Hacker News Reader

Comment by uptown | Hacker News Reader

Online anonymity is pretty much gone. You can uniquely identify most visitors without cookies using a bunch of other exposed attributes.

This site shows you how unique your system appears: http://panopticlick.eff.org/

When you combine things like screen-resolution, installed fonts, etc. you get a pretty-unique profile of each person.

Bruce Schneier addresses the topic here: http://www.schneier.com/blog/archives/2010/01/tracking_your_...

How UberVu mapped this back to an actual email address is a separate matter - but I'm guessing they used the profile of his machine and connected it to a matching profile they had access to from some site he does authenticate with.

Now extend that concept to Google. They've got their digital hooks on millions of sites using Google Analytics. They can map those hits back to an IP address that correlates to a GMail login and get a pretty good idea about where else their users browse.

View on HN

Panopticlick is a bunch of fearmongering nonsense. I'm on an ipad right now, and they tell me that "only one in 350000 browsers has the same fingerprint as mine". All fully-updated iPads have the exact same fingerprint, you can't even come close to uniquely identifying me with that.

Next time I visit the Apple Store, I should remember to visit Panopticlick from some of the machines on display and see what only-one-in numbers it reports.

You're forgetting localization. Your timezone alone makes you more identifiable. Add in your IP address and you're pretty identifiable. Not to mention that iPads don't really have any private browsing mode.

True, timezone could be a biggie. Although in my case (GMT) is 1/22. Screen res is another possibility (1920x1080) = 1/28.

All the site doesn't mention anything about IP address on the report page and presumably doesn't have access to third party tracking cookies however so private browsing shouldn't make much difference (I cleared my cookies and got the same score).

iOS Chrome has private browsing. There are also s number of dedicated apps for private web surfing.

iOS Chrome has "Incognito Mode*". The asterisk is there because WebKit does not have any way to make localStorage private, meaning it's shared between Incognito and Normal browsing modes, so there's a possible leak of information there, especially if they're using a third party tracking service. This is true for any of the private web surfing apps that use WebKit.

Now I'm curious—what does "Private Browsing" do when enabled in Settings > Safari?

It only clears your browsing traces locally (history, cookies, cache, etc). Everything else can still be tracked on server-side. BTW, every private browsing mode that I know works pretty much that way.

In the current model real privacy can only be achieved running something like Tor.

Onion browser on iOS professes tor based anonymity

> Not to mention that iPads don't really have any private browsing mode.

Safari on iOS certainly does have "private browsing". Just go to the Settings app and select "Safari" from the top level and it's the first setting under the "Privacy" (just below the "General" section). When it's enabled, the browser looks different to let you know -- the normally gray bezel UI becomes black. This has been a feature ever since iOS 5.0 was released in 2011.

More info here: http://support.apple.com/kb/HT1677

I just tried Panopticlick both before and after enabling private browsing in Safari (Mac OS X) and the site identified the same number of identifiable pieces of information about me. So it looks like that has no effect.

Which sort of makes sense - the info it's looking at is basically the header info. Screen size, installed fonts, IP address, and so on. It's not relying on cookies, as cookies can't be seen/read across domains (you can't tell I'm an Amazon customer if I just visit you out of the blue).

You used to be able to by reading back CSS styles of visited links. May be fixed now. http://blog.adrianroselli.com/2010/03/mozilla-to-modify-how-...

It is fixed.

CSS may color visited links red, but they hacked getComputedStyle to return the normal color instead. So, you can't tell if that link to Amazon you just created is visited or not.

And you can no longer set, for example, font-weight:bold for visited links, because that would change the size of the element, and they decided, unlike in the color case, that it would be too complicated to get all the APIs to lie about the new geometry.

Is it fixed in all browsers?

Not everyone's using an appliance. My fingerprint is unique in their list.

I'm confused as well, apparently my browser (stock firefox on Ubuntu) is completely unique. I would expect it to be reasonably rare but certainly not that rare.

I haven't done the math, but I have a feeling it just keeps dividing by the "one in x browsers have this value". Maybe it doesn't look at the intersections , for example: Using Totem as the default wmv player is rare and using Ubuntu is rare but reporting Totem as .wmv player is going to be a lot less rare amongst Ubuntu users that it is amongst Windows users.

>I haven't done the math, but I have a feeling it just keeps dividing...

Why would it have to use division, or for that matter, any kind of math at all? I imagine that as each new visitor is recorded, they simply count how many other visitors had the exact same browser configuration.

The "one in x browsers have this value" column is probably just for informative purposes (and not the raw data that was somehow munged to determine the uniqueness of your browser fingerprint).

It has nowhere near the traffic to give the resolution it claims based on simple counting.

I'm not sure what you mean by "resolution"; the site doesn't claim that a browser fingerprint is unique among all instances of all browser software ever run, just that (for example, to quote from my test results) "Your browser fingerprint appears to be unique among the 2,568,783 tested so far".

Not disagreeing with the bogosity of the numbers - but isn't the time zone part of the fingerprint? So not all iPads are the same?

Yeah, you're right

but still: so I'm only as unique as any iPad users in GMT-7, not all iPad users globally. That's not information that is of any use in identifying me, but EFF insists on presenting it as though SWAT teams from adwords will be breaking down my door any day now to shove targeted marketing materials down my throat.

One in 350k means you are similar to ~1100 other Americans. A large crowd to be sure, but not great for being completely anonymous. There is still a lot of value in even making groups with this many members.

My previous comment on this: http://news.ycombinator.com/item?id=4479876

My iPhone 5 is 1 in 214,000; my Galaxy S3 was unique.

