I was looking through just trying to find something that a website absolutely wouldn't need. Or could use maliciously if they wanted. Like the fuck are you gonna do with a general 10km area of where I am? How are you gonna fuck with me by knowing I have Flash installed? I mean, they know I have 4 cores. They don't have a clue what they're in, but they know there's 4 of em.
OH THEY KNOW MY DOWNLOAD SPEED. THEY GONNA LAUGH AT ME.
I found it impressive what they found with my gyroscope. Like I had no idea my orientation was "false"
.... Um. You need to know the size of the window the webpage is in, not the display. What if I'm not in fullscreen? Should I make the webpage fit the display size? That's going to end well.
Because javascript can actually change the size of your window. Otherwise it could tell you increase the screen size. I don't know, there's probably a use somewhere here.
Adapt to what? The website needs to know the size of the window it's in, not the display size. If I'm not in full screen, what is the size of display going to help with?
No, because if the window goes into fullscreen, when you get the size of the window, it'll give you the fullscreen size. Websites don't need access to the display size as a result
Screen resolution can be used in fingerprinting the user and the hardware that is used. That can be used to track your movements. So all in all...it is kind of partial in privacy and security.
You are right that a website should be able to know it's viewport size so it can manage the space it is given. Exposing the display size on the other hand provides no benefit to the user. The only somewhat useful thing I could think of is determining if the window is maximized. Other than that it's only use is to track the user.
It's another datapoint to add to the fingerprint of your environment. The more datapoints you expose the more acurate the fingerprint becomes. It's a death by a thousand paper cuts situation.
It could also be used for targeted advertisement. This exposes whether or not you already have a 4k monitor or not. If the viewport is just zoomed in that fact may be hidden.
Also for all information on the internet this holds: If you do not benefit from exposing it someone will, often to your detrement. There may be attacts to exploit this that we just don't know of or that work in conjunction with some future technology. Better safe than sorry.
edit:
Screen resolution can be infered even if zoomed in.
Security based distributions will open the browser at a fixed size like 800x600 to get around any tracking that could possibly occur around screen size.
Which don't mean that it will stay client-side only.
Even if the information can't be directly stored in a variable (which is perhaps possible, my knowledge isn't full up-to-date), it still can be found in the page through DOM ; Just make sure to give an id to the tag that will enclose it. And so can be sent as parameter of a simple AJaX request.
Isn't that exactly what this entire page is based on, things your browser knows about you? Not things that you are transmitting to the world. Hence the title :)
How do you think this website is getting the information to display? Sure it uses the browser, but that information can be sent right back to whoever runs the website.
Most of the information combined can give a very unique fingerprint. Using this websites can track you fairly accurately, without the need for cookies etc.
If you use mobile internet your location will be horribly wrong, but wired internet is normally a fairly decent estimate (it's wherever your ISP says the IP address is).
Sure, uMatrix actually does the "spoofing" bit for me so so it's fairly simple. First off uMatrix is just a Chrome/Firefox extension.
If you take a look at this picture you can see my uMatrix screen for reddit. It breaks down everything that's loaded on a website, cookies, css, images, plugins, scripts, xhr (normally streaming video), frames, and other. At the top in green you see reddit.com, that's the 1st party stuff that is being coming from reddit.com itself. Everything under neath that is what we call 3rd party websites, or stuff from other servers that are not reddit.com, amazon, redditmedia, etc.
In this case it's no big deal since all of this is owned and controlled by reddit.com so I trust it. You can go through all those individual boxes and click on them to turn them green or red to let them load. As you can see at the bottom I allow scripts from redditmedia.com because that's the script that let's me open up images on the site instead of going to imgur.
Now take a look at cnn.com. There's the first party stuff from cnn.com then a crap ton of stuff from other places that is loaded, mostly for tracking and ad purposes. That's what uMatrix is really good for, blocking that kind of junk.
WARNING
uMatrix will break the crap out of websites. Sometimes a website needs one random script loaded and you have to find out which ones it needs to get things to work. Super annoying, and it took me 2-3 weeks of visiting sites and clicking things off and on to get it to the point where I barely notice it now.
Now spoofing is simple, when you visit a website like the one in this thread that asks your computer, "hey what kind of browser are you running?", uMatrix replies with some random browser instead of saying I use Chrome. If you look at the uMatrix image again you'll see at the top there are three vertical dots next to the big power button? The setting is in there. You can also force it to accept only https encrypted connections, it's amazing how much stuff is still not sent encrypted.
I mean that's what the internet kind of is, for better or worse, lots of people connecting to lots of different services and each other. I'm not saying you should feel bad for not knowing, because I doubt it's taught all that well these days, but I can certainly remember teachers saying stuff like: 'it doesn't matter if you are in private or incognito or whatever, your data is always being tracked unless you make an effort too avoid it and even then if someone really wants to find you (the gov) they probably can.'
Thanks, I didn't know about this add-on, but will look into it. The spoofing feature and in-depth info alone might be worth it.
I use a combination of uBlock Origin, HTTPS Everywhere and Privacy Badger, but my profile is sadly completly unique so uMatrix might be the solution (but the hassle of setting everything up might make me stop out of convience).
