8 ms·

Join a browser fingerprinting study

62 points by elsombrero 6y ago

jeroenhd 6y ago
I've signed up to see what it could find, but when I open the fingerprinting page in Firefox I just get loading spinners for most of the JS based tracking. I think Privacy Possum has prevented fingerprinting. I'll disable it for now, but I do wonder what this would mean for the results of the study.
- hwbehrens 6y ago
  It seems the intention of the study is precisely to determine the impacts that these plugins have on prevention (or facilitation) of fingerprinting. I think it should eventually complete, since mine did and I use a similar constellation of privacy plugins -- I think there is a timeout that eventually occurs once the various fingerprinting methods fail.
  - jeroenhd 6y ago
    I noticed several fingerprints without JS in my account when I browsed the results. I suppose some of the fingerprinting works, but even after waiting a minute my screen didn't work with the JS version.
Daho0n 6y ago
I think we killed it.
jonatron 6y ago
Firefox makes a fuss about anti-fingerprinting, and I have "Enhanced Tracking Protection" set to Strict, yet I see uncommon values for WebGL Vendor and WebGL Renderer in https://amiunique.org/fp https://amiunique.org/fp . Unless this study feeds into changing things like that, it seems a bit pointless.
- codetrotter 6y ago
  > yet I see uncommon values for WebGL Vendor and WebGL Renderer I don’t know how Firefox does it but instead of trying to make the WebGL fingerprint the same for everyone every time they could also try to make it unique for everyone every time and it would have the same effect. If every time you loaded a page your WebGL fingerprint differed then a website can’t use that to tell if it was the same browser that loaded the same page previously or any other page anywhere else previously. (Assuming that the WebGL fingerprint anonymization was so good that it could indeed not be correlated between different fingerprints in any meaningful way.)
  - bluedispatcher 6y ago
    This is what Brave does if I'm not mistaken.
  - kmeisthax 6y ago
    Part of the problem with either approach is that certain identifying information is also necessary for just making the web work. For example, on the EFF's Cover Your Tracks page (what is basically a fingerprinting demonstration), it shows that the screen resolution of my monitor conveys 16.25 bits of information. I use a particularly wonky landscape display mounted in portrait mode, which doesn't help the matter, but there's a problem: we can't lie about it. You see, a while back we decided to allow writing CSS that changed the design of a website based on the size of it's containing viewport. This is called "responsive design" and is very useful; however, it also means that websites rely on having a correct window size in order to display content correctly. We cannot be inconsistent about our lies: if we were to, say, lie about the screen resolution but still handle media queries faithfully, then not only can the fingerprinter see through our lie, it can use the fact that we lied as extra information. (Remember how DNT served as an effective tracking indicator?) So that would mean browsers would have to start, say, snapping browser windows to certain common viewports or capping the number of distinct breakpoints a website's CSS is allowed to have; both of which have UX or compatibility implications.
    - ifigjfur8485 6y ago
gnabgib 6y ago
This title lead me to believe I'd be finding the result of a study.. not receiving the sales pitch. There have been studies before[0] with available tools[1] and advice[2].. perhaps this should be linked to the results [3] OR the title updated to "Join a browser fingerprinting study" [0]: https://coveryourtracks.eff.org/static/browser-uniqueness.pdf https://coveryourtracks.eff.org/static/browser-uniqueness.pd... [1]: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/ [2]: https://restoreprivacy.com/browser-fingerprinting/ https://restoreprivacy.com/browser-fingerprinting/ [3]: https://browser-fingerprint.cs.fau.de/statistics?lang=en https://browser-fingerprint.cs.fau.de/statistics?lang=en
- dang 6y ago
  Ok, we'll put that in the title above. Since the same URL was posted as long ago as 2016 (https://news.ycombinator.com/item?id=11266172 https://news.ycombinator.com/item?id=11266172), it's not clear how current this is.
vehemenz 6y ago
Unfortunately, I think these studies are a bit naive because the proprietary, data-driven, probabilistic fingerprinting models used by Facebook and LinkedIn (to name two of the most elaborate fingerprinters) are years ahead of anything a few researchers could come up with. 1. Get a gazillion users on your site 2. Require a user account tied to a real person 3. Log IP, host, geolocation, and as many JavaScript/browser APIs as you can (there are hundreds at this point) 4. Among the fields you track, find the ones that ones that are the most stable and unique over time 5. Assign some probabilities to these fields to eliminate false positives 6. Generate personas for users for when they are at home, work, one their phone, etc.
- Supermancho 6y ago
  > Log IP, host, geolocation, and as many JavaScript/browser APIs as you can (there are hundreds at this point) That's fingerprinting, traditionally. Hence, the "Cookieless tracking" header right there on the page. If you are tying in other data, that's data aggregation for your business case and is fundamentally unrelated. I mean, generating personas and whatever "false positives" mean, has nothing to do with fingerprinting. If you cant differentiate from an anon user to another, that's data too.
- tjoff 6y ago
  7. Try to figure out what to do with the data generated by step 3 through 6. 8. Give up and stop at 2 instead.
  - vehemenz 6y ago
    Hah, yes. Although, once you have user account tied to a real person, it becomes much easier to analyze the data you generate with the fingerprinter.
- deleted 6y ago
  [deleted]
- weinzierl 6y ago
  > Facebook and LinkedIn (to name two of the most elaborate fingerprinters) are years ahead of anything a few researchers could come up with. Not only them. It is available to the masses[1] and I am afraid GDPR has given this trend a boost. [1] https://fingerprintjs.com/ https://fingerprintjs.com/
mbrumlow 6y ago
I am sorry. Not going to tie my email address to something trying to fingerprint my browser.
minimalist 6y ago
This [0] is a great set of configurations for the Firefox browser that remove many fingerprinting vectors. It turns on several fingerprint-homogenization features that the TBB project upstreamed into Firefox. Check it out! (By using this, G--gle will hound you with impossible capchas and privacy-forward search engines will think that you're a bot.) Most of these fingerprinting vectors are from the browser and the scourge of JS. I wonder about the footprint left by a user who doesn't use a browser, or instead uses some kind of parsing client that just fetches HTTP or data from API endpoint. Aside from the IP address, there are other ways to fingerprint a user based on network requests from various protocol leaks, many are presented here [1][2]. Are there any leak vectors missing from this list? [0]: https://github.com/pyllyukko/user.js https://github.com/pyllyukko/user.js [1]: https://www.whonix.org/wiki/Protocol-Leak-Protection_and_Fingerprinting-Protection https://www.whonix.org/wiki/Protocol-Leak-Protection_and_Fin... [2]: https://www.whonix.org/wiki/Data_Collection_Techniques https://www.whonix.org/wiki/Data_Collection_Techniques
- vorticalbox 6y ago
  Doesn't turning off all this make you stand out more? Surely if you want to hide your need to look like everyone else and hide in the crowds.
  - raspyberr 6y ago
    It's a tough call. You're right that blending in is better but also turning off JS cuts off access to a lot of fingerprinting vectors. That lack of extra information may result in you looking like many others.
- pacamara619 6y ago
  >By using this, G--gle will hound you with impossible capchas and privacy-forward search engines will think that you're a bot A friend of mine had an alternative theory: by making it very very hard to track you, you have shown to be somewhat intelligent and you have shown that you know more about computers than the average Joe. Goolag, knowing you're a somewhat intelligent human, gives you the very hard captchas it needs to train.

