Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

91–100 of 524 posts

Re: Web fingerprinting is worse than I thought

#91

Post by Technotroll »

I'm just guessing here, but I'm fairly sure that they use a model that updates dynamically as the "user" or victim changes his or her web browsing settings, and even when the user tries to hide. It easily sounds like some kind of Bayesian filtering going on, or some sort of Markov Chain or decision tree. That is to say that their model tracks the likelihood that you're the same unique user that reloads the page based on the information it can glean from you.

This makes it exceedingly hard to hide from such a filter, because in communicating with these sites, you are bound to reveal at least some information about yourself. And then the "likelihood-machine" does the rest by connecting the dots, even if you gave them "fewer dots."

It's also quite interesting - or perhaps chilling - to see how fingerprinting through NLP and other language tracking algorithms can also track just about any forum post you do, even if you're using a pseudonym.

Re: Web fingerprinting is worse than I thought

#92

Post by jb1991 »

vesinisa wrote: post #64
throwaway2056 wrote: post #37

It is interesting that the site can fingerprint individual profiles/dir easily: For example chromium-browser --user-data-dir=/tmp/profile_A chromium-browser --user-data-dir=/tmp/profile_A --incognito chromium-browser --user-data-dir=/tmp/profile_B chromium-browser --user-data-dir=/tmp/profile_B --incognito For each command + its incognito it can detect them as separate profiles. For ultimate privacy one needs to ever…

... on a new computer, each time ordered from a different brand and reseller, paid with a unique type of cryptocurrency and delivered each time to a new dead drop in a different country.

How does the fingerprinting know the payment method you used to pay for the computer, is that stored somewhere in the operating system? How would they know it was a dead drop also? Genuinely curious.

Re: Web fingerprinting is worse than I thought

#93

Post by noduerme »

zelphirkalt wrote: post #70
noduerme wrote: post #47

Look, forget about threat models. It's relatively trivial these days to avoid fingerprinting attacks if you want to (as a private, web browsing individual). I use fingerprinting actively in enterprise apps as a form of silent 3FA. It's a useful backstop. If I have a user who forgot their password but retrieves it via email, I'll usually let them pass if their fingerprint matches one of their priors; otherwise my soft…

(1) Users should not receive passwords via e-mail. (2) How very enterprisey of you to even be able to send passwords, which one also should not be able to do. (3) Users can change or modify their browser, either to another browser entirely or through installation of addons. The fingerprint is not guaranteed at all to stay the same or similar.

[flagged]

Re: Web fingerprinting is worse than I thought

#94

Post by Jaer3hah »

Well, I'm glad to report that my efforts to fight fingerprinting have paid off.

I use a text based browser, with no js, no cookies, no css, no external requests past the first html page download, no user agent, no etag, I connect through Tor and I've modified the browser to randomize http headers. And of course, it sometimes happens that I want to see something that is refused to me with that configuration (like, seeing anything behind the big internet killer, aka Cloudflare - thanks archive.org for existing), so I have also a classic browser for the occasional lowering of barrier.

At first, I thought fingerprint.com did identify it, giving me the hZ4W5oQ7pJVIHbW2fBXA id. Then I realized it was giving the same id when using curl with and without Tor. Then I realized, by googling and ddging that id that it's the one reported as well to search engines. So it's not unique and it's basically a "dunno" reply.

Re: Web fingerprinting is worse than I thought

#95

Post by jb1991 »

noduerme wrote: post #76
rat9988 wrote: post #57

Earlier quoted context omitted.

"It's relatively trivial these days to avoid fingerprinting attacks". Why should it be on me to avoid them? And more importantly, it's NOT trivial.

really? it takes a minute to set up a VPN and do your web browsing through a virtual machine. I guess it's not "trivial" for the average American, but it definitely is for the average terrorist or child pornographer, so it's easy compared to surmounting most other threat models faced by people intending to evade detection. Therefore, "trivial". [edit] also, the less trivial it is, the better for corporate security.

I think you should read more about what fingerprinting actually is.

Re: Web fingerprinting is worse than I thought

#96

Post by Arnt »

izacus wrote: post #75

Why is this being fought with technical measures (which are ineffective and cripple the web as a platform) instead of legal consumer law where you can easily fine and punish companies that do the fingerprinting? EDIT: Note that you can do BOTH - but one without the other is just a game of whack-a-mole.

A law needs a justification and needs to apply equally to everyone. Writing that about fingerprinting would not be trivial. Some site operators can make a believable argument that they use it in ways that are good for society.

Re: Web fingerprinting is worse than I thought

#97

Post by mschuster91 »

izacus wrote: post #75

Why is this being fought with technical measures (which are ineffective and cripple the web as a platform) instead of legal consumer law where you can easily fine and punish companies that do the fingerprinting? EDIT: Note that you can do BOTH - but one without the other is just a game of whack-a-mole.

Because bad actors have an easy time on an actually global network. It's disturbingly hard to hold bad actors accountable, particularly if they have zero legal presence (e.g. a corporation's subsidiary) in one's jurisdiction.

Re: Web fingerprinting is worse than I thought

#98

Post by noduerme »

defrost wrote: post #89
noduerme wrote: post #76

Earlier quoted context omitted.

really? it takes a minute to set up a VPN and do your web browsing through a virtual machine. I guess it's not "trivial" for the average American, but it definitely is for the average terrorist or child pornographer, so it's easy compared to surmounting most other threat models faced by people intending to evade detection. Therefore, "trivial". [edit] also, the less trivial it is, the better for corporate security.

The article describes "Fingerprinting as a Service. Some choice quotes: It doesn’t matter if you are using a VPN or Private Browsing mode, they can accurately identify you. Also note that VPNs does not help with fingerprinting. They only masks IP address.

right. but using a VPN plus a fresh VM running Ubuntu can mostly do the trick. In a pinch, just keep a few different versions of various browsers around when you plan to surf a site that you don't want associated with you. Or change your screen resolution or turn off your fonts.

My point was that fingerprinting is much more practical and useful as a positive form of identity verification than it is as a tracking device, as long as it isn't (and hopefully never will be) mandatory to lock into browsers.

Re: Web fingerprinting is worse than I thought

#100

Post by Technotroll »

zamubafoo wrote: post #63

As the years pass, I keep thinking back and realize that Richard Stallman was right all along: > For personal reasons, I do not browse the web from my computer. (I also have not net connection much of the time.) To look at page I send mail to a demon which runs wget and mails the page back to me. It is very efficient use of my time, but it is slow in real time.

I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built up around WGET requests, and then employing some "likelihood machine" on it, to make educated guesses as to how likely it is that the WGET request was actually from Richard Stallman. I think we've just stumbled upon a new and "fun" Where's Wally game here!
Post reply on HN