HN user

aimacs

1 karma
Posts0
Comments3
View on HN
No posts found.

This counters the tracking method used by the "Underpants Project" but does little to help against something more sophisticated that made full use of the remaining bits of identifying information.

According to Panopticlick, the biggest leaks of identifying information are the list of fonts and the plugin information string, neither of which seem to be guarded against by any existing tool except NoScript, though disabling Flash might help. However, even using NoScript, your information would still probably leak to whatever popular site is in your whitelist (e.g. Google or Facebook).

Unless someone hacks Flash to always sort the font lists and finds a way to fix the plugin list leak, one way to get rid of many of these leaks is to build a locked-down virtual machine containing a fixed set of fonts, a fixed screen resolution, UTC timezone, and possibly a fixed browser together with only the en-us locale to minimise HTTP_ACCEPT information leaks (which I presume to be the most popular one). Assuming the filesystem remains mostly untouched, the font list should always be in the same order for all instances of the VM. It might not be necessary to use any specific browser, but I presume there are many possible ways to identify a browser and perhaps even its exact version from its behaviour even without using the user agent.

Even after fixing all of the leaks identified by Panopticlick, the behaviour of the user could still be used for identification, perhaps by leaks caused by the user or by bugs and inadequacies in the "anonymisation suite". To pre-emptively counter this, an orthogonal approach like the one suggested by obituary_latte could be used (http://news.ycombinator.com/item?id=3880822). Such a "random browser" might need to be active most of the day to minimise timezone leakage, though that might not be very practical, or even necessarily a concern for many.

Finally, a yet another thing that might help would be to use popular VPN services which would presumably reduce the amount of information leaked by your IP address.