Hacker News Reader

Comment by bitxbitxbitcoin | Hacker News Reader

Looks like everyone - vulnerable population or not - should be using VPN when viewing pornographic content.[1]

[1] https://www.privateinternetaccess.com/blog/2019/07/why-you-n...

VPN protection from site-level tracking is basically nonexistent. Browser fingerprinting is widespread and bypasses anything a VPN might offer. VPN is effective against network-level issues, not against browser-based tracking - it's a different level in the stack.

VPN in a VM, then, or on a different PC altogether.

Virtual machines have the same virtualized graphics drivers, if everyone used virtual machines for browsing and deleted cookies and cache, web tracking would be restrict to IP-based.

There are still several bits of data, like plugin support, touch support, platform, language, screen size, and timezone, that have to be actively manipulated if you want to reduce the likelihood of unique tracking.

are there any browsers that obscure these properties to sites?

Not that I know of -- there are just browsers that don't send out some stuff because they don't have the capability to detect it. You could do some more header-stripping with extensions and proxies, but in the end, like with cookies, this is stuff that a website might need to actually work properly.

The TOR browser if probably your best bet for this, even if you don't use TOR to browse.

Yes, but it is trivial to distinguish usage of Tor browser as commonly distributed and Tor browser in TAILS, by default one comes with an additional plug-in.

To do this well, you have to take special care with how exactly you obscure them. If your browser refuses to report those values, or sends junk values, then you might actually make the problem worse. It's the internet version of this: https://xkcd.com/1105/

Firefox has various privacy.resistFingerprinting preferences that can be flipped by extensions (or manually). Expect some sites to break though.

Edit: Oh, apparently there's built-in UI now: https://blog.mozilla.org/firefox/how-to-block-fingerprinting...

Yes. And using a VPN in a dedicated VM isolates activity well from the host machine and ISP uplink. There's still the risk that VPN providers will share information with adversaries. And so it's better to use nested VPN chains, which distributes over multiple providers.

The matter of virtual graphics drivers cuts both ways, however. Multiple VMs in a host that use the same virtual graphics driver have the same WebGL fingerprint. So if you want multiple fully compartmentalized VMs on a given host, they must use different virtual graphics drivers. That is, Windows vs macOS vs Debian family vs vs Red Hat family vs BSD family etc.

How does that factor in with locked-down platforms like iOS? Can you effectively fingerprint one of those devices?

I'm not in that business but I'd be surprised if you couldn't. Mobile devices are usually more trackable, since they are always at the forefront of browser/hardware integration in ways that increase the fingerprint surface ("does it support geolocation? does it support battery-related apis?" etc etc).

Does Brave impact that?

Brave on android FWIW seems to help fingerprinting efforts by including the model of phone in the user agent.

Shouldn't browsers enable anti-fingerprinting (fingerprint spoofing) when you go incognito?

incognito was designed for when sharing a browser with another user, but does nothing on the remote end to keep you private.

ad nauseum actively poisons the dataset by clicking on every link it is presented. this can be useful when it is combined with other techniques. https://web.archive.org/web/20180714043311/https://iotdarwin...

(sadly) do-not-track also doesn't work - it makes you stick out even more when activating it. best is to try to blend in with aggressive hardware compartmentalization. there are no solutions that can easily be recommended to somebody less tech-savvy which would protect them from bad actors (and GDPR or not - there will always be plenty of them).

Well, Firefox for one does things to help against tracking. Surely not all the things that can be done, but at least the ones they figured out to be worth it for everyone.

Sounds like that's fairly easily solved by just using a different browser only for your porn habits. If you use FF for your normal web browsing, only use Chrome just for porn, etc.

My understanding is that finger printing relies on gleaning data about the underlying os and hardware. I'd think using a browser in a fresh VM may offer more security security in this case.

VPNs don't help here.

https://panopticlick.eff.org

https://gist.github.com/joepie91/5a9909939e6ce7d09e29

According to panopticlick, Chrome is 100% secure in incognito mode.

That's really cool! Who knew Chrome was doing so well?

The second article CiPHPerCoder linked seems to be more focused on the VPN marketing aspect. A more interactive approach might be https://faq.dhol.es/@Soatok/cryptography/which-vpn-service-w...

its because google wants exclusive access to your browsing data.

Are there differences in how Chrome and Chromium handle incognito? Chromium appears to have a pretty unique fingerprint.

https://ibb.co/9ZB3Yxr

What do you mean by 'secure'? I just ran panopticlick in a fresh installation of Chrome on Windows in incognito mode. It returned a near-unique fingerprint with >14 bits of estimated entropy.

