Cover Your Tracks

https://www.eff.org/deeplinks/2020/11/introducing-cover-your-tracks

by cpeterso • 6 years ago

694 256 6 years ago

n0nc36• 6 years ago

Browser fingerprints are turning up in court cases now. Probably not wise of EFF to frame it as "covering your tracks". It's more like "closing your blinds".

https://www.theregister.com/2019/07/17/exmicrosoft_engineer_...

https://regmedia.co.uk/2019/07/17/us_v_kvashuk.pdf

filmgirlcw• 6 years ago

Just a hunch, but I bet that a legal advocacy group chooses the names for their programs pretty carefully.

ksm1717• 6 years ago

I mean it was formerly called panopticlick

saagarjha6• 6 years ago

“Closing your blinds” doesn’t have “track” in its name.

totalZero3• 6 years ago

Considering that it's an anti-tracker tool, I think it's an appropriate and easily justifiable name.

colechristensen• 6 years ago

It’s not about being justifiable, it’s about what a jury will think when the prosecutor parades a “cover your tracks” tool you used in front of them.

Sometimes you just don’t want to have to try to win that argument.

godelski2• 6 years ago

I often see this stuff and every result from every person I've seen is that fingerprints are unique. Even with DNT enabled, tools like uBlock, privacy badger (an EFF tool!), etc people are still unique. How does one actually become not unique? I'm on Apple hardware, so I can't imagine my hardware is unique (other than silicon lottery) and using Firefox. Testing in Safari shows "nearly unique" (1 bit difference than my FF results) so I gotta imagine that near is myself.

How does one actually make themselves non-unique?

And can we make things more transparent? How many bits is enough?

n0nc36• 6 years ago

You make yourself non-unique by looking like others. In that sense your privacy is limited by the precautions that others take.

Turning off javascript is a very good thing to do. The more people that do it, the stronger a protection it will be.

alquemist7• 6 years ago

What I want for Christmas is javascript disabled by default, plus one-click ability to enable for specific sites.

Random browsing => no javascript.

Play a browser game => javascript.

I have this today with Flash, would be nice to have it for all client-side code execution.

godelski2• 6 years ago

I don't buy this. A 2017 Macbook Air and Safari should be a pretty common setup, yet I am far from unique (more bits than the FF I'm running).

mpeg• 6 years ago

Turning off javascript actually makes your browser more unique, in most cases, as it's so rare for people to do.

iguy• 6 years ago

You make yourself non-unique by looking like others. ... limited by the precautions that others take

Yes. This is why it would ideally be done by the browser, not by individuals. If Safari reported only its top-level version number (and only exposed the installed-by-default fonts, and so on) then millions of others would suddenly look like me.

nazgulnarsil• 6 years ago

I'm guessing each one bit reduction decreases the number of people they can uniquely identify by half.

monkeycantype2• 6 years ago

Maybe we need to run browsers in a virtual machines that poison data gathering by simulating rolling profiles populated with fake history and bookmarks, where all your real bookmarks, history, cookies and passwords are held outside of the browser by a separate program that interacts with the browser using an automation framework like puppeteer.

I wonder what already exists like this?

arminiusreturns3• 6 years ago

Now you are in sockpuppet land, and there are a few established companies that keep a low profile as is the modus operandi for the miccimac (curious about the term?, look up Ray McGovern)

thethirdone• 6 years ago

My results for cover your tracks is not unique (only 13 bits). Not enabling javascript prevents lots of fingerprinting.

surround8• 6 years ago

The Tor browser is really effective at preventing fingerprinting.

sillysaurusx2• 6 years ago

Not really. Even something as small as maximizing your tor browser window can indicate to whoever's watching that you're one of N people using that same screen resolution.

And sure, N is pretty big for popular websites. But the less popular the site, the less it holds up.

Tor is about the most effective thing we have, but I'm not sure "really effective" is fair. It gets the job done sometimes, but it also leaves a lot to be desired.

Still, I'm grateful Tor exists.

ta36143058362412• 6 years ago

We also found TOR effective, especially on the Safest setting (~10 bits).

Firefox comes close with uBlock, NoScript, privacy.resistFingerprinting, and strict privacy settings

saagarjha6• 6 years ago

Yep, I don’t trust this very much. Two of the same iPhones that are fully updated and in the same region should be essentially indistinguishable by the things they mentioned.

absolutelyrad• 6 years ago

It isn't. I've worked with a company in past that has the most advanced tech available. It can uniquely identify iPhones of same model/make/year/os/safari version in the same region under the same ip address.

They promised that the tech would always give a stable and unique id from the browser. And it worked too, but it wasn't public and not for ad tech purposes.

mayneack• 6 years ago

For what its worth, I have mostly non-standard things and it thinks I'm not unique (18 bits)

Brave, piehole, ubuntu, custom desktop computer. I didn't even disable javascript.

bbirk• 6 years ago

I had the same problem, but after setting tracking protection to strict in ff I am now only nearly-unique according to this test. Also this page [1] shows some more details around fingerprinting, although I don't know if it works the same as the page announced here.

[1] https://amiunique.org/fp

alquemist7• 6 years ago

Ironically, amiunique.org is broken with JS disabled.

throwaway1892622• 6 years ago

There's Firefox plugins like Chameleon that corrupt fingerprints.

