The Web Never Forgets: Persistent Tracking Mechanisms In The Wild

https://securehomes.esat.kuleuven.be/~gacar/persistent/index.html

by jcr • 12 years ago

134 47 12 years ago

securehomes.esat.kuleuven.be

Research like this makes me question why I use a cookie manager. Staying ahead of these intrusions takes more time than I have available (job, life, etc.) and a cookie manager is no longer the bare minimum.

In fact, I'm not sure what the bare minimum is anymore, nor do I know whether or not a cookie manager even makes a dent in privacy intrusions.

logicallee• 12 years ago

a VM still seems pretty good? what are they gonna do, benchmark it? (yes.)

it's also super quick to install and update. just snapshot before browsing anything and restore to there. you can install anything you like, before browsing anything (flash etc). there's no logical way to save any state if you throw away the hard drive snapshot.

yourad_io• 12 years ago

While this is probably very close to foolproof, it is just insane that our best method to accomplish "DNT" is to... throw away all changes at an OS level :|

It is incredibly alarming to consider how much control over our own damned gear we've lost over the past 10-15 years.

yuliyp• 12 years ago

We're in a state right now where if you are doing anything that suggests you're willing to spend money on a specific set of things, you have to do it in a private browsing window or put up with retargeting for weeks. Kind of sad.

antocv3• 12 years ago

Its kind of sad that when you actually want to spend money on specific things, you're met with puke upon puke of advertising, forums infested, reviews scammed, its a hellhole just to finda good router for example.

I guess its an effect of having much money or people willing to potentially spend money in one giant network - internet. You just cant make a review site or forum which is immune to scamming, that is when sellers start hiring people to puppet around their marketing message.

peteretep• 12 years ago

    > its a hellhole just to finda good router for example

Unless you think Amazon is compromised, it's pretty easy to search on there, and order by average customer rating. That's pretty much the only way I buy things now.

applecore• 12 years ago

I just clear my browser history constantly.

mirkules2• 12 years ago

The canvas fingerprint is immune to this because your browser paints the fonts the same regardless of your history, and the fingerprint itself is not stored locally.

dan_bk• 12 years ago

It's a cat-and-mouse game, for the time being. Until there's a real solution, use the available tech:

https://prism-break.org/en/

bsilvereagle• 12 years ago

HTTPSwitchBoard [1] seems to a decent job of blocking most (not all) of these methods. I currently have it configured to only allow scripts from the domain I'm visiting and quite a few of the methods mentioned rely on scripts/cookies hosted by third party websites. Granted, switchboard is far from foolproof but it's a step in the right direction.

[1] https://github.com/gorhill/httpswitchboard

BoppreH• 12 years ago

I'm still waiting for a Firefox version, especially to avoid Adblocks's overhead. I currently have Privoxy installed as a replacement, but it's too cumbersome.

tomsthumb• 12 years ago

There's always the RequestPolicy plugin, though it does not appear quite as nuanced.

joosters3• 12 years ago

In Firefox, install Self Destructing Cookies, BetterPrivacy and Ghostery. Ghostery will blacklist most of these tracker sites, the other two plugins should do their best at removing all traces of those that get through.

antocv3• 12 years ago

What can be done about the Canvas security vulnerability?

woogley• 12 years ago

Browsing with NoScript, while inconvenient, offers safe-by-default browsing for cases like these. If I see a site I actually want to interact with, I'll fire up a different browser profile and look at it there. If it's a site I want to use regularly, I just add to NoScript's whitelist.

joosters3• 12 years ago

The sites highlighted in the article are generally blocked by plugins such as Ghostery, and so their attempts to track via Canvas won't even be run.

If you block the known trackers, it doesn't really matter what techniques they try to use on you.

XzetaU82• 12 years ago

this https://news.ycombinator.com/item?id=8068194

pronoiac• 12 years ago

Privacy Badger - https://www.eff.org/privacybadger - might be able to help. It's like Disconnect or Ghostery, but based on behavior, rather than a blacklist.

lifeisstillgood• 12 years ago

Tl;dr wow, just wow.

So we have three fingerprint mechanisms: One I had not even heard of or frankly suspected, but it explains a lot about why many designers who strive for pixel perfection are constantly frustrated. The original paper is fascinating (cseweb.ucsd.edu/~hovav/dist/canvas.pdf) but one simple takeaway - testing 300 different user systems (Mechanical Turk - quite clever) a simple sentence in Arial rendered 50 different ways! So by combining different renderings (like sentences, drawing a line on a canvas element) they find that user systems - hardware, drivers etc, give off different results unique enough to tag you.

I would be interested in their results on iPhones (in fact any one interested in a quick experiment here in HN?)

