How the way you type can shatter anonymity even on Tor

Discussion in 'privacy problems' started by KeyPer4Life, Jul 29, 2015.

  1. KeyPer4Life

    KeyPer4Life Registered Member

    Joined:
    Dec 18, 2013
    Posts:
    974
    http://arstechnica.com/security/2015/07/how-the-way-you-type-can-shatter-anonymity-even-on-tor/
     
  2. PallMall

    PallMall Guest

    I regularly read the excellent arstechnica articles but I've missed the one related here, particularly interesting.
    So... when friends tell me I'm excessively zealous with privacy concerns, reading the arstechnica article makes me believe that I'm certainly not over the truth but still under : trackers will invent the unimaginable to discover everything they possibly can. On us.
     
  3. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    5,057
    Interesting. It looks like everything can be used to track users... Anybody concerned about this tracking method should probably type everything in notepad and then copy-paste it in browser. OTOH site could track him as an only user using copy paste to input data :)
     
  4. Nebulus

    Nebulus Registered Member

    Joined:
    Jan 20, 2007
    Posts:
    1,582
    Location:
    European Union
    The method is not new, but it works only if the site is monitoring your key strokes (see Google Search Autocomplete where a script sends the each of the new key you entered in the search box and not the whole string at the end).
     
  5. deBoetie

    deBoetie Registered Member

    Joined:
    Aug 7, 2013
    Posts:
    1,149
    Location:
    UK
    It's my belief that high levels of anonymity cannot be achieved even with Tor, if you're looking at interactive sessions (such as browsers). You're vulnerable to too many complexities in the browser, demands for low latency, and keystroke profiling as described here. I guess the plugin helps or stopping javascript, but there are really too many gotchas in the hugely complex popular browsers.

    Message passing systems are far better in that the keystroke profile cannot be obtained (you are running the program locally, the browser cannot impose that on you). Plus you do not need low latency.

    An interesting similar type of profiling lies in the content people type:- I read a book called the secret life of pronouns, and apparently the way in which we use those somewhat invisible decorations to language are fairly individual, and could at least be part of a profile. They have been used to attempt to provenance historical works whose authorship is disputed. Also, there are some favorite unusual words that people may individually be fond of, and that can also point the finger at them. And I bet the spooks are looking at that.
     
  6. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    5,057
    New Chrome extension helps combat keyboard biometric profiling
    https://threatpost.com/new-chrome-extension-helps-combat-keyboard-biometric-profiling
     
Loading...