Slashdot Mirror
New Site Checks Your Browser's Fingerprint
"Does your web browser have a unique fingerprint? If so your web browser could be tracked across websites without techniques such as tracking cookies..." warns a new site created by the University of Adelaide and ACEMS, adding "the anonymization aspects of services such as Tor or VPNs could be negated if sites you visit track you using your browser fingerprint." AnonymousCube contacted Slashdot about their free browser fingerprinting test suite:
On the site you can see what data can be used to track you and how unique your fingerprint is. The site includes new tests, such as detecting software such as Privacy Badger, via how social media buttons are disabled, and CSS only (no JavaScript or flash) tests to get screen size and installed fonts.
If you're serious about privacy, you might want to test the uniqueness of your browser's fingerprint.
If you're serious about privacy, you might want to test the uniqueness of your browser's fingerprint.
you've known that browser fingerprinting is real and beimg used for years.
i don't ise a browser, i use telnet and type all of my headers by hand.
...If you're serious about privacy, you might want to test the uniqueness of your browser's fingerprint. ...
If you're not serious about privacy, you might want to register your browser's fingerprint with that site. :)
The User Agent sent by my browser (Chrome) gives the web server enough information to adjust the page to my device, would it be a desktop, a mobile phone, or the kind of browser... But my UA gives, among others: 1) exact version of the (Mac) OS a.b.c, 2) exact version of chrome a.b.c.d which is IMO too much info. The OS and Chrome should be limited to 2 numbers a.b. We all remember the infamous IE6 ... with only ONE number the web server had enough information to understand it has to deal with a crappy browser.
Slashdot, fix the reply notifications... You won't get away with it...
I, for one, support our new automated news curated Slashdot overlords
-dk
You don't need to sign everything you write. That little coloured bar above your post has your name on it. Idiot.
panopticlick.eff.org for anyone who hasn't heard of it yet, though I really can't imagine there's a whole lot of people on Slashdot who haven't heard of it...
https://panopticlick.eff.org/
systemd is Roko's Basilisk.
That randomizes these aspects and injects false data so that every query results in a seemingly random fingerprint.
People have talked about browser fingerprints for years, but I haven't heard any solid reports of sites making use of them. For example, news sites that limit you to a few free articles before paywalling you are easily viewed in a private window or with self-destructing cookies.
If this becomes a real issue, then a browser extension that sanitizes and randomizes the fingerprint would defeat the process. Some aspects might be harder to sanitize or randomize than others, but with a bit of effort, fingerprints could be rendered useless.
Maybe this should be the next extension offered by the EFF.
It is a fork of https://panopticlick.eff.org/ and about the same thing with a few more tests. And I am unique on both.
I tested this using the same browser, on the same machine, a number of times. Sometimes using various proxies and other times just straight through. I got a different fingerprint every time.
So they know exactly who you are.
The goal is NOT TO BE UNIQUE.
I still just don't trust it. The US makes me afraid lately. I don't care how much PR they pump into being 'the good guys' their evil as hell and I don't think the rest of the world would shed a tear if the whole place got turned into a glass desert.
Pssh, like that can't be forged.
-dk
I suppose if peoples unique browser fingerprints will be able to be tracked then the next thing is randomized fake browser fingerprints.
Technology always provides.
No idea who is behind this "new" option...but the Electronic Freedom Foundation did (and possibly still does) offer this same service. Sorry- can't remember offhand what it is/was called- and I have no time at the moment. Nor do I have time to research who is behind this latest "service". Still- I would recommend checking EFF first before going with any unknown company...
That test at the "please wait" screen sure looks familiar. I've seen it each time I had to go through 3D Secure. They have a hidden Flash too. I think people have been doing this for a while now.
I see a lot of posts about how to measure the "uniqueness" of your signature. But what (if anything) can be done about it?
Is this a standards issue? Or are there plug-ins that can mitigate some of this?
I "finger printed" my browser and the website reported two different fingerprints. I changed nothing. So the UUID the website says is my fingerprint (by itself) is basically useless for tracking this browser.
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Ironically my privacy add-on uBlock Origin blocked 6 trackers and Ghostery an additional 3. Admittedly Slashdot is even worse.
