Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Supercookie: Browser Fingerprinting via Favicon (2021)

github.com

Post reply on HN
Print view View original

91–100 of 105 posts

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#91

Post by redbell »

The urge to mine user's data in every possible way is being escalated to higher levels each day. We are, for sure, living in the data rush era.

Another interesting method for web fingerprinting explored by a team of researchers back in 2022 uses the GPU to create unique fingerprints and uses them for persistent web tracking. Codenamed 'DrawnApart' [1] and relies on WebGL to count the number and speed of the execution units in the GPU, measure the time needed to complete vertex renders, handle stall functions, and more. It uses short GLSL programs executed by the target GPU as part of the vertex shader to overcome the challenge of having random execution units handling the computations. Hence, the workload allocation is predictable and standardized.

__________

1. https://www.bleepingcomputer.com/news/security/researchers-u...

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#92

Post by 1718627440 »

shiomiru wrote: post #89
1718627440 wrote: post #81

Earlier quoted context omitted.

Mozilla Firefox doesn't shrink tabs any further, but instead lets the tab list go off screen and you can scroll. I think that is a Google Chrome specific thing.

I've just tried and when I open a bunch of new tabs, Firefox truncates the "new tab" text to "new" and a Firefox logo. Same thing happens with other titles. (Then at some point it stops truncating and scrolls off the screen.)

That's true, it's more without the favicon. It is configurable with browser.tabs.tabMinWidth. Not sure if it is configurable elsewhere in the UI, I normally don't bother with that.

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#93

Post by benob »

cholindo wrote: post #66
benob wrote: post #63

Why doesn't this apply to any kind of cached content?

I guess that you can do fingerprinting with any cached content, but the insane persistency of favicon's cache makes this much more concerning.

If caching is bounded in time, can't you use other fingerprinting methods to seal the gaps?

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#94

Post by dns_snek »

weberer wrote: post #90
gus_massa wrote: post #73

Earlier quoted context omitted.

Isn't this covered by GDPR?

GDPR has a massive exploit where you can do whatever you want as long as you declare it "legitimate interest".

That must've escaped all of the legal teams of all the companies that have been fined. GDPR's biggest problem is its general lack of enforcement. Companies can still get away with just about anything because the overwhelming majority of violations are never investigated.

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#95

Post by dewey »

1718627440 wrote: post #79
snailmailman wrote: post #40

Earlier quoted context omitted.

My hacker news icon has been stuck as the icon for a weather site that I sometimes check. It’s been stuck that way for close to a year now, and has survived an iOS update too. It persists across profiles and into private browsing mode.

You guys have favicons? I don't have any in my tabs, but maybe I have turned that of at some point. I'm using Mozilla Firefox.

Firefox and Safari both have favicons in the tabs.

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#96

Post by prodigycorp »

garrettgarcia wrote: post #53
prodigycorp wrote: post #45

Earlier quoted context omitted.

Safari has super long lived favicon caches too. The only way to force a rebuild is to set your system clock forward a few years.

According to the Github page, you can just run `rm ~/Library/Safari/Favicon Cache/*`

iOS

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#97

Post by kgwxd »

jmward01 wrote: post #59

At some point we need actual consequences for sites that intentionally hide their tracking. It should be criminal. It is stalking and has real world consequences. Just because an exploit exists doesn't mean it should be used. That logic is like saying it is OK to break into a house because the lock on the door was weak. If we don't get real protections, at what point does it become justified to go offensive against s…

The only reason these things work is because we let our browsers silently execute arbitrary code. That logic is more like saying it is OK to enter a house because the owner sent you an invitation, then greeted you at the door and said "GO NUTS!".

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#98

Post by dragochat »

1718627440 wrote: post #78
dragochat wrote: post #68

Earlier quoted context omitted.

If you visit my eg. physical clothing store I'm allowed to monitor your in-shop behavior to better optimize my store for your needs. Same for a restaurant etc. That's how _you_ get _much improved services_ and I get _happier customers_. Ofc I'm not allowed to freaking resell that data. THIS is the problem in online: releseling and data-brokers. Just KILL these categories of businesses off completely and make _them_ c…

> As long as you're on _my (online) property_ and using _my services_ I can of course see EVERYTHING you f do That's fine, but you are not allowed to send me malware, that runs on _my property_ and snoops on _my data_. Also data doesn't stop being mine, just because you have it. You also can't take photographs of random people and claim this is yours now. That's an important difference between the USA and European co…

Well, we'd probably agree on most things... and re the photography example, afaik model release forms work similarly in the EU and US, right?

Now website code does typically run on your device, but I'd say that once you're a paid logged in user you clearly accepted to run it, under the conditions of it staying in its browser sandbox so... if you think it's "malware" then just stop being a customer. Otherwise software has a right to monitor its own operation.

...but yeah, maybe I missed the context a bit, a tracking pixel style tool will likely be used to track not customers but leads, so I do get your point, it gets trickier there and maybe privacy laws have a point there (as long as they stop there... hint: they usually don't!)

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#99

Post by timeon »

gus_massa wrote: post #73
jmward01 wrote: post #59

At some point we need actual consequences for sites that intentionally hide their tracking. It should be criminal. It is stalking and has real world consequences. Just because an exploit exists doesn't mean it should be used. That logic is like saying it is OK to break into a house because the lock on the door was weak. If we don't get real protections, at what point does it become justified to go offensive against s…

Isn't this covered by GDPR?

Unfortunately, future of GDPR is uncertain: https://noyb.eu/en/eu-commission-about-wreck-core-principles...

Re: Supercookie: Browser Fingerprinting via Favicon (2021)

#100

Post by cachius »

jgalt212 wrote: post #87
stingraycharles wrote: post #85

FYI for anyone that cares: this attack vector has been patched by browsers years ago, fairly soon after this was released. https://github.com/jonasstrehle/supercookie/issues/30

The link shows Chrome patched and unpatched this.

[Now Chrome] should reset tracking through favicons on cache deletions and when entering incognito mode. - https://issues.chromium.org/issues/40136308#comment19
Post reply on HN