Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Panopticlick – How Unique, and Trackable, Is Your Browser?

panopticlick.eff.org

Post reply on HN
Print view View original

1–10 of 61 posts

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#2

Post by engtech »

Forgive me if I'm wrong, but it looks like if you could install a system font on a computer then you could create a unique fingerprint for that computer that is detectable by any website?

I am uniquely identifiable out of the 3.7 million samples because of my system fonts.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#7

Post by ds9 »

I'd like to have more control over the Javascript runtime in the browser. Defeating this identification trick is only one of the reasons.

Suppose you had a list of options and could selectively disable, for example, monitoring of mouse movements on one site, or ajax on another. And for this in particular, something that would feed the site random values from a particular range for fonts installed, plugins installed, screen size and other such information.

Using that data in development would still work because 99% would keep the default "true" values, and the few geeks who would change them would get what they should/would expect on sites that rely on those values. But everyone should have the power to control what info they're giving out, and what Javascript is allowed to do on their own device.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#8

Post by WiseWeasel »

ds9 wrote: post #7

I'd like to have more control over the Javascript runtime in the browser. Defeating this identification trick is only one of the reasons. Suppose you had a list of options and could selectively disable, for example, monitoring of mouse movements on one site, or ajax on another. And for this in particular, something that would feed the site random values from a particular range for fonts installed, plugins installed,…

They didn't use any JavaScript to get this information. Most of it is sent by your browser in the request headers, and the font detection used Flash and Java. They could have used JavaScript to detect fonts as a fall-back when Java and Flash are disabled, but it's relatively complicated to do so (requiring you to know the rendered width of a string for each font you're trying to detect), and it was not included in this example.

Sending incorrect information for Java or Flash fonts is an interesting idea, and likely would not affect user experience, as non-standard fonts are often served with the animations. Sending the wrong screen size might get you a mobile site served when you were wanting non-mobile or vice-versa. IP address and ISP are valuable bits of identifying information as well, and those are more difficult to address without using a proxy. But I would bet that randomizing your screen size for each request would break most fingerprinting code, since that would be assumed to be static.

Re: Panopticlick – How Unique, and Trackable, Is Your Browser?

#9

Post by evoloution »

Mine is unique too, I checked Firefox, chrome and IE. I guess it is trivial for large companies to generate unique ID numbers for these unique fingerprints and crosscheck against cookie/login databases to extract e-identity. Is there an easy way from stopping browsers to broadcast this information? Using the Internet anonymously is really hard these days...

EDIT: Maybe it is even better for browsers to broadcast the most common settings if EFF discloses this information.

Post reply on HN