I think its similar to how Absolute Computrace rootkit identifies Android and Lenovo devices. Each hardware compoment has a unique ID, like your ethernet, bluetooth, even microphones and batteries.
Online tracking: A 1-million-site measurement and analysis
71–80 of 272 posts
Re: Online tracking: A 1-million-site measurement and analysis
#72Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.
Will you post insight into the data you've collected? Obviously I don't care about IP addresses, etc, but it would be nice to know how many people have submitted data vs how many unique hashes have been collected for say the "Fingerprint using DynamicsCompressor", etc. I also haven't checked every page on the site, so the data might already be there (and I'm missing it)...
Yes, we'll definitely do an analysis on this and write it up.
Re: Online tracking: A 1-million-site measurement and analysis
#73Of course this is something you do. Throw it together with all of the other information you can clean from a browser (referrer, ip) and you can get a match with a very high confidence level.
Shops can do the same with baskets, you find that people are either identified by one very rare feature which reoccurs often or their little graph of 4-5 items which correlate 99% to them.
Re: Online tracking: A 1-million-site measurement and analysis
#74Earlier quoted context omitted.
So a regular site using, say, mixpanel doesn't need to show a warning?
If the cookies are purely technical (say, login cookies), no. If the cookies are used for tracking, like Google Analytics, then yes, it needs to ask the user for consent. And that’s not a warning, but actual "yes/no", and in the no case, it may not set a tracking cookie, or have set a tracking cookie already. Most sites (except for a few dozen German and Dutch ones) just redirect you somewhere else, though, if you re…
Something that is best left to the browser to handle... by allowing the user to enable/disable 3rd party cookies. Which we already have. But no, the EU has stupid notifications on basically every single website as a result since everyone uses third party analytics. Why? If you want your analytics to be believed by anyone who wants to advertise with you, invest in you, partner with you, or buy you, they'd damn well better be third party analytics.
Re: Online tracking: A 1-million-site measurement and analysis
#75So given this information, how can we poison the results that the trackers get?
Just altering your own browser's fingerprint for each domain won't poison their data (it just makes you anonymous to them). Any data is good data as far as these trackers are concerned. You can devalue their data by collectively sending the same fingerprints, but there is no way to actively poison their databases.
Re: Online tracking: A 1-million-site measurement and analysis
#76Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.
Why would two browsers with the exact same user agent (ie same, version, same OS, same arch) yield two different renditions of an audio fingerprint?
Re: Online tracking: A 1-million-site measurement and analysis
#77So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular" browser fingerprinting. Is anyone aware of the existence of one?
The problem here is Canvas fingerprinting - that's what I found the most surprising and interesting.
How do you prevent that, apart from working on 'fixing' browsers to create pixel-perfect renders across different browsers/platforms/configurations. Would that even be possible?
Edit:
> Tor Browser notifies the user for canvas read attempts and provides the option to return blank image data to prevent fingerprinting.
Huh. I guess that's one attempt, but being able to read pixel data out of a canvas is completely reasonable.
Re: Online tracking: A 1-million-site measurement and analysis
#78So given this information, how can we poison the results that the trackers get?
There have been a couple plugins which try to address this question: Chameleon (https://github.com/ghostwords/chameleon), which is still in early stages, and FireGloves (https://fingerprint.pet-portal.eu/?menu=6), which was built by a research group (not sure it's still supported).
Also a great paper on this topic: http://research.microsoft.com/pubs/209989/tr1.pdf
Re: Online tracking: A 1-million-site measurement and analysis
#79Colour me unsurprised. Disappointed though. I'm glad I disabled WebRTC when I first discovered it could be used to expose local IP on a VPN. These "extension" technologies should all be optional plugins. Preferably install on demand, but a simple, obvious way to disable would be acceptable. (ie more obvious than about:config) Not a great deal can be done about font metrics other than my belief that websites shouldn't…
What would anyone do with your internal network IP?
Having these features as optional plugins means they are basically impossible to count on having in the basic web platform, meaning you're going to fight a losing battle to gain adoption for any applications that need them.
And the open web platform is the only platform right now that is enabling developers to create cross-platform applications outside of the restrictions of walled-garden app stores.
Re: Online tracking: A 1-million-site measurement and analysis
#80Coauthor here. I lead the research team at Princeton working to uncover online tracking. Happy to answer questions. The tool we built to do this research is open-source https://github.com/citp/OpenWPM/ We'd love to work with outside developers to improve it and do new things with it. We've also released the raw data from our study.
What can be done by the browser vendors such as Mozilla, Google, and Microsoft?
To prevent fingerprinting, your browser has to disable all sorts of useful modern JavaScript API's (e.g., WebRTC) by default, prevent spurious HTTP requests (e.g., to prevent abusing @font-face to find out which fonts are installed), and pretend you are an American using the most popular web browser of the moment (i.e., hide the user's preferred language and claim en-US as your preference, and change the user agent string to blend in to the crowd).
This is all assuming people don't run any third party plugins like Flash.
Are browser vendors on track to figure out a solution to this problem that combines user friendliness with privacy? Or will anonymous browsing remain a privilege for those with the right amount of technical know-how?
The problem it seems is that simply disabling JavaScript is not an option for normal web browsing, and even a requirement for interacting with the web services used by organisations you have a relation with (e.g., the government, insurance companies, banks, etcetera).