Tracking Browsers Without Cookies Or IP Addresses?

Peter Eckersley writes "The EFF has launched a research project called Panopticlick, to determine whether seemingly innocuous browser configuration information (like User Agent strings, plugin versions and fonts) may create unique fingerprints that allow web users to be tracked, even if they limit or delete cookies. Preliminary results indicate that the User Agent string alone has 10.5 bits of entropy, which means that for a typical Internet user, only one in about 1,500 (2 ^ 10.5) others will share their User Agent string. If you visit Panopticlick, you can get a reading of how rare or unique your browser configuration is, as well as helping EFF to collect better data about this problem and how best to defend against it." I remember laughing years ago when I would see users who had modified their user agent string with some sort of defiant pro-privacy message, without realizing that their action made them uniquely identifiable out of hundreds of thousands of others.

Comments

Results and flash cookies

[sopssa]

I compared between IE, Firefox, Chrome and Opera. Both IE and Firefox were completely unique even with the user agent because of the .NET versions there. Opera and Chrome were quite genetic.

Plugins were also completely unique and really easy to detect in any other browser than IE8. Interestingly IE's plugin list was really small and not at all so unique. IE's top "warning" bar asked me if I want to run specific plugins (probably to detect them). System fonts were completely unique and looks like easy to detect.

Remember that this is info that for example Google gets all over the internet via Analytics - they don't even need those tracking cookies because your browser leaves so much unique data behind it that it doesn't matter. And so does every website owner.

Another thing people usually forget about when clearing cookies is that Flash has cookies too and they don't clear along. When have you last time cleared them? Probably never. You can use BleachBit" to clear those along with other software, history and temp data.

Re:Results and flash cookies

[Archangel Michael]

And someone will create a Firefox Plugin in a few days that will randomize the variables being reported back, thus invalidating this.

I use a couple dozen different computers for things, and if they can "track" "ME" from that, all the better. Additionally, there are other people who use the same computers that I do, and if they can sniff out who is browsing at what time, all the more power to them. I also use three different browsers on the same computer to browse various sites as well, because of how they are rendered and the speed of rendering.

Now I also realize, that I'm not a "normal" case. Here's to being "odd" !

Re:Results and flash cookies

[sopssa]

One extra thing I noticed also. If you disable javascript they weren't able to get any other info than user agent and http_accept strings.

So NoScript is good to use. Also in Opera you can do this by disabling global javascript and enabling it on per site basis.

Re:Results and flash cookies

[Z00L00K]

I wouldn't say that you are abnormal, but I foresee that browsers in the future will look into having stealth options to remove all identifiable information from the HTTP requests and randomize what can't easily be filtered out.

Of course - there are details that are a bit more tricky to fiddle with - like originating IP address.

Re:Results and flash cookies

[KevMar]

Using NoScript tells them plenty of information.

You are either:
1) Aware of the security risk on the internet so you disabled javascript
2) You suffer from Paranoid Schizophrenia and don't want them controlling things
3) You have a serious aversion to adds

So the adds they should show you would go something like this in a jpg or animated gif (that is not a standard banner size).

Do you want that extra protection that you just can't get on your own? You need more information on how addvertisements and security threats work. Fallow this link to make sure you are informed. They are still watching you.

Sometimes they don't have to track you to figure out your habits

Re:Results and flash cookies

[SydShamino]

With javascript disabled my profile was a mere one in 143, but when I enabled javascript and let them run it again, I became a unique flower.

While having javascript disabled does bin me somewhat (perhaps to 1-2%), telling them about my LabVIEW 8.6 Plugin for Netscape 32 and my Mentor Graphics Veribest Gerber 0 fonts made me completely unique.

So yeah, javascript disabled totally helps.

Re:Results and flash cookies

[Kijori]

I use a couple dozen different computers for things, and if they can "track" "ME" from that, all the better. Additionally, there are other people who use the same computers that I do, and if they can sniff out who is browsing at what time, all the more power to them. I also use three different browsers on the same computer to browse various sites as well, because of how they are rendered and the speed of rendering.

Advertising companies don't need to be able to identify an individual in order for the data to be useful to them - if they can identify what sites the people that use your computer go to they can construct a demographic that is more useful to them than simply the average user of the site showing the adverts.

Put it this way: television companies can't tailor their adverts for specific viewers, but they still put significant effort into finding out information about those viewers. Why? Because the more precisely they can define the average viewer the more they can charge advertisers. Similarly, knowing the average user of your computer, while not as useful as knowing your exact tastes, is more than enough for them to want to track your computer's page views.

Perhaps more worryingly, unless your browsing habits are very similar it wouldn't take much to separate the different users of the computer. If you know what sites every computer visits you could say, for example, that computers that visit Slashdot are unlikely to visit mypinkpony.com - and you could infer, with a relatively high degree of confidence, that if a computer visits both of these sites it is likely that it has multiple users. Then, when the computer visits techreport.com you can ignore all but the sites that were visited shortly before or after visiting Slashdot, while treating sites like mypinkpony.com as a sign that the user has changed. Is it perfect? No, but it will allow you to reduce the noise significantly and build a fairly accurate picture of what to try to sell you.

Re:Results and flash cookies

[PYRILAMPES]

How about a nice packet shaper for your router? Borrow a variable from another user, add it to your router and pass it on?

Re:Results and flash cookies

[pushing-robot]

Actually, Torbutton already anonymizes the user agent string and screen resolution and blocks browser plugins. I don't think it blocks fonts, so that still could be an issue.

But even without any anonymizing plugin, I tested my Mac and found it to be relatively untrackable—one in every few thousand computers matches it. It's not too surprising; Apple pushes Flash/Java/Quicktime updates, Safari stays up to date, and there are only a handful of Mac screen resolutons. Unless you've got some unusual system fonts, it would be hard to distinguish your Mac from any other.

And if you really wanted to ensure anonymity, there's always virtual machines.

Re:Results and flash cookies

[bill_mcgonigle]

And someone will create a Firefox Plugin in a few days that will randomize the variables being reported back, thus invalidating this.

There are still many unique variables for a given HTTP connection, even if only looking at the times and orders of connection requests. Not to mention cache effects or URL tracking tricks.

You can be anonymous but you can't be ambiguous, if you use sites which use data mining techniques to identify their visitors (and you don't know who those are).

Re:Results and flash cookies

[Lumpy]

https://addons.mozilla.org/en-US/firefox/addon/6581

too late, they beat you to it.

Re:Results and flash cookies

[Lumpy]

https://addons.mozilla.org/en-US/firefox/addon/6581

It already exists.

Re:Results and flash cookies

[Lumpy]

Dang slashdot. It ate this and I did not see it as a response for 10 minutes so I figured it did not post... Sorry about the dupe.

Re:Results and flash cookies

[Anonymous Coward]

I was unique even with js disabled, iceweasel user..

Re:Results and flash cookies

[Ken D]

You are misreading the statistics. If only one in a few thousand computers matches yours, then you are very trackable. Your computer sticks out in a crowd. You want to be as close to 1:1 as you can get, as in, my computer looks like every other computer.

Re:Results and flash cookies

[GradiusCVK]

Don't you see? Now all they have to do is find the usage patterns they can't quite figure out and they'll know it's all you.

Re:Results and flash cookies

[Anonymous Coward]

4. It makes browsing at least a entire order of magnitude faster, even moreso on my netbook.

(You forgot a big one here.)

Re:Results and flash cookies

[Zerth]

Anyone using the screen size characteristic can be fooled merely by moving my browser to another monitor(mine aren't identical).

Re:Results and flash cookies

[IshmaelDS]

With my javascript disabled and cookies off I'm still unique! Just based off my user agent and http_accept strings, I'd guess it's due to my .net versions and such of which I need specific versions for different applications we run.

Re:Results and flash cookies

[clone53421]

If you know what sites every computer visits you could say, for example, that computers that visit Slashdot are unlikely to visit mypinkpony.com

Hey!! >:[

Re:Results and flash cookies

[Mister Whirly]

Wouldn't randomizing this every time make you more unique and hence more trackable? They should make an addon that makes every browser have an identical user agent that does not ever change, no matter what you do to your browser.

Re:Results and flash cookies

[TheCarp]

Speaking of.... I have numbers on how well this works.

I have 2 mozilla profiles. One for "open browsing", and one for tor use, with torbutton set to default to tor enabled.
Both use noscript.

"Open"
Scripts on: Unique!
Scripts off: 1 in 261

Torbutton:
Scripts off: 1 in 4775
Scripts on: 1 in 14,605

I would call that a pretty big win for torbutton. A pretty big loss for open browsing in mozilla firefox without noscript (especially if you install a few addons)

-Steve

Re:Results and flash cookies

[DavidRawling]

Nah it seems broken.

I revisited the page multiple times (Shift+Refresh) and each time I was completely unique, despite the content of the page never changing (at least with respect to the headers shown). Noscript didn't make a difference, I was always unique, despite none of the measures showing this. The most "identifying" piece of information was supposedly the HTTP_ACCEPT header, which specifies "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 ISO-8859-1,utf-8;q=0.7,*;q=0.7 gzip en-us,en;q=0.5".

It will also change depending where I am (proxy servers, etc) so it's not me or the browser they're tracking, directly.

Re:Results and flash cookies

[TheCarp]

Or actually, I read that wrong... looks like a huge win for open browsing and scripts off, and huge loss for torbutton with scripts off... especially at under 20k tested so far.

Re:Results and flash cookies

[mcgrew]

2) You suffer from Paranoid Schizophrenia and don't want them controlling things

You don't have to suffer from paranoid schizophrenia to not want others controlling you any more than you have to be bipolar to get angry at people who want to manipulate you.

BTW and offtopic, there is only one "d" in "ad" and "advertisement", "add" is a verb. And "fallow" means "barren". Dew know truss yore spill chucker, yews you're ayes. The last sentence will pass a spell check with flying colors, but it's pretty hard to read, isn't it?

That said, I'm sure there's an embarrassing typo somewhere in this comment. It happens every time.

Re:Results and flash cookies

[Anonymous Coward]

Another thing people usually forget about when clearing cookies is that Flash has cookies too and they don't clear along. When have you last time cleared them? Probably never. You can use BleachBit" [sourceforge.net] to clear those along with other software, history and temp data.

Better yet, use the BetterPrivacy Firefox add-on.

