Slashdot Mirror
EFF Says Forget Cookies, Your Browser Has Fingerprints
alphadogg writes "Even without cookies, popular browsers such as Internet Explorer and Firefox give websites enough information to get a unique picture of their visitors about 94 percent of the time, according to research compiled over the past few months by the Electronic Frontier Foundation. [The Research] puts quantitative assessment on something that security gurus have known about for years, said Peter Eckersley, the EFF senior staff technologist who did the research. He found that configuration information — data on the type of browser, operating system, plugins, and even fonts installed — can be compiled by websites to create a unique portrait of most visitors. This means that most Internet users are a lot less anonymous than they believe, Eckersley said. 'Even if you turn off cookies and you use a proxy to hide your IP address, you could still be tracked,' he said."
From TFA:
"There are some effective countermeasures, however. A uniquely identifiable IDG News Service Windows XP computer running Firefox could not be identified with the NoScript safe browsing extension turned on. Adding the Tor Internet anonymization software also works, Eckersley said."
For those who are interested
I don't care if anyone tracks my preferences or shopping history. What I care about is; 'Is that information "Personally Identifiable"?' In other words its not that they know what I do, its do they know, specifically, who I am.
I am all for research and marketing to tune products and advertising, but they don't need to know my name or various identifiers to do it.
"Waitress I need two more boat-drinks..."
It only lets them know it's the same browser/computer, it doesn't give them the docs on you.
I want to delete my account but Slashdot doesn't allow it.
I know that's a joke, but at work you likely experience greater anonymity than at home (from the website operator at least, can't say if your company monitors). At home, your computer is likely to have an eclectic mix of plugins, more or less up to date browser, OS, etc., all of which make you easy to profile. At work, you're often subject to the demands of the IT department, and the IT department likes uniformity; it's easier to support. So when you surf for porn at work, odds are the website can't distinguish you from anyone else at your office, since you all broadcast the same configuration data.
$_ = "wftedskaebjgdpjgidbsmnjgcdwatb"; tr/a-z/oh, turtleneck Phrase Jar!/; print
Never mind the browser , you can tell (or used to be able to , this was a few years back) what OS someone is running - assuming they're not going through a proxy - by looking at the TCP sequence numbers the client sends. There was an article on /. about it and some post grads had written a whitepaper.
All you have to do is change your fingerprint to "Googlebot/2.1 (+http://www.googlebot.com/bot.html)". OK, perhaps this needs updating, but you get the general idea.
You'll be amazed at the information some sites will be willing to give you. Even paysites will let you in for free if they believe you are Google.
Excellent plan.
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
We have a rather annoying vandal by the name of Grawp who likes to visit often and put penis pictures up on pages that little kids like to visit, among other things.
He edits via proxies, while visiting people, open wifi spots, etc... and never figures out how we know it's him.
Shame his laptop has the same fairly unique MSIE-and-toolbars useragent string.
Cookies are at least a "honest" way to track. you can easily see them in your cookie jar (or whatever term is used by your browser), and you have at least some information about who wrote it. Cookies are not always bad - hidden images, browser/OS fingerprinting, and other 'hidden' means are much worse for privacy.
true,
but you're still boned if you're the only furry in the office.
Don't let the mass media scare you.
Step 1: Install Wireshark
Step 2: Leave Wireshark running and observe what kind of information people are gleaning from you over the network. It's educational!
Step 3: There is no step 3.
I don't see why people expect anonymity on the internet any more than they do driving around in their car with the license plate showing.
I just pretend there's an FBI agent always watching over my shoulder. His name is Fred. I explain to him everything I'm doing.
Can anyone replicate this behaviour: when I clear all browser history on Google Chrome, Chrome makes a few http requests to Google just after that is done. What's that about?
This was on Windows 7. I encountered this when I was capturing packets for some performance test so I had to keep clearing the browser cache for some tests.
This article relates to the publishing of the *results* of the experiment announced in the first article. This is not (for once) a dup. Hence the "compiled over the past few months" bit in the summary.
The ringing of the division bell has begun... -PF
data on the type of browser, operating system, plugins, and even fonts installed
Should I be worried about websites knowing these things?
It goes far beyond just the OS. With Flash for example you can get a list of all the fonts the user has installed. If you ever installed some custom fonts, chances are you are close to 100% uniquely identifiable. You can also trace which pages the user has visited with some dirty CSS tricks (load an image in a:visited {}, track that, and you know if the user has visited the link).