62 points by elsombrero 6y ago

I've signed up to see what it could find, but when I open the fingerprinting page in Firefox I just get loading spinners for most of the JS based tracking. I think Privacy Possum has prevented fingerprinting. I'll disable it for now, but I do wonder what this would mean for the results of the study.

hwbehrens 6y ago
It seems the intention of the study is precisely to determine the impacts that these plugins have on prevention (or facilitation) of fingerprinting. I think it should eventually complete, since mine did and I use a similar constellation of privacy plugins -- I think there is a timeout that eventually occurs once the various fingerprinting methods fail.
- jeroenhd 6y ago
  I noticed several fingerprints without JS in my account when I browsed the results. I suppose some of the fingerprinting works, but even after waiting a minute my screen didn't work with the JS version.

Daho0n 6y ago

I think we killed it.

jonatron 6y ago

Firefox makes a fuss about anti-fingerprinting, and I have "Enhanced Tracking Protection" set to Strict, yet I see uncommon values for WebGL Vendor and WebGL Renderer in https://amiunique.org/fp https://amiunique.org/fp . Unless this study feeds into changing things like that, it seems a bit pointless.

codetrotter 6y ago
> yet I see uncommon values for WebGL Vendor and WebGL Renderer I don’t know how Firefox does it but instead of trying to make the WebGL fingerprint the same for everyone every time they could also try to make it unique for everyone every time and it would have the same effect. If every time you loaded a page your WebGL fingerprint differed then a website can’t use that to tell if it was the same browser that loaded the same page previously or any other page anywhere else previously. (Assuming that the WebGL fingerprint anonymization was so good that it could indeed not be correlated between different fingerprints in any meaningful way.)
- bluedispatcher 6y ago
  This is what Brave does if I'm not mistaken.
- kmeisthax 6y ago
  Part of the problem with either approach is that certain identifying information is also necessary for just making the web work. For example, on the EFF's Cover Your Tracks page (what is basically a fingerprinting demonstration), it shows that the screen resolution of my monitor conveys 16.25 bits of information. I use a particularly wonky landscape display mounted in portrait mode, which doesn't help the matter, but there's a problem: we can't lie about it. You see, a while back we decided to allow writing CSS that changed the design of a website based on the size of it's containing viewport. This is called "responsive design" and is very useful; however, it also means that websites rely on having a correct window size in order to display content correctly. We cannot be inconsistent about our lies: if we were to, say, lie about the screen resolution but still handle media queries faithfully, then not only can the fingerprinter see through our lie, it can use the fact that we lied as extra information. (Remember how DNT served as an effective tracking indicator?) So that would mean browsers would have to start, say, snapping browser windows to certain common viewports or capping the number of distinct breakpoints a website's CSS is allowed to have; both of which have UX or compatibility implications.
  - ifigjfur8485 6y ago

