EFF Says Forget Cookies, Your Browser Has Fingerprints 175
alphadogg writes "Even without cookies, popular browsers such as Internet Explorer and Firefox give websites enough information to get a unique picture of their visitors about 94 percent of the time, according to research compiled over the past few months by the Electronic Frontier Foundation. [The Research] puts quantitative assessment on something that security gurus have known about for years, said Peter Eckersley, the EFF senior staff technologist who did the research. He found that configuration information — data on the type of browser, operating system, plugins, and even fonts installed — can be compiled by websites to create a unique portrait of most visitors. This means that most Internet users are a lot less anonymous than they believe, Eckersley said. 'Even if you turn off cookies and you use a proxy to hide your IP address, you could still be tracked,' he said."
Take some measures... (Score:5, Informative)
From TFA:
"There are some effective countermeasures, however. A uniquely identifiable IDG News Service Windows XP computer running Firefox could not be identified with the NoScript [noscript.net] safe browsing extension turned on. Adding the Tor [torproject.org] Internet anonymization software also works, Eckersley said."
Re: (Score:2)
Re: (Score:2)
Fonts leak a lot of information (Score:2)
Even without the Javascript leakage, fonts leak a lot of information. My browser showed up as unique (until I tried connecting with both Mozilla and IE, and with NoScript on and off under Mozilla), because I was the only person with the couple of fonts used by my company for their logo and branding. And even without that, if you downloaded that cool Elvish font, and that fairly clean monospaced console font, that probably makes you unique.
Browsing would be a lot more private if you could choose which font
Re: (Score:2)
Why not make a script that just periodically installs some bogus fonts (to avoid having these fonts weeded out automatically, we could create a list of real but unusual fonts that practically never get used in webpages).
Then the fingerprint will contain more bits, but it won't matter because it changes regularly. If we wanted to really go all out we could do something similar with plugins.
Although I suspect browsers only load system fonts and pl
Re: (Score:2)
I would say we are currently at the infancy of fingerprinting. It is a really powerful concept in my opinion, but what it lacks is some help from the field of statistics. What I am getting at is this: imagine you have a script that randomly shuffles and/or adds bogus font references. Todays fingerprinting is more than fragile enough to take you as a completely different client, indeed.
Tomorrow however, they will start stat'ing graphs where they will identify the periods/wavelets based on the bogus data you
Re: (Score:2)
Or if they managed to finesse the method so they could say, "well we have this sub-combination which seems likely to be unique (say, linux, with Opera v.10, swfdec, and Apple Garamond light) so we are going to ignore these fonts that don't match as noise."
But that is going to have a higher error rate (beca
Re: (Score:3, Interesting)
I agree. In fact, I don't want my browser to send out any kind of information on the fonts I've got installed. It's not a feature sites tend to use, so you might as well disable it. Any way to do that with Firefox?
Re: (Score:2)
I think it might be possible to obtain that information indirectly, with slightly less precision at worst. For example, you could start with a list of known fonts (that you want to check for), create an autosizing DIV with zero margins and padding, and set its context to a certain text string. Then, measure its (automatically computed) pixel size from JavaScript. This would vary depending on the font, and also on the font rendering technology (which indirectly betrays the OS). I bet that, using enough chara
Re: (Score:2)
That's actually a pretty good idea. While I know FX let's you choose which fonts are the "defaults" for the various families of fonts, it doesn't allow you to restrict exporting to that selection. Curious what the effect is to disabling that particular checkbox. Reckon FX needs a second checkbox on there for "Don't advertise any other fonts"?
Re: (Score:2)
Appreciate practical thinking, but it is also very small minded of you. It won't get you very far in any direction. There will be other query objects than fonts. What do you propose for them? "Don't advertise this?" checkbox for each and every bit of an API.
Fingerprinting efficiency is supported by the very same factor that improves usability of computers. In my opinion, even with your understandable good motivation, the results will not be something the users will like. A lot of applications will break bec
Re: (Score:2)
However, see section 6.1 from TFA (the actual EFF article, not the news piece): technologies used to "enhance privacy" may be counterproductive. Using those technologies (FlashBlock, Privoxy, changing your UA) is very uncommon, so the average entropy of browsers using those technologies is high. They add that they didn't try to fingerprint NoScript usage any further, but it is very possible to do so if users allow scripts from some important sites.