Re:Results and flash cookies

[MyFirstNameIsPaul]

This add-on is for older versions of Firefox

Re:Results and flash cookies

[clone53421]

If you turn off Javascript, you have to go back to the main page and click to start the test again. The &js=yes in the URL messes up the test otherwise.

Keep in mind that you might not have any unique stats, but you might still have a unique combination of stats.

Re:Results and flash cookies

[thsths]

> they don't even need those tracking cookies because your browser leaves so much unique data behind it

It may be unique, but it is not constant, and therefore not as such suitable for tracing. However, if you use it in connection with other data (such as the IP and a tracing cookie) and update your database regularly, you would be able to notice changes of individual parts, including the cookie. They could just restore the cookie based on your likely identity, although that is pretty complicated.

Overall the thread to privacy through these measures is pretty low.

Re:Results and flash cookies

[Idbar]

I compared between IE, Firefox, Chrome and Opera. Both IE and Firefox were completely unique even with the user agent because of the .NET versions there. Opera and Chrome were quite genetic.
Well... I've heard genes are quite unique!

Re:Results and flash cookies

[nolife]

I tried that on my Windows machine, it reports the main screen screen size, not the screen the IE instance was actually running on.

Re:Results and flash cookies

[Anonymous Coward]

>> I compared between IE, Firefox, Chrome and Opera. Both IE and Firefox were completely unique even with the user agent because of the .NET versions there. Opera and Chrome were quite genetic.

> Well... I've heard genes are quite unique!

I'm glad to see that I wasn't the only one who felt the urge to make a joke of the malapropism. Some setups just beg and plead for a punch-line ;)

Re:Results and flash cookies

[onepoint]

looks like I'm screwed, I'm so far unique out of 25,634

not a good day

Re:Results and flash cookies

[Dumnezeu]

... i use multiple browsers ... firefox plugin ... etc

Guess what?! Most people use a single browser, don't know about Firefox plugins (as most people don't use Firefox) and most computers are used by two people. That's enough for the marketers. So 10% of their pool is flawed because of the multiple browsers and FF plugin? That leaves them with 90%. Divide that by 2 and you get a 45% chance of targeted advertising. Considering the size of the pool is a few hundred million people ... I'd say that's pretty good!

Re:Results and flash cookies

[Zerth]

Chrome apparently reports whichever it is currently in, or at least the one the page loads on.

Re:Results and flash cookies

[thms]

Another thing people usually forget about when clearing cookies is that Flash has cookies too and they don't clear along. When have you last time cleared them? Probably never. You can use BleachBit" to clear those along with other software, history and temp data.

Flash cookies are indeed something nasty, I was quite stumped when I found out about this.
My solution was to delete related directories on every login now:
rm -rf ~/.macromedia
rm -rf ~/.adobe/Flash_Player
I fear with client side SQL dbs in HTML5 this will need a DROP TABLE ....; statement as well. Or I'll do it the other way around by deleting my "polluted" browser config and copying a clean one over every time.

Re:Results and flash cookies

[Anonymous Coward]

Another useful thing is to visit Macromedia Flash Settings page to disable Flash storage/audio/video settings.

Re:Results and flash cookies

[Anonymous Coward]

Exactly. That's why I just suggested on the NoScript Forum that they replace the default user agent with minimal info (Browser name and browser major/minor version) if scripting is not enabled for a site.Go add a supporting post if you also think it's a good idea.

Re:Results and flash cookies

[Anonymous Coward]

Firefox with noscript showed me as being the same as a few other 1000s of users.

Disabling noscript made me UNIQUE.

Good thing I have noscript enabled in pretty much most places.

Re:Results and flash cookies

[Firehed]

Maybe, but that has the potential to really screw up a lot of web app interactions. Many login systems check for consistency in the User Agent string (among other headers) to help prevent session hijacking by copying someone's cookies; if browsers in stealth mode start omitting that, it could easily turn into either a security hazard or a completely broken web experience.

Re:Results and flash cookies

[TheCarp]

I kind of expected to come up unique. Running linux cuts out a huge swath, then add in the addons that I use, etc. I was kind of shocked that my wife (windows firefox, probably few or no extensions) also came up as unique at around the 18k level.

Hopefully the sample size is just too small still?

-Steve

Re:Results and flash cookies

[Anonymous Coward]

Hah, same, but with JS enabled - Debian FTL..

Re:Results and flash cookies

[Zero__Kelvin]

Wouldn't randomizing this every time make you more unique and hence more trackable?

I guess that depends upon if you think that the same person is driving every car that passes because each one of them looks different ;-)

Re:Results and flash cookies

[Mister Whirly]

If you made every car appear to have the same make, model, and color, it would be pretty hard to tell the drivers apart if all you could see is the exterior.

Re:Results and flash cookies

[Zero__Kelvin]

Personally, I'd look at the license plates ;-)

Of course, none of what you said makes any sense, or works even remotely as an analogy to what we are discussing. IPs (license plates) don't uniquely identify a computer (car) due to NAT scenarios, for example.

Just admit that you made a very foolish statement. It's no big deal. Everyone makes a foolish statement now and again. It is the people who then go to great lengths to try to make it seem like they didn't that end up actually being foolish, rather than appearing so for a moment.

(either that or entertain us with a great story about the first time you stood on the side of the highway and freaked out when you realized the same guy was driving every car.)

Re:Results and flash cookies

[Mister Whirly]

We were talking about the user agent of a browser as an identifier, not IP addresses or anything else. My point was that if every user agent reported the same thing, no matter the actual configurations or variances of the browser may be, it would be much harder to identify individuals out of the group. So I hardly made a foolish statement. Just because you didn't understand it does not make me foolish.

Re:Results and flash cookies

[Relayman]

You don't need to download software to clear Flash cookies. Just go to this Web site provided by MacroMedia. Don't think that the Settings Manager is an image; it is an actual view of the Flash cookies on your computer. It appears to me that these cookies are shared between my two browsers.

Re:Results and flash cookies

[Zero__Kelvin]

What you wrote:

Wouldn't randomizing this every time make you more unique and hence more trackable?

What you now claim you said:

"My point was that if every user agent reported the same thing, no matter the actual configurations or variances of the browser may be, it would be much harder to identify individuals out of the group."

The first quote is what you said, and doesn't even remotely map to what you now claim you said, as anyone can plainly see.

Re:Results and flash cookies

[Mister Whirly]

Ok, I will go slowly this time so you can follow. Yes, I said that randomizing the user agent every time would make you unique and easier to track. Then I said that if the user agent was the same every time (the opposite of unique) it would make you harder to track. As "anyone can plainly see", these statements do not contradict themselves, and actually support each other.

Oh, I get it. I just looked at your comments and see you are rated troll on about 3/4 of your recent ones. Good show - for a moment you actually had me tricked into thinking you were just really dumb.

Re:Results and flash cookies

[Zero__Kelvin]

I'm starting to feel like I challenged someone to a duel, only to discover later that they are a quadraplegic.

Re:Results and flash cookies

[mOdQuArK!]

I think the "BetterPrivacy" Firefox add-on also helps with Flash cookies.

Re:Results and flash cookies

[Anonymous Coward]

"Oh, I get it. I just looked at your comments and see you are rated troll on about 3/4 of your recent ones."

Oh, I get it. Everything ZK posted was modded down by exactly 1, and everything you posted was modded up by exactly 1. Use a Shill account much?

Re:Results and flash cookies

[the_womble]

Konqueror lets you set user agent per site.

Ad networks will see the same user agent each time, but you can set it to, for example, IE on Windows, or something else very common. It may mess up ads that serve different ads depending on your browser.

Re:Results and flash cookies

[BikeHelmet]

CCleaner can also wipe out Flash cookies.

Well, it appears I'm almost totally unique. One in 70843 people have my fonts. One in 70843 have my plugins. One in 863.94 have my resolution. I refreshed the page, and all three are going up. Go figure.

Re:Results and flash cookies

[pjt33]

You can randomise some variables without affecting the user experience, but I had unique HTTP-Accept headers. Some of those (e.g. language preferences) I can't change without affecting my user experience.

Re:Results and flash cookies

[myocardialinfarction]

Simple solution: the plugin doesn't randomize the User Agent string for sites that you select, just like NoScript, Adblock and Ghostery. It won't cut out all unnecessary profiling, but it means that only sites you select to 'trust' get the normal User Agent string, others get a munged one. Live Http Headers can do vaguely similar things for debugging purposes.

Re:Results and flash cookies

[Anonymous Coward]

Tracking means not that you can identify a single request. It means you can link several requests to the same user. With randomized user agents you can't do the linking.

Every request has a new random user agent string. Even if they are unique every time you can't reasonably link one to the other. The best you can do is assume that every unique user agent string belongs to the same user. Seems pretty stupid and is exactly what the analogy was about.

Re:Results and flash cookies

[KevMar]

I think you missed my disclaimer.

My issue is more that I just cant spell very well, I fat finger the keyboard, and have yet to add a spell checker to IE.

I have used user agent strings to track users for a long time. I added a custom tag a long time ago to make it unique.

Re:Results and flash cookies

[marcosdumay]

"So the adds they should show you would go something like this in a jpg or animated gif (that is not a standard banner size)."

They'd better use those non-standard format, on-site, image-embebed ads for all the users. They don't because of economical reasons, and those reasons don't scale with the number of users. Advertizers won't adapt their ads just for you, you are not that important.

By the way, it seems that my browser is unique. Locales gave them a lot of hints, but version numbers and fonts are the worst problem. I'm quite amazed why most people don't use the same fonts I do, I simply didn't instaled any one of them by hand.

Re:Results and flash cookies

[Anonymous Coward]

. . . aversion to adds . . .
. . . the adds they should show . . .
on how addvertisements . . .

A- D -V-E-R-T-I-S-E-M-E-N-T

Re:Results and flash cookies

[Anonymous Coward]

S-E-E S-I-G-N-A-T-U-R-E

Re:Results and flash cookies

[Liquidscript]

http://lmgtfy.com/?q=flash+settings+manager

Re:Results and flash cookies

[DrXym]

After visiting Panopticlick, I wonder why websites even need to *know* what fonts I have. This seems by far the worst leakage of entropy by far, followed closely by plugins, followed by random junk tacked onto the user agent string such as .NET runtime. I realise some JS does legitimately check plugins (e.g. swfobject.js), but I see no reason that the entire list should be broadcast to any site without some manner of safeguards in the browser.

Re:Results and flash cookies

[onepoint]

now it's worst it said "Your browser fingerprint appears to be unique among the 522,323 tested so far."