gnabgib 6y ago

This title lead me to believe I'd be finding the result of a study.. not receiving the sales pitch. There have been studies before[0] with available tools[1] and advice[2].. perhaps this should be linked to the results [3] OR the title updated to "Join a browser fingerprinting study" [0]: https://coveryourtracks.eff.org/static/browser-uniqueness.pdf https://coveryourtracks.eff.org/static/browser-uniqueness.pd... [1]: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/ [2]: https://restoreprivacy.com/browser-fingerprinting/ https://restoreprivacy.com/browser-fingerprinting/ [3]: https://browser-fingerprint.cs.fau.de/statistics?lang=en https://browser-fingerprint.cs.fau.de/statistics?lang=en

dang 6y ago
Ok, we'll put that in the title above. Since the same URL was posted as long ago as 2016 (https://news.ycombinator.com/item?id=11266172 https://news.ycombinator.com/item?id=11266172), it's not clear how current this is.

vehemenz 6y ago

Unfortunately, I think these studies are a bit naive because the proprietary, data-driven, probabilistic fingerprinting models used by Facebook and LinkedIn (to name two of the most elaborate fingerprinters) are years ahead of anything a few researchers could come up with. 1. Get a gazillion users on your site 2. Require a user account tied to a real person 3. Log IP, host, geolocation, and as many JavaScript/browser APIs as you can (there are hundreds at this point) 4. Among the fields you track, find the ones that ones that are the most stable and unique over time 5. Assign some probabilities to these fields to eliminate false positives 6. Generate personas for users for when they are at home, work, one their phone, etc.

Supermancho 6y ago
> Log IP, host, geolocation, and as many JavaScript/browser APIs as you can (there are hundreds at this point) That's fingerprinting, traditionally. Hence, the "Cookieless tracking" header right there on the page. If you are tying in other data, that's data aggregation for your business case and is fundamentally unrelated. I mean, generating personas and whatever "false positives" mean, has nothing to do with fingerprinting. If you cant differentiate from an anon user to another, that's data too.
tjoff 6y ago
7. Try to figure out what to do with the data generated by step 3 through 6. 8. Give up and stop at 2 instead.
- vehemenz 6y ago
  Hah, yes. Although, once you have user account tied to a real person, it becomes much easier to analyze the data you generate with the fingerprinter.
deleted 6y ago
[deleted]
weinzierl 6y ago
> Facebook and LinkedIn (to name two of the most elaborate fingerprinters) are years ahead of anything a few researchers could come up with. Not only them. It is available to the masses[1] and I am afraid GDPR has given this trend a boost. [1] https://fingerprintjs.com/ https://fingerprintjs.com/

mbrumlow 6y ago

I am sorry. Not going to tie my email address to something trying to fingerprint my browser.

minimalist 6y ago

This [0] is a great set of configurations for the Firefox browser that remove many fingerprinting vectors. It turns on several fingerprint-homogenization features that the TBB project upstreamed into Firefox. Check it out! (By using this, G--gle will hound you with impossible capchas and privacy-forward search engines will think that you're a bot.) Most of these fingerprinting vectors are from the browser and the scourge of JS. I wonder about the footprint left by a user who doesn't use a browser, or instead uses some kind of parsing client that just fetches HTTP or data from API endpoint. Aside from the IP address, there are other ways to fingerprint a user based on network requests from various protocol leaks, many are presented here [1][2]. Are there any leak vectors missing from this list? [0]: https://github.com/pyllyukko/user.js https://github.com/pyllyukko/user.js [1]: https://www.whonix.org/wiki/Protocol-Leak-Protection_and_Fingerprinting-Protection https://www.whonix.org/wiki/Protocol-Leak-Protection_and_Fin... [2]: https://www.whonix.org/wiki/Data_Collection_Techniques https://www.whonix.org/wiki/Data_Collection_Techniques

vorticalbox 6y ago
Doesn't turning off all this make you stand out more? Surely if you want to hide your need to look like everyone else and hide in the crowds.
- raspyberr 6y ago
  It's a tough call. You're right that blending in is better but also turning off JS cuts off access to a lot of fingerprinting vectors. That lack of extra information may result in you looking like many others.
pacamara619 6y ago
>By using this, G--gle will hound you with impossible capchas and privacy-forward search engines will think that you're a bot A friend of mine had an alternative theory: by making it very very hard to track you, you have shown to be somewhat intelligent and you have shown that you know more about computers than the average Joe. Goolag, knowing you're a somewhat intelligent human, gives you the very hard captchas it needs to train.