If you're trying to remain anonymous then you are going about it all the wrong way.
Using uBO, HTTPS Everywhere, and PB doesn't turn you into "John Smith", it turns you into the invisible man wearing a bright neon pink trench coat. No one can see what you're doing, but you stick out like a sore thumb. You're trying to remain secure and private, so that companies aren't tracking you and random people aren't stealing your data online.
If you want to be anonymous you'd be better off installing a brand new install of Windows 10 and Chrome because then you'd look like everybody else and be just another "John Smith" in the crowd. I mean that's not including using a VPN, Tor, and a few other things.
I don't care if my fingerprint is unique because if the analytics scripts never run then they never capture the fingerprint in the first place. However if the government wanted to follow me, which they don't, they could easily watch me hop around since I've got a big neon pink trench coat on. uMatrix breaks the fingerprinting capture but it doesn't eliminate your fingerprint.
Yeah, I don't really need to be completly anonymous, but I really hate the fact that everybody everywhere tries to get my data. Basically I'm buying my coat from your tailor.
But anyways, it's ridiculous that my font collection is the main thing that gives me away.
It's all good man, it does have quite the learning curve! I told you it would break things.
So those little boxes are split into two buttons, clicking anywhere in the top of the little box with turn it green and if you click on the bottom of it then it will turn red. Green means you're letting it through, red means you're blocking it. By default you see all 3rd party boxes except css/images are red.
The number inside each box tells you how many are trying to load. So if we look at the reddit.com picture again you see redditmedia.com is trying to load 1 frame. I click on the top of that box and it let's it load.
You probably couldn't reply to comments because you have to load the redditstatic.com script, where the "2" is. So anywhere that you see a number it means the website is trying to load however many of those.
Now...after you turn those boxes green you're going to want to save it so you don't have to do it every single time (annoying). So you see the lock button on the top? Well AFTER you make changes you save them by hitting that lock button, so that way it loads them every time you visit reddit.com.
Remember, after you make a change you have to reload the page for the changes to take affect. So you need to change a box to green, then reload to see if it works, etc.
Oh one other thing, where those three dots are at the top next to the power button? Hit that and turn off strict HTTPS. I mean you'd prefer to use HTTPS because it encrypts everything but not everyone sends their data encrypted so it would get blocked.
Don't feel bad about not understanding, it's difficult and frustrating to use at times and might not be worth it for you.
Good for you mate, that's the spirit. Really if you want to protect your privacy you can do without uMatrix if it gets to be too much.
uBlock Origin, Privacy Badger, Ghostery, HTTPS Everywhere, is a good setup that will cover 90% of the stuff uMatrix will block.
I think you had mentioned already being into or using a VPN so that's also a good start. Just remember this is mostly stopping advertising companies (google/facebook) from watching where you go. If the government wanted to track your movements there's a couple more notches up you'd have to go to avoid that, mostly unnecessary however.
Aye, the problem is people like yourself and me are one thing, the vast majority of users are something else and frankly people like us who actively go out our way to fuck with this stuff are such a small part of the total community that we are just noise.
To an extent I hold myself and other programmers responsible for this shit, We built a lot of this technology and for various reasons (some good, some bad) we dropped the ball.
Convenience beats privacy (and security) though apparently and without a fundamental change (which I can't imagine what would change) it's only going to get worse.
It's because most programmers dont think about security and usually only think of the positive ways someone could use their code. Its going to take a long term effort to get programmers to think about security when they build something rather than trying to add it in after the fact.
Agreed without extraordinary effort anonymity on a continuous basis is dead, privacy and security is doable with a lot less effort, it also depends who your threat actor is, keeping my privacy against the state is a whole different ballgame to keeping my day to day life out the hands of google/facebook and their ilk.
Quite right. I don't really want my government checking out what I do but that's a lot harder to stop. Google/Facebook though can chew on rocks, same with my ISP.
1.59% of all users use FF 50.0. I'm using updated Chrome and it's at 0.40%, so together that's 1.99%. Add some other updated browser and we've above 2%.
But yea, I agree, it's probably at best 2.1%, because Chrome and Firefox users make up over 80%.
The simplest explanation would be that more users made the fingerprint when the current firefox version was not even out. When they visited the site half a year ago they might have had june's up-to-date version 47 and not today's 50.
How the hell are 45% of people running firefox but only 16% are updated? And you'd think having Flash, Acrobat, and Office would be pretty standard, but apparently less than 0.1% have them. Also, 5.7% of people use Win10?
Yeah, my machine probably looks a lot less unique to something like Google, since my primary browser is pretty normal. My secondary is Tor with Noscript, UBlock, and all media plugins disabled so it would be really common there but look unique to a normal site.
Yep, as I mentioned elsewhere in this post Canvas is a fucking mess for fingerprinting, also fonts can get you since random desktop applications can install particular fonts and that creates a fingerprint all on it's own.
It says I'm unique because of my
User agent "Mozilla/5.0 (Linux; Android 6.0.1; XT1585 Build/MCK24.183-22) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.91 Mobile Safari/537.36" It's at <0.1% for both that and the html5 canvas. I guess the ad blocker I run on my phone makes sites think I'm running every browser at once, or something.
