Race Is On to 'Fingerprint' Phones, PCs

http://online.wsj.com/article/SB10001424052748704679204575646704100959546.html

by mikeknoop • 16 years ago

47 41 16 years ago

online.wsj.com

holdenc• 16 years ago

Based on this article you can "fingerprint" a computer using the following combination of attributes:

- Precise timestamp

- Monitor size

- User agent

- Browser plugins

- and fonts (!)

Really?? I use several browsers, and switch out a few external displays for my laptop. Plugins come and go with the browser version. My system time is synced to a timeserver (as I imagine are many other computers) but sometimes not. Based on these data, it's hard to believe anyone could truly trace my hardware over time.

msy• 16 years ago

It doesn't matter whether it actually works anywhere near as well as the hyperbolic sales pitch as long as advertisers buy it. It's nothing more than cookies and metadata collected by javascript, probably hashed together to produce a unique ID.

nodata• 16 years ago

Yes. Fonts are the key. See the EFF site for a demo: https://panopticlick.eff.org/

dangrossman• 16 years ago

They don't really need to trace your hardware over time. They're selling the info against the device, not against the person. Someone might want to target ads to your activity profile at work, someone else might want to target ads to your activity profile on your laptop at night. It might actually be better for the advertisers to have separate profiles for those machines than one for you the person.

You may switch browsers and displays and plugins all the time, but someone like you is very rare. More people have never strayed from their Windows XP and Internet Explorer for the past 9 years than not.

jakevoytko2• 16 years ago

The EFF tested this themselves. They run a website, http://panopticlick.eff.org, comparing with computers that have visited in the past. They have over a million fingerprints at this point, and my Chrome install is "unique."

It displays all data it lifted from your machine, along with how rare each datum appears to be. On my Chrome 7.0.517.44 install, I appear to be identifiable by my user agent (1 in 182,518), browser plugins (1 in 1,277,632) and system fonts (1 in 638,816).

kolmogorovcmplx2• 16 years ago

Even the default IE8 on my stock Windows 7 Enterprise appears to be unique. In that case it's the browser plugins which identifies it (1 in 1277688). My installed plugins are nothing out of the ordinary: Java, Flash and WindowsMediaplayer.

gjm11• 16 years ago

Panopticlick claims that my user agent (Firefox 4.0b7 on Windows XP) is about 1/15,000. That seems unlikely.

It claims that my http_accept (text/html, STAR/STAR ISO-8859-1,utf-8;q=0.7,STAR;q=0.7 identity en-gb,en;q=0.5 -- except that I've replaced asterisks with "STAR" to avoid HN formatting confusion) is about 1/19,000. That seems even more unlikely.

I suspect these have the same cause: they have this big database of browser information, gathered over time, and recent browsers are underrepresented. So anyone running a Firefox 4 beta, or a recent Chrome build, will show up as being very unusual in the database, but that's misleading because some of the older entries in the database will represent browsers that are no longer in the pool, whose users are now using something more recent.

On the other hand, I don't find it so hard to believe that my browser plugins give 20 bits or so of information. (Though some of the same bias will affect this figure.)

In case it isn't obvious, by the way, their figures are simply the fraction of records in their database that have the same user agent / browser plugins / system fonts as yours. The browser plugins figure is 1/1,277,632 (or, for me a little later, 1/1,277,946) because that's how many times the Panopticlick site has been used.

Hmm, I wonder how they defend against having the same user run their test twice in a row. (Answer, having tried it: they don't. Probably a good thing since the obvious non-privacy-compromising way could skew their figures a bit.)

jodrellblank• 16 years ago

When I run it twice in a row, why am I still unique?

keltex• 16 years ago

Probably works fine for PCs, but for iPhones, iPads and other devices that are more uniform, they'll probably have to stick with cookies.

Do phones' timestamps differ?

trun• 16 years ago

I believe most mobile devices already have unique device IDs built in. Perhaps they're not accessible through JavaScript, but it sounds like this technology already goes beyond the web browser anyways.

golgo13• 16 years ago

-Your browser fingerprint appears to be unique among the 1,279,589 tested so far.

