A New Use For Browser Fingerprints: Defeating Spoofing (browserprint.info) 64
AnonymousCube writes: Researchers at the University of Adelaide have found a new use for browser fingerprints: uncovering and defeating spoofing by web browsers. By using machine learning on browser fingerprints they were able to correctly guess the OS or browser family of a browser 90% of the time, and defeat operating system and browser family spoofing 76% of the time. This was done with small training sets of less than 1000 fingerprints, so accuracy with a much larger training set, like the size of the EFF's Panopticlick database should give even better results; you can help prove this, and see what their site thinks your browser family and OS is, by submitting your fingerprint to their site.
You built the better mouse trap. (Score:5, Informative)
We now have to evolve the better mouse.
Dear fingerprinters: It might surprise you, but we don't want this to happen. We want the non-mobile version of your damn webpage on our mobile phone if we go out of our way to pretend we're not on a mobile device. Because guess what: Your mobile version almost invariably sucks and is unusable. Forcing us to use what YOU want us to use instead of allowing us to choose what WE want to choose leads to us not using your service at all.
Re:You built the better mouse trap. (Score:5, Informative)
They can even get you by canvas fingerprinting and web3d fingerprinting where they use various drawing apis to create an image and then send back the checksum of that image to create a fairly unique fingerprint.
CanvasBlocker sends a fake one, but then they know you are faking it. Or you can shut off access to the api, but then THAT flags you as unique for returning nothing but zeroes.
I have yet to be able to produce a browser fingerprint that isn't unique using any combination of addons.
We need some standardization. Then people could download an addon that produces at least the same fingerprint as all other users of that addon giving some space to hide in.
Re: (Score:3)
> I have yet to be able to produce a browser fingerprint that isn't unique using any combination of addons.
You do not need to. You just need a fingerprint, which is different *every* time. Instead of being one in a group of 100, you're unique, but you are unique every time you re-visit the site.
Re:You built the better mouse trap. (Score:5, Interesting)
Problem is, they can't produce a unique fingerprint for every user's browser. And ANY browser fingerprint can be mimicked - in the end it's just bits and bytes coming down the wire.
So what if they know you're faking the checksum if millions of other people are faking it as well, and giving different bogus checksums for every page load. Or returning all zeroes, along with millions of other people doing the same? No need for an add-on that produces the same fingerprint as all other users of that add-on. You're overthinking the problem. What are they going to do, block users who don't let their browsers return fingerprints? We saw how well that worked with paywalls and not allowing ad-blockers. People just go elsewhere.
It's the internet - it was designed to route around such brain-damage.
Re: (Score:2)
If you were to spoof coherently, you'd need to ensure that you can defend against all (most) of the attacks that attempt to verify your browser. This would require all kinds of a
Re: (Score:2)
I think we will never ever eliminate the uniqueness of modern browser's fingerprint while keeping its features. You may have the same fingerprint when using something like tails in a VM. But start installing addons and you're changing it.
But you can try to randomize everything everytime. The problem is, while you may think "i fooled panopticlick to think i am always another unique person", the real fingerprinting service will not only take the full fingerprint, but try to analyse it. Something which is with
Re: (Score:1)
How do you tell different w3m or lynx users apart if they spoof their user agents?
Re:You built the better mouse trap. (Score:5, Interesting)
By comparing the behavior of the two clients.
When w3m requests a web page it sends the following:
GET / HTTP/1.0
User-Agent: w3m/0.5.3+git20161120
Accept: text/html, text/*;q=0.5, image/*
Accept-Encoding: gzip, compress, bzip, bzip2, deflate
Accept-Language: en;q=1.0
Host: www.website.com
When lynx, with a w3m user agent, requests a web page it sends the following:
GET / HTTP/1.0
Host: www.website.com
Accept: text/html, text/plain, text/css, text/sgml, */*;q=0.01
Accept-Encoding: gzip, bzip2
Accept-Language: en
User-Agent: w3m/0.5.3+git20161120
Re: (Score:1)
If headers are all that make different text browsers look different, perhaps the developers could talk to each other to make their browser more like one another, to thwart just this kind of privacy invasion.
Re: (Score:1)
Obtaining the non-mobile version of a webpage should be as easy as clicking a nice friendly "I want the non-mobile version" button (or vice-versa on a desktop machine... no, wait, that literally never happens because mobile versions invariably suck).
Except for cnn.com. The mobile site is inherently better because it's actually clean compared to the full site. That doesn't mean the mobile site is great or anything, just that the mobile site sucks less.
Re: (Score:2)
Only the ad companies really likes to know which browser you have so that they can force their ads upon you depending on browser by exploiting the specific vulnerabilities.
Re: (Score:2)
But they do it for a reason: their short-term bottom-line. It's a tragedy-of-the-commons situation.