Original ./ article (Score:5, Informative)
Personally Identifiable Information (Score:5, Interesting)
I don't care if anyone tracks my preferences or shopping history. What I care about is; 'Is that information "Personally Identifiable"?' In other words its not that they know what I do, its do they know, specifically, who I am.
I am all for research and marketing to tune products and advertising, but they don't need to know my name or various identifiers to do it.
Re:Personally Identifiable Information (Score:5, Funny)
In other words its not that they know what I do, its do they know, specifically, who I am
Bruce Wayne: It's not who I am underneath, but what I do that defines me.
Re: (Score:2)
If we assume that your fingerprint is assembled wholly at your side, then I would say you are RELATIVELY safe from it being disassembled into components that could compromise your realworld identity. One way to make the fingerprint irreversible like that is to encrypt it with a throw-away random key, also at client side. The unique but absolutely meaningless string arriving at the other end will uniquely identify YOUR END, NOT YOU. You can continue shopping and surfing porn, and all they got is a random str
Re:Personally Identifiable Information (Score:4, Insightful)
Thats where things get difficult, though, right? For the sake of arguement, lets say that Microsoft decided to embed a Unique User ID into everyone's internet explorer, so that anytime you browse the net your ID gets stamped everywhere you go. Makes it easier for adspace to trend towards your interests, right? But then you're also checking your facebook, your email, your bank account, logging into slashdot, and so on and so forth.
Eventually, one of these services slip, like Facebook has, and your Identifiable Information gets out in the open. When I google my name, I see my Facebook Profile, my name come up under my mothers friends list on Facebook, a handful of .NET Debugging forums. Even foreign versions of Facebook, in my classes we had people from the middle east, Japan, Hong Kong, and other regions of the world, and every other google page I see "Facebook: (Chinese Characters) (My Name) ". Makes me a little paranoid I'm being creeped by someone I don't know.
Regardless - my point is that any effort they make to track just your preferences will always lead back to some site that slips up and makes your identifiable information easier to find, should you put it anywhere online. The way things currently are, you are pretty much safe if you do your best to keep your anonymity online, is probably the best its ever going to get.
Re:Personally Identifiable Information (Score:5, Informative)
Some percentage, varying by person(and by whether or not your ISP is selling you out to anybody like Phorm), of site visits are personally identifying with a fairly high degree of confidence. For a substantial number of people, that's probably just facebook. In other cases, patterns of activity across a few websites make inferring your identity with fairly high confidence reasonably plausible. Because things like 3rd-party ad networks and whatever "I can't believe its not beacon" tech facebook is using today, have cross site reach, often remarkably broad, it is by no means unrealistic to expect that, over time, at least one of your personally identifiable visits or visit clusters will overlap with the reach of one or more ad networks with extensive "non-personally identifiable" knowledge of what your browser fingerprint has been up to. At that point, the previously "non-personally identifiable" is suddenly personally identified.
Most people aren't even paying attention. Even the ones that are are likely imperfect in their execution, and keeping up with the scope and sophistication of what a competent data-miner could infer would practically be a full time job. Unless you are a truly bland person, you can probably be identified with fair confidence on surprisingly little data. Worse, as TFA notes, a lot of the common "privacy" measures and extensions and so forth actually make your browser substantially more unusual than it would otherwise be.
Re: (Score:2)
Unless you are quite careful, multiple browsers is trivially def
Re: (Score:2, Insightful)
Re: (Score:2)
The trouble is in aggregated data.
Let's say I run a website. If you visit my site and you don't enter any personally-identifiable data, I don't know who you are. But I do see your browser signature which I can store along with your IP address (which will at least usually identify your ISP) and if you haven't blocked it I can also use doubleclick or googleanalytics to get your unique cookie ID. I can freely sell that information to anyone I damned well please because there's no personally identifiable inf
Re: (Score:2)
Interestingly, even if this type of fingerprinting doesn't 100% uniquely identify a user, for the purposes of marketing, that's probably okay. Users with the same fingerprints are likely similar demographically. At least as far as a target audience for a product is concerned. I'd almost prefer to be lumped anonymously into an "advertising bucket" than be tracked individually. Maybe we need a system for fingerprint sharing. I'm sure some firefox plugin could spoof or randomize this to some extent.
