a system font on a computer then you could create a unique fingerprint for that computer that is detectable by any website? I am uniquely identifiable out of the 3.7 million samples because of my system fonts.

Also the funny thing is you cannot be tracked by this, because whenever you install a new font, update a plugin, install a plugin etc, you change your unique data.

Given that now ISPs give you an IP address that doesn't change for months, isn't it much easier to track someone via IP+OS+ScreenSize?
Post reply on HN