81–90 of 131 posts
Earlier quoted context omitted.
Isn’t a postal code about 50-100 houses? It really narrows things down. That particular variable really reduces things.
That's a bit insane. I looked up US numbers to check and got around 8k/zip code[0] [0] https://www.zip-codes.com/zip-code-statistics.asp
Who is able to get access to my browser history? I thought it was just my ISP/VPN, which can obviously track me better in other ways.
Earlier quoted context omitted.
Ok, so two trips but not any two trips. It requires a lot more knowledge of the person. For someone you know well why would you even need to look at the data?
The thing is, if you know enough trips to unmask them, then you can find out about all their trips in that dataset. As an employer, maybe I can find out an employee wasn't home sick when they said, but took the bus to a station that only serves a competitor's business. Etc.
Earlier quoted context omitted.
Can JavaScript measure DNS resolve time?
I think only indirectly, but if they control the endpoint they can ping you back, subtract rtt from initial request response time and then the difference from that can tell them whether initial request was cached in dns or not.
If so, wouldn’t that drastically reduce the effectiveness of using DNS resolve times as a work around for Firefox containers?
Not trying to be argumentative here, just trying to understand how effective the sandboxing is, or whether I need to design more layers of indirection. :)
Earlier quoted context omitted.
Look up browser fingerprinting. It’s a lot more complicated than just obscuring IPs.
Yes, but the primary identifier is IP address. The detailed profiles built with fingerprinting and other data are attached to the small set of IP addresses a person uses over the course of her lifetime. Most internet users have limited choice when it comes to internet access. A user cannot change her IP address with the same ease as she can change her software fingerprints. If a company is trying to sell online ad se…
> A user cannot change her IP address with the same ease as she can change her software fingerprints.
I dunno. It’s a lot easier for my less techie friends to reboot their router and get a new IP than it is to talk them through installing some privacy enforcing software they required regular maintenance or results in weird and wonderful breakage of their favourite websites.
Earlier quoted context omitted.
Yes, but the primary identifier is IP address. The detailed profiles built with fingerprinting and other data are attached to the small set of IP addresses a person uses over the course of her lifetime. Most internet users have limited choice when it comes to internet access. A user cannot change her IP address with the same ease as she can change her software fingerprints. If a company is trying to sell online ad se…
Given the prevalence of CGN, especially in mobile / cellular internet, and the reality that mobile is first for a large number, the use of IPs as a primary key feels less likely these days than a decade ago. > A user cannot change her IP address with the same ease as she can change her software fingerprints. I dunno. It’s a lot easier for my less techie friends to reboot their router and get a new IP than it is to ta…
Don't take my word for it, read the work cited in the article. Note how much they still rely on (static) IP addresses. If we removed the IP address as a reliable item of available data, based on observed practices (not theory), that would likely be significant.
"Mishra et al. demonstrated that IP addresses can be static for a month at a time [42] which, as we will show, is more than enough time to build reidentifiable browsing profiles."
"Secondly, ground truth was established based on reidentifying visitors with a combination of IP Address and UserAgent, perhaps biasing the baseline data to under-represent users accessing the web from multiple locations."
"Even if traditional stateful tracking is addressed, IP address tracking and fingerprinting are a real concern as ongoing privacy threats that can work in concert with browser history tracking. We point readers to Mishra et al.'s [42] discussion on IP address tracking and possible mitigations. They observed IP addresses to be static for as long as a month at a time, and while not a perfect tracker, IP addresses are trivial to collect."
That's hardly surprising. I mean browsers hand out willingly plenty of information that could be used for pretty accurate identifications. Just scrolling through my scores on amiunique[1], many of the parameters put me in the 0.01% category. [1] https://amiunique.org/fp
1. Visit the site 2. Delete your browser cookies 3. Refresh 4. Repeat the steps until you're less unique
That's hardly surprising. I mean browsers hand out willingly plenty of information that could be used for pretty accurate identifications. Just scrolling through my scores on amiunique[1], many of the parameters put me in the 0.01% category. [1] https://amiunique.org/fp
If you want to be less unique on amiunique.org/fp 1. Visit the site 2. Delete your browser cookies 3. Refresh 4. Repeat the steps until you're less unique
Earlier quoted context omitted.
I think an easier approach is that once you have good IPv6 connectivity you could do something like a unique address per day per host. Every device could have 100M ip addresses and it wouldn't touch the IPv6 address space (10 billion humans * 100 devices = 0.000005% of the IPv6 address space). Edit: My math is wrong. I thought IPv6 was 2^64, but it's actually 2^128, so that percentage is 10^20 times more miniscule.
In that scenario those 100 IPv6 addresses in the subnet would be practically equivalent to an IPv4 address today and would provide no extra benefit.