Re: (Score:2)
What really scares me is when advertisers know stuff about me that *I* don't even know. Like the fact that I will need Viagra tomorrow, or that I am about to receive a million dollars from my Nigerian uncle.
Re: (Score:3, Interesting)
As seen time and time again, the answer is yes. That fingerprint you have - did you go shopping with it? Boom, you've just linked your fingerprint
Re: (Score:2)
"I don't care if anyone tracks my preferences or shopping history.
you do you you are on a site that gets raided for some reason.
If you have purchases something, then you are personally identifiable. How do you think they know where to get your money?
Doesn't link it to YOU (Score:3, Interesting)
It only lets them know it's the same browser/computer, it doesn't give them the docs on you.
Re: (Score:3, Insightful)
So if I can associate you with your browser signature on ANY site, I can let my google fingers do the walking. It's a snap.
Re: (Score:3, Insightful)
The fingerprinting techniques heavily relies on JavaScript, so finding random unprotected http access logs isn't going to help you. If it's truly "a snap" then please show me my last visited sites?
I think at some point the internet privacy debate will have to start featuring some concept of personas, or the idea that a single person does not have a single identity but rather many identities. Some of them overlap, some of them are easier to change than others and some of them are what we might call "personal
Re: (Score:2)
Re: (Score:2)
First you say "A lot of http access logs are web-accessible." My guess would be that mainly smaller/lower trafficked sites (not that the information couldn't be valuable), are the ones making their logs available whereas the more popular sites would do their due diligence and secure them. However you then write "So if I can associate you with your browser signature on ANY site..." Like I said, I may be missing something, but can you, Cmdr-Absurd,
Re: (Score:2)
Re: (Score:2)
Er... why do you theorize Facebook is exchanging browser profiles info with random porn sites?
Like many people assessing online privacy threats, you seem to be looking at what a sufficiently well-placed cabal could do (from a "technically plausible" standpoint) and not thinking about real-world applicability. If your best reason to be concerned about privacy is to conceal your porn habits, you can rest assured nobody's that interested anyway. (Yes, there are exceptions. If you're trying to conceal predat
Re: (Score:2)
It's about as effective as knowing who is driving a car by the license plate. Yeah its not 100% accurate but definately more than 90%.
You can identify the OS just by the TCP connection (Score:3, Interesting)
Never mind the browser , you can tell (or used to be able to , this was a few years back) what OS someone is running - assuming they're not going through a proxy - by looking at the TCP sequence numbers the client sends. There was an article on /. about it and some post grads had written a whitepaper.
Re:You can identify the OS just by the TCP connect (Score:2)
A Wikipedia Checkuser's opinion (Score:5, Interesting)
We have a rather annoying vandal by the name of Grawp who likes to visit often and put penis pictures up on pages that little kids like to visit, among other things.
He edits via proxies, while visiting people, open wifi spots, etc... and never figures out how we know it's him.
Shame his laptop has the same fairly unique MSIE-and-toolbars useragent string.
Cookies (Score:4, Informative)
BFD (Score:4, Informative)
Don't let the mass media scare you.
Step 1: Install Wireshark [wireshark.org]
Step 2: Leave Wireshark running and observe what kind of information people are gleaning from you over the network. It's educational!
Step 3: There is no step 3.
I don't see why people expect anonymity on the internet any more than they do driving around in their car with the license plate showing.
I just pretend there's an FBI agent always watching over my shoulder. His name is Fred. I explain to him everything I'm doing.
Unique font collection (Score:2)
I tried the survey some months ago when they started it, and found that your most unique information usually is the list of installed fonts that Javascript can provide to pages.
Not only is it usually unique, some of these fonts are specifically installed by some applications, which means that info about your work environment (eg. MS Office / OpenOffice.org / etc.) leaks out.
In my case, I had several old Tengwar fonts and one vectorized sample of my handwriting helpfully named "Arancaytar's Handwriting". I m
And? (Score:2, Insightful)
data on the type of browser, operating system, plugins, and even fonts installed
Should I be worried about websites knowing these things?
