Slashdot Mirror

← Back to Stories (view on slashdot.org)

A New Use For Browser Fingerprints: Defeating Spoofing (browserprint.info)

Posted by EditorDavid on from the busted-by-behavior dept.

AnonymousCube writes: Researchers at the University of Adelaide have found a new use for browser fingerprints: uncovering and defeating spoofing by web browsers. By using machine learning on browser fingerprints they were able to correctly guess the OS or browser family of a browser 90% of the time, and defeat operating system and browser family spoofing 76% of the time. This was done with small training sets of less than 1000 fingerprints, so accuracy with a much larger training set, like the size of the EFF's Panopticlick database should give even better results; you can help prove this, and see what their site thinks your browser family and OS is, by submitting your fingerprint to their site.

36 of 64 comments (clear)

  1. You built the better mouse trap. by Opportunist · · Score: 5, Informative

    We now have to evolve the better mouse.

    Dear fingerprinters: It might surprise you, but we don't want this to happen. We want the non-mobile version of your damn webpage on our mobile phone if we go out of our way to pretend we're not on a mobile device. Because guess what: Your mobile version almost invariably sucks and is unusable. Forcing us to use what YOU want us to use instead of allowing us to choose what WE want to choose leads to us not using your service at all.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    1. Re:You built the better mouse trap. by GargamelSpaceman · · Score: 5, Informative

      They can even get you by canvas fingerprinting and web3d fingerprinting where they use various drawing apis to create an image and then send back the checksum of that image to create a fairly unique fingerprint.

      CanvasBlocker sends a fake one, but then they know you are faking it. Or you can shut off access to the api, but then THAT flags you as unique for returning nothing but zeroes.

      I have yet to be able to produce a browser fingerprint that isn't unique using any combination of addons.

      We need some standardization. Then people could download an addon that produces at least the same fingerprint as all other users of that addon giving some space to hide in.

      --
      ...
    2. Re:You built the better mouse trap. by allo · · Score: 2

      > I have yet to be able to produce a browser fingerprint that isn't unique using any combination of addons.
      You do not need to. You just need a fingerprint, which is different *every* time. Instead of being one in a group of 100, you're unique, but you are unique every time you re-visit the site.

    3. Re:You built the better mouse trap. by BarbaraHudson · · Score: 4, Interesting

      Problem is, they can't produce a unique fingerprint for every user's browser. And ANY browser fingerprint can be mimicked - in the end it's just bits and bytes coming down the wire.

      So what if they know you're faking the checksum if millions of other people are faking it as well, and giving different bogus checksums for every page load. Or returning all zeroes, along with millions of other people doing the same? No need for an add-on that produces the same fingerprint as all other users of that add-on. You're overthinking the problem. What are they going to do, block users who don't let their browsers return fingerprints? We saw how well that worked with paywalls and not allowing ad-blockers. People just go elsewhere.

      It's the internet - it was designed to route around such brain-damage.

      --
      "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
    4. Re:You built the better mouse trap. by Some+nick+or+other · · Score: 1

      I have yet to be able to produce a browser fingerprint that isn't unique using any combination of addons.

      How do you tell different w3m or lynx users apart if they spoof their user agents?

    5. Re:You built the better mouse trap. by rudametkin · · Score: 2
      It's actually quite hard to fake fingerprints thoroughly and coherently. There's a whole bunch of different Javascript API's a website can use to obtain fingerprintable data through, and some API's are browser specific or sometimes something simple, like the order of the objects returned, may be browser specific and give you away.

      If you were to spoof coherently, you'd need to ensure that you can defend against all (most) of the attacks that attempt to verify your browser. This would require all kinds of astute manipulations to forge a fingerprint that can't be detected by the server, particularly if your running a different browser than the one you say you are (for example, your on FF but say IE).

      Complete randomization has it's limits too, particularly if your randomly spoofing attributes. You can exhibit a new fingerprint easily, but is that fingerprint coherent (e.g., user agent is in accord with some other attribute, no Chrome API's in your spoofed Firefox browser)? Some sites probably won't care, most may not even check, but fingerprints could be used as an additional security mechanism (e.g., for banks). If the site doubts that you are who you say you are, then they may decide to deny access or require further authentication. Such mechanisms could be helpful against projects like FraudFox.

