Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

EFF Says Forget Cookies, Your Browser Has Fingerprints

CmdrTaco posted more than 4 years ago | from the you-are-not-unique dept.

Privacy 175

alphadogg writes "Even without cookies, popular browsers such as Internet Explorer and Firefox give websites enough information to get a unique picture of their visitors about 94 percent of the time, according to research compiled over the past few months by the Electronic Frontier Foundation. [The Research] puts quantitative assessment on something that security gurus have known about for years, said Peter Eckersley, the EFF senior staff technologist who did the research. He found that configuration information — data on the type of browser, operating system, plugins, and even fonts installed — can be compiled by websites to create a unique portrait of most visitors. This means that most Internet users are a lot less anonymous than they believe, Eckersley said. 'Even if you turn off cookies and you use a proxy to hide your IP address, you could still be tracked,' he said."

Sorry! There are no comments related to the filter you selected.

damn. (1, Insightful)

Anonymous Coward | more than 4 years ago | (#32251956)

gonna have to stop surfing porn at work now.

Re:damn. (4, Insightful)

ShadowRangerRIT (1301549) | more than 4 years ago | (#32252058)

I know that's a joke, but at work you likely experience greater anonymity than at home (from the website operator at least, can't say if your company monitors). At home, your computer is likely to have an eclectic mix of plugins, more or less up to date browser, OS, etc., all of which make you easy to profile. At work, you're often subject to the demands of the IT department, and the IT department likes uniformity; it's easier to support. So when you surf for porn at work, odds are the website can't distinguish you from anyone else at your office, since you all broadcast the same configuration data.

Re:damn. (5, Funny)

Anonymous Coward | more than 4 years ago | (#32252272)

true,

but you're still boned if you're the only furry in the office.

Re:damn. (1)

bytesex (112972) | more than 4 years ago | (#32252486)

Why does everyone always want to bone furries ? And in the office no less !

Re:damn. (1)

Anonymous Coward | more than 4 years ago | (#32252746)

It's the tail. Without a tail there's no good excuse to wiggle your arse at people.

User agent switcher (2, Interesting)

petes_PoV (912422) | more than 4 years ago | (#32252850)

This is a firefox add-on which might go some way to at least confusing, if not entirely obsfucating your brwser identity

Don't worry (4, Informative)

mangu (126918) | more than 4 years ago | (#32252108)

All you have to do is change your fingerprint to "Googlebot/2.1 (+http://www.googlebot.com/bot.html)". OK, perhaps this needs updating, but you get the general idea.

You'll be amazed at the information some sites will be willing to give you. Even paysites will let you in for free if they believe you are Google.

Re:Don't worry (1)

Arancaytar (966377) | more than 4 years ago | (#32252282)

According to TFA, your /fingerprint/ is way more than your /User Agent string/ - in particular, when you enable Javascript.

Re:Don't worry (2, Interesting)

hairyfeet (841228) | more than 4 years ago | (#32253894)

Yeah and the funny thing is what ID'd me was NOT the fonts...it was the codecs. My fonts are pretty bog standard but I like Klie codec pack [free-codecs.com] as it is an easy way to have video support for all formats set up quickly. According to the test page my codec list is only 1 in 904006 when it comes to codecs.

Of course the nice thing is yet again Noscript comes to the rescue, as with Noscript on my highest ID # is 1 in 256, which is only because of using FF over IE. So yet again FF scores a win for me by having the indispensable Noscript. FF plug-ins FTW!

Re:Don't worry (5, Informative)

darthflo (1095225) | more than 4 years ago | (#32252408)

That's just the User-Agent string. The actual fingerprint consists of that and a big bunch of other headers your browser sends out with each request. Language, preferred encoding, plugins; screen resolution, your installed fonts and so on.Changing your standard browser's user-agent to something like you quoted above is a surefire way to be even more unique.
Check the panopticlick page [eff.org] for your details. Keep in mind their "bits of identifying information" only apply to a single header. A bit of work and identifying over all of these fields is easily done. Throw in a bit of extra work and users can be singled out even after they change one or two of 'em.
Summing all the lines together, I can get some 70 bits of identifying info out of my (almost worst-case) setup: Ubuntu 9.10 running a snapshot of Opera 10.54 with a couple of extra fonts and a weird screen resolution.Cut away user-agent and plugins and we're still at some 35, more than IPv4 addresses out there.

Re:Don't worry (1)

hyartep (1694754) | more than 4 years ago | (#32253158)

it's not only about headers, but also about info available with javascript (such as screen size etc.)

Re:Don't worry (4, Funny)

coolsnowmen (695297) | more than 4 years ago | (#32253818)

Which is why I have a linux script that constantly changes the size of my browser window by a couple pixels.

Re:Don't worry (0)

Anonymous Coward | more than 4 years ago | (#32254090)

And don't forget that they get all that info on top of your IP address. This can be used to further refine identification or resolve collisions of the other identifiers. Most people will have a fairly stable IP for awhile, which makes for easy tracking. Even people on dynamic IPs will usually have an IP within a certain range (and it won't change that often). If you try to hide your IP using a proxy or TOR, that also provides a bit of identifying information (you become "the user with this agent-string, these plugins, and who uses this IP-block owned by this proxy service").

