EFF has an excellent tool to check your browser's fingerprint uniqueness:- https://coveryourtracks.eff.org/ I use a lot of browser extensions. Unfortunately, this makes my browser easily identifiable.
[deleted]
Web fingerprinting is worse than I thought
431–440 of 524 posts
Re: Web fingerprinting is worse than I thought
#432Even after discovering it is worse than they thought, it remains far worse than the author thinks. Public knowledge is far behind the actual capabilities in practice.
This is easy to say, but not always true. Can you elaborate about concrete details of the "capabilities in practice"?
I can but frankly I'm pretty happy about the lack of lawsuits in my life currently.
Re: Web fingerprinting is worse than I thought
#433Earlier quoted context omitted.
> I think unless we lock down new APIs that aide in fingerprinting to only be accessible to WebAssembly and let people block or enable WASM theres not too much else we can do. IMO, it should be enough if incognito mode presents an identical fingerprint on everyone's browser.
It's not that easy to "present a fingerprint" without compromising the user experience. Sure, you could remove all those PWA and pretend-OS APIs and hardly anyone would notice, but what about things like viewport size and font rendering? You can't exactly hide them from a website.
User and javascript can simply see different things, like adnauseam does. User experience is already shit.
Re: Web fingerprinting is worse than I thought
#434Earlier quoted context omitted.
> It's not that easy to "present a fingerprint" without compromising the user experience. And that's exactly what I'm talking about. > what about things like viewport size and font rendering? Not much can be done about viewport size, but a browser could easily ship with 2 fonts (one serif and one sans serif) and only allow access to those.
“Font rendering” is a different thing than “what fonts you have.” Font rendering is about how fonts are drawn to the screen. The trick is to draw some words to a and then pixel-peep the result. Different OSes and browsers use different font renderers and font hinting logic; fonts will even render differently on a different-DPI screen.
Don't they already use freetype to parse webfonts?
Re: Web fingerprinting is worse than I thought
#435Until everyday people realize they’re being stalked, I don’t know what will change. I am seriously thinking about trying to go through the proposition process in my state to forbid selling of data (this should already run afoul of wiretapping laws, imho). I thought having an ad campaign that targeted subgroups very specifically and boldly might be enough drum up public interest. Something like: “Hello $name from $cit…
I will admit that it always made me confused as to why browser has access to detailed hardware information. I can understand OS. I can understand resolution. I can rationalize GPU. I don't understand though why it should be able to access .. well, everything about the machine. edit: It is still impressive. Even with the firefox settings on, the website was able to identify me. I am not entirely certain how I want to…
edit/ update from original post cuz i cant edit anymore
So quick update since I am mildly obsessive.
I was sure it was either GPU, CPU or addons that were giving me away ( I do have a mildly unique setup ).
I ran few tests in VM and the moment I dropped GPU passthrough ( left CPU passthrough ), I was no longer ( based on that website anyway ) tracked across sessions.
In other words, cat and mouse game continues.
Re: Web fingerprinting is worse than I thought
#436We use web fingerprinting and adjacent methods to crack down on ID sharing for our SaaS that charges (per person). I make no apologies for this practice.
How does that work out for you? This doesn't strike me as a good use of fingerprinting:
- Since you charge per person, what about people that use multiple machines and browsers (with presumably different fingerprints)? - On the other hand, unless two people share the same workstation and computer account, how do you expect to use fingerprints to detect license abuse?
Re: Web fingerprinting is worse than I thought
#437Ha! I followed the instructions and went to fingerprint.com and it all 'crashed' because I had JavaScript turned off—that's my normal default setting. I have five different browsers on my smartphone and three on the PC all sans JS and none of them are Chrome. Also, normal operation is to automatically delete all cookies at session's end. My smartphone and PCs are de-googleized and firewalled and I never see ads in my…
Before you get all jubilant, note that they have fingerprinting techniques which don't use JS[0]. It was able to identity me. Contrary to popular opinion, disabling JS doesn't protect you from fingerprinting. They describe their approach[1]. They use HTTP headers and conditional request triggered by CSS conditional media queries to gather data. Something like @media(...) {background: url(/tracking/$clientid)}. But in…
It’s one thing to generate the same hash for the same client, but it would be interesting to know how often the hashes collide, too.
I also notice that the no-JS hash changes when I move the window to a different monitor.
Re: Web fingerprinting is worse than I thought
#438Earlier quoted context omitted.
I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built…
I actually did exactly that a while ago. Where I worked, we didn't have internet access but we had email access, so as a workaround, I made an email server on my home machine that fetched web pages for me. A coworker took it even further and made a proxy server that automated the process so you could actually browse the web, although very slowly. Just to say that Stallman is not the only one with this idea. It was in…
I did the reverse and had an ssh connect to my home machine and ran an IPv4 tunnel back through it so that I could browse the entire corporate internet from my home network, creating a full VPN essentially. Make me about 10 times as productive as going through the dial-up we had to use while we were oncall.
Re: Web fingerprinting is worse than I thought
#439Earlier quoted context omitted.
I think it's well within the rights of the EU to legislate in which way the data of its citizens is processed. If your product or service is accessible to EU citizens, in the EU market, then you need to abide by the laws of the EU. It's no different for physical or virtual products.
> If your product or service is accessible to EU citizens, in the EU market, then you need to abide by the laws of the EU It's not that simple though. If I offer a website in the US, I can collect the info of anyone that visit it as long as I am not breaking US law. If the EU doesn't like that, then they can block my site. They claim though that I am subject to their law if I harness the data of Europeans.
Yes, this is what they claim. As long as your company has no physical offices in the EU you probably don't have to worry about it. If your company grows bigger, you probably should.
Re: Web fingerprinting is worse than I thought
#440Earlier quoted context omitted.
Thanks, can you answer a couple of questions: So carriers (ISPs) still would need to do NAT, the RFC didn't seem (I skimmed) explicit? Isn't the removal of processing traffic a large part of the sell for IPv6. Also, surely the ISP can sell IP-to-user correlation lists as I assume they do now? They can presumably do it anonymously bit with some other party seeking the other part of the data that allows deobfuscation o…
No ISPs don't need to do NAT but you can if you like. You also don't have to do NAT with IPv4 if you only have one device or get a subnet from your ISP. It's just done because we don't have enough v4 addresses. They can do subnet to customer correlation. The IPv6 is randomly generated by your device if you use SLAAC. But if your ISP is an adversary you have pretty much lost anyway. If they provide you with a router t…
I'm sorry, you've misconstrued the question. The context is the privacy extension to IPv6 under RFC 4941. So, my question was would ISPs need to do NAT in order to provide that extension -- I only skimmed the RFC but there was no other obvious way to me for it to be provided that wouldn't fall to an adversarial ISP because it appears they must do NAT to make that work?
AIUI ISPs provide a fixed prefix to customers. So I'd need to look how SLAAC would work if it uses a random IPv6 address; surely your ISP only has allowance to use a limited set of numbers that are allocated to them by IANA or whoever.