Thanks EFF. I never thought about that.

[cornicefire]

I'm glad they gave me some new ideas for tracking.

Re:Thanks EFF. I never thought about that.

[Monkeedude1212]

Psh. Real trackers use emotional demographics to Identify their users.

By tracking the various mouse movements on the page, and every key that might be entered, and the timing it takes between movements or keypresses, I can analyze that persons emotional relationship towards my web page. Some people might be angry, and thus have more spelling mistakes in their rage, or some people might be tender, loving, and caring, caressing the page softly and gently with their mouse.

Everyone has different habits and express their feelings towards web pages in different ways. I can easily tell who is visitting my site based on how they are visitting my site.

Re:Thanks EFF. I never thought about that.

[Talderas]

Your browser fingerprint appears to be unique among the 3,396 tested so far.

Fuck.

Re:Thanks EFF. I never thought about that.

[Volante3192]

I got that too when I used Lynx.

Your browser fingerprint appears to be unique among the 4,655 tested so far.

Re:Thanks EFF. I never thought about that.

[FrankSchwab]

I got:

"Your browser fingerprint appears to be unique among the 6,335 tested so far."

So, in the last 15 minutes, they appear to have had roughly 1000 new visitors.

Sounds like they're collecting some new information.

Re:Thanks EFF. I never thought about that.

[tbcpp]

I'm an emotional demographic you insensitive clod!

Re:Thanks EFF. I never thought about that.

[Fartypants]

Well, the EFF gives a shout out to browserspy.dk for the font detection code and to breadcrumbs for supercookie help, so I think it's safe to say those guys had thought of this idea. Good to see that the EFF is still relying on tried and true methods of tracking, though. The Panopticlick site drops a session ID cookie to track users.

Re:Thanks EFF. I never thought about that.

[AnotherUsername]

I got:
"Your browser fingerprint appears to be unique among the 11,342 tested so far."

Re:Thanks EFF. I never thought about that.

[RKThoadan]

Chrome: Your browser fingerprint appears to be unique among the 10,511 tested so far.
IE6: Your browser fingerprint appears to be unique among the 11,542 tested so far.
Firefox: Your browser fingerprint appears to be unique among the 11,788 tested so far.

Boy do I feel special. I'm surprised IE6 came back unique. It looks like it was .NET's fault.

Re:Thanks EFF. I never thought about that.

[element-o.p.]

My Gentoo box: "Your browser fingerprint appears to be unique among the 12,564 tested so far."

My Ubuntu box: "Your browser fingerprint appears to be unique among the 13,730 tested so far."

My Mac: "Your browser fingerprint appears to be unique among the 13,337 tested so far."

I didn't realize I was so unusual ;)

Re:Thanks EFF. I never thought about that.

[Talderas]

What I find disturbing is that its two categories which my browse is showing up unique in. Browser Plugins and System Fonts. It's the System Fonts uniqueness that has me perplexed.

Re:Thanks EFF. I never thought about that.

[Anonymous Coward]

Funnily enough, this is actually quite a good way of tracking people.
Some people have very specific interaction profiles with computers.
With a decent algorithm, your interactions could be profiled.
And even if a person eventually was made aware of such techniques and erased all cookies with whatever tracking site, it could probably find them again pretty easily via the interaction profile.

That combined with the IDing from EFF demo could probably work even more efficiently in determining uniqueness.

And this is even better to do now due to JavaScript being significantly faster than it was a few years back.

The only other way to escape would be blocking JavaScript from them.

Re:Thanks EFF. I never thought about that.

[element-o.p.]

Tried it again from a Windows Virtual Machine, and got..."Within our dataset of about ten thousand visitors, only one in 154 browsers have the same fingerprint as yours."

Go figure...Mozilla on WinXP is more anonymous than Mozilla on Gentoo or Ubuntu and more anonymous than Safari on Mac ;)

Re:Thanks EFF. I never thought about that.

[clone53421]

You had javascript disabled. Try it again with it enabled.

Re:Thanks EFF. I never thought about that.

[PietjeJantje]

This already happens. With Ajax reporting back mouse movements, clicks and keypresses, the site admin can snoop on the visitors and see exactly what they are doing.

Re:Thanks EFF. I never thought about that.

[TropicalCoder]

I get: "Your browser fingerprint appears to be unique among the 17,127 tested so far." Gee - sure glad they don't know my URL. Anyhow - that was using Chrome. Then tried the same test in Chrome's incognito mode, and the number of identifying bits went down by a whole point, to 1 in 9000 or so.

Re:Thanks EFF. I never thought about that.

[tibman]

Your browser fingerprint appears to be unique among the 19,296 tested so far.

: (

Re:Thanks EFF. I never thought about that.

[Hurricane78]

Security trough obscurity never works. Your argument is the same, as that of a company that is suing people who publish their findings about security holes.

Re:Thanks EFF. I never thought about that.

[Anonymous Coward]

Sytem fonts, 1 in 20251.
Browser plugin details, 1 in 10125.

Everything else? All below 1 in 50, which is a pittance and doesn't tell much given the volume web traffic data. So it seems those two things are my most unique aspects of my browser's retrievable non-cookie data. Thus those fonts and plugins are the two that are worth seeking or hiding in regards to unique identifiers.

Still the database is building up, I guess I'll have to check back in a month or two to see if they remain sticking out like that.

Re:Thanks EFF. I never thought about that.

[mister_playboy]

This already happens. With Ajax reporting back mouse movements, clicks and keypresses, the site admin can snoop on the visitors and see exactly what they are doing.

So CmdrTaco knows that 95% of Slashdotters type one-handed? O_o

Re:Thanks EFF. I never thought about that.

[t0p]

That's odd, there isn't much on /. that makes me want to, uh, "type one-handed"...

Re:Thanks EFF. I never thought about that.

[Anonymous Coward]

The problem is joining the massive data sets you're talking about compiling. Obviously, if somebody knows your name, address, and phone number, they know "join (name, address, phone number)".

Re:Thanks EFF. I never thought about that.

[Anonymous Coward]

"Your browser fingerprint appears to be unique among the 31,819 tested so far."

i'm not sure whether to feel special or worried.

for myself, it was in both the "browser plugins" and "system fonts" areas where my uniqueness factor was 1:31819. now, i'm not surprised by the fonts, as i'm a bit of a font fanatic and have far too many installed for my own good, but i am surprised that my browser plugins are considered unique-ish. i figured i had the standard firefox compliment of add-ons, such as adblock and noscript. ah, now that i look more deeply, they are including things like the fact that i have a wacom tablet, and the like.

Re:Thanks EFF. I never thought about that.

[cstdenis]

You don't read the Apple news?

I get this ...

[BlueTrin]

Warning: mysql_connect() [function.mysql-connect]: Can't connect to MySQL server on 'db' (4) in /www/panopticlick.eff.org/docs/config/db.inc.php on line 3

Warning: mysql_select_db() [function.mysql-select-db]: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2) in /www/panopticlick.eff.org/docs/config/db.inc.php on line 4

Warning: mysql_select_db() [function.mysql-select-db]: A link to the server could not be established in /www/panopticlick.eff.org/docs/config/db.inc.php on line 4

Has the site been just slashdotted ?

Re:I get this ...

[Sta7ic]

Hey, more than I got. I hope the EFF can retrieve all the "research data" they're collecting from the servers that must be melting into slag...

Re:I get this ...

[Anonymous Coward]

Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 173 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 191 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 238 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 241 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 238 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 241 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 238 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 241 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 238 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 241 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 238 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 241 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 238 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 241 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 238 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 241 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 238 Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 241

Re:I get this ...

[daveime]

So Postgre supports infinite simultaneous connections does it ? And if not, what does it do ? Yes, it craps out an error message just like MySQL, and it's up to the underlying code / webpage to decide how to handle that and display the fact to the user.

MySQL sensibly defaults to a max connections of (I think) 128 ... you can change that setting in your my.ini file, along with a lot of other stuff controlling how much memory he uses for joins, indexes, temporary tables etc ...

But hell no, let's just declare the DB useless when in fact the DBA / coder was useless.

Re:I get this ...

[muhgcee]

But hell no, let's just declare the DB useless when in fact the DBA / coder was useless.

It actually seems to have been some strange hardware issue(s) that have crashed the server a few times over the past month or so. Obviously I need to replace the server, which can be difficult to do as a non-profit.

But I reject the claim that either of us are useless.

Re:I get this ...

[daveime]

And yet you don't do any error checking when connecting to the MySQL database, and then continue to try and issue commands to a database handle that is invalid.

Draw your own conclusions, people.

Already being done

[QuietLagoon]

in the market research industry.

Dell Default Image

[JohnHegarty]

Unless you are one of the 100,000 using any particular Dell/HP/Apple default install on your pc.

2 ^ 10.5 is lost of combinations , but is bet there are lots of spikes on some.

Re:Dell Default Image

[petermgreen]

Further a lot of the information is stuff that is likely to change over time with the installation of browser updates, OS updates, some new apps (if they bring fonts with them)

Though apparently my user agent ( "Mozilla/5.0 (Windows; U; Windows NT 5.2; en-GB; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 (.NET CLR 3.5.30729)" ) is unique among those tested so far :/

Re:Dell Default Image

[Anonymous Coward]

Ahh nice to know your user agent! It is will no longer be unique, since I just copied it.

Re:Dell Default Image

[Anonymous Coward]

Not anymore, just updated my UA (thanks!).

Re:Dell Default Image

[clone53421]

That’s what I figured, on my PC at work, but I was wrong. (When I get home, I’ll have to try it there.)

My fonts – the default ones installed on the PC – are shared by only 1 in about 3,200 visitors.

The IE user agent string, with its .NET information, said that only 1 in 4,200 browsers shares it.

Using the version of IE installed on the PC (version 7), my particular combination of Java, Flash, and WindowsMediaplayer was unique (amongst about 13,000 visitors so far).

Using Firefox, on the other hand, I share my user agent string with a whopping 4.2% of the visitors (about 1 in 25), although my browser plugins are still unique...

In fact, even my screen resolution (1600x900x32) is only shared by about 1 in 400 visitors. (Surprising, slightly, since the trend has been more and more toward using 16:9 displays.)

Re:Dell Default Image

[clone53421]

Mozilla/5.0 (Windows; U; Windows NT 5.2; en-GB; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7
    – unique.

Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7
    – 1 in ~800
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 (.NET CLR 3.5.30729)
    – 1 in ~530

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7
    – 1 in ~230
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 (.NET CLR 3.5.30729)
    – 1 in ~190

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7
    – 1 in ~23 (my default useragent)
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 (.NET CLR 3.5.30729)
    – 1 in ~18

Your Windows NT version is making you stand out the most.

en-GB is also making you stand out, although after getting Slashdotted by the US this is not surprising. It would be a more appropriate comparison in 18-24 hours or so.

Finally, while I originally thought that the .NET version would make you stand out more (mine didn’t have any), it was actually the opposite.

Also, about:config general.useragent.override...

Re:Dell Default Image

[petermgreen]

Your Windows NT version is making you stand out the most.
I'm not exactly surprised, 5.2 is little used on the desktop because there is no 32-bit desktop edition of 5.2.

en-GB is also making you stand out, although after getting Slashdotted by the US this is not surprising. ;)

Slashdotted already...

[ThatFunkyMunki]

You'd think that the EFF would know how to run a website that doesn't shit itself as soon as it hits slashdot...

in other news

[Lord Ender]

Researches have found a way to track web sites based on the MySQL errors they produce when they're slashdotted.

Re:in other news

[kevin_j_morse]

And it only took 20 minutes...

Nice name

[hodet]

Panoti, panoptip...panopticlick. Sounds like some 0.01 app available in a deb repository.

Panopticlick 0.01

Division by zero

[Anonymous Coward]

>"Warning: mysql_query() [function.mysql-query]: A link to the server could not be established in /www/panopticlick.eff.org/docs/common.inc.php on line 163

Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in /www/panopticlick.eff.org/docs/common.inc.php on line 163

Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 173

Within our dataset of visitors, one in 0 browsers have the same fingerprint as yours.

Currently, we estimate that your browser has a fingerprint that conveys INF bits of identifying information."

Now that's an unique fingerprint.

Re:Division by zero

[Anonymous Coward]

Warning: Division by zero in /www/panopticlick.eff.org/docs/common.inc.php on line 173

OH SHI-

Wait... where's the kaboom? There was supposed to be an earth-shattering kaboom.

LOL

[C_Kode]

The site says Only anonymous data will be collected by this site. Yet they are collecting data to see how un-anonymous you actually really are! :)

Re:LOL

[Amouth]

which means we grab each part of the finger prints and see how unique they are to our data set BUT we don't keep them together with each other. if you notice they give a rating to you based on each of the areas and your over all is the highest unique..

Re:LOL

[clone53421]

True... and since you can revisit the page to see your updated stats, and it remembers you’ve been there, I can only assume it uses a cookie (they could track via IP, but I wouldn’t consider that anonymous and I don’t think anyone else with any sense would either). Looking at my cookies, I have a PHPSESSID, so apparently that is how they’re avoiding double-counting.

It seems to me, though, that users without cookies would be re-counted every time they visited, or perhaps it would not count them at all, but just display the results without saving them.

Re:LOL

[Onymous Coward]

Good work. This utility is very helpful.

I'm glad I support the EFF.

Old news

[Anonymous Coward]

This is nothing new. RSA has been using this to detect fraud for quite a while now.

Cookies, Plugins, User Agents, Timezone, Browser, detectable browser settings, etc.

They easily make up a very accurate fraud detection system.

Two data points...

[sabt-pestnu]

By subtly changing where the errors occur (and which ones are reported), they can correlate your slashdot post with the attempted page fetch...

Hmm

[Jonas Buyl]

I think nobody guessed anyone would care about visiting a website of a non-profit organization?

user agent guessing site

[allo]

http://laxu.de/useragent.php test it ... a bit out of date (thinks arora is googlebot), but its still working good for the most common browsers.

Suggestion for more generic User Agent String

[Tekfactory]

We are all V

or

We are all Zero

Choice will of course depend on if you are a V for Vendetta or Code Geass fan. It will aso decide which mask you should wear when the revolution comes.

We could also use;

Ninjas (should Ninjas be blank?)

Pirates

Re:Suggestion for more generic User Agent String

[imhennessy]

You don't think we should all go with Anonymous?

Re:Suggestion for more generic User Agent String

[Anonymous Coward]

Im in ur DB eating ur statistics

Re:Suggestion for more generic User Agent String

[Anonymous Coward]

We are all V

or

We are all Zero

or

I am Spartacus

For people who appreciate the original.

IPv6 will make this obsolete

[F�an�ro]

Once we get IPv6 everywhere, most ISPs will simply assign each user a fixed subnet, since that is so much easier and more efficient than keeping track of dynamic assignements. Same for large networks that currently use NAT.

So the vast mayority of users will have a unique non-changeable ID, making cookies or this kind of tracking obsolete.

Re:IPv6 will make this obsolete

[ericfitz]

IP addresses (even IPv6) are addresses, not phone numbers. The address identifies the place where the packets are supposed to go, not the person to whom they're supposed to go.

IPv6 was designed to be hierarchical to address some of the shortcomings of the IPv4 allocation process, which requires backbone routers to maintain and exchange large routing lists.

Personal subnets won't be implemented because people move around; it's not to change the global routing infrastructure every time you go to work.

Now it might be the case that broadband ISPs assign networks to their customers; this would not happen with wireless or dial-up though. It's a reasonable assumption that the customer end of a broadband connection won't move geographically.

Re:IPv6 will make this obsolete

[Abcd1234]

Once we get IPv6 everywhere, most ISPs will simply assign each user a fixed subnet, since that is so much easier and more efficient than keeping track of dynamic assignements.

Not necessarily. Unless the user explicitly asks for a routable /48 or /56, I'll bet most ISPs just give each user a /64 and have them autoconfigure, in which case there's always the Privacy Extensions for Stateless Address Autoconfiguration option.

Re:IPv6 will make this obsolete

[F�an�ro]

Not necessarily. Unless the user explicitly asks for a routable /48 or /56, I'll bet most ISPs just give each user a /64 and have them autoconfigure, in which case there's always the Privacy Extensions for Stateless Address Autoconfiguration option.

But no matter what the user configures, he is stuck in the /64, or do I missunderstand this?
So if an ISP is known to give its customers a /64 each, then to identify them one just has to discard the later part of the address.
Sure it is not a perfect identifier, you cannot differentiate between people in a household if they go the extra mile and configure it right, but it is miles better than anything currently used.

Re:IPv6 will make this obsolete

[F�an�ro]

IP addresses (even IPv6) are addresses, not phone numbers. The address identifies the place where the packets are supposed to go, not the person to whom they're supposed to go.
So it can be used as a unique household identifier instead of a unique person identifier. That does not make it less of a privacy concern.
Sure you can change this identifier by changing ISPs or using a PC in a different location. It is still a lot harder to change than a cookie or a dynamic IP, and impractical to do so each day. Advertisers will love this.

Re:IPv6 will make this obsolete

[John Hasler]

> It is still a lot harder to change than a cookie or a dynamic IP, and
> impractical to do so each day.

Proxies.

Re:IPv6 will make this obsolete

[Abcd1234]

But no matter what the user configures, he is stuck in the /64, or do I missunderstand this?

That 64-bit prefix is actually the ISP's subnet. The confusion is really my fault, as I used poor phrasing when I said they "give" the user a /64... what they do is advertise it. The machine then takes that 64-bit prefix, tacks their 64-bit MAC on the end (or, if that RFC is used, some randomized identifier), and voila, they're connected.

If the user wanted their own subnet, they would then have to request a routed /48 or /56. But their firewall/gateway box would still have an IP in that /64 advertised by the ISP. But any boxes on that subnet would instantly be trackable, so if you wanted to preserve your anonymity, ironically, you'd probably want to use NAT (or use some other method, such as Tor or an anonymizing proxy).

Re:IPv6 will make this obsolete

[F�an�ro]

That 64-bit prefix is actually the ISP's subnet. The confusion is really my fault, as I used poor phrasing when I said they "give" the user a /64... what they do is advertise it. The machine then takes that 64-bit prefix, tacks their 64-bit MAC on the end (or, if that RFC is used, some randomized identifier), and voila, they're connected.

ok, I see what you mean. But it would surprise me if that will be how it is done.

ISPs will need to keep track of who has which IP at which time. At least in the EU they are required by law, afaik in the US they make this information available for law enforcement too (occasionally even without warrant).

This bookkeeping is just so much easier if every user gets a fixed IP (or -subnet), so i do not see why they would allow everone to just pick any address in their subnet.

Re:IPv6 will make this obsolete

[Abcd1234]

ISPs will need to keep track of who has which IP at which time. At least in the EU they are required by law, afaik in the US they make this information available for law enforcement too (occasionally even without warrant).

This bookkeeping is just so much easier if every user gets a fixed IP (or -subnet), so i do not see why they would allow everone to just pick any address in their subnet.

Then they'll deploy DHCPv6 and do things the same way they do them today, in which case the anonymity issue is a wash.

But I guarantee you, unless you ask for it, you won't be getting a subnet of your own. ISPs just don't think that way, nor do their customers.

Re:IPv6 will make this obsolete

[tokul]

Once we get IPv6 everywhere, most ISPs will simply assign each user a fixed subnet, since that is so much easier and more efficient than keeping track of dynamic assignements. Same for large networks that currently use NAT.

Not more efficient that my ISP does now. They track users by MAC and always assign same IP address. Technically my IP is dynamic, practically it changed only when I switched to other plan.

Re:IPv6 will make this obsolete

[quantumphaze]

tacks their 64-bit MAC on the end

MAC Addresses are 48 bits.
12:34:56:78:9a:bc = 8 bytes = 48 bits

Re:IPv6 will make this obsolete

[quantumphaze]

6 bytes, whoops

Re:IPv6 will make this obsolete

[Abcd1234]

I'm aware of that. That doesn't change the fact that stateless autoconfiguration uses a 64-bit prefix and the end host typically populates the 64-bit suffix with the MAC plus some padding bits.

Re:IPv6 will make this obsolete

[RealGrouchy]

So the vast mayority of users will have a unique non-changeable ID, making cookies or this kind of tracking obsolete.

Except when I log in with my laptop at home instead of work, or from a hotel or access point?

- RG>

Lynx apparently more popular than I thought

[Volante3192]

Browser Characteristic : User Agent
bits of identifying information : 11.09+
one in x browsers have this value : 2183
value : Lynx/2.8.5rel.1 libwww-FM/2.14FM SSL-MM/1.4.1 OpenSSL/0.9.7d-dev

(Course, i'm also two minor releases behind...but still, 1 per 2000 is more common than I would've guessed)

Re:Lynx apparently more popular than I thought

[Quince alPillan]

Some Slashdotters browse Slashdot at work on Lynx because it looks like a terminal to the PHB walking by.