Well, it depends... (Score:3, Insightful)
Plug-in to randomise all but the essentials? (Score:2)
Randomising most of HTTP_ACCEPT and User agent would totally fix this problem, right? Or at least, it should for those of us with javascript turned off by default (using noscript makes this pretty convenient).
A handful of things should stay the same, such as browser name, the major version number of the browser, and your main language preferences, but I guess the rest could change per-site by selecting random values from lists of valid values.
Anyone know of a plugin (for any browser) that does this?
Re: (Score:2)
Re: (Score:2)
Not true, right? (Score:2)
Re: (Score:2)
They don't figure it out by looking at your plugin list, they figure it out because your fingerprint is essentially random (in other words, "highly unlikely") looking.
It's not really that uniquely identifying... (Score:2)
Re: (Score:2)
The article describes data that isn't gathered in Apache's logs. Things that can only be found through CSS, Javascript or Flash tricks. Screen resolution, Flash Version, installed fonts, visited web sites (in certain versions of Firefox, at least).
Some proxies seem to work (Score:2)
The EFF site identifies my computer uniquely if I access it directly, but when I access it through proxify.com all the information it gathers has no relation to the information it gathers when I access it directly. The user agent and HTTP_ACCEPT headers are both spoofed, and since Javascript is disabled it cannot obtain any info about plugins, time zones, screen size, system fonts or supercookies. I suspect all who access the website through Proxify will look like the same user unless they happen to enable
Public Place? (Score:2)
Re: (Score:3, Insightful)
Actually, yes it is different. The first difference is cost. It is expensive to follow people around and record everything they are saying. I don't worry that someone is going to spend a half a million dollars to follow me around for the next year; it's not impossible, but it's about as likely that I will be struck by a meteor. The second is storage of information. If someone decides today to find out exactly what you said at lunch last week, they can't, becaus
Re: (Score:2)
well, when browsinf is the same as going to dinner, you may ahve a point. It's not.
Tney internet is different for several reasons.
1) All yuo conversations can be searched at ones, and any time.
2) At anytime you movements can be determined.
Both those require a substantial resource to do in meat space, and very little in cyber space.
Sure some can follow you, but is the right?
Practicality also defines privacy.
Not that great an identification (Score:2)
Re: (Score:3, Informative)
Try allowing Noscript on that site? I was listed as 1 in 4 too until I enabled scripting on that website and ran the test again. Then I came out to be 1 in 1,000,000. I'd say that's more unique than I'd like to be.
Test yourself here [eff.org] if you haven't already.
Re: (Score:2, Offtopic)
RSA Passmark MFA uses Fingerprinting (Score:2)
The RSA/Passmark system used by many banks for "Multi-Factor Authentication" (it really isn't) uses fingerprinting as one of the many factors.
I used to have to do support for an installation of this system provided by ITI (a banking industry software provider, now owned by FISERV).
Anyway part of the MFA process checks the fingerprint to see if it is one of the ones saved in a users profile...if it is not then they get asked for the extra security question.
We sometimes had odd issues with the detection when
Even more reason for using noscript (Score:2)
Re: (Score:2)
Your browser fingerprint appears to be unique among the 919,012 tested so far.
It's not 1 in 900k, it's the fact that it's the only one like it in 900k tests meaning that if I went to various sites they could figure out I am the same person time and time again.
As far as that goes, we now can tell which customer is on our website and when they are about to make an online purchase.
Duplicate (Score:2)
Re:damn. (Score:5, Insightful)
Re:damn. (Score:5, Funny)
true,
but you're still boned if you're the only furry in the office.
Re: (Score:2)
Why does everyone always want to bone furries ? And in the office no less !
User agent switcher (Score:3, Interesting)
Re: (Score:2)
And it's not like it wouldn't be possible to write extensions that could fubar the scan even more. Just force the system to return unreliable/inconsistent results to that particular API.
I can't think of many websites that need that information from the browser anyways, but it's in the spec for a reason. The question is, do users care?
Re: (Score:2)
Maybe.
But there is also a very significant risk that unless you understand the problem well you will make yourself more uniquely identifiable. What if you fake the version of the browser you are running but it turns out that you miss faking certain extensions that shipped with that browser, or you fake some extensions in the agent string that weren't compatible with that browser, or you fake an OS version that browser didn't work with, or you fake a browser version that was short-lived due to an auto-update
Re: (Score:2)
On the other hand, as long as everyone who uses this kind of spoofing broadcasts exactly the same way those people will all still be less identifiable. You will be able to track the group as a whole, perhaps, but not any particular individual. The trickiest bit would be covering all the bases, including installed fonts.
