Hacker News Reader

Comment by manaskarekar | Hacker News Reader

Unfortunately with supercookies, IP address-based identification (maybe even machine signature based id-ing?) and such, I think incognito mode is practically a placebo.

View on HN

You'd be wrong. Try this from incognito: https://panopticlick.eff.org/

I did... unique among their database...

You may be unique, but within a very small pool. For example, my current user agent string alone narrows me down to within one in ~2-3 million users/browsers. When taken with the intersection of all those other bits, it's very easy to get an incredibly high-resolution snapshot of an individual...

Same here.

I have no idea what "unique, but within a very small pool" is supposed to mean.

Unique means "only one."

One in a million.

One in a billion.

Do you think those two are the same?

Ack, typo. What I meant to say was that, even if you're not completely uniquely identified by your information, if you're so rare that only a few people on earth have your information, it's just as bad.

I'm looking at this from a different direction. I don't want my fingerprint to be unique, unless it is truly random on every request. I don't want any server to be able to tie any two requests of mine together without my permission (in the form of headers/cookies). That's the whole cookie/tracking argument right there. If you are isolated from a crowd, unique, then you can be tracked and analyzed.

I used Panopticlick, and no one else who has used Panopticlick had the same fingerprint. The meat of the uniqueness was in Browser Plugins and System Fonts. Think about that... If you've installed a few random fonts you found online, you're probably sending a unique font signature. If you've grabbed a few plugins, messed around with extensions, then you're probably sending a unique plugin signature.

I'm aware of that link and here's my result in Chrome on Incognito.

  Within our dataset of several million visitors, only one in 1,172,808 browsers have the same fingerprint as yours.

  Currently, we estimate that your browser has a fingerprint that conveys 20.16 bits of identifying information.

I changed my user agent string & managed to get down to 15.99 bits of information (one in 65,161). Curious if anyone did better.

Would you care to go into detail about what you changed? Wouldn't changing too much make a user agent stand out?

Now I come to think about it, changing the GB to US in my user agent would probably make it less unique.

Then you'd be a British IP with a US user agent, which is probably a ton of bits. I just used User Agent Switcher & changed it to firefox 5.0 under XP.

10.9 bits, 1 in 1900 some odd.

Running Firefox with no-script/ad-block/request policy + UA string set to IE 8. Sites I enable scripting on will surely get more info.

Chrome without incognito: Your browser fingerprint appears to be unique among the 2,347,127 tested so far.

Currently, we estimate that your browser has a fingerprint that conveys at least 21.16 bits of identifying information.

"supercookies"? What's that?

You can read a three part series on this : https://www.eff.org/deeplinks/2009/09/new-cookie-technologie...

In short: http://en.wikipedia.org/wiki/HTTP_cookie#Supercookie

Reply on news.ycombinator.com