Top sites (and maybe the NSA) track users with “device fingerprinting”

lotuseclat79 · Oct 14, 2013

Top sites (and maybe the NSA) track users with “device fingerprinting”.

May make it easier to follow privacy-minded users on the darknet.
Click to expand...

FPDetective: Dusting the Web for Fingerprints (PDF: 346.6 KB).

By reading the PDF paper, there is a Firefox proof-of-concept add-on named Firegloves available to impede fingerprinting-based tracking while maintaining browsing experience.

Cross-browser fingerprinting test 2.0.

Firegloves.

Preventing misuses and misapprehensions of FireGloves. (followup: FireGloves is no longer being developed according to developers, and caused Font size webpage corruption problems for me)

-- Tom

Snoop3 · Oct 11, 2013

i'm wondering why their lawyers advised them not to disclose the sites using device fingerprinting.

J_L · Oct 11, 2013

Those sites will be likely to reconsider their relationship with the NSA after the public backlash.

mattdocs12345 · Oct 11, 2013

Hmmm so how do we counter this? Run Windows XP in VM with Internet Explorer?

Snoop3 · Oct 11, 2013

shouldn't be too difficult to design a batch file or script or small program that effectively gives you a randomized portable disposable browser. it should delete random 5-10% of (lesser used) available fonts, select randomly from the thousands of user agents available, and also install some random 5 or so low impact or no impact extensions so that you'd have a different fingerprint each time. then on exit it deletes browser folder and the cookie and temp files it may have added to in the OS drive, or run it sandboxed. also it should drop in custom user.js file for the config settings, maybe the user chooses from 3 or so different ones depending the level of privacy and security desired. same thing with the extensions installed, just select from an local cache of the XPI files.

i'm wondering why nobody has done this yet. seems like it would be pretty easy to do for a programmer.

mirimir · Oct 13, 2013

Hey, I don't mind device fingerprinting, because any particular device only gets used for stuff that I don't mind associated.

As long as they can't fingerprint VM hosts, I'm OK.

For stuff that I really don't want linked, I do use different hosts.

MrBrian · Jan 15, 2014

Cookieless Monster: Exploring the Ecosystem of Web-based Device Fingerprinting (paper)

Abstract

The web has become an essential part of our society and is currently the main medium of information delivery. Billions of users browse the web on a daily basis, and there are single websites that have reached over one billion user accounts. In this environment, the ability to track users and their online habits can be very lucrative for advertising companies, yet very intrusive for the privacy of users.

In this paper, we examine how web-based device fingerprinting currently works on the Internet. By analyzing the code of three popular browser-fingerprinting code providers, we reveal the techniques that allow websites to track users without the need of client-side identifiers. Among these techniques, we show how current commercial fingerprinting approaches use questionable practices, such as the circumvention of HTTP proxies to discover a user’s real IP address and the installation of intrusive browser plugins.

At the same time, we show how fragile the browser ecosystem is against fingerprinting through the use of novel browser-identifying techniques. With so many different vendors involved in browser development, we demonstrate how one can use diversions in the browsers’ implementation to distinguish successfully not only the browser-family, but also specific major and minor versions. Browser extensions that help users spoof the user-agent of their browsers are also evaluated. We show that current commercial approaches can bypass the extensions, and, in addition, take advantage of their shortcomings by using them as additional fingerprinting features.
Click to expand...

MrBrian · Jan 15, 2014

Correct link for first link in first post is http://arstechnica.com/security/201...e-nsa-track-users-with-device-fingerprinting/.

MrBrian · Jan 15, 2014

Correct link for third link in first post is http://fingerprint.pet-portal.eu/?lang=en.

MrBrian · Jan 15, 2014

From 2nd link in first post:

An intriguing case is that of Anonymizer, a paid anonymization service that ﬁngerprints every visitor accessing their homepage and has a set of ﬁngerprinting scripts that include function names such as submitDnsInfoViaAjax, getClockSkew, getJsFontList and connectViaSocket.
Click to expand...

