Fingerprinting thread.
Previous thread: >>55347948
http://browserprint.info/
http://panopticlick.eff.org/
http://browserleaks.com/
What is fingerprinting?
Fingerprinting is a new way of tracking you across websites, it's not theoretical, it's being done right now by companies like Google.
Why is it scary?
Because unlike cookie based tracking you can't defeat it just by disabling cookies.
There is currently NO FOOLPROOF DEFENCE against fingerprinting.
Attempts have been made but the technology is just too new.
Google releases limited hangout of how much they know about you:
https://news.slashdot.org/story/16/06/29/2038257/googles-my-activity-reveals-how-much-it-knows-about-you
>Oh, they're just remembering what YouTube videos I watched, nothing creepy about that, I already knew they were doing it!
>I guess all those people who fear tracking really are just conspiracy theorists!
ReCAPTCHA probably contains fingerprinting code:
https://archive.is/9K5gs
This means that the majority of 4chan users could be being fingerprinted, and Google might know about your shitposting habits.
To fix this you can get a pass (which allows you to be tracked by 4chan in a different way), or run 4chan with the no JavaScript CAPTCHA (use 4chan X to make 4chan without JS bearable).
Daily reminder to do all your Facebook / Youtube / LinkedIn / botnet shit in a completely separate browser to your Googling or buying shit.
It's currently the ONLY way to truly defend against fingerprint tracking.
Double points if you have each browser running in a different VM with a different OS.
Triple points if you have each browser's VM configured with a different VPN.
The Tor Browser Bundle is still susceptible to many fingerprinting attacks that can uncover your true OS and browser.
Spoofing your user-agent is counterproductive unless you use a different user-agent for every site, even if you rotate them every x HTTP requests.
>run 4chan with the no JavaScript CAPTCHA (use 4chan X to make 4chan without JS bearable).
I just get a black box if I disable the Google scripts, is it only certain 4chanX forks that do this?
>>55364774
Yeah I'm in the same boat.
When I disable all scripts the CAPTCHA stops working.
It's buggy as fuck.
Only works for some people.
4chan X doesn't do anything for the CAPTCHA, it just makes 4chan not shit with scripts disabled.
Jackie 4chan should really fix this
>>55364561
Trying 4chan X now, it doesn't seem to work very well.
>>55364774
Check "Force Noscript Captcha".
>>55365856
Yeah mine's only captcha option is "Use Legacy Captcha"
>>55365869
Sounds like you're using one that doesn't have it then. The one at
https://www.4chan-x.net/
can do it.
>>55365856
I got the noscript captcha working. It seems that I still need to allow scripts on 4chan to post with the quickreply window and 4cdn to use the autorefresh, and the catalog.
>>55365869
I'm using version 1.11.35.9 (shows up in the top right hand side of the settings menu) and have the options:
>Captcha Fixes: Make captcha easier to use, especially with the keyboard.
>Use Recaptcha v1: Use the old text version of Recaptcha in the post form.
>Use Recaptcha v1 in Reports: Use the text captcha in the report window.
>Force Noscript Captcha: Use the non-Javascript fallback captcha even if Javascript is enabled (Recaptcha v2 only).
>>55364561
Am I fine if I use a mobile app?
>>55366293
Probably not unless it presents you with the no-JS CAPTCHA
>>55366338
So google can still track my shitposts if I used overchan or clover?
>>55366293
Do you have Gapps installed?
>>55366139
I'd assume that's the case. Problem is loadletter's fork is the only one that works for my browser
>>55366369
No. I haven't removed that yet.
>>55366354
Potentially.
Check if your app has a force-no-JS-CAPTCHA option
>>55366406
I don't think overchan has that option because I would have seen it by now.
>>55366394
If you haven't removed Gapps then Google is collecting basically everything you do on your phone, including your call info and your texts.
>>55366139
>https://www.4chan-x.net/
That site and https://ccd0.github.io/4chan-x/ are the exact same site made by the same person, right?
>>55366453
Yes. The script was moved to 4chan-x.net so that updates still work if Github ever decides they don't want it there.
>>55366389
Opera 12?
>>55366526
Yup
What if I get new ISP and a new computer every time I want to google something?
>retrieving your browser info is 'new technology'
god you people are so fucking retarded
>>55366559
That might work.
Until you log in to a website.
