Deanonymizing You: I know who you are after 1 click online or a mobile call

http://www.networkworld.com/community/blog/deanonymizing-you-i-know-who-you-are-after-1-click-online-or-mobile-call

by DocFeind • 14 years ago

54 10 14 years ago

Per the video showing the exploit: I thought since it was being served through an iFrame, it won't allow you to effect the inner elements with CSS/JS? If that doesn't matter, is there a way that Facebook, Twitter, Google+, etc. can do anything on their end so the front end user (or exploiter, in this case) can't modify the button with CSS to do these types of things?

dcdan• 14 years ago

Couldn't you just move the iFrame and not need to have access to its elements?

casca• 14 years ago

For those not in the industry, Jeremiah Grossman is a highly respected researcher who does a lot of work in this space.

This is a more useful technical resource to understand how your privacy is being compromised: http://blog.whitehatsec.com/i-know-series-summary-and-guidan...

praptak• 14 years ago

Maybe worth reminding in connection with the article: https://panopticlick.eff.org/ - how many bits of identifying information your browser leaks from its configuration itself. Even on a fresh profile with none of the privacy-leaking stuff like cookies or cache.

stephengillie2• 14 years ago

Turning off Javascript moves me from being unique and fingerprintable, to being 1 of 161,000. This is with Chrome in incognito.

pella• 14 years ago

"How to disable permission to read 'System Fonts' and 'Browser Plugin Details' in Chrome and Firefox"

http://superuser.com/questions/292666/how-to-disable-permiss...

chimeracoder• 14 years ago

How well does this work - in other words, how identifying is the absence of such information?

(The third alternative would be to spoof the information on each request, but I don't know how well that would work, and it could cause other problems.)

pbhjpbhj• 14 years ago

http://cubiq.org/project-underpants-explained - browser fingerprinting demo, they say flash being off reduces your anonymity.

You can measure fonts using JS to avoid having to have flash to do font based fingerprinting, eg http://www.lalit.org/lab/javascript-css-font-detect/. There's also the option to attempt to set the font and then get the style of the element and see if it's using the new font (works only on FF and Opera IIRC), eg http://www.quirksmode.org/dom/getstyles.html).

deltaqueue• 14 years ago

I have no background in security, but I've found Disconnect (Chrome plugin) to be invaluable for keeping sites away from my social media cookies / sessions:

https://chrome.google.com/webstore/detail/disconnect/jeoacaf...

Sometimes it causes problems with Facebook photos embedded on other websites or social integration you actually want, but you can easily see what's being blocked and disable as needed.

Deanonymizing You: I know who you are after 1 click online or a mobile call

Related Stories