Besides that, Tor browser is really your only option.

We're in so deep it will take years to reverse fingerprinting vectors. If it's even possible

deadwing04• 6 years ago

Are there any catalysts to reverse our course?

onli• 6 years ago

Chameleon does not seem to be enough. Or do you have some pointers how to configure it?

The EFF site showed two fingerprint ids that were completely unique for my browser: window size (because of my dock) and the http-accept headers (because of my language selection). That's with FFs fingerprint-resist option enabled. Chameleon can spoof those, which is great, and it gives access to the fingerprinting option which I think FF does not expose properly outside of about:config. So it should greatly reduce my identifiablity, but according to the site it does not help much, even if the specific categories are now almost unique. Like they explain, the combination seems to be the problem, or maybe they are not exposing the category that gets me.

Edit: Okay. The solution seems to be: Chameleon with most of the options enabled, so as much spoofing as possible, but without activating FF's fingerprint-resist option. Probably sending no data is worse than sending spoofed data!

+ Ublock of course.

dymax783• 6 years ago

I’ve not compared the two in any great length, but another add-on that aims at protecting against fingerprinting is CanvasBlocker.

sillysaurusx2• 6 years ago

Use whonix. https://www.whonix.org/wiki/Documentation

It's basically a virtualbox VM that you run a browser inside of.

No, it's not really practical. But yes, it works. If you're doing nefarious things, that's probably the #1 thing you should use.

gruez5• 6 years ago

That doesn't really solve the fingerprinting issue. Hardly anyone uses whonix for everyday browsing, so you'll be that guy[1] with the obfuscated fingerprint

[1] https://xkcd.com/1105/

fastball• 6 years ago

I use Brave, and this website says I have a randomized fingerprint which protect from tracking.

ffpip• 6 years ago

Yes. They randomize your fingerprint output, every session, and for every website.

https://brave.com/brave-fingerprinting-and-privacy-budgets/

bigiain4• 6 years ago

It says my iPad running iOS14.2 with no particular attempt to increase or decrease its privacy level is unique. Most of that seems to be the small sample size they have so far couples with the fact Safari is telling them my screen size, en-au language setting, and my Sydney/Australia Timezone. I suppose it’s entirely plausible I’m the only iPad Air 2 user on 14.2 in Sydney to have checked using their site so far...

dehrmann2• 6 years ago

One of the easier ways to not look unique is use a popular iOS device because Apple pushes updates hard, so OS and browser versions tend to move in sync, they don't maintain that many SKUs (4 right now, and I'm not even sure if the 12 and 12 Pro are different enough for fingerprinting to detect), and their devices are pretty popular.

Various privacy trackers also block fingerprinting code.

If you need a new hobby, uBlock Matrix is the hard way to block most fingerprinting.

1vuio0pswjnm74• 6 years ago

Here is another way to look at it. Not expecting anyone to agree; it's just a thought experiment.

Instead of asking "How do we become "non-unique""?

We could ask "How do we send less data to the parties who want to do tracking?"

For example,

User A sends 2-3 HTTP headers, the bare minimum, e.g., Host, Connection, maybe User-Agent or Cookie in some instances if required. User A has disabled Javascript unless she needs it.

User B sends a potentially unlimited number of HTTP headers (User B does not care to control the headers she sends, she just leaves that to the applications). User B leaves Javascript enabled regardless of whether it is needed.

Each user may be "unique", with sufficient effort from the party doing tracking, but there's an argument that User A is less interesting to the tracking parties than User B. Both users have footprints, both can be tracked, but one is sending much more data to the trackers than the other. She's leaving more detailed tracks, so to speak. User A is leaving a more generic footprint.

There is also an argument that finding "uniqueness" among a large group of "User B's" would be easier than amongst a large group of "User A's". If we were trying to achieve the impossible goal of "non-uniqueness" it would arguably be easier to try to have all users appear to be identical to User A than trying to get all users to match User B what with all the additional potential variables User B presents thanks to uncontrolled HTTP headers and Javascript's access to her computer's resources (and all the potential issues and "options" that raises).

atoav• 6 years ago

If non-uniqueness means "there are others that look like you", it is clear that giving them less identifying clues makes things harder.

The question is how to do it tho, because some things might actually be useful: if your browser tells the site you prefer dark themes the site can react and display your prefered color scheme. If the browser tells the site how big your viewport is it can give you a site that fills that viewport neatly — and if the site can do these useful things it can also track you using that info.

SeriousM• 6 years ago

You can never be non-unique because of your actions. To stay in the analogy of tracks: it really doesn't matter how your Tires look, the direction of the tracks make you unique. That's the same reason why Tor is not secure. But you can make it harder by cutting your tracks in smaller pieces.

gruturo• 6 years ago

User A is also "unique", indeed... until more people start doing the same. Then they can no longer be told apart.

We should agree on common set of absolutely minimal necessary data (User agent, supported fonts, screen resolution and DPI if Javascript can probe those, etc) and then ALL run with the same, except on the very few sites one truly needs and which don't work with this bare minimum for some (hopefully valid!) technical reason.

