Hacker News Reader

Comment by chime | Hacker News Reader

Is there a moderate resistFingerprinting setting? I don't mind my date/tz/language being known. There are 150m+ people living in my timezone who use en-US.

I don't want my fonts, plugins, user agent, or detailed HW/graphics features (e.g. canvas/WebGL hash) being known. Those can uniquely identify me according to https://panopticlick.eff.org.

View on HN

Those can uniquely identify me

So does your resolution. And that's hard to mask because JS usually needs to know it.

If you're not using the browser fullscreen, chances are that you're using a unique innerWidth+innerHeight.

As unsatisfying as it is, the current best solution seems to be not to care about privacy most of the time, and then take privacy seriously when you do. Whonix is excellent for this.

The Tor Plugin sets the window sizes to predefined values that match various fullscreen resolutions. So there are options, but they all involve tradeoffs.

If fingerprinting uses a hash based on a number of input criteria, then you only need to perturb one of those inputs to make the entire hash unusable. Perhaps Firefox is perturbing the other inputs (?) such that screen resolution doesn't matter much. (Just guessing and looking for a positive angle here).

True, but that's assuming inputs go to a hash rather than something more robust like a probability function.

I had to work on fingerprinting (not my proudest moment) and disabling hashing to avoid this problem was literally the very first thing we did. Just a datapoint, of course.

It's hard to imagine any non-toy implementation of fingerprinting doing anything that naive, really.

But I resize my browser all the time? Even with timezone + language surely it's a very short lived fingerprint? When it's not manually sized it's snapped to either side of a standard screen.

idk - it seems like that can't be enough?

Your resolution alone will not likely uniquely identify you. The idea is to eliminate many of the data points that make it easy to track you across IPs. Resolution is very common if you're browsing with a maximized window so it's not in the same league as these others that quickly diverge amongst users.

No, not alone. But if you're not masking your IP address, it probably will.

Weirdly, I tried to measure how unique my window.innerWidth/Height was, but panopticlick no longer seems to measure this. It only uses my full screen resolution, which of course is much less unique than canvas dimensions.

> No, not alone. But if you're not masking your IP address, it probably will.

If you're not masking your IP, resolution and anything else is largely irrelevant for tracking you.

> JS usually needs to know it

What do you mean by this?

JS is often used to change the position of elements based on the window size. If you give it wrong info, it will break the layout.

True, but if you round it down to the closest multiple of (say) 32, you significantly reduce the information content while leaving JS/CSS layout essentially the same.

Indeed, it will surely make resize look less sexy (jumping by 32s instead of pixels), and you might waste a few pixels of screen real estate on some sites at some times -- but it's the kind of tradeoff that some people happily do for more privacy.

Related, does anyone know if privacy badger include "screen size determination" in its heuristics?

I can't imagine that's 'usual'; most sites will do absolute positioning in css, if at all. As you suggest, trying to layout pixel-by-pixel designs is notoriously awkward and best avoided.

You could still do fingerprinting for resolution based on media queries in CSS.

I'm not talking about absolute positioning, but calculating positions and width/length based on rules (like the browser does with CSS, but for stuff the browser can't do). For example: https://css-tricks.com/scaled-proportional-blocks-with-css-a...

Sure, I just don't think that kind of thing is 'usual'.

Don't huge swaths of people have the same resolution, though? Yes, I understand other things come into play here (OS, Browser, available plugins, etc) but I am skeptical that people are really building UUIDs based on someone's screen resolution. Or, if they are, that such IDs are meaningfully accurate.

Not if the browser is not full screen, this is resolution/size of browser window.

Nope, you can get the screen size, too:

    > window.outerWidth
    1168
    > screen.width
    1920

It's all about the bits. You need 33 bits to identify 8 billion people. All that is required is for these bits to be independently uniformly distributed.

Say everybody uses one of four resolutions equally. That's two bits: 00, 01, 10 and 11. Now let's say that people's gender is also binary, distributed 50/50 and independent from what resolution someone uses. You can just tack that bit onto the two you already got and now you have three (the ability to distinguish between 2^3 = 8 individuals).

I won't go into the details, but if you have an estimate for the probability distribution of browser resolutions, it's fairly easy to extract the proper amount of bits of entropy. Being independent is a bit harder to make sure of, but as long as you pick things which aren't too obviously correlated, you can just take a safety margin and use, say, 40 bits to identify people, and it's probably fine (and for tracking purposes, a false positive isn't the end of the world, either).

That said, while I support the concept and idea behind panopticlick, I've always felt it overestimated the unicity of my browser. Or maybe I just really underestimate it myself. I don't know.

Assuming there's 4k possibilities for width and 2k for height, that's 8 millions possibilities right here. Compared to ~2 billions of people accessing the internet, the odds of having a unique one seems really really low.

It's one of many different data points that can be used to identify you though, and if you aren't full screen at a standard resolution then it's a very good one.

Of course keeping in mind that a good number of those will rarely be seen. (e.g. anything less than 100px)

> As unsatisfying as it is, the current best solution seems to be not to care about privacy most of the time, and then take privacy seriously when you do. Whonix is excellent for this.

No offense, but advice like this is useless. It reduces to, "someone I don't know thinks the average person with no special risk factors should think this way about their personal privacy based on who knows what priors."

Different people have different reactions to risk, have different actual exposures to risks, different competencies, and different tolerances for the hassles of opsec. And potential future risks of data slopping about are unknown.

There is no such thing as a "best solution" when talking about this.

That https://panopticlick.eff.org link was interesting, but I don't see what about my user agent string makes it so unique (1: 76540.09) ?

  Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.62 Safari/537.36

Looks fairly generic, I think I'm running a mainstream chrome browser on a mainstream OS.

Using Javascript the page can query more details about the environment including installed plugins, addons, configuration settings (language etc), certificates and fonts. That combination is often unique.

One problem is that your user agent is matched against all tested user agents from all times. This includes very old ones. If the user agent was used to track you online, they would account for that it frequently updates and for a lot of users (considering that most browsers update automatically these days).

So the site should really only take into account your OS, maybe its major version, and browser version (which changes frequently so trackers can’t rely on that). Or at least not count any that are not used anymore.

This is amazing, I use Ghostery, Privacy Badger and Scriptsafe in Firefox, and I was MORE private in non-private window! wth?

I suspect it's partly because these plugins don't function fully in a private window?

Reply on news.ycombinator.com