Slashdot Mirror
Tor Users Can Be Tracked Based On Their Mouse Movements (softpedia.com)
An anonymous reader writes: The way you move your mouse is unique, like fingerprints, and can be used by dark forces to track you on supposedly anonymous and secure networks like Tor, according to a Barcelona researcher. Because the Tor Project has failed to address a ten-month-old issue regarding "time measurement via JavaScript," there are a series of user fingerprinting techniques that are quite accurate at identifying users based on their mouse movements, scrolling speed, and how their browser and hardware reacts to certain JavaScript code. If a user visits a "fingerprinting" website via Tor and then via a normal browser, an attacker can have a general idea about their identity and can even pinpoint them to real IPs. The data that is usually logged in fingerprinting schemes is not 100% reliable or accurate for that matter, but it provides a starting point for future investigations.
Start using a trackpad when you use websites you don't wanna be tracked on. Oh and maybe reduce your browser's processor priority so it reacts differently to their time based snooping. Oh and first post maybe?
This one of the reasons why they should have never left noscript off by default.
Minimum threshold fixed. Thanks!
"time measurement via JavaScript,"
There's like a dozen betters ways to track someone using javascript.
If a tor user has javascript on, they should assume they're not anonymous.
internet access.
They should close the internet and put up a for sale sign.
Good luck catching pedophiles with that.
APK is that you?
By the way you keep cross posting this, one would think that MS has patented the HOSTS file or something.
You know, there are LOTS of little things that are particular to a particular person that can ID you if tracked. You can be tracked by your farts is the peroper telemitry is in place. Mouse movments? I choose not to be that paranoid.
If you want news from today, you have to come back tomorrow.
I know nothing, but doesn't The Official Tor Browser have NoScript enabled by default?
- Change hands every so often
- Manually alter your mouse's tracking and acceleration settings to different values before starting Tor
#DeleteChrome
Replace your mouse pad with rough sandpaper, randomly rotate sandpaper before a new session. The spooks will be looking for a group of terrorists with Parkinson's disease, plus it keeps your mouse feet clean!
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
so this probably won't work on me! The mouse movement is so jerky and unreliable that there's no way the readings could be reliable.
So i don't understand yet why one cares about this attack. I can see edge cases but I'm not sure I see the main threat but this may be due to my ignorance about how ToR works.
Here's the issue. Suppose the user visits the following three web sites.
1. Mao Mao Mao, via tor, a site secretly run by the chinese military that fingerprints Tor User
2. Falun Gong Spy Network using tor, but not controlled by the chinese miltary
3. Communist party phone directory, not on Tor but using fingerprinting.
So clearly they can connect 1 and 3. But how can they spot 2? And it's only 2 they care about.
The edge case would be if they were to run some entrapment site that was offering illicit reading material that would attract Falun Gong curious people. Then they could ID these wanna-be thought crimminals. But I don't see how they are going to spot the people visiting the hard core (site 2) site.
Some drink at the fountain of knowledge. Others just gargle.
The likelihood of this being used in any real life situation/court seems pretty low. Technically it is an exploit, but for practical purposes it's not really an exploit.
Ubercookie did a poor job as reconnecting my identities when surfing in normal and private modes. Only two numbers in clientRect match, everything else is different.
Well, I guess it's time to write a jitter plugin for Chrome. It's going to make using the browser with jitter enabled sort of like trying to perform a delicate operation after five or six beers, but without the false confidence, or everything's-funny, added benefits of beer...
The one guy using Tor with Parkinson's is going to have a lot of problems pretty soon.
Problem solved.
Only an idiot would activate javascript white using tor.
The Tor Browser, by default, does not use any form of javascript.
I heard it's hella tite.
I don't know who's dumb enough to be surprised that any technology can singularly solve a problem as large as privacy.
Tor solves the network connection problem, moderately well. There's more to privacy than that, and it's ridiculous to expect Tor to solve that all by itself.
Big surprise! If you use tor to log into facebook, facebook knows who you are! Where's the outrage?!?!
Care about electronic freedom? Consider donating to the EFF!