We could actually package all of this into an addon or a simple recipe of settings. I'm not knowledgeable enough to pull such an effort with absolute certainty that nothing gets forgotten, but if someone does, I'd suggest "V for Vendetta" as a name, as it reminds me of the 5th of November scene.

goatinaboat• 6 years ago

User A sends 2-3 HTTP headers, the bare minimum, e.g., Host, Connection, maybe User-Agent or Cookie in some instances if required. User A has disabled Javascript unless she needs it.

There is actually no technical reason that an HTTP request needs to be any more than

    GET / HTTP/1.0

It's nice for the server to know your user agent, what fonts you have installed, your OS, and whatever else, but it is not necessary and so the majority of the problem of fingerprinting browsers is one created by the browser developers themselves. The original concept of the web was that the client controlled the rendering, the server shouldn't care about what specific fonts you have or the size of your screen.

There is no reason that the Firefox or Safari developers couldn't decide in the next version to send only bare minimal request headers.

enriquto3• 6 years ago

Instead of asking "How do we become "non-unique""? We could ask "How do we send less data"

The basic principle of information theory is that these two things are exactly the same. There is no "correspondence" between them, they are one and the same thing. The amount of information that you send is, by definition, the measure of how unique it is.

mswann2• 6 years ago

Using the Tor Browser from torproject.org with the so called "safest" security settings (that I usually use) I am not unique (currently 1 in 15k browsers have the same fingerprint as mine - which is not exactly great but still better than unique). With "standard" security settings (I switch to those mainly for watching videos) I am unique among the tested 288,728 others (screen qualities and not using the recommended default language en stick out).

craftinator• 6 years ago

How does one actually become not unique?

Actually, let's look at a different solution up the same vein, how does someone become NOT themselves? I think that right now it's less about how to blend in, and more about how to swap identifying features.

What about a pool of users, like a vpn, except the pool exercises identifiable information swapping!

throwaway_pdp09• 6 years ago

How does one actually make themselves non-unique?

Though this is highly desirable, for a guy like me who is rather paranoid I'm not going to worry too much. I disable js and block lots of sites (based on MVPS but also my own personal list - anything that gets through gets put into my personal list). After that, I don't care too much if they track me cos they aren't getting bugger all useful - if everyone did that, what market would be left for advertisers?

I'll still read more of the article and try to close more holes, but perhaps a 95% solution is sufficient? What do you think?

l33tman2• 6 years ago

In my test (umatrix, but no other preventions), the main sources of uniqueness were the fonts installed, the HTTP-ACCEPT header, and WebGL fingerprinting.

Especially the fonts installed was very interesting and I hadn't thought of that before. The JS just iterates over thousands of known fonts in a div/span and sees if the browser can render it to build a list. It's enough that you've installed a single uncommon font and together with everything else you suddenly became unique just by that.

You're not going to block all of these "dynamic" prints just by changing browser or installing a single plugin. Even if you run in a VM, unless you actually flush and reinstall that VM every session, you're eventually going to amass customizations inside the VM that can be fingerprinted.. :/

ignoramous• 6 years ago

Forget webgl and fonts, content blockers also fail at blocking third-party analytics masquerading as first-party analytics. Exhibit A: https://gist.github.com/sperand-io/fc211731e31c628232abb998f...

viseztrance2• 6 years ago

The problem is that the same font is rendered differently by different video cards, hence why your hardware can get fingerprinted.

tug0fwar• 6 years ago

How about a browser that has cookies etc. as different modules detachable/attachable from/to the actual _browsing session/s_, and an option to attach/detach them on the fly. I think I would get used to the overhead work involved when browsing, just like I got used to NoScript.

EastSmith• 6 years ago

Looks like fonts are basically cookies with side effects (rendering characters).

genewitch2• 6 years ago

windows 10 pro has "Windows Sandbox" which is a VM that runs windows 10 that is only ephemeral storage. Closing the VM and restarting it is 100% fresh again.

There's ways to do it with virtualbox and qemu as well by setting the disks to the same ephemeral style.

d_theorist• 6 years ago

Setting DNT probably makes you more unique. You’re putting yourself in the vanishingly small set of people who have that bit set.

DyslexicAtheist• 6 years ago

slightly dated but still relevant for maintaining privacy, especially the later parts that talk more about tradecraft then obsessing over DNT etc:

https://web.archive.org/web/20180714043311/https://iotdarwin...

crucial bit is to blend into the crowd instead of standing out (the paradox is the harder we try to mitigate on a technical level the more we'll stick out). instead use hardware compartmentalization, pseudonymous identities (not anonymous ones) and focus on operational techniques (modify your behavior). technology can be a means but often it is just part of a strategy. (e.g. instead of "let's encrypt all the comms" why not eliminating some comms altogether - no need to worry about data that doesn't get stored in the first place etc)

AreYouElite• 6 years ago

stylometry can identify you, or even just the times you are online, what content you visit. We need a browser plugin for this. Some button in the corner of your browser that you click to sanitize your post of any identifying features.

ta36143058362412• 6 years ago

We could successfully become non-unique (~10 bits) with 2 approaches:

1. TOR browser on Safest setting

2. Firefox using the strictest privacy settings except allowing 1st party cookies, and using Private Browsing; toggling privacy.resistFingeprinting to True in about:config; and using the uBlock and NoScript add-ons

These were successful on both desktop and mobile (except iOS)

z3t4• 6 years ago

We cant do anything about our fingerprints. But we can make sure no one knows who the fingerprint belongs to.

dkdk82832• 6 years ago

Defaults in a VM. No plugins

dkdk82832• 6 years ago

Having software that helps mitigate timing attacks and pre-fetches uninteresting content is a start. Disabling JS will be painful but helpful tool. Although disabling JS makes you a uniquely identifiable user. Not sure, but I think this should spark disfission.

stelfer• 6 years ago

Probably never. Unique in the Crowd: The privacy bounds of human mobility[1].