      In either case, just because the site knows you are spoofing doesn't mean they know the truth nor that they can fingerprint enough attributes to track you over time.

      Plug: We worked on a small prototype that, instead of spoofing, randomly assembled components and generated unique environments using Virtualbox, we also have a docker version that is lighter now. Here's our paper. https://hal.inria.fr/hal-01121...

      We think it's more flexible than Tor since instead of attempting to construct one fingerprint, a user can have trillions. Also, we don't improse any specific browser or version, giving users more choice. Tor however addresses other concerns too that our small project didn't look at (e.g., IP address).

    6. Re:You built the better mouse trap. by Vairon · · Score: 4, Interesting

      By comparing the behavior of the two clients.

      When w3m requests a web page it sends the following:
      GET / HTTP/1.0
      User-Agent: w3m/0.5.3+git20161120
      Accept: text/html, text/*;q=0.5, image/*
      Accept-Encoding: gzip, compress, bzip, bzip2, deflate
      Accept-Language: en;q=1.0
      Host: www.website.com

      When lynx, with a w3m user agent, requests a web page it sends the following:
      GET / HTTP/1.0
      Host: www.website.com
      Accept: text/html, text/plain, text/css, text/sgml, */*;q=0.01
      Accept-Encoding: gzip, bzip2
      Accept-Language: en
      User-Agent: w3m/0.5.3+git20161120

    7. Re:You built the better mouse trap. by Some+nick+or+other · · Score: 1

      I was asking how it could tell different lynxes apart, or different w3ms apart, the way it could tell e.g. Firefox on Linux and Firefox on Windows apart. It doesn't seem possible unless the headers or the response times differ.

      If headers are all that make different text browsers look different, perhaps the developers could talk to each other to make their browser more like one another, to thwart just this kind of privacy invasion.

    8. Re:You built the better mouse trap. by Gr8Apes · · Score: 1

      Obtaining the non-mobile version of a webpage should be as easy as clicking a nice friendly "I want the non-mobile version" button (or vice-versa on a desktop machine... no, wait, that literally never happens because mobile versions invariably suck).

      Except for cnn.com. The mobile site is inherently better because it's actually clean compared to the full site. That doesn't mean the mobile site is great or anything, just that the mobile site sucks less.

      --
      The cesspool just got a check and balance.
    9. Re:You built the better mouse trap. by allo · · Score: 1

      I think we will never ever eliminate the uniqueness of modern browser's fingerprint while keeping its features. You may have the same fingerprint when using something like tails in a VM. But start installing addons and you're changing it.

      But you can try to randomize everything everytime. The problem is, while you may think "i fooled panopticlick to think i am always another unique person", the real fingerprinting service will not only take the full fingerprint, but try to analyse it. Something which is with big data and machine learning easier than ever before. And then they have the four properties, which correlate even while you're constantly changing them in a way, which can be used to fingerprint you again.

      I tried the HTTP-Header stuff from the article about 10 years ago, it could even spot the google bot.
      Now the results are incorrect because i never updated it, my current firefox seems to be an opera (12.x version).
      https://laxu.de/useragent.php

  2. Why would I want to help defeat spoofing? by scrib · · Score: 5, Interesting

    If a user has gone to the trouble of configuring a browser (or plugin) to spoof which browser they are using, why would I want to help researchers circumvent that?

    If there's a good reason to defeat an intentional user choice, I'd love to hear it.

    --
    Help! Help! I'm being repressed!
    1. Re:Why would I want to help defeat spoofing? by TimSSG · · Score: 1

      I just tested the Microsoft Edge Browser and I have never changed the defaults.
      The website responded with
      Your user-agent string specifies your browser as being a variant of CHROME.
      Judging by your fingerprint we believe your browser is a variant of EDGE.

      Tim S.

    2. Re:Why would I want to help defeat spoofing? by scrib · · Score: 1

      Are you saying that browser spoofing is equivalent to falsifying credentials? That would be a frightening precedent...