Guess using Opera helps with my uniqueness! >_<

palewery• 16 years ago

This sounds great until the spammers get involved.

kolmogorovcmplx2• 16 years ago

This is an effective demonstration: http://panopticlick.eff.org/

cicero• 16 years ago

When I saw the title, I thought it was going to be about the FBI trying to find the source of WikiLeaks material.

jakevoytko2• 16 years ago

I foresee a future where the Adblock crowd runs a plugin that randomizes the data returned by browsers. It wouldn't take many variations in user agent strings, reported browser plugins, and system fonts to give you a quasi-anonymous footprint each time you visit a website.

neworbit2• 16 years ago

or a completely identical infoblock - anonymity of the crowd

pierrefar• 16 years ago

Surely by labelling yourself with this identical info block you're marking yourself as a type of person?

SageRaven• 16 years ago

A couple of years ago, I set up privoxy to rotate my user agent string periodically, usually once an hour (once I even changed it once per request). As fun as this was, even when running adblock and noscript and flashblock, it was obviously not very effective.

This kind of fingerprinting does not bode well for TOR users. What is required is an intermediate proxy that modifies the out-bound browser traffic to delete or randomly modify these highly-unique sets of info (font sets, plugin sets, etc.) presented by the browser.

I'm still amazed at how much info flash, java, and javascript can glean about a system. I'm curious... is it possible to get the username or file/directory names readable by that user from the browser?

Silhouette3• 16 years ago

The question we should all be asking is: why on Earth do browsers transmit all of this information to web servers in the first place?

A few details, window size for example, might have a legitimate purpose and could at least be requested by the web server and provided optionally. However, this sort of fingerprinting technique is pretty obvious to anyone who's ever stuck an analyser on their system and looked at what a typical HTTP transaction to fetch a web page looks like. As far as I can see, there is no need for most of it.

qjz2• 16 years ago

In my experience, there's enough basic information in the HTTP transaction to identify a unique visitor for most forensic purposes. However, the level of detail available for fingerprinting goes far beyond this. I just performed a little experiment, disabling as much as I could in Firefox to affect my uniqueness at http://panopticlick.eff.org/. I was surprised when disabling plugins (font info comes from java & flash) and even cookies had virtually no effect. It wasn't until I disabled JavaScript before I dramatically lowered it from 7 figures to 5. I'm going to try surfing this way and adding exceptions to see if I can sustain the experience for a while.

ams6110• 16 years ago

The more unusual your configuration, the more likely it is to be unique in the context of things you can't change. Most people don't run with all these things disabled...

Encosia• 16 years ago

The thing about Panopticlick is that the two most "accurately" identifying methods aren't stable fingerprints. As soon as you install an update to one of your plugins (the constant Adobe updates come to mind), your fingerprint is altered. Similar with the font list; programs seem to be installing new fonts on my system all the time, which makes that fingerprint unstable as well.

omh2• 16 years ago

Really? I can see a good use case for the ones that are described at Panopticlick.

Things like http_accept, plugin details and fonts are necessary if you want to use the capabilities of the client - you need to know what they have. The time zone, screen size and (to a certain extent) user-agent let you customise the content you serve in an appropriate way.

Providing it "optionally" doesn't seem like a solution. If you were prompted every time then most people would turn it on anyway, and any ad network site would obviously ask for everything that it could possible get.

Silhouette3• 16 years ago

Things like http_accept, plugin details and fonts are necessary if you want to use the capabilities of the client - you need to know what they have.

I disagree rather strongly with sending things like user agent strings, plugins and fonts by default. There should be no need for a web site to know anything about either. Indeed, customising content to that degree based on specifics of the client's software identity rather than providing adaptive content seems somewhat anti-WWW to me.

Moreover, given the number of plugins with security issues widely available for some browsers, sending a list of installed plugins and versions with every HTTP request is practically begging to get malware back if you're not 100% patched up (and even if you are, if you're unlucky with a 0-day exploit).

Let me put it this way: most web sites that I've encountered actively modifying their content based on specific user agents have been places like banks, and usually the reason I know that they were doing this is because they got it wrong and consequently refused to serve perfectly good content to a browser perfectly capable of rendering it as intended because of concerns about some security flaws in browsers from another era. I'm not sure I have ever come across a web site that actively modifies the content it provides based on the browser plugins or fonts on the client system.

On the contrary. I think people would very quickly tire of visiting sites whose ad networks caused such problems, and the ad networks would have to give up doing it or quality sites would drop them. Indeed, the only common uses for this kind of information today seem to be supporting user tracking or deployment of targeted malware from compromised sites. Providing the detailed information only to sites that explicitly request it and possibly only if the user's security settings permit would make life more difficult for both groups, and I have no problem with this outcome.