In other words, it doesn't matter if you broadcast IE9.8 running on Windows ME with the Tickle Me Elmo extension installed, as long as 1 million other people broadcast identical configurat
Don't worry (Score:5, Informative)
All you have to do is change your fingerprint to "Googlebot/2.1 (+http://www.googlebot.com/bot.html)". OK, perhaps this needs updating, but you get the general idea.
You'll be amazed at the information some sites will be willing to give you. Even paysites will let you in for free if they believe you are Google.
Re: (Score:2)
According to TFA, your /fingerprint/ is way more than your /User Agent string/ - in particular, when you enable Javascript.
Re: (Score:3, Interesting)
Re: (Score:2)
Firefox isn't the only browser where you can disable Javascript..
And Noscript... (Score:2)
doesn't just disable Javascript.
Re: (Score:2)
In the context of this discussion, that's all it's being used for. The EFF says that disabling Javascript is one way to mitigate this type of tracking (another recommendation, BTW, is to use a "non-rare" browser, such as IE). One can disable Javascript in Firefox without using Noscript, Noscript is not required to defend against this. In Opera, for example, my results are noticeably smaller when I disable Javascript and information about my installed plugins and fonts are missing from the test.
People lik
People use Noscript... (Score:3, Insightful)
because of its whitelisting feature. Otherwise they would use their browser's built-in ability to turn off Javascript. What percentage of people use a browser that doesn't enable the user to turn off Javascript?
Re: (Score:2)
What percentage of people use a browser that doesn't enable the user to turn off Javascript?
Probably very low, and that's my point. You don't need Noscript to be protected against things like this. You only need to understand what Javascript is. It's disingenuous to say that Noscript is the way to protect against this, because it implies that you are only protected if you're using Firefox. I can whitelist sites in Opera, and that works just fine.
Nobody is saying that Firefox... (Score:2)
is the only way to protect against this, or that Noscript is the only way to protect against this. Hairyfeet described Noscript as indispensable for use with Firefox. You obviously took that as a chaff against non-firefox and non-noscript users.
Re: (Score:2)
Nobody is saying that Firefox... (Score:2)
by deesine (722173)
Alter Relationship
on Tuesday May 18, @12:24PM (#32256680)
is the only way to protect against this, or that Noscript is the only way to protect against this.
This is what was said:
Of course the nice thing is yet again Noscript comes to the rescue, as with Noscript on my highest ID # is 1 in 256, which is only because of using FF over IE. So yet again FF scores a win for me by having the indispensable Noscript. FF plug-ins FTW!
The emphasized part is clearly false. It has nothing to do with browser choice. In fact, one could even argue that IE with Javascript disabled is the single most non-personally-identifiable setup.
Re: (Score:2)
Between some PCs having some really unusual codecs (such as the older Indeo codecs for some seriously pre DivX era .AVI files), and having some pretty rare fancy decorative fonts, this would create a situation where identification would really be about as distinctive as fingerprints or DNA. In court, a prosecutor could cite billions to one odds that it was any other PC than that particular one, and it would most likely be believed by a jury.
However, it would probably be misleading. Mos
Re:Don't worry (Score:5, Informative)
That's just the User-Agent string. The actual fingerprint consists of that and a big bunch of other headers your browser sends out with each request. Language, preferred encoding, plugins; screen resolution, your installed fonts and so on.Changing your standard browser's user-agent to something like you quoted above is a surefire way to be even more unique.
Check the panopticlick page [eff.org] for your details. Keep in mind their "bits of identifying information" only apply to a single header. A bit of work and identifying over all of these fields is easily done. Throw in a bit of extra work and users can be singled out even after they change one or two of 'em.
Summing all the lines together, I can get some 70 bits of identifying info out of my (almost worst-case) setup: Ubuntu 9.10 running a snapshot of Opera 10.54 with a couple of extra fonts and a weird screen resolution.Cut away user-agent and plugins and we're still at some 35, more than IPv4 addresses out there.
Re:Don't worry (Score:5, Funny)
Which is why I have a linux script that constantly changes the size of my browser window by a couple pixels.