[1]https://www.nature.com/articles/srep01376

jcynix• 6 years ago

You might want to try https://en.wikipedia.org/wiki/Privoxy, a "privacy enhancing proxy" which works by reducing the stuff a browser sends before passing it on.

Edit: removed typo.

suifbwish• 6 years ago

Are you kidding? Apple has all but stripped away the ability to make a profit from Apple users as they all identify as the same advertising ID now if you use the safari browser. Facebook stock took a huge hit right after that update.

nextos• 6 years ago

The question is how to protect against fingerprinting?

Protecting yourself against some scripts is easy and convenient with uBlock Origin. Tracking by URLs can be handled by ClearURLs. Cookies are easy to address with containers, ideally temporary ones with per domain isolation. IP tracking can be addressed partially using a VPN or Tor.

But fingerprinting is hard. Some Tor browser configurations go as far as fixing the window size. Things like timezone, user agent or available fonts leak a lot of unique information. Any simple setup that doesn't have too many caveats?

eeZah7Ux2• 6 years ago

Tor browser does that.

gruez5• 6 years ago

Firefox with resistfingerprinting also works.

tbiteteitb• 6 years ago

I love tor-browser project, what I don't like it's the hostile web you uncover with it. Browsing with tor-browser has become a CAPTCHA minefield.

Everything, everywhere there's a "human" captcha waiting for You. Sometimes I have to do the challenges 3 or more times. There's opportunities that even after a 4th attempt it just doesn't work.

keyle• 6 years ago

It's great, I got told I got browser fingerprinting, showed me how it does it, but not really how to prevent it... Which is kind of the point I did the test for.

Xxgunnardxx• 6 years ago

My pandemic project is https://www.dontwatchme.com trying to make a site that I would want to go to for privacy information.

gtsop2• 6 years ago

This website is an ad minefield. Avoid

krzrak• 6 years ago

...and typo minefield ;)

diebeforei4852• 6 years ago

Other than timezone and iOS version, how am I different from other users of my model of phone (eg. are all iPhone X users the same?)

samename• 6 years ago

Fellow iPhone X user here. Unfortunately, it seems because of the User Agent and hash of WebGL Fingerprint, our phones have unique fingerprints:

Within our dataset of several hundred thousand visitors tested in the past 45 days, only one in 71131.0 browsers have the same fingerprint as yours.
Currently, we estimate that your browser has a fingerprint that conveys 16.12 bits of identifying information.

diebeforei4852• 6 years ago

User Agent is the same for everyone on your iOS version, correct?

I don't fully understand the WebGL fingerprinting stuff- why is it different on the same device model?

systemvoltage• 6 years ago

I am of the belief, rather an insidious belief that not only do we need to block AdTech and other awful face-recog technologies, etc.; but to actively spread and feed it with fake data in order to completely confuse the algos, rendering them useless.

DarthGhandi• 6 years ago

The EFF considers data pollution to be fairly useless. They've spoken a bit about it.

n0nc36• 6 years ago

The practices should be banned. It's a federal felony to wiretap or open someone else's mail. In almost all states, it's a crime to record conversations without consent from at least one party. Earlier generations passed those laws because they viewed mass surveillance as a fundamentally Soviet activity with no place in a free society.

According to some footnotes in Shoshana Zuboff's book, the FTC was on the path to ban these practices in 2001 but then 9/11 happened.

Sephr• 6 years ago

You're not being "wiretapped" if the site you visit explicitly included tracking. As an analogy, the sites that you visit are already providing one-party consent (all that is needed with current federal wiretapping laws) by including said intentional tracking.

In the case where non-essential sites are required to disclose what they track to the user, the user is arguably also providing consent on their end even if it's mandatory. Nobody is forcing you to visit non-essential sites.

charliesome• 6 years ago

Calling mass surveillance a "fundamentally Soviet activity" weakens your argument here. Is mass surveillance something that happened in the Soviet Union? Of course. But it also happens in the US and many other nations, liberal democratic or not, worldwide. So why shouldn't we call mass surveillance fundamentally American, or fundamentally capitalist?

Mass surveillance is bad. It is toxic to freedom and democracy. Let's focus on that rather than invoking Red Scare tendencies of old.