Each ad company benefits by being scummy. It harms the ad ecosystem overall, and wouldn't happen if there was a monopoly where only one ad company existed.
Re: (Score:2)
Why would I want to help defeat spoofing? (Score:5, Interesting)
If a user has gone to the trouble of configuring a browser (or plugin) to spoof which browser they are using, why would I want to help researchers circumvent that?
If there's a good reason to defeat an intentional user choice, I'd love to hear it.
Re: (Score:1)
Now, as the Devil's Advocate, my argument is that if these researchers can beat browser fingerprinting, it's only a matter of time before a well-funded advertiser does the same, possibly in secrecy. By making their research openly accessible, the people who make spoofing plugins get a chance to harden their software before this next-gen fingerprinting tech becomes common among advertisers.
That's not a Devil's Advocate argument. That's reality. Ideally, with randomized headers and a 2 or 3 hop Tor base implementation, all advertiser tracking could end tomorrow. (3 letters could obviously still easily track a 2 or 3 hop Tor implementation)
Re: (Score:1)
Re: (Score:2)
Are you saying that browser spoofing is equivalent to falsifying credentials? That would be a frightening precedent...
Re: (Score:2)
> But you are not, however, free to falsify your credentials
Of course you are. Because most ToS do not include anything about browser modifications or even any requirements which browsers you are allowed to use.
Re: (Score:3)
Next you'l be claiming that a person must own an 80" XHD TV because the content producer has the right to display their content in the manner in which they intended. You're full of shit.
If they were supplying the internet connection, the computer, and the electricity, they still wouldn't have that right, because what happens in my home is my business, not theirs.
And in case you haven't noticed, people already have decided to "go elsewhere" when sites insist on blocking ad blockers (and most of the blocks
Re: (Score:2)
No, it isn't. Especially on the web where it is well known that screen sizes vary and many browsers are in use.
But even print publishers have no right to demand specific lighting, lack of tinted glasses, or even that I not cut the ads out before I read it. I can even black out teeth and add horns to people in the pictures if that amuses me.
Re: (Score:1)
Re: (Score:1)
It is the content producer's right to display their content in the manner in which they intend
It is, and if they wish to control display, then publicly served HTML is not the way to go.
Re: (Score:1)
The website responded with
Your user-agent string specifies your browser as being a variant of CHROME.
Judging by your fingerprint we believe your browser is a variant of EDGE.
Tim S.
double plus ungood (Score:4, Informative)
You do not call it "fighting spoofing". You must call it "reducing privacy, usability and anonymity". Doesn't sound so good now, does it?
Running Firefox with NoScript (Score:1)
Tim S.
Your user-agent string specifies your browser as being a variant of FIREFOX.
Judging by your fingerprint we believe your browser is a variant of IE.
Re: (Score:2)
Re: (Score:2)
University of Adelaide
It's an ex-prison colony. They probably like searching your prison cell at random times just out of habit.
Palemoon and some addons solve all lifes problems. (Score:1)
Cookie Monster - https://addons.mozilla.org/en-... [mozilla.org]
RequestPolicy - https://addons.mozilla.org/en-... [mozilla.org]
NoScript - https://addons.mozilla.org/en-... [mozilla.org]
Secret Agent - https://www.dephormation.org.u... [dephormation.org.uk]
No java, no flash. Good luck finger printing that.
Pair digital fingerprinting with AI and Internet p (Score:2)
doesn't work without running their payload (Score:1)
I tried it. It pops up a page that says "Please wait..." with an icon to "Get Adobe Flash". That's it.
So yet again, it's a malicious technique that only works with the active cooperation of the target. Do not volunteer to run malicious payloads, and you are apparently safe from this.
Re: (Score:2)
Re: (Score:1)
It does need JavaScript,
But it's javascript that leaks so much identifying information. Once you enable javascript, you have lost the battle pretty much no matter what you do.
The best approach is probably a combination of things. Use javascript on a strict whitelist basis, not by default. Whitelist sites you trust that need it for something real. Block all other javascript. That will VASTLY reduce the number of bits of entropy that you leak to web sites, and still let you use your bank and so on.
Sites break with JS because th
Now we need a spoofing AI (Score:2)
Needs work... (Score:2)
Though my User-Agent header clearly says: "FreeBSD", the site claimed, my OS is "likely Windows" :)
Other than that, yes, it is quite amazing, how much info is available to the JavaScript code...
It guessed mine wrong (Score:2)
Re: (Score:2)
Me too.
I tried Browserprint twice just now. Each time, it gave a different browser, none of which were correct. In one case, it even responded that I was using a Mac; but I am using a Windows PC.
How did I defeat it? It was simple. I have Secret Agent from https://www.dephormation.org.u... [dephormation.org.uk] installed.
Browserprint is not new. I first tried Browserprint almost a year ago. I have also tried Panopticlick several times. Secret Agent always defeats the attempt to identify my browser.