Since the iPhone 5 makes up more than one in 200,000 of the Internet's traffic, even that "relatively low" uniqueness is worrisome.

Panopticlick also glosses over the fact that the browser characteristics it uses for 'fingerprinting' change over time. In the time it took me to write this comment, Chrome updated itself three times, for example.

Not to mention Facebook tracking you across the web with their Like buttons.

I try to do most of my browsing in a different browser from the one I log into FB/Google with.

me too. Do you reckon this is enough?

http://www.ghostery.com/

Honestly I found Ghostery useless and ultimately uninstalled it. I am not paranoid enough to want to completely deprive every site of statistics, so I had opt-in by default, and it's difficult to block the especially nefarious packages because they're all lumped together with typical counters/stats scripts.

I think NoScript does an adequate job preventing most undesired analyzers, as they will often be on a separate domain that needs temporary activation. Ghostery was just annoying because it'd always be blaring that there were trackers tracking me, but include mostly things that I don't really mind, basically all counters. In fact, I usually want counters to register my UA/OS, so that their recorded Linux marketshare increases.

Would be nice if we could install Ghostery as a private-browsing-only extension and turn its default to block everything, but barring that, I don't think it's valuable unless you make it block everything all the time.

You know, sites have log files for basic stats... Tracking is completely another league. I feel no guilty using Ghostery fully blocking everything by default (and I'm not so paranoid).

The problem is when you use http cache, it screws your basic stats.

I use this in conjunction with an ad blocker and a NoScripts-like extension.

I always wonder how effective this combination is :/

Ghostery is fantastic. It takes a little while to get setup and maintain as you'll want to disable everything by default then reenable services when things don't work. But it's well worth the effort.

I use the Ghostery add-on for Firefox, but if you enable "GhostRank" then the add-on will send every URL you visit to Evidon. This is purportedly for "tracking the trackers", but it does give one pause.

"Enough for what? is the question. I hope it is enough to disrupt the FB and Google from from getting a total view of my activity but I don't think its enough to stop all monitoring and tracking.

My main browser is Firefox with NoScript installed and I've been known to back away from sites that won't work without a number of different domains being authorised. Flash isn't installed at all. I use Chrome with Ghostery for Linked In/Facebook and any Google logins plus anything that needs Flash (as I trust Google to keep that up to date even though I don't trust them not to track me).

I never log in to Linked In/Facebook/Google on my phone or tablet although I don't have much other protection from tracking there.

If you use Chrome, there are extensions like this one: https://chrome.google.com/webstore/detail/facebook-disconnec...

Just because of that I have disabled fb like, twitter and g+ from my blog. I had also disabled google analytics but traffic started to go down. Today I have re-enabled analytics to see if that is the reason.

I did not have too much traffic from fb or twitter to think that is because I took their buttons out.

Anyway, I prefer to avoid those sites tracking my readers, savvy people can anyway share my content if they want.

So, if you want is http://www.garron.me :). Just kidding.

You may be interested in https://addons.mozilla.org/en-US/firefox/addon/facebook-bloc... , which stops your browser from reporting back to FB until you actually click a "Like" button.

Does pressing a "like" button actually redirect the browser to facebook? Or is it trying to do something based on evaluating what the FB javascript does?

The best way to implement something like this would be "if facebook.com" is not in the address bar don't allow any requests to anything with a facebook IP address.

Trying to do something cleverer might be simple for FB to break by changing the like button code.

Tracking doesn't start at "pressing Like", but the Like button is actually loaded from an HTTP call to Facebook's server with the referer of the site you're on ... so they know could (claim: don't) track every site you visit with any original cookie you set on Facebook's site.

We added Panopticlick-inspired user fingerprinting to SnowPlow recently - as far as we know, we're the first analytics package to make user fingerprinting generally available. If you're interested in the implementation, it's here:

https://github.com/snowplow/snowplow/blob/master/1-trackers/...

I'm skeptical of its utility on its own - though when you add timezone, IP address and screen resolution, it may start to get mostly-unique.

Anyway we're waiting on some of out bigger users (millions of page views per day) to report back on its uniqueness - should be interesting...

Way to make a name for yourself under the Be Evil brand--democratizing access to abusive user-hostile technology. It has the same feel as an open access community meth lab.

It it possible to block/fake list of fonts and/or browser add-ons from being sent to a website?

While trying to find a browser add-on for the above, found that Facebook detects NoScript and adjusts links accordingly [1]. In other words, the list of add-ons is used proactively to try to bypass some of them.

[1] Excerpt: "Facebook seems to detect an active NoScript and replaces external links with tracked ones." from https://addons.mozilla.org/en-US/firefox/addon/google-privac...

The list of fonts is only available through flash, so if you get rid of flash (either permanently or with flashblock) that should cut down your fingerprint a bit.

It's also exposed to javascript and CSS. With a list to test, you can generally evaluate the fonts installed on a system without using Flash.

I was just thinking earlier today, "I should turn on the Do Not Track header in Chrome." Then I thought, "...and become one of a very tiny group of people with that characteristic."

I'm going to do it anyway, though on principle. And I encourage all of you to do the same. ;)

I wouldn't bother, to be honest. Personally, given MS's stupid, stupid idea to turn it on by default in IE10, its just gonna be ignored (i actually asked our analytics vendor if we could record it so I could segment based on it).

The only way DNT will work is if its legally mandated, and I don't think that's gonna happen (though I could be wrong).

> You can uniquely identify most visitors without cookies using a bunch of other exposed attributes.

Yep, that's nasty, but this is much worse still: getting visitor names & email contact info.

Reply on news.ycombinator.com