MrBrian · Jan 15, 2014

Tracking and Fingerprinting in E-Business: New Storageless Technologies... (paper)

From the paper "Tracking and Fingerprinting in E-Business: New Storageless Technologies and Countermeasures" (found at http://gulyas.info/):

Abstract

Online user tracking is a widely used marketing tool in e-business, even though it is often neglected in the related literature. In this chapter, the authors provide an exhaustive survey of tracking-related identification techniques, which are often applied against the will and preferences of the users of the Web, and therefore violate their privacy one way or another. After discussing the motivations behind the information-collecting activities targeting Web users (i.e., profiling), and the nature of the information that can be collected by various means, the authors enumerate the most important techniques of the three main groups of tracking, namely storage-based tracking, history stealing, and fingerprinting. The focus of the chapter is on the last, as this is the field where both the techniques intended to protect users and the current legislation are lagging behind the state-of-the-art technology; nevertheless, the authors also discuss conceivable defenses, and provide a taxonomy of tracking techniques, which, to the authors’ knowledge, is the first of its kind in the literature. At the end of the chapter, the authors attempt to draw the attention of the research community of this field to new tracking methods.
Click to expand...

MrBrian · Jan 15, 2014

From paper "User Tracking on the Web via Cross-Browser Fingerprinting" (found at http://gulyas.info/):

Abstract

The techniques of tracking users through their web browsers have greatly evolved since the birth of the World Wide Web, posing an increasingly significant privacy risk. An important branch of these methods, called fingerprinting, is getting more and more attention, because it does not rely on client-side information storage, in contrast to cookie-like techniques. In this paper, we propose a new, browser-independent fingerprinting method. We have tested it on a data set of almost a thousand records, collected through a publicly accessible test website. We have shown that a part of the IP address, the availability of a specific font set, the time zone, and the screen resolution are enough to uniquely identify most users of the five most popular web browsers, and that user agent strings are fairly effective but fragile identifiers of a browser instance.
Click to expand...

TomAZ · Jan 15, 2014

Secret Agent may be of some value as well. Works well most of the time, but you may run into a little trouble on some sites. Those sites can be whitelisted if desired.

MrBrian · Jan 15, 2014

Another fingerprint test site: hxxp://noc.to

Techwiz · Jan 15, 2014

MrBrian said:

Another fingerprint test site: hxxp://noc.to
Click to expand...

@MrBrian,

Thanks for sharing this very informative site. I was comfortable with my current setup, but after checking this site out I feel even better. Took quite a bit of sabotage on my part to leak anything even remotely revealing about my system.

MrBrian · Jan 16, 2014

Techwiz said:

@MrBrian,

Thanks for sharing this very informative site. I was comfortable with my current setup, but after checking this site out I feel even better. Took quite a bit of sabotage on my part to leak anything even remotely revealing about my system.
Click to expand...

You're welcome . I got that link from http://en.wikipedia.org/wiki/Device_fingerprint.

Be aware though that, according to one (or more) of the above papers, commercial solutions may use techniques that these test sites don't. From the 5th link in the 1st post (my bolding):

One of the main things why FireGloves gained visibility, that it is the only known extension of its kind. This is because fighting fingerprinting is not easy, and several aspects of protection need to be considered. Which is perhaps too much for a single extension. Secondly, probably because the achievements of FG on fingerprinting tests can be misleading (both on the Panopticlick and Fingerprinting 2.0 tests). For instance, in this video it is demonstrated that FG decreases traceability greatly. In fact, what is shown is that it is possible to protect ourselves against the vulnerabilities what these tests (and fingerprinting trackers at those times) exploited. However, fingerprinting techniques evolved since these tests were created. Thus to have an up-to-date protection FG would have also needed to be upgraded constantly.
Click to expand...