I seriously doubt that most users are away of that trickery on how much information it is really giving away.
This is a firefox add-on which might go some way to at least confusing, if not entirely obsfucating your brwser identity
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
Except what's "wrong" is not well defined *now*, and it may even be worst in the future - and we have no idea for how long they'll keep those logs.
Dilbert RSS feed
Who really cares that their "browser fingerprint" is out there? Unless you're doing something wrong there's no reason to ever try to trace it back to a source.
And who defines what "wrong" is? In some places being gay is a crime. In some places being an apostate is a crime. In some places being anti-government is a crime. In some places playing violent video games, looking at porn of women with small breasts is a crime. In some places reading certain books is a crime.
Either you are ignorant, or you are trolling.
No one has a right to their *own* opinion. They have a right to the TRUTH.
I agree. In fact, I don't want my browser to send out any kind of information on the fonts I've got installed. It's not a feature sites tend to use, so you might as well disable it. Any way to do that with Firefox?
Switch back to Slashdot's D1 system.
Try allowing Noscript on that site? I was listed as 1 in 4 too until I enabled scripting on that website and ran the test again. Then I came out to be 1 in 1,000,000. I'd say that's more unique than I'd like to be.
Test yourself here if you haven't already.
... nobody particularly cares if website operators find out what fonts and plugins you use. You might, however, care if website operators can look at those things and be able to say "hey, it's flintmecha again". Some people (I'm one of them) don't necessarily want every company on the internet building dossiers on their online behavior. But some people might be happy to let such companies do so - it's not like there are no advantages. When a website knows who you are, it can personalize your experience with the site. I personally am happy to see a generic site and not feel like I'm being snooped on. YMMV.
Of course, no one cares what fonts you have installed. The issue, which would be clear if you so much as RTFS, is that this information can uniquely identify you. Still not the greatest injustice since they got rid of red M&Ms, but honestly. You're either deliberately ignoring the central point of the posting, or you didn't bother to read it. I know, I must be new here.
Actually, yes it is different. The first difference is cost. It is expensive to follow people around and record everything they are saying. I don't worry that someone is going to spend a half a million dollars to follow me around for the next year; it's not impossible, but it's about as likely that I will be struck by a meteor. The second is storage of information. If someone decides today to find out exactly what you said at lunch last week, they can't, because that information is gone, no matter how many people could overhear you. Cheap aggregation and eternal storage of public information lead to a loss of privacy.
Unless you're doing something wrong there's no reason to ever try to trace it back to a source.
I realize that it's a bad idea, but posts like this make me think we should have a (-1, ignorant) mod anyway.
Usually, people who offer the "If you're not doing anything wrong, why do you care who has your information" claim are talking about something such as the Dept. of Justice seeing that information. Here we're talking about anyone who puts up a web site, (as you, yourself, posted). That's actually a pretty extreme position. You're not just saying we should all trust the government - you're really saying we should all trust random strangers.
Would you respond to my post right now, with your current IP address, monitor resolution, video card and driver info, all browser functions enabled, any 3rd party add ons, what versions of Flash, Shockwave, and so on you have, your OS and what support packs it has, a complete list of codecs on your machine, a similarly complete list of fonts, and probably a lot more info? I'm a random stranger to you, aren't I? I can understand if you don't want to look all that up manually and type it into a little slashdot window (in fact, please don't), but how is that really different from my automated havesting of that same data?
Look at all the things you can't change. Yeah, you, and most people can force a new IP address if you're with a common ISP such as Comcast. But if you update your Flash, that update's gonna have a time-stamp after the version I just found out about, so I can still assume that your PC had that version of Flash at the time it visited my site. What if I'm looking for old versions of add ons that have known vulnerabilities? Maybe I'm watching for visitors who don't upgrade or patch much. There are certainly exploits that would be hard to stop if their originator focused on putting them only on the obviously slow to patch set's boxes. So, if for no other reason, we should care because it's another reason to keep up with current versions of all those 3rd party support files browsers have these days.
Who is John Cabal?
because of its whitelisting feature. Otherwise they would use their browser's built-in ability to turn off Javascript. What percentage of people use a browser that doesn't enable the user to turn off Javascript?
damaged by dogma