Hacker News Reader

Comment by kelnos | Hacker News Reader

Does changing things often also help? Like, if there was a way to set things up so the browser would randomly change (on every request, or maybe every N minutes) bits of your user-agent, font list, screen resolution, etc., would that make it harder for sites to track you?

View on HN

The rate of change is of course an important factor, but some things like the order of how you installed fonts (which depends on the order you installed the software that fonts came with) or the plugins you have installed in your browser are still going to be constant.

What we saw was that people tried to spoof their UA only made it more unique. (E.g. your UA says Internet Explorer but you have Chrome specific plugins). Or even worse if you have a completely unique User Agent.

As long as you're spoofing your fingerprint info (you can randomly change things like fonts, video cards, battery life, plugins etc) it doesn't matter how unique you are because every time you visit the site you'll be unique just like everyone else who is either a first time visitor or does the same. That seems way more effective than trying to hide in a "crowd" when even the smallest consistent deviation in an ever growing and changing list of potential flags will get you tracked 100% of the time.

Couldn't the frequency of profile information itself be considered a uniquely identifying attribute? Couple that with something that's harder to change on every request (such as IP address) and I imagine you can confidently build a profile out of that.

frequency of changes could be an issue in cases where connections are continuous, but for most browsing it shouldn't be a huge problem. Your information will have changed multiple times between requests. The IP problem is larger, but can be mitigated by the use of VPN, TOR, or shared connections (school, workplace, public wifi etc). I think the real takeaway is that there is no perfect solution, only means which make the work of people attempting traffic correlation more difficult. For services you're already logged into (facebook, steam, reddit, insta, youtube, HN) the battle is already lost. Blocking trackers and ads helps prevent 3rd parties from building a profile of your actions across the web, but all we can ever hope to do is make the record less complete. We're all vulnerable. Now that ISPs are able to decrypt much of our traffic and sell our entire browsing histories alongside our names it's not something I see being solved anytime soon.

There are extensions for Firefox that do this. See https://news.ycombinator.com/item?id=24851721.

Reply on news.ycombinator.com