AshWolfy• 6 years ago

Earlier generations passed those laws because they viewed mass surveillance as a fundamentally Soviet activity with no place in a free society

Laughs in cointelpro

wormslayer666• 6 years ago

Relevant: https://adnauseam.io/

eindiran4• 6 years ago

The book "Obfuscation" shown at the bottom of the page is a very interesting one, definitely worth taking a look at.

https://mitpress.mit.edu/books/obfuscation

boogies2• 6 years ago

+1 for the best WebExtension ad blocker there is, a fork of №2 µblock Origin

surround8• 6 years ago

Unfortunately, adnaseam does not improve privacy since it has to load the ad scripts.

dymax783• 6 years ago

How would you (or anyone) rate this vs uBlock Origin? Seems like by it's inherent design, AdNauseam would use greater resources.

CinchWrench• 6 years ago

Will not happen. The U.S. military industrial complex views these sorts of algorithms as a vital technology in fighting future wars, and also fears that it's at a disadvantage to China because 4x population means a strategic advantage purely from the size of data sets Chinese ML researchers have access to.

What are ya gonna do? MIC gets what it wants.

ketamine__• 6 years ago

We have also worked with browser vendors such as Brave to provide more accurate results for browsers that are employing novel anti-fingerprinting techniques.

Brave is a force for good.

surround8• 6 years ago

I’m afraid their fingerprint randomizing methods may be doing more harm then good.

https://github.com/arkenfox/user.js/wiki/4.1-Extensions#smal...

antonok2• 6 years ago

There's one important distinction from that link:

remember: very, very, very few users use anti-fingerprinting measures

At this point, Brave has 20-million-something monthly users, all of whom have fingerprint randomization enabled by default. Randomization definitely makes an individual stand out if nobody else is doing it, but it makes it almost impossible to distinguish from others using the same technique.

saagarjha6• 6 years ago

This sounds like “our results looked bad for Brave so we changed them”…

Wowfunhappy3• 6 years ago

I've been thinking for a while—what if the solution to fingerprinting wasn't making your browser less unique, but less constant?

Take Canvas fingerprints. If you added a bit of randomness to how the browser renders pixels, the fingerprint would change each time you measured it. It would still be unique, but it would be a useless tracking tool.

Presumably I'm not the first person to come up with this, is there a reason it isn't done?

antonok2• 6 years ago

This is actually exactly what Brave does! Both for Canvas and WebAudio, which is also used for fingerprinting in a similar way.

There's more info here if you're curious: https://brave.com/privacy-updates-4/

igravious• 6 years ago

But won't trackers start ignoring these cues?

Here is Brave's take: https://brave.com/brave-fingerprinting-and-privacy-budgets/

gtsop2• 6 years ago

This deserves to be heard. I will also add to this, since it is known we can use addons to disable tracking and fingerprinting but addons can themselves be used for fingerprinting, why don't we get a feature on firefox (or even one more addon) to prevent javascript from getting a true result when querying for known addons?

kdrag0n• 6 years ago

Bromite for Android does that: https://github.com/bromite/bromite/blob/73ef7f3ea1937f5ba8eb...

surround8• 6 years ago

Randomizing fingerprints is generally a bad idea. See:

https://github.com/arkenfox/user.js/wiki/4.1-Extensions#smal...

Wowfunhappy3• 6 years ago

Sorry, I don't actually see in there why randomizing something like a canvas or webaudio fingerprint is a bad idea. I believe they know what they're talking about, but I'd still like to know why.

Notably, to me this isn't necessarily about beating the resistFingerprints setting, because I can't use that setting. For good or for ill, it breaks too much of the web.

kunfuu• 6 years ago

This reasoning is valid when randomization is not pre-configured and is done at the individual level. It doesn't hold when talking about changes that come with browsers etc and deployed at scale.

gruez5• 6 years ago

Take Canvas fingerprints. If you added a bit of randomness to how the browser renders pixels, the fingerprint would change each time you measured it. It would still be unique, but it would be a useless tracking tool.

that doesn't work because the sites can just take multiple samples and average the results.

gitgud• 6 years ago

This is very similar to how OS's and Browsers have mitigated the spectre vulnerabilities last year.

They basically fuzz (randomize) the timing precision that you can do, so you can't use timing to leak information across 2 different processes.

"As of Firefox 57.0.4, Mozilla was reducing the resolution of JavaScript timers to help prevent timing attacks, with additional work on time-fuzzing techniques planned for future releases."

https://en.m.wikipedia.org/wiki/Spectre_(security_vulnerabil...

Maybe similar tactics could help prevent finger-printing!

fnord77• 6 years ago

whelp, a quick check on my macbook - latest versions of everything.

    chrome w/ privacy badger:   unique fingerprint
    firefox w/ privacy badger:  unique fingerprint
    safari 14:                  nearly unique

something like DNT actually make your score worse

eindiran4• 6 years ago

Since virtually no one honors DNT, and its usually not set by default, choosing to set it is giving up a free bit. Instead try to do whatever the default behavior of your browser is.

ohazi• 6 years ago

What the fresh hell is this?

Our tests indicate that you have you have strong protection against Web tracking, though your software isn’t checking for Do Not Track policies.
Unblocking 3rd parties that honor Do Not Track? ..... No [marked in red, as if this were a bad thing]

Are they suggesting that I unblock trackers when the provider posts a text file pinky swearing that they honor a do-not-track policy?