Plus the fingerprints allow them to link "old IP" to "new IP" each time it changes, providing a continuous history for a given user. Basically, if you're keen you can uniquely track every visitor to your site.

Really what we need is for browsers to send less information. For instance I think we can survive without screen resolution being broadcast (How many sites really adjust on that basis? We could probably get by with just a "Mobile Device? Y/N" flag.) The plugins also provide way too much information. I realize that a page may need to know whether a given plugin exists or not. But there's probably a way to trim it down just to the essential information, which would make the number of combinations smaller, and thus make browsers look more generic.

Re:damn. (1)

WrongSizeGlass (838941) | more than 4 years ago | (#32252186)

gonna have to stop surfing porn at work now.

Just do it from the proxy server and they'll never be able to trace it back to you ... unless you're the only one with access to that server, which means you should start handing out the server passwords, which would make you the anti-Terry Childs of workplace porn!

Re:damn. (1)

WrongSizeGlass (838941) | more than 4 years ago | (#32252264)

Who really cares that their "browser fingerprint" is out there? Unless you're doing something wrong there's no reason to ever try to trace it back to a source.

If you're that concerned about some site(s) knowing you were there then either don't go there or change your IP address regularly so they don't know you're the same visitor (changing the cloned MAC address of your router and rebooting your router & broadband modem will get you a different IP address on some networks). If you're doing it from a static IP address you're paying for, well, then you're paying to identify yourself.

Re:damn. (1)

The Fanta Menace (607612) | more than 4 years ago | (#32252470)

Umm, what if you're in China and you're browsing pro-democracy websites?

Re:damn. (1)

omnichad (1198475) | more than 4 years ago | (#32253170)

Then the IP address is enough identifying information. This article would be irrelevant.

Re:damn. (0)

Anonymous Coward | more than 4 years ago | (#32253714)

um...no. What if you already took precautions against having your IP address identified. Unsecured wireless access, etc...then THIS would still get you.

Re:damn. (1)

coolsnowmen (695297) | more than 4 years ago | (#32253874)

just be cause you can fingerprint(uniquely identify) a browsing entity, doesn't mean you can easily find them. You'ld have to then correlate that fingerprint with one with a traceable ip. What if the same firefox plugin I'm using to obfuscate my source IP also is providing a standard set of plugins/fonts and is disabling certain java script calls (ostensibly to prevent itself from being detected but now with the added side effect of preventing you from being uniquely identified).

Re:damn. (3, Insightful)

icebraining (1313345) | more than 4 years ago | (#32253136)

Who really cares that their "browser fingerprint" is out there? Unless you're doing something wrong there's no reason to ever try to trace it back to a source.

Except what's "wrong" is not well defined *now*, and it may even be worst in the future - and we have no idea for how long they'll keep those logs.

Re:damn. (4, Insightful)

DM9290 (797337) | more than 4 years ago | (#32253514)

Who really cares that their "browser fingerprint" is out there? Unless you're doing something wrong there's no reason to ever try to trace it back to a source.

And who defines what "wrong" is? In some places being gay is a crime. In some places being an apostate is a crime. In some places being anti-government is a crime. In some places playing violent video games, looking at porn of women with small breasts is a crime. In some places reading certain books is a crime.

Either you are ignorant, or you are trolling.

GOD DAMN ENUF WITH THE DUPS ALREADY ! (-1, Troll)

Anonymous Coward | more than 4 years ago | (#32252016)

Are you fucking slow? Who'd the tardo that keeps submitals over this? Old shit alreay mnutherfucker!

Take some measures... (5, Informative)

IYagami (136831) | more than 4 years ago | (#32252022)

From TFA:

"There are some effective countermeasures, however. A uniquely identifiable IDG News Service Windows XP computer running Firefox could not be identified with the NoScript [noscript.net] safe browsing extension turned on. Adding the Tor [torproject.org] Internet anonymization software also works, Eckersley said."

Re:Take some measures... (1)

The MAZZTer (911996) | more than 4 years ago | (#32252508)

Chrome also has NoScript-like functionality. Go to Options > Content Settings and disable JS and plugins, and add exceptions using the addressbar icons that appear when you browse sites you trust.

Re:Take some measures... (1)

MyFirstNameIsPaul (1552283) | more than 4 years ago | (#32254020)

But does that work the same as NoScript to select which domains on the site the user allows? I don't like it that google-analytics is on damn near every page on the Internet. I don't need Google tracking me everywhere I go.

Re:Take some measures... (0)

Anonymous Coward | more than 4 years ago | (#32252514)

God I love that extension, it grants all sorts of security just by preventing me from doing 'stuff' I didn't mean to do.

Fonts leak a lot of information (1)

billstewart (78916) | more than 4 years ago | (#32253138)

Even without the Javascript leakage, fonts leak a lot of information. My browser showed up as unique (until I tried connecting with both Mozilla and IE, and with NoScript on and off under Mozilla), because I was the only person with the couple of fonts used by my company for their logo and branding. And even without that, if you downloaded that cool Elvish font, and that fairly clean monospaced console font, that probably makes you unique.

