Tracking Browsers Without Cookies Or IP Addresses?

Peter Eckersley writes "The EFF has launched a research project called Panopticlick, to determine whether seemingly innocuous browser configuration information (like User Agent strings, plugin versions and fonts) may create unique fingerprints that allow web users to be tracked, even if they limit or delete cookies. Preliminary results indicate that the User Agent string alone has 10.5 bits of entropy, which means that for a typical Internet user, only one in about 1,500 (2 ^ 10.5) others will share their User Agent string. If you visit Panopticlick, you can get a reading of how rare or unique your browser configuration is, as well as helping EFF to collect better data about this problem and how best to defend against it." I remember laughing years ago when I would see users who had modified their user agent string with some sort of defiant pro-privacy message, without realizing that their action made them uniquely identifiable out of hundreds of thousands of others.

Comments

Re:Results and flash cookies

[Zero__Kelvin]

Personally, I'd look at the license plates ;-)

Of course, none of what you said makes any sense, or works even remotely as an analogy to what we are discussing. IPs (license plates) don't uniquely identify a computer (car) due to NAT scenarios, for example.

Just admit that you made a very foolish statement. It's no big deal. Everyone makes a foolish statement now and again. It is the people who then go to great lengths to try to make it seem like they didn't that end up actually being foolish, rather than appearing so for a moment.

(either that or entertain us with a great story about the first time you stood on the side of the highway and freaked out when you realized the same guy was driving every car.)

Re:Results and flash cookies

[Zero__Kelvin]

What you wrote:

Wouldn't randomizing this every time make you more unique and hence more trackable?

What you now claim you said:

"My point was that if every user agent reported the same thing, no matter the actual configurations or variances of the browser may be, it would be much harder to identify individuals out of the group."

The first quote is what you said, and doesn't even remotely map to what you now claim you said, as anyone can plainly see.

Re:Results and flash cookies

[Zero__Kelvin]

I'm starting to feel like I challenged someone to a duel, only to discover later that they are a quadraplegic.