Of course, that makes total sense, because many of the factors that can identify your system have little to do with the browser, but are determined by the underlying system: fonts, display, date/time information, graphics fingerprints, etc.

Hmm, according to panopticlick, my Chrome provides about 70 bits of identifying information. There are about 2^33 people. I don't feel incognito.

70 bits? That's a ton. I'm at:

  17.62 Chrome 75.0.x normal (non-incognito)
  16.62 Chrome 75.0.x incognito
  15.62 FF 68.0.1 (Private doesn't seem to make a diff, I get the same score)

Seems like in Chrome, at least, the most offending (most unique) "characteristic" is HTTP_ACCEPT Headers, which looks something like

  text/html, */*; q=0.01 gzip, deflate, br en-US,en;q=0.9,fr-FR;q=0.8,f...

If there is a good way to control this (FF does a much better job -- could be tied to plugins and such tho), one could further reduce the number of identifying bits.

Chrome seems to do better (less unique) in both Hash of canvas fingerprint and Hash of WebGL fingerprint. I've summarized the main differences I see below, seems like combining the best of Chrome w/ the best of FF would result in even better privacy:

https://i.imgur.com/QQQ6R85.png

Edit: I think Chrome's HTTP_ACCEPT Headers is like that because I've installed/enabled many languages in it for l10n testing. I'm removing them now, which should make Chrome get a better score than FF.

FWIW, I've not taken the number quoted by the website ("at least x bits", which appears to be the maximum of the per-characteristic numbers, which sort of assumes that the characteristics are fully dependent (such that knowing further characteristics does not tell you anything beyond that one maximally informative characteristic)), but the sum of the per-characteristic numbers (which sort of makes the opposite assumption that the characteristics are fully independent, and knowing all the other characteristics does not reduce the information added by any one characteristic).

So, the true number is somewhere in-between.

In my experience the biggest entropy generator with browser fingerprinting in system fonts. I ran Panopticlick against both my Firefox browser instance (running Ghostery, uBlock Origin, and Privacy Badger) against a Chromium instance running no plugins and both cases yielded 17 bits from browser fingerprinting. It makes me curious whether system fonts are a major source of privacy leakage.

So this is really interesting:

On Panopticlick with Firefox Mobile, with Ghostery plugin active in a normal tab I get 18 bits of info, in a private tab I get 17 bits, but the best is a private tab with Ghostery paused - then I get 16 bits, and equal results on the other parts.

Are privacy plugins really redundant in this day and age? Or is the test too incomplete to reflect their value?

Panopticlick won’t work at all on brave on mobile. Maybe a good sign?

I don't think a VPN is enough, it will mask your location but there are so many ways your browser can be fingerprinted so you would need to have fingerprint resistant browser profile, maybe with JS off is possible.

>so you would need to have fingerprint resistant browser profile

easy. use firefox, open about:config, and set privacy.resistFingerprinting => true.

Easy to enable, but in practice not much help yet: For me, at least, I enabled resistFingerprinting and tested on https://panopticlick.eff.org. A unique fingerprint was still present. Test it yourself.

Right, that's why the setting is called resist fingerprinting. You still need to take other precautions like not full screening. A while ago I tested resistfingerprinting with a few machines and they all have the same fingerprint, so at least it's better than nothing.

I tested with my browser and it was unique as well. It seems to be caused by high dpi monitor breaking the window size rounding logic. Retrying with high dpi disabled results in

    Within our dataset of several hundred thousand visitors tested in the past 45 days, only one in 5551.36 browsers have the same fingerprint as yours.

    Currently, we estimate that your browser has a fingerprint that conveys 12.44 bits of identifying information.

Maybe having resistfingerprinting is a fingerprinting datapoint itself?

Check and make sure it's the same fingerprint across multiple runs.

I installed CanvasBlocker, and one of the things it does is fake results for a handful of API calls. So while Panopticlick reports a unique fingerprint each time, it looks (to me, based on their results) like a different browser each time.

In particular, the two most specific categories they track are canvas and webgl hashes. Those are changing every time, which I believe makes them less useful as tracking information; the next-most-specific thing is a list of fonts, which is almost two orders of magnitude less specific.

I don't fully understand panopticlick results. My machines always get uniquely identified by screen size (which I sort of understand, but find doubtful) and fonts installed. The latter I find very confusing since it often lists a set of garden variety Windows fonts, which I don't even have installed on my machine.

