Hacker News Reader

Comment by cm2187 | Hacker News Reader

Would I be right to assume that safari on iOS defeats browser finger printing, given the absence of flash and the fact that you can't really customise the platform, adding new fonts, etc, so the entropy is close to zero?

View on HN

It doesn't seem so, visiting Panopticlick[0] on my unmodified Safari/iPhone7/iOS 10.3.3 gives "your browser has a nearly unique fingerprint"

[0]https://panopticlick.eff.org/

Ditto on iOS 11 with Safari. In Firefox I get just unique, in Safari it is “nearly unique”.

I don't know how well Panopticlick would do for scoring Safari 11, as it runs all its tests within a few seconds. Some of Safari's new behaviour around third and first party cookies only kick in after 24 hours, or 30 days.

So, panopticlick marks down my browser because it doesn't unblock third parties that promise to honour "Do not track".

In what way is this bad? (Yes, I have third party cookies blocked. No, I'm not unblocking them.)

It's bad in a sense that you're possible to identify uniquely by the advertisers.

Do not track is snake oil anyway...

The more things you do that aren't like what everyone else does, the easier it is to single you out from the combination of those choices.

Being on an iPhone will however reduce most of those bits to 0. For example any iPhone 8 with iOS11 will share the same screen resolution, fonts, user agent and so on. They talk about this in their methodology, however do not give the actual bits in their results, only that you have 'more than 19'

I’m golden on iOS 11.0.0

I got the same thing. When I look at the fingerprint details though, it's not clear why it should be "nearly unique". Of the things listed there, there's not much that's customizable, mostly just time zone, locale, DNT, and if cookies are enabled. That said, it also has "Hash of canvas fingerprint", which apparently has a lot of bits, but I have no idea what information that's actually extracting. Similarly "Hash of WebGL fingerprint".

I did try this on iOS 11, which they probably don't have much data for yet and would explain some of the unique-ness, but you said iOS 10.3.3 which is much less new.

Maybe iPhone users just don't try panopticlick very much?

You can still do things like being able to get the battery status with JS or detect visited links.

> detect visited links

Is this still possible? I was under the impression this is prevented in most browsers.

Also wrt battery status - that's only Chrome thing these days.

http://caniuse.com/#feat=battery-status

For firefox there is dom.battery.enabled and https://developer.mozilla.org/en-US/docs/Web/API/Battery_Sta... but it seems that since 42 it is enabled only for addons. It seems that I was wrong about that indeed.

Well, browser vendors keep adding features, and in 2014, it was predicted by lcamtuf that the mix-blend-mode property would be useful to access browser history:

https://lcamtuf.blogspot.fr/2016/08/css-mix-blend-mode-is-ba...

Two years later, it was implemented, and the demo seems to be working here in Firefox 56: http://lcamtuf.coredump.cx/whack/

Newer versions (since around 2013) of webkit and gecko limit a:visited style changes to just colour or background colour.

So the getComputedStyle() trick doesn't work anymore. Is that what your referring to?

Reply on news.ycombinator.com