Re:Lynx apparently more popular than I thought

[Volante3192]

Hrm...apparently I missed part of the page when I saw that. It's likely that there were only 2183 browsers cataloged at the time.

Oops. Mea culpa.

Re:Lynx apparently more popular than I thought

[Waynelson]

That might actually be their current data pool right now though. Try hitting it again and see if it cuts that number in half.

Re:Lynx apparently more popular than I thought

[Volante3192]

Yeah, looks like someone else has the same User Agent string (1 of 3309 now), and two others have the same HTTP ACCEPT headers (1 of 2206, 'text/html, text/plain, text/sgml, */*;q=0.01 gzip, compress en'), but I'm still unique out of 6618.

Re:Lynx apparently more popular than I thought

[greed]

It also means we can browse over SSH to our home machines in case we want to check something that might be NSFW and don't want to risk any lag between "oops" and Cmd-W. I hate open concept offices.

Re:Lynx apparently more popular than I thought

[Anonymous Coward]

NSFW over Lynx?

Re:Lynx apparently more popular than I thought

[Inda]

I browse with MS Word and the site says I'm unique. Who'd of thunk it? //no JS
http://panopticlick.eff.org/index.php?action=log

Seems to identify itself as IE :(

Re:Lynx apparently more popular than I thought

[Anonymous Coward]

Plain old links will report your terminal size in the user-agent string, either randomizing your data (If you run in different-sized xterms) or making you unique to your screen setup (if you're at a framebuffer).

Re:Lynx apparently more popular than I thought

[timq]

bits of identifying information : 11.09+
one in x browsers have this value : 2183

log (2183) / log (2) = 11.092096414990792

It's just a mathematical expression that does not heed the semantic value of the UA string. In other words, they treat "lynx" as being as common as "MSIE".

Re:Lynx apparently more popular than I thought

[marcosdumay]

My elinks instalation is unique. What is no surpize, since my Firefox is unique too.

Woah fonts

[Anonymous Coward]

As a graphic designer, suppressing the font list would help. Why is it even needed?

Re:Woah fonts

[Kazoo the Clown]

As a graphic designer, suppressing the font list would help. Why is it even needed?

Or perhaps more interesting, can I somehow use a huge font list to mount a buffer overflow attack against such monitoring programs?

I'm unique!

[eddy]

Woho!

"Your browser fingerprint appears to be unique among the 3,026 tested so far."

3026 is a super small sample though.

Re:I'm unique!

[eddy]

Sample is growing fast. In the minutes since that post...

"Your browser fingerprint appears to be unique among the 5,747 tested so far."

Re:I'm unique!

[Maestro485]

Me too, but it's up to 8223 in the half hour since you posted. The sample is growing pretty quick.

Re:I'm unique!

[backbyter]

And I'm unique at 12,107!

Needs some more work.

[the_other_chewey]

It doesn't seem to work that well. I know for sure that my browser's UA string is globally unique - and am still
told that one in 4316 browsers will have that UA string.

Unique Browser

[RedTeflon]

Your browser fingerprint appears to be unique among the 5,465 tested so far.
Oh my browser is unique just like me.

I'm unique! Not so fast...

[cvtan]

The web site says I am unique (well I knew that). I'm still running WIN7 RC.. Maybe I should change the ver to WIN98ME. Then I would be unique and certifiable.

Interestingly enough,

[Minwee]

roughly one in five browsers has javascript disabled.

Then again, that's probably artificially high based on what circles this story has been circulating in.

I'm twice unique!

[chrysrobyn]

My desktop environment is so far unique over 2,357 samples, and my iPod Touch is unique over 2,239 samples. Interesting. I know I have some interesting pieces to my desktop, but 1/2357 surprised me. My iPod Touch being unique, on the other hand, just tells me more about who they've sampled so far than about the uniqueness of the test.

Re:I'm twice unique!

[Anonymous Coward]

Heh. My N900's user agent string occurs in 1 of 11304 cases, out of a sample of 11304.

Interestingly, my FF 3.5 on Win7 x64 user agent string is less usual than my two Ubuntu laptops, 1/60 for Win7 but only about 1/47 for Ubuntu. I guess that sort of thing happens when you get linked from Slashdot. Or everyone is using IE8 on Win7...

Little Bobby Tables in User Agent String

[fibrewire]

Lets see whose tracking what :P

Somebody write a firefox plugin that changes "Fingerprints" to "DropDB" statements

Re:Little Bobby Tables in User Agent String

[thms]

The quick manual way:

1) Type "about:config" in the addressbar, if you haven't been there before you must confirm that you are actually a geek.
2) Filter for "useragent", then append whatever you want to the general.useragent.extra.firefoxComment key.
3) Help -> About shows your current user agent, btw.
4) Wait for lawsuits? Or Profit? I forgot...

Re:Little Bobby Tables in User Agent String

[daveime]

So how would adding unique text to the UserAgent make you *less* recognizable ?

It's about lowering entropy bits, not adding them !!

Re:Little Bobby Tables in User Agent String

[Chyeld]

You do understand the joke the GP was making, correct? DropDB is the command to dump the entire database. If your inputs aren't properly sanitized, then the user agent string DropDB would cause you to lose your entire tracking database.

It's similar to the old yarn about the student in college who kept righting on their test after the time limit was up and when the professor started to chew the student out and explain they were going to throw their test in the trash since they hadn't stopped on the bell, the student asks if the professor knows who they are. When the professor responses that they don't, the student just shoves their test into the middle of the pile and runs.

Re:Little Bobby Tables in User Agent String

[Bill Evans]

dave, your observation holds if the user changes the UserAgent just once.

But thms's idea (leaving aside the whole idea of destructive data) has great merit if you change the UserAgent string differently every day, or every hour. That anonymizes you periodically.

Re:Little Bobby Tables in User Agent String

[Pictish Prince]

So how would adding unique text to the UserAgent make you *less* recognizable ?

It's about lowering entropy bits, not adding them !!

You're not thinking it through. After posting that on slashdot, how many firefox browsers have the "unique" DROP TABLES appended to their UA string?

Plugin to thwart this?

[cormander]

Write a browser plug-in that randomly mangles these bits of information into to other valid values before passing them to the website, in known "good" combination. You'll start to look like other random people on each request.

Targeted advertisers - here I am!

[log0n]

Your browser fingerprint appears to be unique among the 6,764 tested so far.

Tested

[Rikiji7]

Your browser fingerprint appears to be unique among the 7,335 tested so far.

Reloading does cut the numbers in half

[Anonymous Coward]

And further reloading is a good way to make your browser readings more popular and thus less unique ;-)

Fonts as identifier

[Anonymous Coward]

Those people who have tons of fonts installed because they design logos and banners and stuff will have the most unique fingerprint of them all, because not all designers install the same font packs.

That and everyone who has a font of their handwriting on their computer, made with Fontifier or whatnot. They'll have unique fingerprints too, unless they distribute the font to friends or family.

I have my handwriting as a font. I'm going to be a unique browser fingerprint for as long as this test is carried out. I guarantee it.

UA strings put unnecessary stuff in them

[linebackn]

I look at user agents from time to time, and it blows my mind how much stuff some programs are permitted to put in there. It seems like every toolbar, add-on, and browser re-branding these days wants to put itself in you user agent.

I wonder what the longest non-fake user agent is these days? I recall there was a problem a while back on the Mozillazine forums because it records user agent strings for support purposes, but only allocated so many characters. Thanks to some new toolbars and such some people couldn't post because their user agent string was to long.

I don't think people realize that what some programs can add to their user agent sting can potentially be a privacy issue.

Really, even with a most basic user agent string there is, arguably, still information that probably doesn't need to be there any more. Do web sites really need to know your specific Windows version? CPU Type? Rendering engine version? Browser minor revision? And what is with all the MS .Net verison info anyway? It just seems like a lot of detail.

Re:UA strings put unnecessary stuff in them

[t0p]

You don't say! My user-agent string is pretty uncommon at 1 in 6309.5. Lok at the bloody thing: Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7. Why on earth does it have to be so detailed? I think I might start using the User Agent Switcher add-on to make it a bit more usual.

Re:UA strings put unnecessary stuff in them

[Anonymous Coward]

But what is usual? Mine is unique, because I compiled it myself (Gecko/20100127). The date has to go. The build number has to go. The architecture has to go. That rv:foo has to go. I don't see how any of that is useful for anything but tracking. But when I remove it from my UA I am unique because I removed it.

Mozilla/5.0 (Linux; en-GB) Firefox/3.5

That is how it should look like.

Re:UA strings put unnecessary stuff in them

[quantumphaze]

What's with the "Mozilla/5.0" part anyway. Others say IE has that in its UA string too and looks like some legacy shit from the old Netscape days.

HAHA - Does not mask out same IP so keep clicking

[Anonymous Coward]

Each click halves the "uniqueness" so while I started as unique among the 2500 captures and 12.5 bits of id, after 10 clicks I was about 1 in 40 and about 5 bits.

Wrong summary

[trold]

Revealing 10.5 bits of information about yourself will place you in one of roughly 1500 groups, not in a group of size 1500. With more than 1.5 billion internet users, you are "identified" as being in a group of 1 million.

Anyone NOT

[mrwolf007]

unique so far?

Re:Anyone NOT

[Volante3192]

My FF3.6 at home is 1 of 262.

Re:Anyone NOT

[clone53421]

Blocking Javascript, I assume.

Shows who your true friends are. Thank Microsoft.

[Anonymous Coward]

There is an option for privacy enhanced web browsing: IE compatibility test virtualization images. A very common OS packaged with a vanilla install of a very common browser, neatly resettable in a virtual machine. Thank you, Microsoft.

EFF's browser test isn't a browser test

[isa-kuruption]

When I went to their site to find out how "unique" I was, the site launched a java applet. This isn't tracking browsers at this point, it's tracking JVM's too. If you're allowed to have the browser launch a third party application, then might as well launch an .exe that scours your hard drive and does an HTTP call back to the EFF.... at that point, might as well just say every system is unique.

Re:EFF's browser test isn't a browser test

[Skal Tura]

Actually you are incorrect there. It is running trying some extensions but afaik not plugins (see the last section, allowed normal extensions available in some browsers), if it would have access to your files etc. without asking permission (didn't ask for me using chrome), that would be so huge security issue that every computer in the world, ever connected to the net and browser used even for just a few pages would be part of a botnet...

