Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

411–420 of 524 posts

Re: Web fingerprinting is worse than I thought

#411

Post by cptskippy »

GuB-42 wrote: post #186
Technotroll wrote: post #100

Earlier quoted context omitted.

I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built…

I actually did exactly that a while ago. Where I worked, we didn't have internet access but we had email access, so as a workaround, I made an email server on my home machine that fetched web pages for me. A coworker took it even further and made a proxy server that automated the process so you could actually browse the web, although very slowly. Just to say that Stallman is not the only one with this idea. It was in…

> It also was a time where companies were paranoid into letting employees access the internet, but at the same time had abysmal security.

I recall we had a crappy firewall that would collapse under the load of NAT for the 100ish employees and so executives got static IPs mapped to their machines. The late 90s and 00s were crazy.

Re: Web fingerprinting is worse than I thought

#412

Post by TylerE »

bdhcuidbebe wrote: post #408
ambicapter wrote: post #373

Earlier quoted context omitted.

I was under the impression that base64 encoding doesn't reduce file size of an image at all, rather it sometimes increases it. That wasn't the point of using base64 string, right?

> a base64 string representing a compressed image Parent explained that the base64 encoding held compressed data.

But why base64 and not just… send the bytes? 6 bits per character vs 8

Re: Web fingerprinting is worse than I thought

#413

Post by cph123 »

Firmwarrior wrote: post #394
super256 wrote: post #291

Earlier quoted context omitted.

In Germany there is a "WhatsApp" SIM [1], where you have to pay for normal internet use, but WhatsApp texts are free of charge. With a technique which you described, you could probably abuse a phone with this SIM as a "free" hot spot with infinite data. [1] https://www.whatsappsim.de/

A lot of paid Wi-Fi hotspots allow DNS traffic through unmolested, that's a similar loophole

Maybe one could use something like this https://github.com/yarrick/iodine

Re: Web fingerprinting is worse than I thought

#414

Post by logifail »

cptskippy wrote: post #411
GuB-42 wrote: post #186

Earlier quoted context omitted.

I actually did exactly that a while ago. Where I worked, we didn't have internet access but we had email access, so as a workaround, I made an email server on my home machine that fetched web pages for me. A coworker took it even further and made a proxy server that automated the process so you could actually browse the web, although very slowly. Just to say that Stallman is not the only one with this idea. It was in…

> It also was a time where companies were paranoid into letting employees access the internet, but at the same time had abysmal security. I recall we had a crappy firewall that would collapse under the load of NAT for the 100ish employees and so executives got static IPs mapped to their machines. The late 90s and 00s were crazy.

> so executives got static IPs mapped to their machines. The late 90s and 00s were crazy

In my Uni days, all our department's machines had public IPs; no NAT, no firewall(!)

So much simpler to able to telnet, FTP and/or remote desktop straight from home to the office :)

Re: Web fingerprinting is worse than I thought

#415

Post by warner25 »

Firmwarrior wrote: post #398
jonhohle wrote: post #357

Until everyday people realize they’re being stalked, I don’t know what will change. I am seriously thinking about trying to go through the proposition process in my state to forbid selling of data (this should already run afoul of wiretapping laws, imho). I thought having an ad campaign that targeted subgroups very specifically and boldly might be enough drum up public interest. Something like: “Hello $name from $cit…

Yeah man, I think that's the only way anything is going to change People are such dumb fucking cattle that they'll lash out at you rather than the data brokers or the software vendors who ratted them out though

> they'll lash out at you

Not only that, but they might have a legal case against you. I've been slowly working through Seek and Hide: The Tangled History of the Right to Privacy, and my main takeaways have been:

(1) The constitutional right to free speech and a free press is not as broad as most people probably think.

(2) Truth is not necessarily an air-tight defense in a case of libel, as courts at various times and places have decided against publishers for true but embarrassing things intended to humiliate or harm.

Re: Web fingerprinting is worse than I thought

#417

Post by than3 »

danbruc wrote: post #371
than3 wrote: post #298

Earlier quoted context omitted.

> This is confusing whether it can be blocked and whether it would be effective. It shouldn't be confusing because its really fairly simple. The gist is this... so long as determinism as a systems property holds true in a system, you can leak information by the absence of something when compared to another expected thing. This is how inference works in many respects, you have properties and you can deduce or infer fr…

I meant you are confusing whether such scripts can be blocked and whether it would be effective to do so. That it can not be blocked would require some fundamental or practical obstruction like having to solve the halting problem or whatnot. You said that it can not be blocked because the act of blocking itself makes you identifiable which defeats the purpose, but that is not true, or only true if only you or a few p…

The practical obstruction is if you block the browser API access, they test for it, and then block you so you can't view their site, and they do that by using the information that you leaked.

As for the effectiveness of blocking what they are doing, you can block them by giving them bogus but plausible data. There's a range of accepted values for those interfaces. If its within that range, they can't tell the difference, but their entire assumption is its determinate, when it can never be determinate because a hash is a finite field.

Their assumption is based on applied probability which has validity issues in an adversarial environment.

Neither requires solving the halting problem.

Re: Web fingerprinting is worse than I thought

#418

Post by tenebrisalietum »

A4ET8a8uTh0 wrote: post #364
jonhohle wrote: post #357

Until everyday people realize they’re being stalked, I don’t know what will change. I am seriously thinking about trying to go through the proposition process in my state to forbid selling of data (this should already run afoul of wiretapping laws, imho). I thought having an ad campaign that targeted subgroups very specifically and boldly might be enough drum up public interest. Something like: “Hello $name from $cit…

I will admit that it always made me confused as to why browser has access to detailed hardware information. I can understand OS. I can understand resolution. I can rationalize GPU. I don't understand though why it should be able to access .. well, everything about the machine. edit: It is still impressive. Even with the firefox settings on, the website was able to identify me. I am not entirely certain how I want to…

Because the browser has become a vendor neutral, architecture neutral app engine and people want to do things like play MIDI instruments, use serial ports, use proprietary USB check scanners for accounting/ERP apps that work on the web and don't need SCCM to manage, etc.

Re: Web fingerprinting is worse than I thought

#419

Post by thakoppno »

jefc1111 wrote: post #335

Is anyone trying to tie users to multiple devices, and consequently identify both fingerprints as being from one user? I.e. Let's say I visit HN on both my laptop and on my mobile phone, each will have a very different fingerprint, but not only do I visit the same site on both devices but I am unlikely to do so simultaneously across the two devices, and there are likely to be other factors such as not visiting on eit…

We did a demo at CES in 2015 which retargeted users on a secondary device.

The demo delivered an ad-unit on mobile after viewing an ad-unit on TV.

Re: Web fingerprinting is worse than I thought

#420

Post by fnordpiglet »

shanebellone wrote: post #368
mihaic wrote: post #194

Fingerprinting is doing terrible things for big-tech data collection, and at the same time it's excruciatingly hard to protect against bots, spammers, fraudaters etc without it. Few people seem to try to reconcile this, since neither side cares about the other. I personally think that discussion about fingerprinting as raw tech, without mentioning the size of the company collecting the date or the purpose is meaningl…

Disabling JavaScript does not stop fingerprinting either. HTTP headers are sufficient to construct unique user identifiers. Passing that data via API to a FaaS provider would enable cross site tracking that's invisible to the visitor. Edit: The required FaaS implementation is trivial too. I could launch an endpoint that performs exactly this function in 30-60 minutes.

In fact, the disablement of JavaScript itself is a very identifying characteristic.
Post reply on HN