Cookies are ancient technology, and in no way necessary of even particularly desirable to track you. Modern fingerprinting doesn’t need them at all.
A live demonstration of everything a website learns about you before you click anything with no cookies. It reads you during the connection and in the first two seconds of JavaScript, then narrates what it found back to you in plain English, as if a stranger were describing you out loud.
The argument isn’t “look how creepy this site is.” It’s: the site you visit after this one can do all of it too, and won’t tell you.
↫ Kuber Mehta
Also note, as the demonstration does, that if some of the things it determines about you are wrong, that doesn’t really matter. In fact, it may actually make fingerprinting and tracking you easier; as long as fingerprinting consistently gets the same things wrong in the same way, it becomes a valuable part of the fingerprint, like a small scar obscuring part of your real thumb’s fingerprint.
Online tracking of people should be illegal.
That site probably has enough generic information about my hardware and setup to uniquely identify me, but the closest it got to *personally* identifying me was the general area in which I live, and it got the city wrong.
There is still a lesson to it: as soon as you leave your peer group, you are marked. Something like “Nigeria:Linux:German:Scriptblocker” identifies you better than your International Password. Kind of obvious, but I never thought of this honestly (Not that it really matters, I stick out anyway).
WorknMan,
It’s interesting to see the stuff it got right and wrong. The microphone test, laytex test, and gpu test are all wrong for me. While the inferences aren’t reliable, wrong values can still contribute to a browser’s uniqueness.
IP to location databases are frequently wrong because they often geolocate the ISP infrastructure rather than the subscriber, Although it terms of fingerprinting the IP gets used directly and the inferred city doesn’t contribute any additional information.
The one that surprised me is the mysql test. I think FF is guilty of unnecessary data leaks here and they probably should fix this. The browser has no business letting websites scan local ports to do a timing attack.
Browsers can do a better job mitigating these fingerprinting techniques. Everything is a tradeoff. CSS “visited” styling used to be a pretty big leak, and they made changes minimize the opportunity for leaks to happen.
https://blog.mozilla.org/security/2010/03/31/plugging-the-css-history-leak/
They could probably revisit this for the modern era. Don’t let webpages scrape plugins is an obvious one. Does a webpage need to know my screen size (as opposed to current window size) or how many cores I have? Probably not. Such leaks could be disabled by default. Let people intentionally enable them.
This is extremely similar to the EFF’s work on “Cover Your Tracks” (formerly Panopticlick) to expose sophisticated fingerprinting techniques.
https://coveryourtracks.eff.org
I think the idea is to make it so that your fingerprint changes all the time.
I am not sure how effective my setup is, but I use a mix of:
– CanvasBlocker
– uBlock Origin
– noScript
And I avoid downloading custom fonts and set all deep Firefox settings to the strictest I can, plus also clearing cookies all the time (whenever I need to accept them). I have to relogin to stuff every single time so is life. I got used to it.
Well, being a tall white and velly hansom man always sells me out — having 2 large screens with Firefox/Scriptblocker and English locale does not add much. Just 1 : 127 million feels like an insult …
Nice to have another demonstration of the kinds of things that get forged by the privacy.resistFingerprinting=true that got upstreamed into Firefox from Tor Browser.
(4 CPU cores, 4096×2160 display with 2x pixel scaling, a camera that I don’t have plugged in at the moment, a list of fonts “that render” which doesn’t match what I actually have, forced timezone offset 0 (UTC) that the ad thing inferred to be “Atlantic/Reykjavik” for some reason, etc.)
The site claimed that I have a camera and a mic connected, which I don’t have. Also, it considered VPN as “connectivity in a corporate environment”. Also, it actually asked me for permissions.
I changed VPN location and also the browser, for a fresh Basilisk instance and it told me that I have “13362 text-to-speech voices installed, the exact set is a strong fingerprint. You’ve got LaTeX’s fonts installed. Academic papers, or a maths-heavy day job.”
What a BS.
oh, and the “WebRTC just leaked a different public IP” part turned out to be wrong. Hundreds of kilometers away from my actual location. VPN seems to be doing its job.
niebuszewo,
How is it that you have the same avatar as “ssokolow (Hey, OSNews, U2F/WebAuthn is broken on Firefox!)”?
Anyway it did make many of the same mistakes for me under FF. The website probably should have made a bigger point of focusing on browser uniqueness. The https://coveryourtracks.eff.org website is geared more that way, telling you exactly how strong it believes your browser fingerprint is.
WebRTC is tricky because it can leak connection candidates outside of the VPN. This depends on both the browser and the VPN. Here is more information about it.
https://whatismylocation.org/blog/webrtc-leak-explained
Here is a specific tester that outputs the webrtc information that websites are getting.
https://ipleaks.io/tools/webrtc-leak-test
In my case FF uses a random algorithm on every request to mask the local ip addresses. Values that change can’t be used for fingerprinting.
IMHO if you’ve got a static IP address, a browser fingerprint has been effective for a long time. But if you’re behind a VPN or CG NAT, then finding enough unique data becomes much harder. Settings that are rare might still be unique even without a static IP, but without cookies there’s a good chance that tracking websites will end up sticking multiple users with common setups in the same bucket.
For example according to cover your tracks…
1 in 151k is not sufficient to identify a browser worldwide. It is conceivably enough to uniquely track someone within a VPN’s customer base though even if traffic gets mixed up with other customers. You need a fingerprint hardened browser to mitigate this.
> How is it that you have the same avatar
It seems we are both Louis Rossmann fans.