Plugins List

[gknoy]

I did not realize that my plugins list was the largest source of fingerprint data. I didn't even know it was listed.

I imagine many people use Opera at my screen resolution, but I'd be interested in seeing how many people shared my particular combo of data (aside from the plugins list).

Re:Plugins List

[Kral_Blbec]

I didn't realize either that the plugin list was sent out, nor the screen resolution, nor what fonts are enabled. What is the purpose of all that?
Taking a look at the plugins I have installed, I'm also surprised at some of them. Hulu Desktop Integration? I thought the purpose of a standalone was so it didnt need to integrate. 2007 Microsoft Office plug in for Netscape Navigator? WTF?

Re:Plugins List

[Anonymous Coward]

Haha, i never expected it would be so thorough either.
Mines was entirely unique upon testing.

I'm scared, somebody hold me...

NoScript

[mewsenews]

With javascript disabled, they said my browser was 1 in 140.

With javascript enabled, they said my browser was unique among all browsers seen so far.

NoScript is so great.

Re:NoScript

[spune]

Curious; when I have javascript enabled (NoScript off) I'm only 1 in 6000 but it gives me unique when it's disabled.

Re:NoScript

[T Murphy]

I am curious what their skew is on NoScript and FireFox use- I would assume both will be more common in their data than in the general population. I don't expect it to make a notable difference in the practical meaning of the numbers- I'm just curious from a statistics perspective.

This is scary

[whatajoke]

Your browser fingerprint appears to be unique among the 10,808 tested so far.
I just realised that the fact that I turn off all my plugins(and java) and have multiple languages enabled, probably gives a completely unique fingerprint to automated stalkers like google.

Fresh Install

[Anonymous Coward]

Fresh install of Firefox for windows from getfirefox.com rendered me unique out of 9608. A fresh install in wine, that is.

Snowflake

[Anonymous Coward]

Panopticlick says I am a unique snowflake, but here on slashdot, I'm just an AC.

Firesomething

[nevermore94]

Funny thing is, my browser is unique every time I go there, thanks to Firesomething.

Mr Taco

[Vlijmen Fileer]

"I remember laughing years ago when I would see users who had modified their user agent string with some sort of defiant pro-privacy message, without realizing that their action made them uniquely identifiable out of hundreds of thousands of others."

Mr Taco must have laughed the laugh of a naive person.

These people made a /statement/, /trading/ this little aspect of their privacy in the process. Seeing they were at least smart enough to see there is a thorny privacy issue with the user agent string, it's also logical to assume they were very much aware of this trade.

Ubuntu LiveCD

[Anonymous Coward]

From the Ubuntu Live CD, I'm unique among 14998 people.

This is an unmodified Live CD running default everything.

Re:Ubuntu LiveCD

[Anonymous Coward]

Sounds about right. Check if netcraft confirms. If so, move to phase 3 - profit !!

Good luck to them

[killmenow]

I'M BEHIND SEVEN PROXIES!!!!

Re:Good luck to them

[BitterOak]

I'M BEHIND SEVEN PROXIES!!!!

Won't help you, unless the proxies actively filter out identifying information such as the plugins or fonts you have installed.

Re:Good luck to them

[killmenow]

That's a joke... I say, that's a joke, son.

Also, Know Your Meme

Worrying

[zmollusc]

What will happen when 'they' identify me and fail to correlate my purchase history with the ads I have been served?

"Oh jeez, another one who buys the same groceries every week, drives an old car and wears £3 Asda clothes until they fall to pieces!"
"Another windows 2000 user?"
"Yeah!"
"Dammit, just stop serving him any pages at all and put him on the 'to kill' list."
 

Re:Worrying

[John Hasler]

You can either give a sigh of relief at not needing to deal with such assholes, or install a Firefox plugin that will have them exclaiming "Hot damn! It's Paris Hilton!"

Highest entropy?

[SloWave]

I got my entropy up to 14+ by becoming a Mozilla/4.78 (Macintosh; U; PPC).

Re:Highest entropy?

[IndieKid]

I got 16+

Is this a new form of ePeen waving? Anyway, I think I was only unique out of 83k hits because of the strange resolution of this laptop (1440x1050) and combination of addons/plugins I have installed

Editor is a moron

[Anonymous Coward]

"I remember laughing years ago when I would see users who had modified their user agent string with some sort of defiant pro-privacy message, without realizing that their action made them uniquely identifiable out of hundreds of thousands of others."

Editor is a complete moron. What were they trying to be private about? Did you talk to them? Self-centered moron who both created and destroyed /.

When people modified their user agent back in the day when it was commonplace, it wasn't much about being tracked on an individual basis. It was about keeping the site and web people from trying to make their sites browser, platform, or even plugin specific. Back then, IE was huge, and sites were going IE specific, even to the point of locking out browsers.

Modifying the user agent meant, generally, the site didn't have a clue what browser the person was using, and couldn't craft the content and layout. These were the days when sites wouldn't even render if you were using something other than IE, or Netscape. It was commonplace then, as it is now, to require a browser, as now it is to require a plugin (like Adobe Flash, that piece of shit).

It was all for naught, as sites now have gone nearly all Flash, or the layout is browser specific, or lots of JS use. A lot of content is just a mess, not looking the same from one browser to another, and the content writers have overtaken the user experience so much so that single clicking on icons don't even work so much anymore because of a embedded Flash or JS.

To say that people were not protecting their privacy--well, jackass, did you know what browser they were using? Or not? I doubt you did, so man up, you're laughing at your stupidity in analyzing and understanding the situation about what the users were doing. They were trying to keep the web true to its original intent of being open to all comers and having pages standardized, something /. obviously does not believe in given their own site design (as I wait 15 seconds for the captcha to "load").

Wow!

[BitterOak]

I just ran this test, and I was horrified to discover that every font I have installed on my system shows up! I had no idea the browser (Firefox v. 3.5.7 with NoScript) leaks this kind of information. I do graphic design work and I have a huge number of fonts on my system, some of them unusual. I certainly don't want nor need to have them all available to my web browser, and I certainly don't want my web browser to be broadcasting this list to the world. Does anyone know if I can configure Firefox to use only the "standard" fonts? I really don't think it's anyone else's business which fonts I have installed.

Re:Wow!

[YA_Python_dev]

I just ran this test, and I was horrified to discover that every font I have installed on my system shows up! I had no idea the browser (Firefox v. 3.5.7 with NoScript) leaks this kind of information.

It doesn't. It's the Adobe Flash plugin, deinstall it and try the test again. BTW, if you have noscript and flash, instead of JS enabled and flashblock, you have your configuration exactly backwards.

Re:Wow!

[pjt33]

They launched a Java applet, which is perfectly capable of getting those details.

Re:Wow!

[Anonymous Coward]

How did you configure NoScript? I have FF 3.5.7 with NoScript and the site tells me that it cannot determine my fonts because I have JavaScript disabled... Do you allow by default JavaScript or something?

Re:Wow!

[Anonymous Coward]

Not quite. I have Flashblock installed, and didn't click the little button to run the flash on the page. It still found my fonts - with "(via Java)" added to the end of the font list. So appearently Java reveals this info as well.

CRASH!

[Anonymous Coward]

My Mozilla browser crashed after I hit the TEST button. Any other crashers out there?

Interesting...

[Kral_Blbec]

With noscript enabled I came up as one out of around 1400, with noscript disabled I was completely unique out of the 19000 tests done so far. I'm special.

Compiling Firefox

[J'raxis]

I noticed this years ago, when I noticed that compiling Firefox puts the exact date and time in your user-agent. The user-agent also contains the usual things like the OS, architecture, &c.. So how likely is it that someone else with the exact same system configuration and compiled the exact same version of Firefox at the same time? Probably zero.

Re:Compiling Firefox

[J'raxis]

Specifically, the Firefox user-agent when compiled on Gentoo will look like this:
Mozilla/5.0 (X11; U; Linux $ARCH; $LANG; rv:$REVISION) Gecko/$YYYYMMDDHH Gentoo Firefox/$VERSION

Re:Compiling Firefox

[Anonymous Coward]

Are you saying that gentoo's user-base is on the decline? Gentoo is not dying dammit. Thousands of gentoo users are emerging firefox as we speak.

Re:Compiling Firefox

[YourExperiment]

I noticed this years ago, when I noticed that compiling Firefox puts the exact date and time in your user-agent.

Well, duh. Get with the 21st century and go and buy yourself an operating system where they compile the web browser for you.

(I'm just slightly too nervous to post this without a smiley, so here ya go: :) )

Unique among 18100+

[AliasMarlowe]

I tested my three browsers (Opera 10.10, Firefox 3.5.7, Chromium 5.0.306.0) on Ubuntu 9.10, and all three were rated "unique" among 18100 to 18200 signatures. In fact, they were all unique on browser plug-ins alone, and Firefox was also unique in its reported set of system fonts. This is troubling.

On other items, they were not unique, but often in a small set. The combination of a few rare settings could easily make the browser nearly unique in a far larger set. Chromium was nearly unique in fonts (2 browsers with the same set) and in user agent (about 10 browsers with the same user agent string). On screen size, about 9 browsers reported 3840x1080x24 resolution, and 3 of them were probably mine...

So, cleaning cookies and temporary files and flash droppings regularly may no longer be enough. [donning a tinfoil hat] do we have to install or remove some fonts every day, or change screen resolution and user agent string every few hours?

Re:Unique among 18100+

[John Hasler]

> ...do we have to install or remove some fonts every day, or change screen
> resolution...

No. You just have change what you report, not what you actually do.

Re:Unique among 18100+

[sopssa]

Disable javascript globally and enable it for sites you like and need it. Most of the unique info is sent by it.

Re:Unique among 18100+

[AliasMarlowe]

Disable javascript globally and enable it for sites you like and need it.

But the sites I like might include some that I don't like being tracked by...
In my crystal ball, I see a changing user agent string and ditching of arcane fonts & plugins.