This smells like another "acceptable ads" program.

snazz• 6 years ago

That's basically what DNT was supposed to be—browsers said "do not track me" and "legitimate" trackers respected it. I agree that it's dumb. Ironically, DNT is now just one more bit that makes fingerprinting your browser easier.

dudus• 6 years ago

DNT was supposed to be that until Microsft decided to make it on by default pretending it to be a big privacy move on their part. Because it was no longer a user choice advertisers decided it was no longer reasonable to honor it. So they just ignore it most of the time. And thus DNT became completely obsolete.

surround8• 6 years ago

I like the uBlock Origin philosophy:

DNT is essentially acknowledging that a 3rd-party is the one in control of your privacy in the 1st place, and you have to resort to asking this 3rd-party -- which has financial (or whatever) interests in tracking you -- to not track/data mine you, and trusting that they respect your wish, with no way for you to find out whether your request is respected. In short, it's BS, and supporting tracking/data mining is agreeing that tracking/data mining is the natural, expected behavior and thus an opt-out "feature".
Nobody should ever agree to this.
I see it differently: tracking is opt-in, and the ideal is that users are in full control of their privacy by default. Those who want to track/data mine you should ask you to opt-in, along with all the detailed information of how the data collated from you will be used and monetized (lists all entities to which your data is sold), in the spirit of informed consent.
Currently the way for users to enforce their privacy choice is to use all the tools at their disposal to prevent their data from ending up in the hands of the trackers/data miners, and DNT is not one of these tools.

https://github.com/gorhill/uBlock/issues/827#issuecomment-15...

mkskm• 6 years ago

Surprised to still see that included on here. Apple removed support for it over a year ago since it never gained much traction and ironically can be used as an additional variable for fingerprinting.

https://www.macrumors.com/2019/02/06/apple-removes-safari-do...

antonvs• 6 years ago

This smells like another "acceptable ads" program.

Do Not Track is an EFF program - it's not surprising that their tools are going to push it.

See https://www.eff.org/pages/understanding-effs-do-not-track-po...

The EFF seems to essentially be an extension of the Silicon Valley business model - it's like the notices at casinos giving a number to call if you have a gambling problem. They're not going to address the underlying issues, but they'll offer some ineffective band aids for them.

surround8• 6 years ago

“Add-ons and browsers that randomize the results of fingerprinting metrics have the potential to confuse trackers and mitigate the effects of fingerprinting as a method of tracking.”

I would like to dispute this. It is easy to detect when a user is spoofing certain settings. As such, randomizing fingerprint data increases entropy, making your browser more unique, not less. There is a reason why the Tor browser works so hard to make sure every user has the same fingerprint, rather than randomizing it.

More on that here: https://github.com/arkenfox/user.js/wiki/4.1-Extensions#smal...

ACow_Adonis2• 6 years ago

The key here is randomising them over time.

If you browse website A and website B, with different randomised qualities at different times, and your non-randomised data isn't enough to sufficiently identify you, then although A and B might be able to identify that you're spoofing certain settings, they can't identify that you're the same entity browsing both websites.

If you just set things to a weird or unlikely value, then you're as identifiable as a man who walks down the street in a mascot uniform that he never takes off. That is to say, although they don't know the 'person' behind the mask, all you need to look for is the dingus wearing the capital city goofball costume. Indeed, it makes you stand out more...

jobigoud2• 6 years ago

If not a lot of people do it the bit of information "this browser is spoofing certain settings" is also a very telling thing and combined with the non-randomized data may tip the balance towards uniqueness.

renewiltord3• 6 years ago

But uniqueness is valuable only if you have identity. If you can't tell that dude A is also dude B then you just have a million dudes and you can't violate anyone's privacy.

minitech3• 6 years ago

”Random data” can be part of that “same fingerprint”, and it actually already is (Firefox with privacy.resistFingerprinting, and I think Tor too, randomize canvas and WebGL results).

lvs• 6 years ago

Any extensions that block probes for system fonts? That seems to be the most identifying piece of information.

surround8• 6 years ago

Try disabling JavaScript. uBlock origin lets you do this on a per-site basis.

kayson• 6 years ago

Could fingerprinting be easily avoided by randomizing all of these parameters? Sure, you'd still have a unique fingerprint, but if every time you load a page you have a completely different unique fingerprint, wouldn't that solve the problem?

ACow_Adonis2• 6 years ago

It 'solves' the problem in the theoretical sense, but in a practical sense websites may still require information from the browser for actual justified purposes. Think identifying the browser, OS, resolution and window size (non-exhaustive list and I'm a data-linking person but not a web person, so I'm just making them up).

Indeed as long as browsers need to send actual information for successful implementation of whatever it is the website is doing, the potential for fingerprinting still exists. And as long as there are sufficiently non-random properties of the computer for the theoretical attacker to poll (via whatever mechanism they can), then fingerprinting will be a viable mechanism.

Although as EFF points out, if MOST of the identifier obtainers require Javascript or connections to certain URLs to work, it might be that blocking javascript and URL blockers might be sufficient to stop most of them in practice?

Edit: of course, every time I say theory and practice here we run into problems of how much people are willing to do or put up with in practice...

minitech3• 6 years ago

Yes, as long as enough people randomize them along with you.