And cookies - the synching cookies where fucking trackers collaborate and share / copy each other's ids, and ever cookies where they store a cookie in JavaScript/cookie and anywhere else and keep respawning.

Little fuckers

I propose two solutions:

Cookies should be limited to no more than 128bits - enough to store one randomly generated UUID. Screw the backward compatibility.

And we should be able to only allow signed hashed JavaScript to run on our machines. For example I want to only allow say bootstrap and some overlay and a config or data file. No one gets to run unsigned js on my machine?

Have I just reinvented Microsoft code signing?

But boy I am in a bad mood

Terr_• 12 years ago

Does anyone else wish all these smarts people bake into per-browser plugins... could instead be part of a localhost proxy?

Then the browser-plugin component could be entirely optional, just a more-convenient way to command the proxy (via some HTTP call that it recognizes and intercepts) to block a given URL or pattern.

MichaelGG2• 12 years ago

How does that work with SSL?

tokenizerrr3• 12 years ago

Proxy does SSL checking, browser trusts proxy's CA certificate, requests are re-signed on the fly.

userbinator• 12 years ago

As someone who's used a local filtering proxy (Proxomitron) and multiple browsers for a long time, I completely agree - browsers are getting more and more complex and it's difficult to use a plugin to block things that would have been fetched and loaded already by it. The fact that it works for all browsers on the system, and applications that incidentally include non-configurable browsers, is also nice.

On the other hand page modification that involves DOM manipulation/JS interactions would definitely be better handled in a browser plugin, since a proxy is more of a streaming filter device.

SSL is a bit of a pain (especially certificate pinning) since this is essentially a "benevolent MITM attack" but there are workarounds for it.

joosters3• 12 years ago

Does this technique work for iOS? There just aren't that many varients of iOS devices, and you can already tell them apart by other browser settings.

Safari on iOS will have the same hardware, renderer and fonts as every other user with the same iOS version and device type. So surely it can't track an individual user?

Someone1234• 12 years ago

The "Evercookies" are one of the many advantages of turning "Click to Play" on for all browser extensions (but most notably flash and java).

Both Internet Explorer and Chrome have supported "Click to play" natively since forever. Only Firefox shamefully doesn't.

Unlike many other security measures it is pretty intuitive. Just click on the applets you wish to load or unblock them like a pop-up blocker from the URL bar.

In Chrome you can also whitelist entire domains like this:

[*.]youtube.com

However be careful not to go too whitelist crazy, as I think this article makes clear a lot of those "Share this" applets are tracking you and many otherwise innocent sites host them.

huhtenberg• 12 years ago

Only Firefox shamefully doesn't.

Of course it does. It had "Ask to activate" option for every plug-in since some mid-20s release if not earlier.

T-hawk• 12 years ago

As with most user-friendly browser innovations, it was Opera that did it first. I was using it as early as 2001 for its ability to easily turn off annoying Flash content unless specifically requested.

It wasn't quite as simple as click-to-play or controllable per site until a few versions later; it was an application-wide toggle to enable plugins or not, but always very easy to use just one click away on the right-click quick preference menu.

mseebach• 12 years ago

Why are there "subtle differences in the rendering of the same text" when rendering on a canvas? I get how there can be differences between different browsers and even different builds of the same browser, but what more plays in? How many bits for identification does this actually provide?

richdougherty• 12 years ago

They use WebGL to render text. The OS, browser and video card can produce different pixel values.

See Pixel Perfect: Fingerprinting Canvas in HTML5 (http://cseweb.ucsd.edu/~hovav/papers/ms12.html).

userresu• 12 years ago

seems like this (and many other tracking mechanisms) can be stopped by using a blacklisting HOSTS file, like http://winhelp2002.mvps.org/hosts.htm

BrandonMarc• 12 years ago

The EFF has a good write-up about this, too.

https://www.eff.org/deeplinks/2014/07/white-house-website-in...

Big takeaway is to avoid AddThis.com, and that NoScript - along with other tools - is an effective defense.

It's also noteworthy how this is at odds with the White House's own policy on cookies.

The White House cookie policy notes that, “as of April 18, 2014, content or functionality from the following third parties may be present on some WhiteHouse.gov pages,” listing AddThis. While it does not identify which pages, we have yet to find one without AddThis, whether open or hidden.

On the same page that is loading the AddThis scripts, the White House third-party cookie policy makes a promise: “We do not knowingly use third-party tools that place a multi-session cookie prior to the user interacting with the tool.” There is no indication that the White House knew about this function before yesterday's report.

As usual, Bruce Schneier (and his commenters) has a useful thread on the topic:

https://www.schneier.com/blog/archives/2014/07/fingerprintin...

The Web Never Forgets: Persistent Tracking Mechanisms In The Wild

Related Stories