Re:Unique among 18100+

[orangesquid]

Exactly. I enjoy how many sites block the user-agent string for wget. This is easily remedied with tagging --user-agent "Mozilla/4.0 (compatible; definitely-not-yoo-git)".
Since wget politely will obey robots.txt, though, to do recursive downloading, you really ought to remember to change this compile-time "option" by carefully commenting out the appropriate code. (What?! You're installing a binary you didn't compile yourself?!) ;)

I've always enjoyed randomizing identification information. My /etc/issue.net (in the days of telnet) used to be fed by a daemon that would print login banners from ULTRIX, VMS, SunOS4, BSD 4.3, CRAY Unicos, etc. The automated script kiddie banner-scanners of the day used to have lots of fun with that, let me tell ya.
(sshd's Banner option isn't as flexible, just static text... it's disappointing, because the various gettys always had @ and \ options. I did used to modify my getties to extend those options though, so, I've played with extending my sshd for an field-substituting banner message. For the record, if you're curious about extending OpenSSHd, since it loads the banner file into a static text area at startup: You can have a config-file-rehash or SIGHUP-style routine reload the bannerfile. If you want to do load-average numbers in your banner, you can have the daemon wake up every 60 secs and get that info from /proc or appropriate kcalls for your OS and put them in appropriate static vars. Replace the call to print the banner on connect with something like: alloc larger temp buffer (if fail, bail with an error) and do substitutitions up to the buffer length, ensure NUL-term'd, tell connection-handler code to write that buf, and plan to dealloc when the connection-handler code no longer expects to need to push any more text from that buffer to that accepted sock (the tricky part, iirc from the opensshd code!))

Why do they need to know my plug-ins?!

[Anonymous Brave Guy]

I guess I'm somewhat paranoid/security conscious, e.g., I do clear out things like Flash cookies, and I block sites like Google Analytics. What surprised me was that Firefox, a browser I originally chose in part for its reputation of having better security and privacy settings than certain other browsers, seems to be broadcasting a signature that tells any site I visit all of the plug-ins I am using. This not only uniquely identifies me, it also paints a huge target if any of those plug-ins is found to have a security hole. This information should never have been broadcast publicly, and it should certainly be blocked by a patch in the immediate future!

Re:Why do they need to know my plug-ins?!

[t0p]

Browser plugin details are visible only if you allow Javascript. When I allow Javascript, my plugin details are very uncommon at 1 in 12740.5; but if I block Javascript, it goes right down to 1 in 4.76 ("no javascript"). So if you're as "paranoid/security conscious" as you claim, block Javascript. Then the villains won't know what plugins you use.

Re:Why do they need to know my plug-ins?!

[Anonymous Brave Guy]

Unfortunately, blocking Javascript also breaks the web. Almost every site I use regularly relies on Javascript, and a high proportion of those I visit occasionally seem to as well. I'm sorry, but Noscript is not the correct answer to these problems; it's cutting off one's nose to spite one's face.

The USER_AGENT String can be Changed in Firefox

[Anonymous Coward]

You can change the user_agent string in Firefox in about:config.

Noscript no help?

[godel_56]

All three of the browsers on my system (Firefox 3.6, Opera 10.x and IE8) show as unique, and I do have Noscript enabled on Firefox.

The site uses cookies.

[fava]

The irony is that the site uses cookies to determine if you are unique to the site or have been there before.

Deleting the cookie (and maybe changing your IP address) and revisiting would introduce spurious duplicates into the database.

browserrecon project

[Marc Ruef]

Hello,

I would like to refer to an old project of mine. browserrecon is an implementation which uses application fingerprint techniques to identify web clients:

http://www.computec.ch/projekte/browserrecon/

Bye, Marc

14.63 bits of entropy and shrinking!

[cfriedt]

Apparently My browser's UA was the first of its kind after 25,430 visitors ;-) My guess is that it has to do with the Chrome build number.

Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.43 Safari/532.5

14.63 bits of entropy and shrinking!

SAME results using Firefox vs Safari in private

[solosaint]

I got the SAME results using Firefox vs Safari in private mode? Look for yourself http://phatanium.com/firefox-vs-safari.png

Re:SAME results using Firefox vs Safari in private

[natehoy]

No surprise there.

The only thing "porn mode" does is store all cookies, web history, and cache in a special place during the browsing session, and when you shut down private mode all of that stuff is deleted. While private mode is running, scripts still run, your useragent remains unchanged, and the web site that you are visiting knows exactly as much about you as if you had visited in normal mode.

It's only "private" in that other users of the computer who come after you can't tell what you did online. Your ISP and the remote web servers collect exactly the same information on you as they would if you ran in "normal" mode (with the exception of persistent cookies surviving across sessions).

I just ran the test and it said...

[Anonymous Coward]

That I am unique among all the browsers tested! Awesome!!! That's pretty good, right?

Re:I just ran the test and it said...

[natehoy]

No, actually, that's bad. Well, if you care about being tracked, that's bad. If you don't care, then the test results are irrelevant to you and the only bad thing is that you've wasted time running the test. But you've contributed a new signature to the EFF so you've helped out with the test.

What the EFF is saying is that all of the attributes they are checking (which can be checked by any web server) combine to form a fingerprint. That fingerprint identifies you as a unique individual to a greater or lesser extent. The more uniquely you can be identified, the more likely it is that a web server (or coalition of web servers) can track your usage on their sites. All they need to do is gather this information for each page you view.

Let's use an automotive analogy, because they always work so very well on Slashdot. I'm making up the ratios, but they only serve to demonstrate the point.

I'm driving at random through a large city (one million cars on the road right now), and you have lots of people trying to track my movements as I drive through the streets and run my errands.

  - If you only know that I drive a car, you'll never find out anything about me, because over half the people on the road drive cars. I'm anonymous to you. Over 500,000 chances for a false match all the time means you'll never ever be able to tell where I am.

  - If you only know that I drive a green car, your confidence in identifying me is still pretty low, because (let's say) in 100 vehicles on the road are green cars. I'm still pretty anonymous, but in a city of 1,000,000 there are still 10,000 cars that could match. So for any practical purpose you can't tell who I am.

  - If you only know that I drive a green Honda Civic, your confidence just went up, because green Honda Civics are unique to within (say) 1:2,000 - for every 2000 vehicles on the road there is one green Civic. There are still 500 cars that could be mine in the city, though, so it's still a really low confidence that you know where I am.

  - If you know that I drive a green Civic with one headlight out, you've significantly upped your confidence, maybe to a useful level. There's still a chance of a false positive matching me, but you're pretty darned close. There may be 10 cars, at most, that match that description. But if you went up to one of them, there's still only a 1:10 chance it's me. I wouldn't bet on those odds.

  - If you know that I drive a green Civic with one headlight out, the front drivers door has been replaced with a blue one, I've added a bumper sticker that reads "I BRAKE FOR CLOWNS", and the car has a scratch down the driver's side, it's unlikely in the extreme someone else's car looks like mine, so you can identify me with significant, if not absolute, confidence. Even in a city of a million people, it's terribly unlikely that someone else has a car that matches that description precisely.

  - If you know my license plate number, you've got me identified with complete confidence (discounting the odd chance that someone has forged my plate).

the button to start the test is an image

[richlv]

the button to start the test is an image without alt text or other controls.
eff, please make the site usable without loading images.

thanks.
signed : gprs and other crappy internet connection users worldwide.

There is a Firefox plugin for that

[Anonymous Coward]

User Agent Switcher: https://addons.mozilla.org/en-US/firefox/addon/59

Re:There is a Firefox plugin for that

[natehoy]

That only changes one part of the fingerprint. The one part that is, for the most part, the LEAST unique. Personally, if I did this I'd ignore the useragent entirely, and go for the fonts and plugins. Those are more unique and harder to change.

Our staff runs X clients in VM's to a X11 server

[Anonymous Coward]

That way all 2 of them look alike in their headers while petitioning and supporting Lesbian rights. We've known about the uniqueness of client web browsers passing information to servers for quite some time now. They've been using the Dillo web browser for most of their neeeeeds, and don't need to take turns when they use the same IP address.

Interesting...

[natehoy]

With NoScript blocking eff.org, I was unique to about 1:7000. Once I allowed eff.org on NoScript, I came up as completely unique - Fonts and Plugins seemed to be the most unique factors (as you might expect).

To be honest, if I was using this as a tracking tool I'd probably not put a lot of stock in Useragent, but instead on more unique things like fonts and plugins. Useragents can be spoofed easily, and are generally not that unique. Fonts and plugins, on the other hand, are less likely to be spoofed and are a lot more unique to the user. A lot of people have installed or deleted at least one font on their system, and that's a relatively unique fingerprint.

It's the FONTS...

[trygstad]

If you do any graphic design work at all, odds are extremely strong that you will have a very distinctive set of fonts installed. My Firefox installation was a 1-of due to not only fonts but the particular mix of add-ons I am sporting. Interestingly enough my Chrome was unique for plug-ins--and not fonts, and IE was unique for (surprise!) the USER AGENT details. Go figure.

affiliate marketing networks ...

[Anonymous Coward]

... are doing this for quite a while now

Unique but stock

[Anonymous Coward]

I appear to be the one user to hit the EFF site with a fully-updated HTC Magic with stock firmware from Rogers in Canada, so far. Wonder how many other sites I browse on this thing where I'm the only one with it.

Torbutton Needs UAS Improvements / developerblind?

[Anonymous Coward]

"and huge loss for torbutton with scripts off"

On the official Tor (or-talk) mailing list (found at torproject.org when you click Docs and scroll down the page),
people have asked the Torbutton author to update the user agent string more often, complained it stood out,
and even suggested he IMPROVE upon Torbutton by (A) Allowing the user to specify a UAS, (B) Providing a default
set (3 or more) of choices for the user to switch between should they choose, (C) Updating the default UAS with
each release of Torbutton, (D) and so on

The Torbutton author FAILED to respond to these suggestions on or-talk in Dec-2009, perhaps he was on holiday, but I doubt it. Making these improvements to Torbutton would remove the want/need for the Tor+Torbutton user to install ANOTHER untrusted addon for the single purpose of changing the user agent.

In short, thank you Torbutton author for not reading Dec-2009's loud and clear call for improvements.

PS / Slashdot : I simply LOVE the Invalid form key message, it's great when the You Can't Post To This Page message isn't displayed. I have to resubmit the post and hope YCPTTP or IFK doesn't show up, yup, it's a joy to post when using Tor.

Tor Stew / And EFF Could Do Better Than This!

[Anonymous Coward]

Mix the following for a nice, tasty, warm stew:

1. Tor
2. Web Proxy #1
3. Web Proxy #2
4. A touch of SSL
5. A sprinkle of VPN
6. More Web Proxies to taste
7. A dash of SSH
8. Randomized User Agents either timed or manually switched
9. Noscript and/or Proxy with custom/paranoid settings
10. VM and or LiveCD with no HDD drives or other writable medium plugged in

And the user agent string at the end is useless! You're no longer identified as a tor exit node, either.