      --
      Help! Help! I'm being repressed!
    3. Re:Why would I want to help defeat spoofing? by allo · · Score: 1

      > But you are not, however, free to falsify your credentials
      Of course you are. Because most ToS do not include anything about browser modifications or even any requirements which browsers you are allowed to use.

    4. Re:Why would I want to help defeat spoofing? by BarbaraHudson · · Score: 2

      Next you'l be claiming that a person must own an 80" XHD TV because the content producer has the right to display their content in the manner in which they intended. You're full of shit.

      If they were supplying the internet connection, the computer, and the electricity, they still wouldn't have that right, because what happens in my home is my business, not theirs.

      And in case you haven't noticed, people already have decided to "go elsewhere" when sites insist on blocking ad blockers (and most of the blocks are pitifully easy to get around) or putting stuff behind a paywall.

      Anonymous Coward is a moron. Don't be like Anonymous coward. Don't be a moron.

      --
      "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
    5. Re:Why would I want to help defeat spoofing? by sjames · · Score: 1

      No, it isn't. Especially on the web where it is well known that screen sizes vary and many browsers are in use.

      But even print publishers have no right to demand specific lighting, lack of tinted glasses, or even that I not cut the ads out before I read it. I can even black out teeth and add horns to people in the pictures if that amuses me.

    6. Re:Why would I want to help defeat spoofing? by wtfbill · · Score: 1

      "Not free to falsify credentials" says the guy who comments as AC. How ironic, or is that your real name? I have TOS too: stop trying to thwart my desire to have some modicum of privacy, or we can't do business.

    7. Re:Why would I want to help defeat spoofing? by Gr8Apes · · Score: 1

      Now, as the Devil's Advocate, my argument is that if these researchers can beat browser fingerprinting, it's only a matter of time before a well-funded advertiser does the same, possibly in secrecy. By making their research openly accessible, the people who make spoofing plugins get a chance to harden their software before this next-gen fingerprinting tech becomes common among advertisers.

      That's not a Devil's Advocate argument. That's reality. Ideally, with randomized headers and a 2 or 3 hop Tor base implementation, all advertiser tracking could end tomorrow. (3 letters could obviously still easily track a 2 or 3 hop Tor implementation)

      --
      The cesspool just got a check and balance.
    8. Re:Why would I want to help defeat spoofing? by Gr8Apes · · Score: 1

      It is the content producer's right to display their content in the manner in which they intend

      It is, and if they wish to control display, then publicly served HTML is not the way to go.

      --
      The cesspool just got a check and balance.
    9. Re:Why would I want to help defeat spoofing? by sp0tter · · Score: 1

      this should have more points

      --
      you don't eat crackers in the bed of your future--or else you'll get all scratchy
  3. double plus ungood by Anonymous Coward · · Score: 4, Informative

    You do not call it "fighting spoofing". You must call it "reducing privacy, usability and anonymity". Doesn't sound so good now, does it?

  4. Running Firefox with NoScript by TimSSG · · Score: 1

    I am running Firefox 45.9.0 with NoScript and the site thinks it is IE.
    Tim S.
    Your user-agent string specifies your browser as being a variant of FIREFOX.
    Judging by your fingerprint we believe your browser is a variant of IE.

    1. Re:Running Firefox with NoScript by BarbaraHudson · · Score: 1

      Really screw them over. Fix it so that it thinks it's IE4.

      --
      "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
  5. Palemoon and some addons solve all lifes problems. by Xenolith0 · · Score: 1

    Palemoon + Addons:
    Cookie Monster - https://addons.mozilla.org/en-...
    RequestPolicy - https://addons.mozilla.org/en-...
    NoScript - https://addons.mozilla.org/en-...
    Secret Agent - https://www.dephormation.org.u...
    No java, no flash. Good luck finger printing that.

  6. Re:UA Spoofing for web devs by Z00L00K · · Score: 1

    Only the ad companies really likes to know which browser you have so that they can force their ads upon you depending on browser by exploiting the specific vulnerabilities.