Browsing would be a lot more private if you could choose which fonts you actually want the browser to export, as opposed to having Mozilla automatically export everything your machine has. In general, I've got no interest in having all those decorative things show up in my browser; I'd prefer to have just a couple of fonts advertised.

Re:Fonts leak a lot of information (1)

quickOnTheUptake (1450889) | more than 4 years ago | (#32253640)

Isn't there a really simple way to change the fingerprint?
Why not make a script that just periodically installs some bogus fonts (to avoid having these fonts weeded out automatically, we could create a list of real but unusual fonts that practically never get used in webpages).
Then the fingerprint will contain more bits, but it won't matter because it changes regularly. If we wanted to really go all out we could do something similar with plugins.
Although I suspect browsers only load system fonts and plugins at startup, so you would retain a fingerprint until you restarted the browser.

Re:Fonts leak a lot of information (2, Interesting)

moonbender (547943) | more than 4 years ago | (#32253668)

I agree. In fact, I don't want my browser to send out any kind of information on the fonts I've got installed. It's not a feature sites tend to use, so you might as well disable it. Any way to do that with Firefox?

Re:Take some measures... (1)

Steve Max (1235710) | more than 4 years ago | (#32253144)

However, see section 6.1 from TFA (the actual EFF article, not the news piece): technologies used to "enhance privacy" may be counterproductive. Using those technologies (FlashBlock, Privoxy, changing your UA) is very uncommon, so the average entropy of browsers using those technologies is high. They add that they didn't try to fingerprint NoScript usage any further, but it is very possible to do so if users allow scripts from some important sites.

Re:Take some measures... (0)

Anonymous Coward | more than 4 years ago | (#32253516)

It seems that a good chunk of your identifiability comes from the list of fonts you have actually installed on your computer (many programs install fonts). This list is captured through a flash object. Since noscript blocks flash... you know.

Original ./ article (5, Informative)

Mouldy (1322581) | more than 4 years ago | (#32252026)

Re:Original ./ article (0)

Anonymous Coward | more than 4 years ago | (#32254076)

./ article? really?

no shit (1, Insightful)

Anonymous Coward | more than 4 years ago | (#32252034)

anyone that has had a website not hosted on geocities knows this

most normal people should know this by now also, how do you think it knows to install the windows version over the linux or OSX version (ie installing java)

Re:no shit (1)

Cro Magnon (467622) | more than 4 years ago | (#32252394)

most normal people should know this by now also, how do you think it knows to install the windows version over the linux or OSX version (ie installing java)

Or, in the case of this crowd, how it knows NOT to install the windows version on our Macs/Linux boxen.

Re:no shit (1)

EvanED (569694) | more than 4 years ago | (#32252400)

how do you think it knows to install the windows version over the linux or OSX version (ie installing java)

Being able to tell what OS you're running is a far cry from being able to basically personally identify you. The former is probably present in your browser's useragent; the latter requires for more than just your useragent. But of course you know that, because you read TFA, right?

Re:no shit (2, Informative)

grumbel (592662) | more than 4 years ago | (#32252584)

It goes far beyond just the OS. With Flash for example you can get a list of all the fonts the user has installed. If you ever installed some custom fonts, chances are you are close to 100% uniquely identifiable. You can also trace which pages the user has visited with some dirty CSS tricks (load an image in a:visited {}, track that, and you know if the user has visited the link).

I seriously doubt that most users are away of that trickery on how much information it is really giving away.

Old News (1, Informative)

ronmon (95471) | more than 4 years ago | (#32252036)

This was covered in January [slashdot.org] .

Re:Old News (4, Informative)

caerwyn (38056) | more than 4 years ago | (#32252370)

This article relates to the publishing of the *results* of the experiment announced in the first article. This is not (for once) a dup. Hence the "compiled over the past few months" bit in the summary.

Re:Old News (0)

Anonymous Coward | more than 4 years ago | (#32253444)

Any Slashdotter worth his salt (or whatever) should have realized years ago that this is probably possible.

Re:Old News (1)

noidentity (188756) | more than 4 years ago | (#32252386)

The beginning of this was covered, I believe. Now the data are in and they can draw definite conclusions.

Personally Identifiable Information (5, Interesting)

Coreigh (185150) | more than 4 years ago | (#32252040)

I don't care if anyone tracks my preferences or shopping history. What I care about is; 'Is that information "Personally Identifiable"?' In other words its not that they know what I do, its do they know, specifically, who I am.

I am all for research and marketing to tune products and advertising, but they don't need to know my name or various identifiers to do it.

Re:Personally Identifiable Information (5, Funny)

somersault (912633) | more than 4 years ago | (#32252086)

In other words its not that they know what I do, its do they know, specifically, who I am

Bruce Wayne: It's not who I am underneath, but what I do that defines me.

Re:Personally Identifiable Information (0)

Anonymous Coward | more than 4 years ago | (#32252176)

What I care about is; 'Is that information "Personally Identifiable"?' In other words its not that they know what I do, its do they know, specifically, who I am.

The problem is that being uniquely identifiable (as is the case with this problem) greatly expands the scope of any personally identifiable leak and also potentially creates new personally identifiable leaks when data is aggregated. It also takes surprisingly little information to become personally identifiable: The Netflix privacy scandal [slashdot.org] was based on the combination of zip code, birthdate, and gender.

