Earlier quoted context omitted.
If websites can detect that you've disabled favicons, then you are easy to track between all websites because you are very unusual.
I don't think that's true. You'll just look like someone who already has it cached.
Supercookie: Browser Fingerprinting via Favicon (2021)
41–50 of 105 posts
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#42Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#43Nonpersistent vm-based browser, I use qemu + cage + firefox and some glue logic to fire up a copy of a base image which gets deleted on exit. Fires up slower than a native firefox instance but runs all the same. Can containerize for the less paranoid and less work but browsers touching host kernel gives me the ick as does the idea of trying to write ebpf policies for firefox to mitigate. Browsers are pain.
This sounds interesting, do you have this written up anywhere?
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#44Nonpersistent vm-based browser, I use qemu + cage + firefox and some glue logic to fire up a copy of a base image which gets deleted on exit. Fires up slower than a native firefox instance but runs all the same. Can containerize for the less paranoid and less work but browsers touching host kernel gives me the ick as does the idea of trying to write ebpf policies for firefox to mitigate. Browsers are pain.
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#45I was sure this has been a thing for a while, either that or safari has a UI bug since forever. I regularly get the wrong favicon in specific sites, for example ars technica favicon in reddit
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#46I was sure this has been a thing for a while, either that or safari has a UI bug since forever. I regularly get the wrong favicon in specific sites, for example ars technica favicon in reddit
My hacker news icon has been stuck as the icon for a weather site that I sometimes check. It’s been stuck that way for close to a year now, and has survived an iOS update too. It persists across profiles and into private browsing mode.
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#47I was sure this has been a thing for a while, either that or safari has a UI bug since forever. I regularly get the wrong favicon in specific sites, for example ars technica favicon in reddit
My hacker news icon has been stuck as the icon for a weather site that I sometimes check. It’s been stuck that way for close to a year now, and has survived an iOS update too. It persists across profiles and into private browsing mode.
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#48Nonpersistent vm-based browser, I use qemu + cage + firefox and some glue logic to fire up a copy of a base image which gets deleted on exit. Fires up slower than a native firefox instance but runs all the same. Can containerize for the less paranoid and less work but browsers touching host kernel gives me the ick as does the idea of trying to write ebpf policies for firefox to mitigate. Browsers are pain.
Tried a similar approach but found that putting the browser in a VM has a tendency to expose a few data points that stand out as less trust worthy which means you end up getting a lot of captchas on some websites (like using swiftshader for renderer, not having some fonts installed, among other things), lying about these can typically be detected as well (like injecting noise into a canvas, modifying the advertised r…
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#49I was sure this has been a thing for a while, either that or safari has a UI bug since forever. I regularly get the wrong favicon in specific sites, for example ars technica favicon in reddit
My hacker news icon has been stuck as the icon for a weather site that I sometimes check. It’s been stuck that way for close to a year now, and has survived an iOS update too. It persists across profiles and into private browsing mode.
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#50Earlier quoted context omitted.
I don't think that's true. You'll just look like someone who already has it cached.
It depends on how the browser rejects favicons? If the browser reports the icon is already cached, I agree (assuming the reports are indistinguishable). But maybe it just never downloads the icon, for example.
Browsers don't do that.