MrBrian · Jan 16, 2014

From paper "Fast and Reliable Browser Identification with JavaScript Engine Fingerprinting" (direct link: hxxp://www.w2spconf.com/2013/papers/s2p1.pdf ):

Abstract

Web browsers are crucial software components in today’s usage of the Internet, but the reliable detection of whether a client is using a specific browser can still be considered a nontrivial problem. Reliable browser identification is crucial for online security and privacy e.g., regarding drive-by downloads and user tracking, and can be used to enhance the user’s security. So far the UserAgent string is often used to identify a given browser, but it is a self-reported string provided by the client and can be changed arbitrarily.

In this paper we propose a new method for identifying web browsers based on the underlying Javascript engine, which can be executed on the client side within a fraction of a second. Our method is three orders of magnitude faster than previous work on Javascript engine fingerprinting, and can be implemented with well below a few hundred lines of code. We show the feasibility of our method with a survey and discuss the consequences for user privacy and browser security. Furthermore, we collected data for more than 150 browser and operating system combinations, and present algorithms to make browser identification as fast as possible. UserAgent string modifications become easily detectable with JavaScript engine fingerprinting, which is shown exemplarily on the Tor browser bundle as it uses a uniform UserAgent string across different browser versions. Finally, we propose to use our results for enhancing state-of-the-art session management (with or without SSL), as reliable browser identification can be used to increase the complexity of session hijacking attacks considerably.
Click to expand...

MrBrian · Jan 16, 2014

From paper "XSS-FP: Browser Fingerprinting using HTML Parser Quirks" (direct link: hxxp://arxiv.org/pdf/1211.4812 ):

Abstract

There are many scenarios in which inferring the type of a client browser is desirable, for instance to fight against session stealing. This is known as browser fingerprinting. This paper presents and evaluates a novel fingerprinting technique to determine the exact nature (browser type and version, eg Firefox 15) of a web-browser, exploiting HTML parser quirks exercised through XSS. Our experiments show that the exact version of a web browser can be determined with 71% of accuracy, and that only 6 tests are sufficient to quickly determine the exact family a web browser belongs to.
Click to expand...

Compu KTed · Jan 17, 2014

The IP check is a free and easy understandable anonymity test. The test shows at a glance
which attacks a website may launch on your privacy. Moreover, you get recommendations for
possible counter measures. It explains which data your own web browser sends to websites.
A website may use this data to create an individual profile. By misusing such a profile,
you may later get identified reliably on this or on another website.

http://ip-check.info/description.php?lang=en

MrBrian · Jan 20, 2014

Table 1 in the paper in post #7 shows features used by Panopticlick vs. those of three fingerprinting companies.

MrBrian · Jan 20, 2014

From paper "Searching for Indicators of Device Fingerprinting in the JavaScript Code of Popular Websites" (2013) (direct pdf hxxp://www.truststc.org/education/reu/13/Papers/RauschM_Paper.pdf ):

Abstract

Over the years a number of studies have investigated online tracking using cookies. Individuals and organizations are becoming aware of this form of tracking and are taking steps to protect their privacy by deleting and blocking third party cookies. In response, some companies have developed a form of tracking known as device fingerprinting that does not rely on cookies to identify a user. Fingerprinting could potentially override a user’s attempts to prevent tracking.

In this paper we attempt to determine the prevalence of device fingerprinting by crawling the 1000 most popular sites on the internet in the United States as ranked by Quantcast searching for JavaScript code that could be used to fingerprint devices. We identified characteristics of code used to track devices from companies known to engage in device fingerprinting and counted how many sites used similar code. We found that less than 6% of websites surveyed contained such code. In addition, only six domains in our sample contained code from the three commercial fingerprinting companies we studied.
Click to expand...

MrBrian · Jan 20, 2014

From paper "Host Fingerprinting and Tracking on the Web: Privacy and Security Implications" (2012):

[Abstract]

Many web services aim to track clients as a basis for analyzing their behavior and providing personalized services. Despite much debate regarding the collection of client information, there have been few quantitative studies that analyze the effectiveness of host-tracking and the associated privacy risks.