Re:Personally Identifiable Information (3, Insightful)

Monkeedude1212 (1560403) | more than 4 years ago | (#32252224)

Thats where things get difficult, though, right? For the sake of arguement, lets say that Microsoft decided to embed a Unique User ID into everyone's internet explorer, so that anytime you browse the net your ID gets stamped everywhere you go. Makes it easier for adspace to trend towards your interests, right? But then you're also checking your facebook, your email, your bank account, logging into slashdot, and so on and so forth.

Eventually, one of these services slip, like Facebook has, and your Identifiable Information gets out in the open. When I google my name, I see my Facebook Profile, my name come up under my mothers friends list on Facebook, a handful of .NET Debugging forums. Even foreign versions of Facebook, in my classes we had people from the middle east, Japan, Hong Kong, and other regions of the world, and every other google page I see "Facebook: (Chinese Characters) (My Name) ". Makes me a little paranoid I'm being creeped by someone I don't know.

Regardless - my point is that any effort they make to track just your preferences will always lead back to some site that slips up and makes your identifiable information easier to find, should you put it anywhere online. The way things currently are, you are pretty much safe if you do your best to keep your anonymity online, is probably the best its ever going to get.

Re:Personally Identifiable Information (4, Informative)

fuzzyfuzzyfungus (1223518) | more than 4 years ago | (#32252254)

The trouble is, you only need to fuck up once(or, perhaps more realistically, a few times to let the algorithms bump their confidence in the ID high enough) for that information to become personally identifiable. And, once gathered, a body of "non-personally identifiable" information can persist for a time limited only by the plummeting costs of storage and can, at any future time, be linked with enough new data to make it personally identifiable.

Some percentage, varying by person(and by whether or not your ISP is selling you out to anybody like Phorm), of site visits are personally identifying with a fairly high degree of confidence. For a substantial number of people, that's probably just facebook. In other cases, patterns of activity across a few websites make inferring your identity with fairly high confidence reasonably plausible. Because things like 3rd-party ad networks and whatever "I can't believe its not beacon" tech facebook is using today, have cross site reach, often remarkably broad, it is by no means unrealistic to expect that, over time, at least one of your personally identifiable visits or visit clusters will overlap with the reach of one or more ad networks with extensive "non-personally identifiable" knowledge of what your browser fingerprint has been up to. At that point, the previously "non-personally identifiable" is suddenly personally identified.

Most people aren't even paying attention. Even the ones that are are likely imperfect in their execution, and keeping up with the scope and sophistication of what a competent data-miner could infer would practically be a full time job. Unless you are a truly bland person, you can probably be identified with fair confidence on surprisingly little data. Worse, as TFA notes, a lot of the common "privacy" measures and extensions and so forth actually make your browser substantially more unusual than it would otherwise be.

Re:Personally Identifiable Information (2, Insightful)

tpstigers (1075021) | more than 4 years ago | (#32252482)

I use credit and debit cards to purchase items in stores all the time. There's nothing even remotely anonymous or private about the process. Why do we all expect it to be otherwise online?

Re:Personally Identifiable Information (1)

natehoy (1608657) | more than 4 years ago | (#32252768)

The trouble is in aggregated data.

Let's say I run a website. If you visit my site and you don't enter any personally-identifiable data, I don't know who you are. But I do see your browser signature which I can store along with your IP address (which will at least usually identify your ISP) and if you haven't blocked it I can also use doubleclick or googleanalytics to get your unique cookie ID. I can freely sell that information to anyone I damned well please because there's no personally identifiable information in it. Data aggregators pay decent sums to collect that data.

Then, if you visit another site, they can buy the aggregate data on your visits and see what other sites you visit.

Eventually, you're going to buy something. That seller (if they are honest and have a decent privacy policy) will not sell your name. But they have it, and they have your entire browsing history. And they add the fact that "user 918470293487 purchased a XYZ-model digital camera at 8PM on the 15th for $X, after spending 4 hours on the site reviewing other models, looking at 245 reviews, focusing mostly on negative reviews, marking three of them as helpful, two of them as unhelpful, and asking the following questions on the user forums."

That is now part of your aggregate data. Do a search for "check engine light" and your car dealer knows something is wrong with your car, because they are collecting aggregate data and know who you are.

Re:Personally Identifiable Information (1)

dmomo (256005) | more than 4 years ago | (#32252930)

Interestingly, even if this type of fingerprinting doesn't 100% uniquely identify a user, for the purposes of marketing, that's probably okay. Users with the same fingerprints are likely similar demographically. At least as far as a target audience for a product is concerned. I'd almost prefer to be lumped anonymously into an "advertising bucket" than be tracked individually. Maybe we need a system for fingerprint sharing. I'm sure some firefox plugin could spoof or randomize this to some extent.

Re:Personally Identifiable Information (1)

ccady (569355) | more than 4 years ago | (#32253404)

What really scares me is when advertisers know stuff about me that *I* don't even know. Like the fact that I will need Viagra tomorrow, or that I am about to receive a million dollars from my Nigerian uncle.