AngryParsley• 16 years ago

Because not transmitting that information doesn't get you much. You only need 30 bits of identifying information to track a billion users. With basic stuff like IP address, time zone, screen size, user agent, and supported plugins, you're pretty much there.

The web server asking the browser "do you support X?" increases latency and doesn't help anonymity. Bad web servers could just ask, "Do you support X, Y, Z, and what's your screen size..." If each of these questions prompts the user, it's a usability nightmare. If the browser's answers are configurable, why not make current browser information configurable instead of inventing a new standard?

Silhouette3• 16 years ago

You only need 30 bits of identifying information to track a billion users.

You need 30 unique bits of information.

Given that there are only a handful of common screen resolutions, for example, they are unlikely to represent more than a few bits in most cases, and if you provided current size of the viewable area in the browser instead (a more useful measurement anyway) then in many cases this would change over time. If you further provide this information only on explicit request, and potentially lock it down to only the host site rather than third party content, then it is of almost no use to anyone with unwelcome intentions.

deutronium2• 16 years ago

They could use TCP time stamps to estimate the clock skew of devices, as they access web services.

See "Remote physical device fingerprinting - Tadayoshi Kohno, Andre Broido, kc claffy"

xtacy• 16 years ago

Doesn't nmap have a whole bunch of such fingerprints stored in a database?

deutronium2• 16 years ago

Nmap only gives you information on the version of OS and of network applications.

e.g.

   nmap -sV 127.0.0.1

   Starting Nmap 5.00 ( http://nmap.org ) at 2010-12-01 18:28 GMT
   Interesting ports on localhost (127.0.0.1):
   Not shown: 997 closed ports
   PORT      STATE SERVICE   VERSION
   631/tcp   open  ipp       CUPS 1.4
   2000/tcp  open  callbook?
   24800/tcp open  kvm       Synergy KVM

runjake• 16 years ago

I worked on this a long time ago and knew of others working on the same idea. I didn't pursue it for financial gain because it seemed too sleazy.

If you're curious what kinds of information your browser gives to a remote server, creating a "test.php" file with the contents "<?php phpinfo(); ?>", and opening that page in a browser is a good start. There are some other ingenious (read: I didn't think them up) methods, but I don't want to help the spammers n' spies.

These days, I use them in forensics.

orangecat• 16 years ago

BlueCava says the information it collects about devices can't be traced back to individuals

Well that's just blatantly false.

binarymax• 16 years ago

I remember some while back (8 or 10 years? I cant remember exactly when) - Intel was trying to give each processor a GUID so that certain transactions could be traced back to the chip. Didn't go over well at all and Intel eventually pulled back.

I wonder if the same uproar will happen this time around?

omh2• 16 years ago

I wonder how this deals with corporate PCs.

We have dozens of desktops running identically imaged copies of Windows/browser/plugins and all behind a single NATed IP. I imagine that they'd all look the same to one of these systems.

If they start serving up adverts then perhaps I'll start seeing ads targeted at something one of my co-workers has been searching for. That could get interesting!

fingerprinter• 16 years ago

(throw away account...)

Full disclosure: I wrote one of these systems (AMA)

1. You'd probably be surprised what we can figure out from this. You'd also be surprised that there isn't much you can do to stop it from happening b/c we've been able to find ways to get information that is actually outside the browser.

2. You'd probably be surprised to see how embedded this is already. I'm guessing most people have had their browser fingerprinted at least once...for some reason. Knowing who used the services I wrote, I can tell you that they are everywhere...and given that I know our competitors also have this technology and who they work with...well...

3. There are legitimate uses to this tech besides spam. Its just that the money is in spam. I'm near 100% certain that most people will use this for spam in the next year or two.

pyre2• 16 years ago

  > You'd also be surprised that there isn't much you can
  > do to stop it from happening b/c we've been able to
  > find ways to get information that is actually outside the
  > browser.

I find it hard to believe that you're going outside of the browser if Java/Flash/JavaScript are uninstalled or disabled. Are you claiming to be using 0-day browser exploits to get information from outside of the browser?

Race Is On to 'Fingerprint' Phones, PCs

Related Stories