Attacks against Torbutton (see recent Defcon and elsewhere) and other browser plugins are cropping up, we need a browser to do it all, remove the need for addons and a scrubbing proxy, but no one seems to be up to the task (there's a few torifed browser projects but no all-in-one solution).

Shouldn't EFF be working on something more interesting? Maybe a browser for Tor which removes the need for Proxy/Plugins with Tor? No, instead we get this project which may result in a broken link in X amount of months or years when people forget about it.

Since tor.eff.org was shuffled off, I've been waiting for something equally interesting, like torbrowser.eff.org.

Re:Tor Stew / And EFF Could Do Better Than This!

[natehoy]

You know, I'm tempted to keep a half-dozen fonts I'm not interested in around so I can randomly install and uninstall 2-3 of them each morning. That, and enable/disable a plugin or two each day. :)

Re:HAHA - Does not mask out same IP so keep clicki

[pclminion]

That's a pointless waste of time. Such manipulations can just be filtered out later. But hey, feel free to act like an ass.

OMG PONIES!!!1! (was Re:Results and flash cookies)

[ljhiller]

If you know what sites every computer visits you could say, for example, that computers that visit Slashdot are unlikely to visit mypinkpony.com

There is, however, a very, very high correlation between Slashdot visits and cuteoverload.com on single-user computers over 3 years old. Not sure what that says about your thesis.

Ratted Out By Fonts

[billstewart]

I checked with Mozilla 3.6, Mozilla with Noscript blocking Javascript, and IE. There are now 44000 users.

• Blocking Javascript blocked my fonts and plugins, so I had only 8 bits of uniqueness,
• but my fonts were enough to make me unique on unblocked Mozilla and IE (technically not unique, but there were only two instances, which would be my Mozilla and my IE)
• my plugins were unique on unblocked Mozilla and 1/12000 on IE, and
• My User Agent string was unique on IE (claiming to be Mozilla).

The tricky bit was that my fonts include the corporate-logo font for $DAYJOB, and I guess none of my coworkers have tried the system or have an earlier edition of the corporate-IT-installed vanilla fonts. (My laptop trashed itself last week, so it's running a vanilla image as of Monday, and I'll have to go reinstall those cool programmer-oriented monospaced fonts and Elvish and such.)

Are there any privacy extensions or options to Mozilla to tell it to only advertise boring fonts, or advertise your favorite choices of fonts so web pages display things the way you want?

NoScript, Adblock, Ghostery

[billstewart]

You don't have to disable Javascript everywhere; you can use NoScript to enable it for sites you trust (or don't trust but want to get full functionality anyway). And most of the tracking seems to happen on tracker-company sites that the content-provider sites use, so you can use NoScript to block the ones that Adblock doesn't already block.

However, I recently installed Ghostery, and even with NoScript blocking popular trackers, there's apparently still a bunch of Javascript dreck on many popular web sites, especially blogger services and news sites, so I'm now using that to block more stuff.

More Unique, Less trackable

[billstewart]

It should make you more unique - but if it's actually different every time, you should be less trackable, because each time the web server sees a User Agent that it's never seen before, so you look like a different stranger every time.

Re:More Unique, Less trackable

[Mister Whirly]

If everybody was using it, yes. But if you keep seeing a unique agent string coming from the same IP range over and over, it would be easier to track, to a degree. There are a lot of variables, but if you didn't have a lot of traffic it could make it easier to identify an individual user.

Re:More Unique, Less trackable

[billstewart]

The point of the original article was to discuss what tracking can be done without the IP address or cookies, and as I've said, you're creating a different unique value every time. So you're Not going to see one unique agent string coming from the same IP range over and over - you're going to see a different brand new unique agent string every page load (or at least every session), and if you've only got an IP range (e.g. because it's coming from a wireless access point at a coffee shop) you've got no way to correlate sessions.

If you've got an IP address you can track to a user, you don't need the user agent to be trackable, unless you're trying to figure out whether it belongs to the resident or to random wireless guests.

I'm number 46,000 and one!!

[hellop2]

Your browser fingerprint appears to be unique among the 46,001 tested so far.

Currently, we estimate that your browser has a fingerprint that conveys at least 15.49 bits of identifying information.

My list of plugins and my list of fonts are both unique in 46001. Interestingly, only 61 people ran the test in my timezone. But, I'm curious about the "bits of identifying information". Both fonts and plugins give 15.49 bits of info. Wouldn't their results combined give more "bits"?

Re:I'm number 46,000 and one!!

[hellop2]

Yeah, log_2(46001) = 15.49. So, they didn't bother to combine metrics. They don't have to, since I'm unique in at least 2 of the metrics. You can get the probability of each of your metrics by taking 1/y where y is "one in x browsers have this value". So my "HTTP_ACCEPT Headers" have a value of about 3. Which means that 1 in 3 people have the same headers. You can calculate the probability of your unique fingerprint by multiplying the independent metrics together. "User Agent", and "HTTP_ACCEPT Headers" are probably not independent since they are probably the same for a default install of firefox.

But, if I take just User Agent, Plugins, Timezone, and Screen, I get a probability of: 1/451/519461/7011/14 = 4.35E^-11. Which is 1 in 22,940,911,980.

Add in fonts and I'm 1 in 1,191,688,613,713,080.

Re:I'm number 46,000 and one!!

[hellop2]

1/45 * 1/51946 * 1/701 * 1/14

In case anyone wondered about the math. I was 1/51946 when I refreshed. I'm over 60,000 now. Are my plugins really that unique?

It would be really great to see a larger dataset. Like, a million records. Does anyone have a large-traffic website and would be willing to make a dataset accessible?

What can data miners find out about us???

[Anonymous Coward]

I am worried.

How much more information can they get from our browser?

Where to find out what these kind of information and ways to protect ourselves from the potential malicious data miners?

Seems to be some programming errors on the test pg

[Anonymous Coward]

I tried the test - getting a ton if PHP errors... Seems the EFF needs a few more programmers... where
is John Gilmore?

Very unique here.

[metrix007]

16.11 unique bits.

I suspect mainly because I have Quake Live installed.

I am also running Firefox Portable on Windows Server R2.

R2 should report the same as window 7 does, and firefox portable should not be able to be distinguishable from Firefox.

My resolution of 1680x1050 may also be less common.

After turning off JS, it became more interesting.

Still 10 unique bits, and only 1 in 1093 other browers did one have the same fingerprint.

I guess my firefox portable is giving off a unique string.

I claim prior art!

[fph il quozientatore]

I claim prior art!

I'm unique.

[mr_mischief]

Out of the first 76,633 users, I'm the only person with my plugin selection and my available fonts.

Using Midori for the browser and Mandriva for the OS was a good start, obviously. The User-Agent string doesn't mention the distro name, though. It just says it's under X on Linux on an i686. One in every 25544.33 people (so two others) submitted to the test with Midori on Linux.

Having commercially-licensed fonts that don't come bundled with any OS helps, and how many people have identical sets of plugins?

When I'm really so worried about privacy, I'll be sure to use a browser that reports exactly what a stock XP or Win7 system would report. There's nothing in the world that forces your browser to tell the whole truth about what it can do.

Not like this...

[Anonymous Coward]

User Agent 14.77/27936.67 - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.1; en) Opera 10.01

HTTP_ACCEPT Headers 9.22/594.4 - text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 iso-8859-1,
                                                      utf-8, utf-16, *;q=0.1 deflate, gzip, x-gzip, identity, *;q=0 en-US,en;q=0.9

Browser Plugin Details 2.5/5.67 - no javascript

Time Zone 2.49/5.63 - no javascript

Screen Size and Color Depth 2.49/5.63 - no javascript

System Fonts 2.5/5.64 - no javascript

Are Cookies Enabled? 2.99/7.92 - No

Limited supercookie test 2.49/5.63 - no javascript

The only question is, is it good to be unique here? Being unique, as to what I am drawing from this article's conclusion, actually harms one supposedly. It's espousing the "security-by-obscurity" principal. Hiding via "security-by-obscurity" does help. After all, look @ the *NIX variants out there using it due to less market share & use overall worldwide vs. Windows NT-based OS by comparison. In turn, they get less victimized online via maliciously coded pages or adbanners or bogus servers because of it, as they present less of a target to hit. This is how/why being less used helps though, not exactly unique identifiers, however, it does tend to illustrate the benefits of being less used via exemplifying the "security-by-obscurity" principal in computer security at least.

Very Ccounter-intuitive

[Anonymous Coward]

Posting as an AC because I was always too paranoid to create an /. account -- how's that for irony!

Anyway, there are two configuration I use commonly at home: the text-based w3m, and Firefox.

At first thought one would think that w3m--a little-used browser--would be much more unique. After all, how many people use it, as compared to firefox?

But on reflection, this is actually not the case. Sure, w3m isn't very widely used, but without javascript support there is little of its customization that can be remotely quereied (beyond _ACCEPT and USER_AGENT and the like). So I decided to test both and see if in fact the more rare browser was also more anonymous. And it was:

W3M: "Within our dataset of about ten thousand visitors, only one in 46,065 browsers have the same fingerprint as yours.
Currently, we estimate that your browser has a fingerprint that conveys 15.49 bits of identifying information."

Firefox: "Your browser fingerprint appears to be unique among the 92,923 tested so far.
Currently, we estimate that your browser has a fingerprint that conveys at least 16.5 bits of identifying information."

Of course, now I've just given away who I am!

With Tor

[Xabraxas]

Without Tor I'm unique with my fonts and browser plugins. With Tor I'm more generic in every category except screen resolution! Tor randomizes screen resolution but the res it gave me was very weird, and hence unique. I think reporting a generic screen res like 1024x768 would probably be more helpful than reporting weird resolutions.

Old Knowledge?

[Anonymous Coward]

Back in the mid-90s (before cookies) this is exactly how I tracked sessions for log analysis. It may be a bit dicey for apps but for anything else it just works.

So I better use my iphone to browse than debian

[droopycom]

my iceweasel on debian: unique
my iphone: like any other iphone...

Oh deary.

[Anonymous Coward]

Your browser fingerprint appears to be unique among the 589,355 tested so far.

Currently, we estimate that your browser has a fingerprint that conveys at least 19.17 bits of identifying information.

FUUUUUUUUU-