    --
    If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
  7. Pair digital fingerprinting with AI and Internet p by TheOuterLinux · · Score: 1

    I've said this too many times, and I really don't know what to write that would be a thoughtful comment. All I know to do for now, and have done for nearly a decade, is use VPN, Tor, and DNSCrypt, and hope that all I've done so far will be enough to mud-up things, at least for a while, for when it gets really bad. The Internet used to be like the U.S. was in its infancy, a self-reliant frontier of sorts, and now we're are all statistics once again to be ruled and manipulated by governments that don't know what they're doing because the banking puppet strings are wrapped around too tight. Every so often, humanity is required to go through a "transcendental" phase in order to prevent catastrophe brought by too much change at once. One of the best ways to have done this is through cultural exchange. Unfortunately, leaders keep deciding to let this transcendence happen after wars or international economic gain. The Internet could provide a safe and anonymous way of doing this, but not anymore. The only reason there hasn't been a major war in while, regardless of the who's in charge right now, is because everyone with a social media account has been conditioned to be compliant. You know how your grandparents react when they have to pay for water? Look at the current generation now.

  8. doesn't work without running their payload by Anonymous Coward · · Score: 1

    I tried it. It pops up a page that says "Please wait..." with an icon to "Get Adobe Flash". That's it.

    So yet again, it's a malicious technique that only works with the active cooperation of the target. Do not volunteer to run malicious payloads, and you are apparently safe from this.

    1. Re:doesn't work without running their payload by mi · · Score: 1

      It does not require Flash for most of the functionality. My browser does not have Flash installed, and it told me quite a bit about my environment anyway. It does need JavaScript, but that's enabled for most people, because a vast number of sites break without it.

      --
      In Soviet Washington the swamp drains you.
    2. Re:doesn't work without running their payload by Anonymous Coward · · Score: 1

      It does need JavaScript,

      But it's javascript that leaks so much identifying information. Once you enable javascript, you have lost the battle pretty much no matter what you do.

      The best approach is probably a combination of things. Use javascript on a strict whitelist basis, not by default. Whitelist sites you trust that need it for something real. Block all other javascript. That will VASTLY reduce the number of bits of entropy that you leak to web sites, and still let you use your bank and so on.

      Sites break with JS because the public has taught those sites that it's OK to depend on it. We need to teach them otherwise, or this will only accelerate.

  9. Now we need a spoofing AI by Visarga · · Score: 1

    Now we need a spoofing AI to defeat the anti-spoofing AI, thus recovering our privacy.

  10. Re:This makes zero sense.. by PPH · · Score: 1

    University of Adelaide

    It's an ex-prison colony. They probably like searching your prison cell at random times just out of habit.

    --
    Have gnu, will travel.
  11. Needs work... by mi · · Score: 1

    Though my User-Agent header clearly says: "FreeBSD", the site claimed, my OS is "likely Windows" :)

    Other than that, yes, it is quite amazing, how much info is available to the JavaScript code...

    --
    In Soviet Washington the swamp drains you.
  12. It guessed mine wrong by ITRambo · · Score: 1

    Using Sandboxed Opera (Sandboxie) and Opera's built in VPN, it guessed my browser was Chrome.

    1. Re:It guessed mine wrong by DERoss · · Score: 1

      Me too.

      I tried Browserprint twice just now. Each time, it gave a different browser, none of which were correct. In one case, it even responded that I was using a Mac; but I am using a Windows PC.

      How did I defeat it? It was simple. I have Secret Agent from https://www.dephormation.org.u... installed.

      Browserprint is not new. I first tried Browserprint almost a year ago. I have also tried Panopticlick several times. Secret Agent always defeats the attempt to identify my browser.

  13. Re:UA Spoofing for web devs by Wootery · · Score: 1

    But they do it for a reason: their short-term bottom-line. It's a tragedy-of-the-commons situation.

    Each ad company benefits by being scummy. It harms the ad ecosystem overall, and wouldn't happen if there was a monopoly where only one ad company existed.

  14. Re:UA Spoofing for web devs by Merk42 · · Score: 1

    If you're still looking at user agents instead of feature-support, you're doing it wrong.