I still get failing marks in FF testing on panopticlick.eff.org with that set, though?

As others said it is not as easy, you probably need a special browser profile that is very "extreme" with the privacy settings. I would suggest not over selling that Firefox setting.

That still won't work. Most people don't have 'extreme' privacy settings, so you'll again be unique. To resist fingerprinting, you want your setup to be as generic as possible. This is one reason why it's important that browser vendors need to tackle this issue by setting privacy focused defaults.

With NoScript on Firefox, I have 8.7 (???) bits of identifying information according to Panopticlick. I did not enable the about:config setting a sibling poster mentioned. According to the site, I am passing adblocking and fingerprinting, but not invisible trackers or DNT.

> Within our dataset of several hundred thousand visitors tested in the past 45 days, only one in 417.05 browsers have the same fingerprint as yours.

> Currently, we estimate that your browser has a fingerprint that conveys 8.7 bits of identifying information.

So yeah, pretty much all web privacy is broken by Javascript.

While I don't disagree with using a VPN as you suggest, I would be wary of using an advertisement by a VPN company as a supporting source for that claim.

I think if you use a VPN that doesn't have any of your personal information of file for billing or infrastructure purposes (like your residential ISP does) then at the very least the shady logging VPN will have a dossier on you that doesn't include your name, street address, bank or credit card numbers, etc. Even if the VPN is otherwise a bunch of Mafia scum datamining you as hard as they can, you're still better off than if you were raw-dogging on Comcast.

However I think those VPN companies that throw around suspicious abouts of cash advertising all ask for credit cards or similar. I would never do business with one of them, it's pointless.

I also hate NordVPN's YouTube advertising campaign in particular, in which they pay YouTube creators to mislead their audience. Suggesting among other things that connections to your bank's website are unencrypted if you aren't using a VPN.

But most importantly, close the incognito mode once you finished consuming the content, don't just close the lid of your machine. The next day at work might be a bit more awkward than what Google does with your aggregated data :)

Also ask your girlfriend / boyfriend to tag imgur links with NSFW :)

A VPN might be handy for bypassing the near-future UK porn block / age verification system[0] (by spoofing your geo-location). I imagine tech savvy teens/children are already investigating VPNs in light of the recent articles which outline the system.

[0] https://www.wired.co.uk/article/porn-block-uk-wired-explains

[0] https://www.ageverificationfacts.org.uk

Here's the important bit from the article where children will need to bypass:

> From the launch date in July, porn websites will have to show anyone visiting from a UK IP address a landing page that doesn't show any explicit content.

>Each age-checking company has a variety of different ways people can prove they're old enough to view porn. These include using SMS, credit card data, passport information, or driving licence details. There are other options that include face scanning and the blockchain.

This is so going to result on a ton of teens with credit cards. Just look at what is already happening with mobile games. Sounds like a boom for the porn industry. Sure enough, MindGeek is already on it:

>The most well-known of these is AgeID, designed by MindGeek

That's very incomplete advice (on the blog of a VPN provider). A VPN alone won't give you any protection from being tracked either, you need both that and incognito mode (or a separate browser), and should probably throw ad/tracking blockers in the mix as well.

I read the link you provided, but there wasn't any "OMG yes" light-bulb moment in that article.

Do I care if Google & Facebook track my viewing habits? I'm not sure I understand what the potential harm to me might be.

It might be problematic in countries where certain kind of sexual orientation is punishable even with death. If you don't live in those countries, then I don't see much problem with GA in these sites as well.

Are you claiming that in those countries there have been cases where people are identified and rounded up with some mass sweep identification by online viewing habits?

If being outed means possible death than with this info it's only a data leak away.

> If you don't live in those countries, then I don't see much problem with GA in these sites as well.

Countries can change. There are plenty of examples in history.

It is relevant if your porn habits can be used against you (blackmail, public shaming, strict indecency laws, etc).

I was recently googling friends' names and looking at the results from find-people sites. It's already creepy enough that they have "related to:" and then a list of family members of that person. But the most recent concern was one site already has a "reputation score" like china has already implemented. I checked a few friends who had criminal convictions and, voila, their "score" ranked lower (and of course you can pay the site to remove your entry or whatever, aka a racket). Porn viewing could easily be ranked into the "score" in a negatively-impactful way and lead to job/social discrimination.

s/pornographic content/any content/g

Reply on news.ycombinator.com