Well, it is more like “you don’t need a bike, you can use an unicycle” — these are useful techniques for fraud or spying, but massive adtech & social networks will still rely on cookies, these small fraction of users using even most basic privacy-friendly settings is simply not worth the effort.. Anonymous browsing is also not about not being fingerprinted but about not sharing the same fingerprint between personas online, like fighting gov corruption in one tab and checking work e-mail in the other.
This is a very interesting thought experiment, but also happens to be fundamentally broken. It makes a cardinal sin in statistics.
It does the “I can identify you to 1 in a million” (or in one case one in 100,000,000), but does this by multiplying probabilities. Very tempting, but will fail you on STA101, unless you can prove these variable to be independent.
They are not.
(Changing all these numbers for privacy, but they are in the same ballpark)
It does not work like that. This only tells:
Unfortunately for them, there are hundreds of thousands of us.
Ironically, this makes identifying privacy protecting people easier. If I were in a remote place, using a VPN, using a niche browser… It would be a much narrower group.
Good idea, terrible implementation.
sukru,
You’re right you can’t naively multiply correlated odds. IIRC coveryourtracks factors this in.
Sure, but conversely linux users could be more likely to customize their system in a way that diversifies fingerprints.
Of course this is all handwaivy, we need actual raw data to conclusively answer such questions, and I don’t have the data.
Just as a thought experiment though, coveryourtracks put my browser’s uniqueness at 1 in 151k. Assuming this is fairly representative, it could plausibly be enough to distinguish between all of of us on osnews without using cookies or IPs. Statistical arguments are strictly weaker than specific data, but it might actually be the case that everyone here could be uniquely identified with zero collisions.
Clearly a huge website like facebook with billions of visitors is going to have more collisions, but once you add back IP based tracking it could resolve many of those collisions. Obviously changing IPs makes it harder to track “travelers”, but even so there’s still a lot of information about repeat visits. Mathematically, your fingerprint doesn’t have to be unique across the entire world, it only has to be unique across the set of IPs you can potentially connect through.
So if I use a VPN provider with a class C (~256 ip) network and 50k subscribers, my 1 in 151k fingerprint, there’s still a chance that my browser could be uniquely identified in the traffic on these VPN IPs. In other words the fact that my fingerprint isn’t unique across the whole internet doesn’t strictly mean fingerprinting can’t identify me. The main caveat with fingerprinting is that outside of controlled experiments, one doesn’t necessarily know if there’s been a collision or not.
Ultimately the main reason I’d say fingerprinting isn’t that relevant for tech companies is because they already get our identities when we log in. And with governments increasingly pushing compulsory identification, fingerprinting could become increasingly redundant.
Thinking off the cuff, there are other potential ways to leak information that we rarely think about.
Timing
Even if you use a VPN, javascript ping several websites through it. You can generate an arbitrary number of samples.
you – VPN provider – websites
With enough samples, a website can get a good approximation for the ping between you and the VPN provider. Even when the VPN is working correctly, this information may potentially help distinguish between you and another user accessing the VPN at the same time.
The obvious mitigation for timing techniques is to deliberately add jitter, but how many people actually do that? Also be careful about how you add jitter because it’s not just timing that’s at risk, one’s “jitter profile” can make sessions more distinguishable too.
Also depending on your setup, a similar technique could be used with DNS. Every unique path that can be timed before the VPN adds new information that could make your profile unique.
TTL
Network packets have time to live counters in them and this can be used to differentiate sources. If you don’t use a VPN this is naturally a strong indicator. If you do use a VPN, TTL won’t count hops through the encrypted VPN, but will count the unencrypted network hops before and after it. This could differentiate between users with different VPN setups.
TTL values can be deliberately enumerated to see which routers respond via ICMP. This is exactly how tools like traceroute/tracepath are implemented. Usually we’re accustomed to seeing this work on the user’s end, but technically the server’s end can do it too. I’m genuinely curious if common VPNs would actually forward the ICMP packets from behind the VPN? If so, this could clearly leak more information.
While all of these behaviors change according to one’s configuration, the fact that there can be different configurations is what fingerprinting is all about.
OS Probing
A server can probe operating system implimentation details via standard tcp sockets. Such as retries.
Alfman,
Yes, ironically, you’d be advertising your identity by customization, or worse, using random values.
Just erasing with most common things out there makes de-anonymization much more difficult.
“Hello, I’m Alfman,
I use the most popular phone, with most popular browser, my screen is 1080p, I have all the standard web fonts available.
Did I say Alfman? Sorry my name is John Smith, and I live at 123 Park Street”
Maybe keep Linux as it is popular enough, and one might want to at least leave a mark in global usage metrics.
The only real VPN is Tor, and that is causing too much headache. Basically all Cloudfare hosts will require you to go through infinite loop of CAPTCHAs.
Yes, this is the ultimate point, We have collectively decided privacy was not very important on the web. And when there were actual good features to pursue, the astroturfing campaigns worked unfortunately well.
Just as Assassin’s Creed games…
“Don’t hide in the shadows, hide in the crowds”
sukru,
Not that long ago they pushed out a faulty update and I couldn’t access any cloudflare protected websites using FF. They fixed their bug, but not before many websites became simultaneously inaccessible. It’s stunning to see how many websites are controlled by cloudflare. The cloudflare denial of service outage created a spike in reports on downdetector. Even though it was only an accident, it really highlights how dangerous it is for everyone to put all their eggs in so few baskets. I’m not against against what cloudflare does, but I am strongly against such high concentration of gate keepers. Monocultures are dangerous.
Not familiar with the game, but it’s an interesting point.
When the majority of websites don’t follow the “rules”, there’s safety in numbers and you can ignore bad rules without repercussions. However if enough people follow the rules to create a new normal, suddenly it becomes a lot riskier to break them.