In this paper, we perform a large-scale study to quantify the amount of information revealed by common host identifiers. We analyze month-long anonymized datasets collected by the Hotmail web-mail service and the Bing search engine, which include millions of hosts across the global IP address space. In this setting, we compare the use of multiple identifiers, including browser information, IP addresses, cookies, and user login IDs.

We further demonstrate the privacy and security implications of host-tracking in two contexts. In the first, we study the causes of cookie churn in web services, and show that many returning users can still be tracked even if they clear cookies or utilize private browsing. In the second, we show that host-tracking can be leveraged to improve security. Specifically, by aggregating information across hosts, we uncover a stealthy malicious attack associated with over 75,000 bot accounts that forward cookies to distributed locations.
Click to expand...

MrBrian · Jan 20, 2014

From thesis "Browser Fingerprinting" (2012) (direct pdf hxxp://publications.lib.chalmers.se/records/fulltext/163728.pdf ):

Abstract

Tracking Internet users have several purposes; for example preventing online fraud or measuring and analysing online advertisements. The most common current methods for tracking users involve storing unique identifiers locally on the user’s device, a method which may be restricted by law in the future. This thesis examines the possibility to replace such methods with the method of browser fingerprinting.

A browser fingerprint is a composition of information gathered from a web browser. Using data from several sources, we have analysed which features to extract to create a unique fingerprint. Within the scope of machine learning, we have designed online algorithms which can be used for telling Internet users apart by their browser fingerprints. The results from these algorithm show that if the data is preprocessed and partitioned adequately, users can be identified with high accuracy over time periods spanning over several days, even weeks in some cases.

Based on our analysis, we can conclude that machine learning is a promising approach for solving the problem of telling Internet users apart and that extremely naive solutions are sufficient, in certain applications.
Click to expand...

MrBrian · Jan 20, 2014

Fingerprinting, CDI & How to Deal With It

I've come to the conclusion that fighting device fingerprinting is futile. I'm now in the same camp as the author of the above link and mirimir: things you don't want linked should be done in separate instances of operating systems, each with a different type of browser. Depending on how you do this, the different operating systems might or might not use the same IP address. So maybe you'd have the following:
operating system #1: activities that involve your real name, or anything that might be linked to it already (email addresses, etc.)
operating system #2: any "interesting" activities
operating system #3: everything else

MrBrian · Jan 21, 2014

From Browser Fingerprinting: 9 Facts:

But Acar noted that not all tracking technology can be detected by tracking monitoring software such as Ghostery or NoScript. "Ghostery has a big database of trackers, if they add the ones we found to their databases Ghostery can block some of them," he explained. "Still, there are ways to circumvent these protections, like serving the same script from different addresses." In addition, he said, "NoScript can block some fingerprinters -- depends on the configuration."

[...]

Furthermore, tracking firms still have many more tracking techniques available to them, should they decide to use them. "There are ways to fingerprint devices without JavaScript or Flash. Clock skew, network packet fingerprinting and our attack on Tor Browser -- scriptless font fingerprinting -- are examples for passive fingerprinting techniques," said University of Leuven's Acar. "These techniques I'd refer to as really, really stealthy compared to JavaScript or Flash-based fingerprinting. They don't require any client-side code to run and are very hard to detect for researchers too."
Click to expand...

Log in or Sign up

Top sites (and maybe the NSA) track users with “device fingerprinting”

lotuseclat79 Registered Member

Snoop3 Registered Member

J_L Registered Member

mattdocs12345 Registered Member

Snoop3 Registered Member

mirimir Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

TomAZ Registered Member

MrBrian Registered Member

Techwiz Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

Compu KTed Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

Log in or Sign up

Top sites (and maybe the NSA) track users with “device fingerprinting”

lotuseclat79 Registered Member

Snoop3 Registered Member

J_L Registered Member

mattdocs12345 Registered Member

Snoop3 Registered Member

mirimir Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

TomAZ Registered Member

MrBrian Registered Member

Techwiz Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

Compu KTed Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

Useful Searches