Threeve303• 6 years ago

Put a browser inside a read only virtual machine and have everyone agree to use it. All temp folders can be mapped to RAM. Have the VM use a random VPN each time and never login to anything.

Nearly everyone would have the same fingerprints even down to the browser resolution, root CA lists, installed fonts, etc. The only real difference being the sites you visit.

ping_pong• 6 years ago

I wonder why they claim that I'm uniquely identifiable. I'm using default settings for my Macbook, no additional extensions, and the latest update of Chrome. I would think that is relatively common, no?

ramphastidae• 6 years ago

Screen resolution * fonts * extensions * geography is usually enough.

saagarjha6• 6 years ago

Three of those are controlled in the scenario presented, and the last gives 4-5 bits of entropy. Not convincing.

_jal• 6 years ago

Lots of things effect the fingerprint. Install any non-stock fonts, possibly by installing an application?

t0astbread2• 6 years ago

Well, I don't know what your result says of course but I suspect the default settings in browsers aren't strict enough to avoid "conventional" tracking and that's how you were identified.

jacobwilliamroy• 6 years ago

Nowadays you want to run a VM with a randomized mac and route all your traffic through something special like a pfsense box.

minitech3• 6 years ago

Scroll down to the detailed results to find out!

renewiltord3• 6 years ago

Very interesting. Dual language Accept headers will completely wreck your anonymity.

unhammer• 6 years ago

    One in x browsers have this value:290162.0

for me – that one alone is probably enough to make me unique. I got the exact same number for system fonts.

I guess it's near-impossible to get the features of accept-language without fingerprinting you :-/ but why does js need to know what fonts I have?

walrus01• 6 years ago

I think this is a really bad name for a browser extension.

Non technical users will install it and think it provides them with real anonymity on the Internet or something.

audiometry• 6 years ago

I agree. And it didn't even seem to be aware I was already running Privacy Badger. And inside Privacy Badger I saw no obvious options to decrease my browser footprint. Sort of lame.

miked85• 6 years ago

It isn't a browser extension.

foolinaround• 6 years ago

i recently switched to the Brave browser which comes with good defaults.

TedDoesntTalk2• 6 years ago

Same. But on HR, many people conflate Brave’s built-in privacy with Brave’s ridiculous crypto thing. And so Brave is pooped on, laughed at, or at best ignored by many here.

To me they are completely separate and although Brave has had privacy missteps, all browser vendors have. I believe in the leadership (Brendan Eich, creator of JavaScript) more than the leadership of any other browser vendor. I believe Brendan eats his own dog food.

IceWreck• 6 years ago

I refuse to use them until they remove all the crypto BS. Anything extra that Brave does can also be done using chrome or firefox extensions

totalZero3• 6 years ago

You can hide all of that.

66fm472tjy7• 6 years ago

I tried out Brave a few years ago and soon noticed it did not completely clear history on close when configured to do so. While the history was not shown in the UI, you could see it was retained because URLs visited in previous sessions were shown in :visited style (links were purple instead of blue with default CSS. Note that this can also be queried via JS and thus allows sites to extract your browsing history).

I reported the issue at the time but they said the won't fix it since they were moving away from brave-laptop. They still had issues[1] clearing forms of local storage year later. They are not taking privacy seriously.

They also took crypto from users under the false pretense of taking payment on behalf of content creators[2].

[1] https://github.com/brave/brave-browser/issues/9929

[2] https://en.wikipedia.org/w/index.php?title=Brave_(web_browse...

Semaphor• 6 years ago

Ad Blocker Used
False

I wonder how they test that? I guess uBlock Origin or uMatrix block their detection.

fuzxi6• 6 years ago

My screen resolution isn't shown accurately on this tool. It returns 1920x1080x32, but my actual window resolution is something like 1880x1020x32 (I use swaywm and leave gaps around windows for a border). If I resize the window to 300x700, the tool returns 1440x900x32. If I disable all my extensions and Firefox's enhanced tracking protection, it always returns 1920x1080x32.

I'm using swaywm, so maybe this is an (unintentional?) feature of wayland.

starky2• 6 years ago

I doubt it is your WM since my Windows 10 computer also displays 1920x1080x32 when the resolution should be 3840x2160x32

fuzxi6• 6 years ago

Interesting. Are you using firefox as well?

kart23• 6 years ago

My graphics card really destroys my fingerprint. Why are browsers even showing websites the exact model of GPU that's running?

maCDzP• 6 years ago

I read comments about solving this problem by randomising the fingerprint. Is it possible to randomise the hardware by creating a sort of "ramdom VM-container" that runs the actual browser binary? It would randomises the VM so sometimes it's Linux and sometimes it's Windows.

kebman2• 6 years ago

Meanwhile as money is becoming 100% digitized and reliant on banks, the ability to hide your tracks online is moot.

samoa422• 6 years ago

did you notice the unique alphanumeric id on every piece of paper money?

the banks registers it and turns out the vast majority of money does only "one cycle" ie. from the bank to a (known) consumer/customer, to a shop/cashier and then back to the bank. so "they" already know were you spent it.

jobigoud2• 6 years ago

How can they really know it does just one cycle since any possible intermediate step doesn't store/track the number?

kebman2• 6 years ago

That is not entirely true. They can only track end-points with that system, meaning those places where the note ID is inspected. Moreover it's usually only done by one bank; the central bank. In any case that is certainly not a great argument for giving away more of your freedom.