Neither do we! And it will get worse when one of those two bozos running becomes president. (And keep in mind that a people and a government are different. Some times VERY different.)
I can be less unique if I need to be. More importantly, I can be a different unique person when I really need to be. The trick is remembering to never let unique person A access a forum used by unique person B.
Hey how did you do that?
-dk
It seems that there is some issues with CSS font detection. If to make several fingerprinting attempts then they are all deemed unique. Only difference I see is with (CSS and system) font detection what does find different fonts on each run.
If you're serious about privacy, you've already been modifying your browser's fingerprint for many years.
--- not to mention your OS and system identifiers.
It's been a while since I've seen a site get slashdotted, I guess the death of slashdot is slightly exaggerated.
Use a plugin to rotate the browser agent
This really screws up this type of tracking
EditorDavid is mother fucking FBI.
DO NOT CLICK that site in the summary or you just related your browser and ip in totality to the FBI.
Check timestamps on similar comments.
there are two legit browser fingerprint scanners, and of the two one of them doesn't require javascript.
1) https://panopticlick.eff.org/
2) browserspy.dk
The first one is EFF and fine. No javascript required for basic test.
The second one is sort of hackish, but you want to use NoScript to block gstatic and google-analytics because using browserspy.dk with javascript enabled (required) and not blocking google-analytics and gstatic... does the same thing as the link in this summary. It sends your fucking PC data ... browser fingerprint and IP... to the mother fucking US governmenet. Google is straight up Pentagon. Eric Schmidt is not their custodian.
So.. back to fuck your mama's spies.
It's not a fork, it's been written from scratch, it's just been designed to look similar and implement all the tests the old Panopticlick had.
AC they have via "GCHQ Created Spoofed LinkedIn and Slashdot Sites To Serve Malware" https://news.slashdot.org/stor...
The way out is not be a very interesting person online.
Visit the same news sites, run the same updates. Been repetitive to the same short list of news sites, sports, games is not interesting to the security services.
They want to follow interesting people into newly formed sites, forums, chats, web 2.0 and then get back into their more secure computer usage or get admin rights over larger invite only online groups.
The main issues is collection has to be online as thats all the gov's can collect from. Larger teams in shifts been detected wandering around getting overtime watching one person is an issue in very inward looking communities and many sections of cities.
Domestic spying is now "Benign Information Gathering"
The goal is NOT TO BE UNIQUE.
That's one way to approach the problem. Another way is to be unique on every http request . Did you spot the change-up? The trick is to use browser plugins to vary randomly or add entropy to information returned with each request. For example, randomized user agents, http accept headers, canvas data, plugin and font ordering etc. Any hashing is thus poisoned by spoofing.
Visit the test Web site more than once. If subsequent visits indicate that you remain unique -- that you are the only one out of all visits including your own prior visits -- then you are somewhat safe from tracking. Even better is when it reports inconsistent results from several visits within a short period of time. I did that, and the report was that I was unique twice relative to HTTP_ACCEPT Headers. Also, the Monitor Contrast Level was not the same for two consecutive visits.
I get this result by installing the Secret Agent extension from https://www.dephormation.org.u.... Panopticlick has similar problems characterizing my browser. And various Web sites that attempt geolocation have me all over the globe.
Did you spot the change-up?
No, I'm not clever enough. But you are. Why don't you explain it for us.
The trick is to use browser plugins to vary randomly or add entropy to information returned with each request. For example, randomized user agents, http accept headers, canvas data, plugin and font ordering etc. Any hashing is thus poisoned by spoofing.
Thank you. You are very clever.
Only started recently but I am now doing all my browsing in VM. At the end of the session I shutdown and restore to previous snapshot.
No need to delete cookies or worry about plugins. Only thing to worry about is specific malware that targets and can escape a VM and there are very few of those, in fact most malware detecting a VM with simply shutdown functionality to thwart investigators.
use a plugin to eliminate the user agent seems a better option
Change so much on each visit, that you're unique every time. You will not eliminate all data, but if everything is zero except one identifier, i get you using this one. If everything always changes, i always think i identified somebody new.