Re:Personally Identifiable Information (2, Interesting)

tlhIngan (30335) | more than 4 years ago | (#32253752)

I don't care if anyone tracks my preferences or shopping history. What I care about is; 'Is that information "Personally Identifiable"?' In other words its not that they know what I do, its do they know, specifically, who I am.

I am all for research and marketing to tune products and advertising, but they don't need to know my name or various identifiers to do it.

As seen time and time again, the answer is yes. That fingerprint you have - did you go shopping with it? Boom, you've just linked your fingerprint to a name, address, phone number, and partial credit card. Or visit Facebook? Or other social networking site?

Remember that Netflix contest? A simple match of that data with IMDB reveals all. And people constantly do things that inadvertently link their personal information with a fingerprint.

It's only a matter of time - businesses often sell your information to third parties, and soon those third parties will pay for the fingerprints as well. It doesn't have to be an exact positive match, even something as crappy as a 50% hit rate is enough to be spooky. And even if YOU don't make yourself identifiable, others do to make it worthwhile to do so.

And even if we strip down tons of browsers to return the same information regardless, there'll be other ways - possibly using Flash to profile your system to generate your fingerprint (they already do with flash cookies). Hell, who knows what Flash can retrieve, especially on phones (the UI to manage flash cookies is crappy enough. The UI to do it on mobile phones supporting flash will probably be non-existent).

Doesn't link it to YOU (3, Interesting)

Gothmolly (148874) | more than 4 years ago | (#32252054)

It only lets them know it's the same browser/computer, it doesn't give them the docs on you.

Re:Doesn't link it to YOU (2, Insightful)

Cmdr-Absurd (780125) | more than 4 years ago | (#32252256)

Ah, but if you can be ID'd on a single site, much of what you do can be tracked. A lot of http access logs are web-accessible.
So if I can associate you with your browser signature on ANY site, I can let my google fingers do the walking. It's a snap.

Re:Doesn't link it to YOU (2, Insightful)

IamTheRealMike (537420) | more than 4 years ago | (#32253014)

The fingerprinting techniques heavily relies on JavaScript, so finding random unprotected http access logs isn't going to help you. If it's truly "a snap" then please show me my last visited sites?

I think at some point the internet privacy debate will have to start featuring some concept of personas, or the idea that a single person does not have a single identity but rather many identities. Some of them overlap, some of them are easier to change than others and some of them are what we might call "personal" - for instance personas like your full legal name or physical appearance are clearly different to a persona like a passport number, which is itself quite different to an email address (a lot harder to change for one). Although today they tend to all get lumped together under the same concept of "you-ness".

In this case, my browsers fingerprint is clearly a persona, but is that really a problem?

Re:Doesn't link it to YOU (1)

camperdave (969942) | more than 4 years ago | (#32253754)

That's easy. Your last visited site was Slashdot.

Re:Doesn't link it to YOU (1)

suggsjc (726146) | more than 4 years ago | (#32253066)

Either I'm missing something or your creating a strawman.

First you say "A lot of http access logs are web-accessible." My guess would be that mainly smaller/lower trafficked sites (not that the information couldn't be valuable), are the ones making their logs available whereas the more popular sites would do their due diligence and secure them. However you then write "So if I can associate you with your browser signature on ANY site..." Like I said, I may be missing something, but can you, Cmdr-Absurd, get access to the logs to ANY site and compile that information across ALL the sites on the web? If you can, please let the /. community know how because I'd say you've stumbled across a very large security/privacy hole.

Re:Doesn't link it to YOU (1)

canajin56 (660655) | more than 4 years ago | (#32252262)

Yeah, not quite...you turn on your proxy and browse whatever porn. Then you close everything, turn off the proxy, and hit up facebook. Now they know who you are.

Re:Doesn't link it to YOU (1)

mea37 (1201159) | more than 4 years ago | (#32252530)

Er... why do you theorize Facebook is exchanging browser profiles info with random porn sites?

Like many people assessing online privacy threats, you seem to be looking at what a sufficiently well-placed cabal could do (from a "technically plausible" standpoint) and not thinking about real-world applicability. If your best reason to be concerned about privacy is to conceal your porn habits, you can rest assured nobody's that interested anyway. (Yes, there are exceptions. If you're trying to conceal predatory behavior, my attitude switches from apathy to lack of sympathy.)

Which is not to say there's no threat. If Facebook realizes that those profile-to-person mappings have commercial value, they certainly might start sharing them with commercial sitest that are willing to pay for them.

Re:Doesn't link it to YOU (1)

Monkeedude1212 (1560403) | more than 4 years ago | (#32252316)

It's about as effective as knowing who is driving a car by the license plate. Yeah its not 100% accurate but definately more than 90%.