Re: (Score:2)
Screen size, not window size.
Re: (Score:2)
Nope, you're good.
http://www.useragentstring.com/pages/Googlebot/ [useragentstring.com]
Re: (Score:2)
gonna have to stop surfing porn at work now.
Just do it from the proxy server and they'll never be able to trace it back to you ... unless you're the only one with access to that server, which means you should start handing out the server passwords, which would make you the anti-Terry Childs of workplace porn!
Re: (Score:2)
If you're that concerned about some site(s) knowing you were there then either don't go there or change your IP address regularly so they don't know you're the same visitor (changing the cloned MAC address of your router and rebooting your router & broadband modem will get you a different IP address on some networks). If you're doing it from a
Re: (Score:2)
Umm, what if you're in China and you're browsing pro-democracy websites?
Re: (Score:2)
Then the IP address is enough identifying information. This article would be irrelevant.
Re: (Score:2)
just be cause you can fingerprint(uniquely identify) a browsing entity, doesn't mean you can easily find them. You'ld have to then correlate that fingerprint with one with a traceable ip. What if the same firefox plugin I'm using to obfuscate my source IP also is providing a standard set of plugins/fonts and is disabling certain java script calls (ostensibly to prevent itself from being detected but now with the added side effect of preventing you from being uniquely identified).
Re:damn. (Score:4, Insightful)
Except what's "wrong" is not well defined *now*, and it may even be worst in the future - and we have no idea for how long they'll keep those logs.
Re:damn. (Score:5, Insightful)
Who really cares that their "browser fingerprint" is out there? Unless you're doing something wrong there's no reason to ever try to trace it back to a source.
And who defines what "wrong" is? In some places being gay is a crime. In some places being an apostate is a crime. In some places being anti-government is a crime. In some places playing violent video games, looking at porn of women with small breasts is a crime. In some places reading certain books is a crime.
Either you are ignorant, or you are trolling.
Re: (Score:2, Interesting)
Unless you're doing something wrong there's no reason to ever try to trace it back to a source.
I realize that it's a bad idea, but posts like this make me think we should have a (-1, ignorant) mod anyway.
Re: (Score:3, Insightful)
Usually, people who offer the "If you're not doing anything wrong, why do you care who has your information" claim are talking about something such as the Dept. of Justice seeing that information. Here we're talking about anyone who puts up a web site, (as you, yourself, posted). That's actually a pretty extreme position. You're not just saying we should all trust the government - you're really saying we should all trust random strangers.
Would you respond to my post right now, w
Re:I'm not really worried (Score:5, Funny)
Excellent plan.
Re: (Score:3, Interesting)
This was on Windows 7. I encountered this when I was capturing packets for some performance test so I had to keep clearing the browser cache for some tests.
Re: (Score:2)
Re: (Score:2)
Those connections are made when I click clear browsing data, not when I need suggestions...
Re: (Score:2)
JavaScript. Detects screen resolution and plugins, too.
Re:Old News (Score:5, Informative)
This article relates to the publishing of the *results* of the experiment announced in the first article. This is not (for once) a dup. Hence the "compiled over the past few months" bit in the summary.
Re: (Score:2)
Or, in the case of this crowd, how it knows NOT to install the windows version on our Macs/Linux boxen.
Re: (Score:3, Informative)
It goes far beyond just the OS. With Flash for example you can get a list of all the fonts the user has installed. If you ever installed some custom fonts, chances are you are close to 100% uniquely identifiable. You can also trace which pages the user has visited with some dirty CSS tricks (load an image in a:visited {}, track that, and you know if the user has visited the link).
I seriously doubt that most users are away of that trickery on how much information it is really giving away.
Re: (Score:2)
Well, if you are going to enlighten us on Flash, let me help you. You can go much farther than just forwarding the list of fonts to a fingerprint making machine. Why not also grab:
1. Flash Player version and host OS
2. Flash Player "is a debugger player version" flag
3. Flash Player "is embedded" (browser/standalone) flag
There is more, like locale, accessibility flags delegated from the OS, and I would imagine some 5 or 10 more samples that will help you with the fingerpring entropy. Flash is wonderful!
This is what is known as willful ignorance (Score:3, Insightful)