While mouse movements (and typing speed, and word length statistics, and a variety of other things) are not too bad for authentication (e.g. verifying you are who you say you are), they're not very good for identifying a person from a database of a lot of people.
For authentication, mouse dynamics, typing dynamics, prosody, etc. are all about 80% for "equal error rate".. that is about 10% of the time it will authenticate someone else as you, and about 10% it will reject you. So they work great for stuff like preventing you from "loaning" your porn password to your friends. They don't mouse or type like you, most of the time.
But if you're doing "who is this", against a database of thousands of people, you're going to get tons of false hits.
I use a laptop. I like my laptop in my lap, my mouse movements probably have 2-3 patterns (just got up, working on the first coffee, been up a while). Then my cat discovers my lap and the laptop moves to some combination of my right leg (stupid cat insists my left leg is the only one worth sleeping on) and my right armchair leg. It changes every time the cat jumps up, as I'm reminded every time I use fingerprint recognition to login.
When in the office, did I ride my bike to work or drive? Cafeteria opens at 8, have I had breakfast yet or not? Did I push myself climbing Lusk or just put my head down and grind? Did I drink too much last night and drove like grandma, or drive like normal?
And yeah, in my web browsers JS is disabled by default, ads are blocked, and Java isn't installed.
and how their browser and hardware reacts to certain JavaScript code
You just need a browser plug-in to inject perlin noise into the coordinates that javascript sees.
At a previous job I worked on mouse prediction for precaching and thought "There's no way this can ever be used for evil!"
i know it was you, you're the only left handed badger fetishist in the office!
What do you mean there are others?!
Okay, now that's just creepy and more than a little unsettling.
Just cruising through this digital world at 33 1/3 rpm...
Until a court rules that a subpoena can be granted based on an algorithmic computation of a fingerprint based on mouse movements, cpu behaviours and.... by this time the judge has tuned out and thrown your geek ass out of court.
It is all subject to court interpretation. And judges (unless you shop them well) tread lightly on technical stuff they do not understand. Who wants a record of granting warrants which are later overturned.
Even if he did grant this, you would likely toss the warrant on appeal and all the fruit from this search will be thrown out as you can argue the mouse movement "fingerprint" is not personal identifying information.
just sayin'...
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
some ibbs users complain about using certain images, maybe imaging robots seek specific topics by a given type of image.
Why are people running javascript in their tor browsers again? That shit should be disabled, there are too many vectors to reveal your identity to ever "safely" use javascript whilst attempting to achieve anonymity.
That was needed because the FBI at the time was corrupt but Capone had not thought of bribing the IRS.
Others such as the scientologists have taken care of that angle as well as the law enforcement angle.
use mouse on the other hand to when using tor.
right handed use left hand when using tor.
i knew drawing imaginary swasticas while browsing web pages would be my undoing!
also signing off with
hitler did nothing wrong
is probably problematic aswell
I thought the Tor browser's default state had javascript disabled by default, so this vulnerability should only affect Tor users who deviate from the default settings (or use a different browser). Perhaps one mitigation would be to use a vim-like plugin that lets you follow links from the keyboard, though this would only be effective if a lot of people did it.
I imagine I would be identified by my hardly using the mouse. I tend to use the keyboard unless I have to use the pointer. In addition, if I had a touchscreen, I would be using that where possible. But the basic fix in the browser is something like we see with Android, but on a per-site basis: if your javascript wants access to timing information, it needs explicit permission.
John_Chalisque
How about us geeks who always browse the TOR network using "Noscript"?
You realize that "noscript" thing that's on by default keeps javascript from running, which in turn keeps javascript from tracking you this way. If requiring intentional disabling of that feature wasn't enough, as i recall, there is a warning about scripts on startup. It's about as well addressed as a vulnerability can be.
Also, don't visit the same sites with and without tor. And disable javascript wherever possible. The FBI has injected javacsript malware into many sites (including slashdot!) to exploit browser bugs and break security. Actually, slashdot works better without javascript!
Just write a script that randomizes your mluses sensitivity every second or so. That shksho hld throw off your style enough to not allow tracking.
Tor users can be identified by the way they walk
you know one for poop, the other for food and hand shacking
just keep in mind that they can still relate your anonymous sessions