Re:Doesn't link it to YOU (0)

Anonymous Coward | more than 4 years ago | (#32253328)

there are tons of methods for hiding who you are... but probably only 5% of the users out there (if even that many) will ever even know that they exist or even understand how to put them in effect even if explained with pre-school pics and wide rule yellow kindergarten paper ;)

i personally prefer this method to identifying individuals on sites i develop personally for myself... i also use cookies but this as somewhat of a background for non sensitive preferences, etc... but if anonymity is what your looking for you could spend a life time trying to keep up with all the new crap out there that the spammers and marketers and even honest developers keep coming up with to figure out who you are and what the best add is they should through in your face... and as for the chrome comment... you may be able to hide cheesy little things that will keep your wife from knowing that you prefer to look at 19 year old firm breasts to get worked up instead of her aging 50 year old saggy bottom that looks like a bag of marbles, but you'll never trick company sniffers, or advanced server developers... so clicking that ole incognito button (aka the porn browser mode which is what we call it at work ;) ) only gets you so far... we have entered into an age where someone seems to know just about everything about us if they wish from what we purchase including just every dollar we spend and our preferences in ice cream and books to what our favorite fetish and techie information site ;) face it only way out of it completely is get a cabin in the woods use candles for light and those old fashioned information sources that we used to use as kids (aka books *sarcastic grin*) other then that assume that you will never be 100% anonymous in anything you do from this day forward!

even plugins? (0)

Anonymous Coward | more than 4 years ago | (#32252062)

> data on the type of browser, operating system, plugins, and even fonts installed

Surely the browser, version, an OS are available in the user agent ID string, which one can spoof with a FF plugin.

But unless one enables scripts, how can a site get the list of plugins and fonts intalled? I didn't know there was something sent from my browser back with that information. If so, is there a plugin to remove it? :)

Of course if I enable scripts I'd expect a site could get that info, but if I let it run scripts, all bet are off about privacy anyway, which is why my default is "disable scripts unless I have a good reason to enable them". I've never understood why most people use the opposite default of, "hey, Mr Web Site, run anything you want! Really, it's no problem, I don't need to have any idea whatsoever what you're doing that for."

I'm not really worried (1)

sourcerror (1718066) | more than 4 years ago | (#32252096)

When I want to be anonymous I switch to incognito mode in Chrome (ctrl+shift+n). This won't show my cookies, and doesn't save browsing history. As I don't use any plugin besides Flash in Chrome, this doesn't reveal too much about myself. I don't use any other fonts than what are installed in WinXP by default. (However I don't see, how can a webserver know what fonts are installed.)

Re:I'm not really worried (4, Funny)

$RANDOMLUSER (804576) | more than 4 years ago | (#32252196)

When I want to be anonymous I switch to incognito mode in <Google product>...

Excellent plan.

Re:I'm not really worried (2, Interesting)

TheLink (130905) | more than 4 years ago | (#32252326)

Can anyone replicate this behaviour: when I clear all browser history on Google Chrome, Chrome makes a few http requests to Google just after that is done. What's that about?

This was on Windows 7. I encountered this when I was capturing packets for some performance test so I had to keep clearing the browser cache for some tests.

Re:I'm not really worried (1)

dave420 (699308) | more than 4 years ago | (#32252864)

It only seems to do that when you have configured it to send usage statistics back to Google. It must be for tracking, as the server sends nothing back (even going so far as sending a 204 instead of 200).

Chrome Incognito Mode won't help (1)

G'Quann (237134) | more than 4 years ago | (#32252266)

If you are talking about TFA, it won't help. Just tried visiting EFF's test site in normal mode and in inkognito mode and both times got identified as the same user.

Re:I'm not really worried (1)

darthflo (1095225) | more than 4 years ago | (#32252518)

how can a webserver know what fonts are installed?

JavaScript. Detects screen resolution and plugins, too.

Re:I'm not really worried (1)

Verteiron (224042) | more than 4 years ago | (#32252754)

And if you enable Flash, it will happily transmit all of your browser info (and, I believe, info about your computer's specifications) to any site that asks for it.

And a webserver can figure out what fonts you have by using @font-face to offer you fonts. If your system downloads them, then the server knows you didn't have them.

You can identify the OS just by the TCP connection (2, Interesting)

Viol8 (599362) | more than 4 years ago | (#32252104)

Never mind the browser , you can tell (or used to be able to , this was a few years back) what OS someone is running - assuming they're not going through a proxy - by looking at the TCP sequence numbers the client sends. There was an article on /. about it and some post grads had written a whitepaper.

Re:You can identify the OS just by the TCP connect (1)

TheRaven64 (641858) | more than 4 years ago | (#32252360)

Yup, the OpenBSD TCP/IP stack lets you do this; pf can filter based on the OS of the originating packets. Unless you run Haiku or ReactOS, however, this is not really uniquely identifiable information.

A Wikipedia Checkuser's opinion (5, Interesting)

Anonymous Coward | more than 4 years ago | (#32252208)

We have a rather annoying vandal by the name of Grawp who likes to visit often and put penis pictures up on pages that little kids like to visit, among other things.

He edits via proxies, while visiting people, open wifi spots, etc... and never figures out how we know it's him.

Shame his laptop has the same fairly unique MSIE-and-toolbars useragent string.

Re:A Wikipedia Checkuser's opinion (1, Insightful)

Anonymous Coward | more than 4 years ago | (#32252296)

Lets hope Grawp does not read this ;)

Re:A Wikipedia Checkuser's opinion (0)

Anonymous Coward | more than 4 years ago | (#32252800)

Too late... >:)

Re:A Wikipedia Checkuser's opinion (0)

Anonymous Coward | more than 4 years ago | (#32252924)

We have a rather annoying vandal by the name of Grawp who likes to visit often and put penis pictures up on pages that little kids like to visit, among other things.

