EFF Launches Panopticlick 2.0
panopticlick.eff.org
panopticlick.eff.org
Even with this new version of Panopticlick and its associated help pages, it's disturbing to know that browser fingerprinting cannot be completely defeated.
In the help page, the recommended limited effect approaches to handle browser fingerprinting are:
1. Use Tor - this is probably useless for most people due to the low speed of browsing (I know everyone has to pitch in to share bandwidth with others, but this is not an easy compromise at all).
2. Use Privacy Badger - I do use it with Firefox and Chrome, but it's not available for other browsers, which is not ideal for me.
3. Use NoScript - I tried this a long time ago and found that it crippled almost every site I regularly visited. I realized this was too heavy and cumbersome a solution. I can easily recommend uBlock Origin and Privacy Badger to other non-technical people, knowing that those wouldn't usually cause issues with websites. But it's not possible to recommend NoScript to non-technical users who just want to get things done.
My earlier conclusion on browser fingerprinting was that ironically, it usually traps the more technical and privacy oriented people who may use more of the unpopular solutions in order to derive privacy and security related benefits.
I wish there were easier ways to defeat browser fingerprinting, because we may not even know which sites are using it to track us (unlike say, cookies or super cookies, where the evidence is usually visible).
I know about the options NoScript provides, but I see this statement itself as part of the problem. If we just whitelist sites that we use and see (to have them work), we're not really stopping tracking, are we? We're just guarding against unknown sites. Most people visit perhaps 10 major sites on a regular basis everyday, and all the popular ones that people would whitelist use trackers.
I'm not denying the benefit of being protected from unknown, obscure and malicious sites that we may land in once in a while and things like XSS protection, but that alone is not enough in this context.
What we need is either a trusted block-list for NoScript that's updated periodically, similar to block-lists that exist for ad-blockers, or some other mechanism that can curb the tracking potential of scripts (I don't know the answer for the latter).
There are extensions/add-ons to very easily change your user-agent on the fly, on Firefox I can recommend https://addons.mozilla.org/en-US/firefox/addon/user-agent-sw...
There should be an extension to randomize headers / and strings in a certain interval by itself, or maybe just based on a number of possibilities provided by the user.
So it would never (well at least not often) brake anything, because it would never say "I don't have flash, I don't have java" but it would always report different versions and mix it up. Sounds quite possible, any Firefox Add-On Developer reading this? ;)
Some discussion yesterday: https://news.ycombinator.com/item?id=10753087
This is interesting because IMO, "Do Not Track" is basically another flavor of Trusted Computing, which the EFF has been critical of before.
https://www.eff.org/pages/understanding-effs-do-not-track-po...
It checks if you really lose cookies and supercookies on browser exit.
> your browser has a nearly-
> unique fingerprint
Clicking the link and getting more details about what they look at is very interesting. I'm particularly interested in the hashing of the WebGL and canvas contexts and how reliable and unique those turn out to be.
"User Agent" "Mozilla/5.0 (X11; FreeBSD amd64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36"
OK then. I suppose this implies I was the 6193830-st person to run it from a desktop like mine.
"The method is based on the fact that the same canvas-code can produce different pixels on a different web browsers, depending on the system on which it was executed."