Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Your Social Media Fingerprint (maybe NSFW)

robinlinus.github.io

Post reply on HN
Print view View original

201–210 of 258 posts

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#201

Post by drvdevd »

duaneb wrote: post #190
drvdevd wrote: post #173

Earlier quoted context omitted.

What about virtualization? It seems to me that something like Qubes might not at present protect against this (I don't know what information is available to guest/isolated domains on that system), but could be made to? One can easily lie to a browser about battery status and fonts from the OS too, for example. I guess my point is that it depends on what you view as pathological? I surmise that this is the kind of thi…

It's very difficult to prevent side channel thumbprints—something as simple as traceroutes, wifi hotspots, caches (DNS, routing) can be uniquely identifiable. Add on top of this biometrics like how you type, how you move your mouse, etc, and it becomes very difficult to avoid concerted tracking efforts. Of course, if you're not pissing off state actors, you're probably fine with qubes/tails.

Very interesting list, thank you. I will have to read up on this subject in greater depth.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#202

Post by vacri »

zerognowl wrote: post #39

This is why I use 'browser isolation', which is a way to separate different types of surfing activity into different buckets. Currently the best way to do this in Firefox is to create multiple profiles, or in Chrome, you can simply add a different user/persona. Having one profile, or even an entire dedicated browser just for Twitter/FB ensures the login is not spilled over into other sites. If you're surfing the web…

> It sounds like common sense, but many people have cookies and login information persisting for years at a time in their browsing sessions.

If it requires quite a bit of domain knowlege (almost everything in security does), it's not 'common sense'.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#203

Post by tomvangoethem »

Attaching cookies to third-party requests is the source of many issues. In a similar demonstration [0], I showed that browser-based timing attacks (which can probably be considered as wont-fix as well) can be used to extract more specific information from social networks (e.g. one's political preference based on who they're following).

[0]: https://labs.tom.vg/browser-based-timing-attacks/

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#204

Post by Ph0X »

Zeklandia wrote: post #189
0942v8653 wrote: post #152

Earlier quoted context omitted.

A more SFW version (took out YouPorn): http://codepen.io/anon/pen/ALdqox/right/ This version connects to squareup.com, twitter.com, www.facebook.com, accounts.google.com, accounts.google.com, plus.google.com, login.skype.com, www.flickr.com, www.spotify.com, www.reddit.com, www.tumblr.com, www.expedia.de, www.dropbox.com, www.amazon.com, www.pinterest.com, www.netflix.com, de.foursquare.com, eu.battle.net, store.stea…

This one actually works for me! The other said that I was using Privacy Badger since it couldn't detect anything. I'm not, but I am using uBlock Origin. This one is only wrong about a couple (it doesn't register, for example, that I am logged in to G+, Khan Academy, Steam, Amazon, PayPal, or Skype).

Doesn't uBlock have a filter specifically for privacy (off by default I believe).

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#205

Post by sliverstorm »

duaneb wrote: post #190
drvdevd wrote: post #173

Earlier quoted context omitted.

What about virtualization? It seems to me that something like Qubes might not at present protect against this (I don't know what information is available to guest/isolated domains on that system), but could be made to? One can easily lie to a browser about battery status and fonts from the OS too, for example. I guess my point is that it depends on what you view as pathological? I surmise that this is the kind of thi…

It's very difficult to prevent side channel thumbprints—something as simple as traceroutes, wifi hotspots, caches (DNS, routing) can be uniquely identifiable. Add on top of this biometrics like how you type, how you move your mouse, etc, and it becomes very difficult to avoid concerted tracking efforts. Of course, if you're not pissing off state actors, you're probably fine with qubes/tails.

if you're not pissing off state actors, you're probably fine

Thank you, this seems to be a point that is often ignored. Most of us don't need to hide our trail from a full wing of CIA analysts, just drive-by snooping and the like. (It of course doesn't help the Snowdens of the world)

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#206

Post by sliverstorm »

tankenmate wrote: post #176
to3m wrote: post #57

Earlier quoted context omitted.

I only ever log in to Facebook in private browsing mode.

I only ever log into Facebook via a VPN to a remote VPS using a private window on a browser I don't use for anything else. And also... Chain OUTPUT (policy ACCEPT 6309 packets, 599K bytes) pkts bytes target prot opt in out source destination 330 19800 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 match-set block-facebook-ips dst reject-with icmp-port-unreachable I have an ipset that matches FB networks.

Careful, too strict and you'll start to be identifiable from your conspicuous lack of identifiable information ;)

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#208

Post by oldmanjay »

throwanem wrote: post #167
drvdevd wrote: post #164

Earlier quoted context omitted.

When I first read that it was making these requests here in the comments, my reaction was similar. But then upon reflection, I don't think there's a problem for the author here. Why? Because all I did was click the link. Meaning if I was behind a corporate firewall or the like, this sort of thing could be happening all the time and unless I was always tracing requests in my browser or via MITM or logging DNS, I'd hav…

The point I'm making is that it's not necessary to hit a porn site in order to get the point across, and there are HN users whose organizations observe and don't care for that kind of thing.

Yet another inequality to throw in the hopper

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#209

Post by ge96 »

proaralyst wrote: post #187
ge96 wrote: post #186

How does this work? I think I get the basic concept of calling redirects to various sites from the page, probably back-end like with php, CURL maybe? I just don't get how you'd keep track of where it goes after the redirect (trying a link) since you would now be on Facebook's site for example

There's an explanation further down the page, but essentially the redirect they choose is an image. You can tell if an image loaded successfully using JS, so if the redirect succeeds, that JS fires. If it fails (because the login page isn't an image), some other JS runs instead.

Oh okay, that makes sense. It's like those tracking/analytics where they know where a person came from previously to follow their "thought pattern" that is something I'm not 100% in either.

Re: Show HN: Your Social Media Fingerprint (maybe NSFW)

#210

Post by mablap »

Pxtl wrote: post #123

FYI, it's very NSFW in the back-end. Your browser is sending requests to obvious porn servers when you hit this link so it can test if you're logged in to them.

Well, that was not very nice. Should have asked confirmation. I clicked on the link thinking there would be an explanation of what this project does.
Post reply on HN