He edits via proxies, while visiting people, open wifi spots, etc... and never figures out how we know it's him.

Ummm, maybe because his username is Grawp?

Cookies (3, Informative)

chipperdog (169552) | more than 4 years ago | (#32252260)

Cookies are at least a "honest" way to track. you can easily see them in your cookie jar (or whatever term is used by your browser), and you have at least some information about who wrote it. Cookies are not always bad - hidden images, browser/OS fingerprinting, and other 'hidden' means are much worse for privacy.

Yeah... so? (1)

SpicyBrownMustard (1105799) | more than 4 years ago | (#32252290)

All this tuss-up over cookies and "browser fingerprints" ... has anyone ever pointed to any contemporary examples of where the anonymous alphanumeric string in a cookie and/or "browser fingerprint" (combination of header information of OS, browser version, IP, etc.) has resulted in any bad thing happening to good people?
Anyone?
Anyone?
"What's your point Walter?"
"Shut the -F- up Donnie!"

BFD (3, Informative)

rwa2 (4391) | more than 4 years ago | (#32252298)

Don't let the mass media scare you.

Step 1: Install Wireshark [wireshark.org]
Step 2: Leave Wireshark running and observe what kind of information people are gleaning from you over the network. It's educational!
Step 3: There is no step 3.

I don't see why people expect anonymity on the internet any more than they do driving around in their car with the license plate showing.
I just pretend there's an FBI agent always watching over my shoulder. His name is Fred. I explain to him everything I'm doing.

Re:BFD (1)

unixan (800014) | more than 4 years ago | (#32253124)

Step 1: Install Wireshark [wireshark.org]

Step 1.5: Install HttpFox [mozilla.org] (Firefox on any OS) or HttpWatch [httpwatch.com] (IE or FF on Windows).

For HTTP traffic, both will supplement WireShark by giving you a clear browser-level picture of what data your browser is sending and receiving.

For HTTPS (or other SSL/TLS tunneled protocol spoken by your browser), it's also the practical way to get a cleartext version of the communication.

Unique font collection (1)

Arancaytar (966377) | more than 4 years ago | (#32252328)

I tried the survey some months ago when they started it, and found that your most unique information usually is the list of installed fonts that Javascript can provide to pages.

Not only is it usually unique, some of these fonts are specifically installed by some applications, which means that info about your work environment (eg. MS Office / OpenOffice.org / etc.) leaks out.

In my case, I had several old Tengwar fonts and one vectorized sample of my handwriting helpfully named "Arancaytar's Handwriting". I might as well add my name to my user agent string. :P

And? (3, Insightful)

flintmecha (1134937) | more than 4 years ago | (#32252402)

data on the type of browser, operating system, plugins, and even fonts installed

Should I be worried about websites knowing these things?

Re:And? (0)

Anonymous Coward | more than 4 years ago | (#32253736)

data on the type of browser, operating system, plugins, and even fonts installed

Should I be worried about websites knowing these things?

Obviously. If you're not paranoid enough and someone can actually identify you, that allows the eeeeevil scaaaary sp00ks in the gummint and corporations to Evil(tm) your soul out, right through your very nose!!! See? Scaaaaaaaaary! OoooooOoooOOOo!

So take our advice and go hide under a rock (but not OUR rocks; they might find us then!) and live in complete anonymity for the rest of your life! Then maybe you'll achieve the one true, real bliss that you can only get from being a completely unknown person and you can die content in knowing that nobody ever knew or cared about you, because you're not a SHEEP like all the other SHEEPLE (see what i did there isnt that clever)!

Or you could, like you suggest, just get over it and realize people know a lot more about you than their l33t off-the-grid counterculture wants to believe and maybe live a life that doesn't involve wasting way too much of your time hiding in fear. You do know those silly tinfoil hats haven't stopped our mind-beams since the early 70s, right?

I mean, their mind-beams. The ones that they have that I did not take part in developing. The ones that they don't have. That don't exist. That I never said anything about. Now, just look over here for a second...

Plug-in to randomise all but the essentials? (1)

ciaran_o_riordan (662132) | more than 4 years ago | (#32252462)

Randomising most of HTTP_ACCEPT and User agent would totally fix this problem, right? Or at least, it should for those of us with javascript turned off by default (using noscript makes this pretty convenient).

A handful of things should stay the same, such as browser name, the major version number of the browser, and your main language preferences, but I guess the rest could change per-site by selecting random values from lists of valid values.

Anyone know of a plugin (for any browser) that does this?

Re:Plug-in to randomise all but the essentials? (1)

dave420 (699308) | more than 4 years ago | (#32252894)

Paranoid much? If you are that far gone, you might as well simply unplug your computer and spend all your savings on tin foil.

Re:Plug-in to randomise all but the essentials? (1)

pclminion (145572) | more than 4 years ago | (#32253964)

That's only useful if a whole lot of people use it. Otherwise, you have a very clear fingerprint: you're "That guy with that weird randomizer plugin."

