Live data from Hacker News

Supercookie: Browser Fingerprinting via Favicon (2021)

github.com

41–50 of 105 posts

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#41
post #39
post #35

Earlier quoted context omitted.

If websites can detect that you've disabled favicons, then you are easy to track between all websites because you are very unusual.

I don't think that's true. You'll just look like someone who already has it cached.

It depends on how the browser rejects favicons? If the browser reports the icon is already cached, I agree (assuming the reports are indistinguishable). But maybe it just never downloads the icon, for example.

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#43
post #27

Nonpersistent vm-based browser, I use qemu + cage + firefox and some glue logic to fire up a copy of a base image which gets deleted on exit. Fires up slower than a native firefox instance but runs all the same. Can containerize for the less paranoid and less work but browsers touching host kernel gives me the ick as does the idea of trying to write ebpf policies for firefox to mitigate. Browsers are pain.

This sounds interesting, do you have this written up anywhere?

I sadly do not atm beyond some notes but I can if there is interest.

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#44
post #27

Nonpersistent vm-based browser, I use qemu + cage + firefox and some glue logic to fire up a copy of a base image which gets deleted on exit. Fires up slower than a native firefox instance but runs all the same. Can containerize for the less paranoid and less work but browsers touching host kernel gives me the ick as does the idea of trying to write ebpf policies for firefox to mitigate. Browsers are pain.

Tried a similar approach but found that putting the browser in a VM has a tendency to expose a few data points that stand out as less trust worthy which means you end up getting a lot of captchas on some websites (like using swiftshader for renderer, not having some fonts installed, among other things), lying about these can typically be detected as well (like injecting noise into a canvas, modifying the advertised renderer). If you've found any solutions to these please share.

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#45
post #2

I was sure this has been a thing for a while, either that or safari has a UI bug since forever. I regularly get the wrong favicon in specific sites, for example ars technica favicon in reddit

Safari has super long lived favicon caches too. The only way to force a rebuild is to set your system clock forward a few years.

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#46
post #2

I was sure this has been a thing for a while, either that or safari has a UI bug since forever. I regularly get the wrong favicon in specific sites, for example ars technica favicon in reddit

My hacker news icon has been stuck as the icon for a weather site that I sometimes check. It’s been stuck that way for close to a year now, and has survived an iOS update too. It persists across profiles and into private browsing mode.

Could site icons be connected somehow to iCloud?

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#47
post #2

I was sure this has been a thing for a while, either that or safari has a UI bug since forever. I regularly get the wrong favicon in specific sites, for example ars technica favicon in reddit

My hacker news icon has been stuck as the icon for a weather site that I sometimes check. It’s been stuck that way for close to a year now, and has survived an iOS update too. It persists across profiles and into private browsing mode.

[deleted]

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#48
post #44
post #27

Nonpersistent vm-based browser, I use qemu + cage + firefox and some glue logic to fire up a copy of a base image which gets deleted on exit. Fires up slower than a native firefox instance but runs all the same. Can containerize for the less paranoid and less work but browsers touching host kernel gives me the ick as does the idea of trying to write ebpf policies for firefox to mitigate. Browsers are pain.

Tried a similar approach but found that putting the browser in a VM has a tendency to expose a few data points that stand out as less trust worthy which means you end up getting a lot of captchas on some websites (like using swiftshader for renderer, not having some fonts installed, among other things), lying about these can typically be detected as well (like injecting noise into a canvas, modifying the advertised r…

What approach did you end up going with instead?

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#49
post #2

I was sure this has been a thing for a while, either that or safari has a UI bug since forever. I regularly get the wrong favicon in specific sites, for example ars technica favicon in reddit

My hacker news icon has been stuck as the icon for a weather site that I sometimes check. It’s been stuck that way for close to a year now, and has survived an iOS update too. It persists across profiles and into private browsing mode.

To me HN has been stuck as Facebooks icon for a really long time.

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#50
post #41
post #39

Earlier quoted context omitted.

I don't think that's true. You'll just look like someone who already has it cached.

It depends on how the browser rejects favicons? If the browser reports the icon is already cached, I agree (assuming the reports are indistinguishable). But maybe it just never downloads the icon, for example.

> If the browser reports the icon is already cached

Browsers don't do that.

Post reply on HN