Granted more and more shops now have machines that count all bills and change automatically and per transaction, under the guise of convenience and increased security towards theft or robbery. In the mean time, the notes may have travelled from hand-to-hand in a long chain that is completely shrouded in a dark—if not entirely black—economy that neither the bank nor the state can ever hope to fully track.

That all changes with the advent of a fully digital system, especially if all transactions are sanctioned to be within that system by force of law. Which is exactly what the banks are pushing for, with various scares such as claims of the danger of money laundering, corruption, and so on. What they systematically fail to add, however, is how they themselves gain the ability to track full markets, and make sure-fire investments based upon surplus data gleanded from aggregating private purchases and trades, thus ensuring their full control over said market.

Meanwhile they can use that same power to effectively shut down all opposition—and anyone who protests their actions—simply by finding a reason to freeze their accounts, just like they did to Julian Assange.[1] Thereby they get the power to effectively keep individuals they dislike from accessing the entire economy, unless perhaps they own some diamonds or a valuable goat... This has in turn given precedence to other financial institutions to shut down accounts or memberships based upon political affilations, such as is the case with Patreon, or because they somehow are construed to be in a competing position.

As an example, a Norwegian crypto trader has effectively been barred by all the banks in Norway to get a business account.[2] The reasons given were vague claims that his completely legal business somehow supported nefarious and evil individuals who all wish to undertake in money laundering, without offering any solid evidence for it. However the banks all failed to mention that his business can in many ways be seen as being in direct competition with their own business model, namely that of manual and middle-man-laden banking. In any case, for all intents and purposes, Bitcoin transactions are far easier to track than bank notes.

[1] https://www.forbes.com/sites/andygreenberg/2010/12/07/visa-m...

[2]: Norwegian language article: https://e24.no/naeringsliv/i/oRgdW0/dn-bitcoin-toppen-tapte-...

tsimionescu3• 6 years ago

I never understand why browsers expose APIs to read the state of a canvas and WebGL results, or color depth of the screen. How often are they used for anything other than fingerprinting?

Note: at least for my profile, those are the only things that truly seem to give significant data. Everything else is in the 1 in 2-300 range, just by using FF on Android with uBlock.

tiborsaas2• 6 years ago

I never understand why browsers expose APIs to read the state of a canvas and WebGL results

That's the basis of any image manipulation. A write only canvas is not useful at all.

tsimionescu3• 6 years ago

Ok, so that's one use case. How many webapps are doing image manipulation (not to mention plain sites)?

There should really be a prompt whenever a site tries to access this information, especially in privacy-conscious browsers (I wouldn't expect Chrome to want such an anti-feature for their customers, the ad companies).

jepper• 6 years ago

With uMatrix in "unless withlisted no js configuration" the test does not run. The noJS fallback does not progress. Probably means a pass :)

Unique fingerprint is really interesting upon enabling first party js. Fonts and gpu give lots of unique information.

Dont get the message to unblock ad providers that follow DNT. This trust is too easily betrayed.

szundi• 6 years ago

Genius

dcassett• 6 years ago

Using an old iPad with Safari, it endlessly spins on "testing your browser"

unnouinceput• 6 years ago

I've tested my Firefox. They said I don't have an Ad Blocker. Since I use uBlock Origin it means either my ad blocker is quite smart or their technology is poor which casts a shadow over this tool entirely. My 2 cents

defanor• 6 years ago

That's odd: the test claims that my user agent is Go-http-client/1.1, and that there's gzip in HTTP_ACCEPT, after I've followed the redirect trail manually (with s_client(1)), only providing a GET request line and a host.

sloshnmosh• 6 years ago

It’s next to impossible to stop a website from fingerprinting your browser and/or device.

I found a heavily obfuscated script on the webpage of my cellphone data provider which I initially thought was a credit-card skimmer.

After several rounds of de-obfuscation and beautification it turned out to be some really intensive tracking and fingerprinting script from Akamai.

It used every single fingerprinting technique imaginable from pixels, cookies, webgl, webrtc, flash, vector drawings etc etc.

1996• 6 years ago

Please share for 1) study and 2) counter measure implementation!

decko• 6 years ago

It might their bot manager product

blindm• 6 years ago

I see a few people asking how you blend in among the crowd. My strategy is to use a common device like an iPhone 5 using the Safari browser, and for the connection I use a 4G connection that I seem to be sharing with loads of other subscribers. Apple's Advertising Identifier[0] AFAIK is not passed into Safari, as that only applies to other apps and not browsers like Safari.

The only thing that could make me stand out is if I deviate from this basic setup and use different browsers on weird connections like a VPN (Yes - a VPN can make you stand out). Also: upgrading my phone to the latest model is probably an uncommon practice and used as another heuristic to track you, & I've heard many people like to stick to a certain phone model until it starts acting up.

[0] https://developer.apple.com/documentation/adsupport/asidenti...

Cover Your Tracks

Related Stories