It's not really that uniquely identifying... (1)

damn_registrars (1103043) | more than 4 years ago | (#32252496)

Watching my apache logs, I see lots of very similar "fingerprints" like they refer to. However, a lot of it leads to dead ends. For example, I see a lot of users who connect through RoadRunner, running Windows Vista, using Firefox3. That doesn't really tell me much. Sure I can attempt to locate where they are geographically by their IP address, but that isn't all that useful either if I really want to say "that was John Smith". After all, even if I know that two visits on different days were the same originating IP, same OS and same browser, I can't really say for sure that it was the same person.

Now of course, if the distribution of operating systems (and browsers) on PCs was more even it would be easier to be more confident about identifying return visitors. But as it is there are a lot of PCs out there that aren't upgrading their OS for any of a number of reasons.

Re:It's not really that uniquely identifying... (1)

omnichad (1198475) | more than 4 years ago | (#32253374)

The article describes data that isn't gathered in Apache's logs. Things that can only be found through CSS, Javascript or Flash tricks. Screen resolution, Flash Version, installed fonts, visited web sites (in certain versions of Firefox, at least).

COOKIES (0)

Anonymous Coward | more than 4 years ago | (#32252566)

http://www.youtube.com/watch?v=0VlnFI7J-Tk&feature=PlayList&p=1B134515F6E5C749&playnext_from=PL&index=0&playnext=1

Some proxies seem to work (1)

Adrian Lopez (2615) | more than 4 years ago | (#32252622)

The EFF site identifies my computer uniquely if I access it directly, but when I access it through proxify.com all the information it gathers has no relation to the information it gathers when I access it directly. The user agent and HTTP_ACCEPT headers are both spoofed, and since Javascript is disabled it cannot obtain any info about plugins, time zones, screen size, system fonts or supercookies. I suspect all who access the website through Proxify will look like the same user unless they happen to enable Javascript.

EFF (0)

Anonymous Coward | more than 4 years ago | (#32252650)

Eff that.

Public Place? (1)

Cytlid (95255) | more than 4 years ago | (#32252792)

I'm all for privacy, don't get me wrong. But is the Internet a public place? I mean, if I go out to lunch somewhere with my wife or a friend, anyone can take pictures of me. People can see what I'm wearing. They can overhear my conversations, and maybe glean my name or address from them. They can look at my car and my license plate. A whole slew of valuable personal information about me can be gathered from something as simple as a lunch date. Someone can follow me. Anything can happen, really. Is being on the internet any different? Just because it happens while you're at home, behind a computer, you're accessing the public world from the privacy of your own home. Is there something in the human brain that wants to pretend they're in a private space when they're not? (Think people in their cars). Just because it's virtual and not tangible, doesn't mean it isn't public. Your "address" on the internet is a public space, even if you don't like it. Just like the address of your house is public. My point is this. Your picture of your aunt Sue in your "Pictures" directory on your computer is private information. Chances are noone has that same image in that same spot, named exactly the same thing. Your IP address, what browser you use or sites you've visited is not private information. It's generic information. Some person uses Firefox. And Ubuntu. And they went to XYZ.com and their ISP is ABC corp. I'm glad the EFF is a watchdog group keeping an eye on these things. But sometimes I'm just a normal guy doing normal things and if I told you everything I did and where I went, you'd be bored to tears.

OMG! (1)

KiwiCanuck (1075767) | more than 4 years ago | (#32252886)

People know what font I'm using. Holy carp! Stop the presses, this is the greatest injustice in the history of the multiverse! Yep, I am defined by my browser font.

Another Perspective: Use the data for security... (0)

Anonymous Coward | more than 4 years ago | (#32253188)

It would take more than just cookie hijacking to break a session then.

Not that great an identification (1)

aepervius (535155) | more than 4 years ago | (#32253430)

It says 1 browser out of 4.72 for each criteria 8except one) have the same ID as me. Even assuming *ALL* criteria are actually really unique, with the user agent string being common to 1 out of 36 that come out at about 1 out 150.000. Naturally the other data aren't really unique it comes out at less. So..... I am not worried.

Re:Not that great an identification (2, Informative)

jittles (1613415) | more than 4 years ago | (#32253858)

Try allowing Noscript on that site? I was listed as 1 in 4 too until I enabled scripting on that website and ran the test again. Then I came out to be 1 in 1,000,000. I'd say that's more unique than I'd like to be.

Test yourself here [eff.org] if you haven't already.

RSA Passmark MFA uses Fingerprinting (1)

Jainith (153344) | more than 4 years ago | (#32253580)

The RSA/Passmark system used by many banks for "Multi-Factor Authentication" (it really isn't) uses fingerprinting as one of the many factors.

I used to have to do support for an installation of this system provided by ITI (a banking industry software provider, now owned by FISERV).

Anyway part of the MFA process checks the fingerprint to see if it is one of the ones saved in a users profile...if it is not then they get asked for the extra security question.

We sometimes had odd issues with the detection when the customer had an old version of flash (5 ish) , or was using an odd platform (Apple).

WHERE IS FIREFOX PLUGIN FIX? (0)

Anonymous Coward | more than 4 years ago | (#32253680)

DAMMIT? Don't say TORBUTTON

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?