Browser Fingerprints – How Unique Is Your Browser – Panopticlick

The New Acunetix V12 Engine


Now this is another interesting attack vector using little bits of data not many people consider. I have heard about this kind of technique before and considered how it’d be done myself.

Finally someone has put together a public version of a tool that can tell you how unique your browser footprint is. As for me I’m using a fairly standard Firefox install with a couple of plugins – but still Panopticlick tells me “Your browser fingerprint appears to be unique among the 764,828 tested so far”.

The people behind it are the EFF or Electronic Frontier Foundation.

Forget cookies — even the ultrasneaky, Flash-based “super cookies.” A new type of tracking may identify you far more accurately than any cookie — and you may never know it was there. The method pulls together innocuous data about your browser, such as plug-ins, system fonts, and your operating system. Alone, they don’t identify you. Together, they’re a digital fingerprint.

It’s like describing a person. Just saying “brown hair” won’t identify anyone. But add in “5 feet, 10 inches tall,” “chipped right front tooth,” “size 12 shoes,” and so on, and soon you have enough information to pull someone out of a crowd, even without their name, Social Security number, or any other of the usual identifiers.

Test your browser for unique identifiers without the risk: The Electronic Frontier Foundation, a privacy advocacy group, has set up an interesting online experiment at Panopticlick.eff.org. Panopticlick gathers little de­­tails about your browser and computer, mostly using Javascript. In my case, the information it gathered about my browser was enough to uniquely identify my surfing software out of more than 650,000 visitors.

I’d say the technique would work fairly well for tracking people on a large traffic site such as Google, but then again the amount of data that needs to be stored is quite staggering.

Either way it gives some insight into the kind of technology ad agencies or online ad networks could have been gathering about viewers so correlate statistics.

There’s currently no evidence that anyone has actually been using this kind of fingerprinting, but this demo shows it is technologically feasible.

Peter Eckersley, a staff technologist with the EFF, says he and his colleagues decided to create the site when he heard rumors about this kind of tracking. He wanted to see how accurate it might be. Well, it’s pretty accurate. And as it turns out, its use is more than a rumor.

Browser fingerprinting was developed for banks to employ to prevent fraud. But now one company, Scout Analytics, offers it as a service to Web sites, and it collects not just browser data but also data about how you type — things like your typing speed and typing patterns.

This biometric signature, like the identifiers collected from the browser and the computer, can be gathered using JavaScript alone, making this form of tracking hard to block. Matt Shanahan, senior vice president of strategy at Scout Analytics, says that the company sells its service primarily to paid subscription sites, such as those offering real estate listings, and that it is keen to expand into marketing and advertising by helping sites track visitors in a way that, as he notes, is more accurate than using cookies. (Cookies can be deleted, which makes a repeat visit look like a new person to the site.)

As with many things online, your privacy can be protected by running something like NoScript on Firefox.

EFF has provided a full list of how to protect against fingerprinting here – Self Defense.

You can check out the PoC here:

https://panopticlick.eff.org/

Source: Network World

Posted in: Privacy, Web Hacking

, ,


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


2 Responses to Browser Fingerprints – How Unique Is Your Browser – Panopticlick

  1. Gabriel March 29, 2010 at 9:03 pm #

    Well, I’m impressed. It seems the only way I could really reduce my browser fingerprint was to pose as an iphone browser, or to use Tor. The EFF love to surprise me with incredible things every now and then.

  2. dblackshell March 30, 2010 at 5:45 pm #

    If just want to track the browser one could hash all that data and use that as the browser fingerprint. Of course if aggregation is desired, that is a large amount of data.