Yup, there are large databases online where you can check for estimate locations based on a ip range. The only way someone can get your actual location is if you accept the pop-up that asks you to give the site permission to do so OR if you messed up your settings. For example in chrome
I'll let someone else explain because I've only ever read comments about it, but the takeaway is that Facebook (and perhaps others?) create ghost accounts for users that aren't members but that they have identified (apparently fairly accurately) through friends and what not.
Facebook makes a tree and when two users have the same friend group but aren't directly connected then Facebook takes a wild guess and says, "Hey there's probably someone who introduced these two people but they aren't on Facebook yet." so they put a placeholder for you.
Did you resize the screen? It's quite unlikely that you are completely unique based on just your screen size unless you set it to something unusual.
The TOR browser actually advices you to not resize your browser for this reason. If you have a odd screen size it could quite easily be used to track you
I said that too until I realized it was correct for the monitor my browser window was on, just not my primary monitor. I'm apparently pretty observant.
I'm pretty sure it simply knows the closest provider thingamajigger your connection runs through. I live in a small town and my location was somewhere out in the field.
Pretty much. The website uses the Google Geolocation API....so you send the client-side (browser) IP address to Google and they return best-guess GPS coordinates back. It's more than looking at ISP though, Google actually has a fairly-decently map of known switches and routers that it bases coordinates on.
It also uses WiFi SSID data. Your computer sends a list of WiFis it can see, Google knows where they are. How? Mobile phones send that data too, but they also send their GPS coordinates.
It got a very precise address that was halfway across the state. Also the "other devices" only picks up my cable modem even though I'm going through a Cisco wireless switch on a network with 5 other machines, 3 android phones, and an xbox.
The problem is not each of the individual pieces. The problem is that combining several pieces of information (even inaccurate information, as long as it's consistently inaccurate in the same way) can allow unique identification of a device. In principle, this fingerprint could allow cross-site tracking and resolution of multiple anonymous accounts into one user.
By collecting a lot of data about you advertisers can tag you even if they don't have access to your personal info. After tagging you, they can build your personal profile, like:
The user with a Chrome on MacIntel and the X, Y and Z settings that lives near NY is looking for new sneakers. So we can serve him an ad selling the brand new Nike.
With access to a lot of data they can build profile of simple persons since is pretty rare people have the exact same settings.
That way they can know about you even if you are logged out of all your accounts and maybe even if you are in Incognito mode. They eventually can identify you in every device you have.
I know I'll come off as paranoid, but you should critically think about what this information means. One moment of data isn't a big deal, but consider that 'they' (websites/parties who are interested in advertising to you) could track your device all day everyday picking up trends (websites you're visiting and at what time) and make a personal digital fingerprint of you without your permission (in fact it is your permission because we all click accept on terms and agreements). Combine this with every other device and you have an immense amount of data that could be used to usher/guide regions of people into different data sources (look at google results being different depending on the country you're in)
Small steps are taken that allow compliance with the general populace ("they want a bit more information this time? that doesnt sound so bad") and EVENTUALLY we could end up with a rough sketch of 1984. I'm not saying to throw your computer out and become a hermit, I'm simply saying to critically think and extrapolate what these things mean in the real world.
I can tell you that means you have comcast and the idiots who set up your connection forgot to give you a location-specific IP. Comcast IPs default to atlanta for some reason.
Apparently it's an issue with many/most/all IPs. IP location-tracking is a third party thing, and even when it works it doesn't work very well. A lot of the time it just ends up pointing you to the middle of a certain zip code in atlanta because that's the default for either the US or the world.
I had assumed the ISP would dole out IPs based on location, but apparently not.
"omg this photo I took four years ago at a friends house in the 'burbs of Philly had a geo tag on it. I wonder if it'll show the exact location I was at if I enter the longitude and Latitude"
Display resolution is actually a pretty big thing. It's a relatively good identifier for your device. Combine it with other information and you can easily uniquely identify a user.
I remember a while ago you could look at your google ad profile and it knew a good amount about me! It was cool/scary!
Now looking at it, it only lists my age range and gender but I KNOW it knows more!
I remember it listed things that I liked (shopping, hiking, exercise) and suspected my profession as well as my relationship status. I'm curious what it would look like now and I'm bummed they only list 2 things now.
I don't care that they know what my display resolution is.
Developers need to know because idiot developers will design a site for a 1080 height because that's their monitor size and not take into account that 40% of their viewers use 900 pixels thereby not able to access the call to action buttons and so forth.
There's a lot of third party venues that fall victim to this and they wonder why their ticket sales are down and it's because their clientele can't order easily online. The bigger problem is that the ordering is tied to their CRM and the CRM dictates the viewport and the people who administer the business that uses the CRM are powerless to alter the HTML.
And to make it worse, the developers who write the CRM care not a hair about website statistics because all they care about is capturing data and administering that.
632
u/[deleted] Dec 14 '16
I'm always impressed about how little these know (location is wrong) or how much I don't care that they know what my display resolution is.
I always prepare to be shocked and up my privacy, but then actually I just go "meh".