Hacker News Reader

Hacker News

Comment by fjarlq | Hacker News Reader

Full thread

fjarlq

Question for mikewest:

Can Google do anything to help make browsers appear to be less unique, and thus less trackable?

I'm talking about http://panopticlick.eff.org/

I'd much rather find a technical solution to that than a political non-solution.

View on HN

Fingerprinting is a problem, and it's difficult to address. There's been some discussion around mechanisms for disabling features to make the browser signature less unique, but it's a very tough problem.

Take a look at https://trac.webkit.org/wiki/Fingerprinting for some discussion around what would be required. It's very, very nontrivial.

otoh, you need a browser signature if you want to avoid CSRF attacks.

No, to reliably protect your application from cross site request forgery attacks you usually use auth tokens in the request.

So even if there might be a browser-signature based solution for CSRF protection, there is a very solid alternative, which I think is the best practice anyway.

Enabling click to play for plugins in Chrome is already possible and makes you much less trackable. You will get much less bits of identifying information in panopticlick because your fonts and some other things can't be read out without Flash or Java.

You sure about that?

I already do click-to-play for plugins in Chrome, and it doesn't seem to help much. According to Panopticlick, there are 19.75 bits of data in my Browser Plugin Details, and for the "value" it describes all the plugins I have enabled.

Also with click-to-play enabled, Panopticlick can see my system fonts (20.75+ bits of data, one in 1,769,122 browsers has this value). Apparently Panopticlick is not using one of my plugins to get that data... I haven't whitelisted eff.org or otherwise enabled plugins there.

Looks like Panopticlick is using JavaScript/CSS font detection methods: http://www.lalit.org/lab/javascript-css-font-detect/

Hmm... Panopticlick reports "No Flash or Java fonts detected" when I try it with IE9 on the same system. Is IE9 doing something to block Javascript/CSS detection of those fonts, or does Panopticlick have a bug with IE9 or what? Looks like that method worked for IE6/7...

Whoops, I have to take back what I wrote above.

Somehow my Chrome had lost its click-to-play setting. I don't remember unsetting that... hrm.

Anyway, with click-to-play enabled you are correct: Panopticlick cannot see my fonts. Sorry about the confusion.

However, with click-to-play definitely enabled, Panopticlick can still see my Browser Plugin Details.

IIRC click-to-play doesn't prevent detection of the plugin; it just prevents it from initializing. And you should also be able to get at fonts by using CSS, SVG, or canvas just to name a few.

As for the larger question, I really don't think there's any way of preventing sites from uniquely fingerprinting a given browser installation. There are just so many places where fingerprints leak through (and the behavior is relied on) that I'd expect it would take a massive overhaul of the web as we know it. Although, I'm a security guy not a privacy guy, so maybe I'm just too pessimistic.

Reply on news.ycombinator.com