Slashdot Mirror
Fingerprinting Methods Identify Users Across Different Browsers On the Same PC (bleepingcomputer.com)
An anonymous reader quotes a report from BleepingComputer: A team of researchers from universities across the U.S. has identified different fingerprinting techniques that can track users when they use different browsers installed on the same machine. Named "cross-browser fingerprinting" (CBF), this practice relies on new technologies added to web browsers in recent years, some of which had been previously considered unreliable for cross-browser tracking and only used for single browser fingerprinting. These new techniques rely on making browsers carry out operations that use the underlying hardware components to process the desired data. For example, making a browser apply an image to the side of a 3D cube in WebGL provides a similar response in hardware parameters for all browsers. This is because the GPU card is the one carrying out this operation and not the browser software. According to the three-man research team led by Assistant Professor Yinzhi Cao from the Computer Science and Engineering Department at Lehigh University, the following browser features could be (ab)used for cross-browser fingerprinting operations: [Screen Resolution, Number of CPU Virtual Cores, AudioContext, List of Fonts, Line, Curve, and Anti-Aliasing, Vertex Shader, Fragment Shader, Transparency via Alpha Channel, Installed Writing Scripts (Languages), Modeling and Multiple Models, Lighting and Shadow Mapping, Camera and Clipping Planes.] Researchers used all these techniques together to test how many users they would be able to pin to the same computer. For tests, researchers used browsers such as Chrome, Firefox, Edge, IE, Opera, Safari, Maxthon, UC Browser, and Coconut. Results showed that CBF techniques were able to correctly identify 99.24% of all test users. Previous research methods achieved only a 90.84% result.
Someone tell me why a browser needs to tell this stuff to the Internet?
So it will be easier for the travel industry to keep track of you and keep the prices up for the places you have been looking at information for, even when you try to use different browsers, ip adresses etc?
I guess now we need a bunch of VMs with different distros on them or something. This is really getting tiring.
Btw, I bet javascript was used to pull all these variables somehow.
What benefit does using a HOSTS file have over using a plugin to block JS/tracking shit/ads/etc?
Is the HOSTS file more dependable? Is the HOSTS file faster?
Unplug your computer from the Internet...
I really think that is the only way.
But then you still have all the public surveillance, credit cards, wifi, cell towers and who knows what else tracking you.... so.... good luck.
My eyes reflect the stars and a smile lights up my face.
Browsers should present a "generic" capabilities list to web sites unless the user white-lists that site to receive some or all of the "real" capabilities. An online video-gaming site may need to know if I can play a GPU-intensive online game through the web browser, but very few other sites need to know.
For example, "generic capabilities" would be:
Screen size would be "small" for tablets, phones, and small notebooks, or "normal" for everything else. Pixel density would not be disclosed.
"List of fonts" would be the most common "web fonts" in the main language of the operating system.
As for the rest, they would be shown as "not disclosed."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Someone that has advanced personal knowledge of this should definitely chime in about the glories of the HOSTS file over all other options.
What I always wonder is why Mozilla isn't doing more to protect user privacy. This is one thing that could really differentiate them from Chrome and other browsers.
I always hear from Mozilla supporters that Firefox is already "the best" when it comes to this. But the summary claims that Firefox is affected by these methods.
Then there are problems like how Firefox includes "telemetry" support that can be disabled, but it can't be easily removed completely. This should be opt-in, in the sense of the functionality not even being present unless you download a special non-default build that includes it. Yeah, that means Mozilla likely won't get as much user data to mine. That's the whole point, though: the browser shouldn't unnecessarily share data with anyone, including Mozilla. It's not like whatever data they've been collecting so far has done them any good; Firefox's share of the market is continually dropping as users get more and more disappointed with its awful user experience. All of the smart Firefox users (the ones being driven away) likely already disabled "telemetry", so they're probably already basing their decisions on incomplete data from the dumbest Firefox users.
It also doesn't help that they're so eager to include all of this unnecessary Web 2.0 and HTML5 functionality that lets websites track your location, or use your microphone, or other nonsense like that. This is the kind of crap that has one purpose only: providing personal data to advertisers. Any other use case is better handled by non-browser applications.
User privacy is one area where Firefox could really shine. It's perhaps the one thing that could really draw users back from Chrome, Edge, Safari, and the other browsers they've moved to after Firefox's user experience went to hell. Yet what the Firefox devs have done in this direction so far has been uninspiring.
Some kind of VM with one browser in it and a good VPN on a router?
Domestic spying is now "Benign Information Gathering"
The game site does not need to know what your capabilities are. If you try to run it, and it doesn't work, you don't try again. It doesn't need to know *any* of the fonts or even font-families you have installed, it just needs to do what the web has always done; Present a list of fonts the site designer would like the browser to use, if they are available and the user allows it. No site needs to know even the simple small/med/large screen size, as that can all be (and usually is) handled entirely within the browser via CSS.
Give them even less info than you propose and it'll still be too much, generally speaking.
Wake me up when we're able to fingerprint the same user across different devices. *That* will be freaky - and, admittedly, will interest me as a marketer.
Which is why I have a whole house DNS server that redirects to a catchall Nginx server that returns a 204.
woosh
The VAST majority of fingerprinting and most of the useful stuff relies on whoever is doing the fingerprinting running their javascript in your browser (client). Using something like NoScript to block javascript by default and limiting what you allow is quite effective at fighting fingerprinting.
Definitely not a magic bullet but it's super helpful for this and lots of other web annoyances.
Plus, you get to learn just how much useless javascript most sites want you to run (3rd party that has no impact on functionality)
I KUT J00 M4NG!!!
Have a look at ffprofile.com to generate a secured profile. Look at the github page to extend the site for more un-features.
nope, you should not.
0.0.0.0 means "use a random* ip of the system".
Your should either use 127.0.0.1 (and make sure NOT to run a webserver on your host) or some unroutable ip.
* depending on the order of network interfaces.
You can have multiple individuals using the same PC.
I'm aware that multihead is possible with multiple graphics cards on an X11/Linux box.. But I thought home versions of Windows, the most popular operating system for desktop and laptop computers in the industrialized English-speaking world and therefore probably the most interesting to the marketing industry, were locked down to support only one desktop session at once.
Or perhaps you meant one at a time. Previous comments such as this one seem to indicate that multi-PC households are more common than family members taking turns on separate user accounts on the same PC. Furthermore, multi-PC households are more attractive to the marketing industry because they are more likely to be affluent enough to buy what the marketers are pushing.
Nope. Just open two terminals:
$ nc -vlp 2000 #first terminal
$ nc 0.0.0.0 2000 # second terminal
listening on [any] 2000 ...
connect to [127.0.0.1] from localhost [127.0.0.1] 47888