>>55364561
Well fuck. were all screwed. fuck this Im moving to sweden.
Oh look, newbabby just discovered a """new""" type of supercookie! Congrats! Are you impressed with yourself now?
>it's being done right now by companies like Google.
You can't make a claim without showing proof.
>>55366572
It's not the collection of information, it's the use of information to track you across websites.
>>55364561
>Google releases limited hangout of how much they know about you:
>https://news.slashdot.org/story/16/06/29/2038257/googles-my-activity-reveals-how-much-it-knows-about-you
>>Oh, they're just remembering what YouTube videos I watched, nothing creepy about that, I already knew they were doing it!
>>I guess all those people who fear tracking really are just conspiracy theorists!
I do all my creepy shit on a secure laptop via the neighbors wifi. The local cable company sets the default password as the users phone number, so it's just a matter of bruteforcing a 10 digit number.
I do wonder what kind of information is stored about me. I used google for years before I paid any attention to privacy.
If you delete your account, they claim all data is "anonymized" within 18 months. I wonder if that's true, and how anonymous it really is..
>>55366601
>You can't make a claim without showing proof.
Ok. Easy.
https://yro.slashdot.org/story/16/05/19/232216/google-is-a-serial-tracker
>shows that Google, through multiple domains, is tracking users on around 80 percent of all Top 1 Million domains.
>Additionally, besides tracking scripts, HTML5 canvas fingerprinting and WebRTC local IP discover, researchers discovered a new user fingerprinting technique that uses the AudioContext API.
I've read the paper and that summary is accurate.
>>55366616
Using your neighbor's wifi won't help against these techniques, IP address is generally ignored since it's not consistent for most people.
Even if they anonymise the data after 18 months it's still stored in back up and such.
>>55366630
Where does it say specifically that google uses it? Oh right it doesn't.
>>55364561
>Daily reminder to do all your Facebook / Youtube / LinkedIn / botnet shit in a completely separate browser to your Googling or buying shit.
>It's currently the ONLY way to truly defend against fingerprint tracking.
>>55366731
Do you have a better solution?
AFAIK there are no extensions out that spoof your fingerprint, except for user-agent, and even if there was those could be defeated by just inventing new fingerprinting attacks.
The Tor Browser Bundle provides some protection against fingerprinting but is still susceptible to AudioContext API fingerprinting and fingerprinting that detects your underlying OS and browser / browser version.
You can go full no JavaScript, but that'll break most of the internet.
>>55366772
Ever heard of a fucking adblocker you fucking imbecile?
I see you've been making them the entire day with no more than ~40 replies. Time to fuck off and go yap this shit to someone who actually cares.
>>55366809
well the real way is not not use facebook at all, but a shill wouldn't know that
>>55366809
>Ever heard of a fucking adblocker you fucking imbecile?
>He thinks an ad blocker will do shit against fingerprinting
>He doesn't even know what fingerprinting is
>>55366831
Are you having a stroke or did you reply to the wrong post? And no I don't use facebook.
>>55366843
Tell me, dumb animeposter, exactly how do tracking scripts get around adblockers? Without resorting to greentext and memery, please.
>>55366831
Not everybody wants to isolate themselves from the world.
Not everybody wants to cut themselves off from the countless services that require a login.
>>55366884
>you need a facebook or it's impossible to stay in touch
>>55366884
Buy a telephone retard if you want to stay in contact with people.
>>55366881
Ad blockers generally only block advertising scripts.
Sure you can use extra lists like the AdBlock Plus anti-social list, but they only block obvious stuff like if your fingerprint script is called fingerprint.js.
>>55366922
>>55366902
Also means you can never buy anything online unless it's with a cryptocurrency.
Also means you can't use government websites or insurance websites that require login.
Also means you can never use an online repository that has your real name attached to it.
Etc etc
>>55366843
>fingerprinting
The buzzword caught on...
>>55366922
>tinfoil hatter to the point that he won't use websites that require login
>uses a fucking cellphone
TOP KEK.
That's some bizarre double standards
>>55366948
>Also means you can never buy anything online unless it's with a cryptocurrency.
What the fuck? I haven't had a Facebook in years and buy shit online all the time.
>Also means you can't use government websites or insurance websites that require login.
I've never seen a site where it was mandatory to have a Facebook to log in other than Facebook. Sure there are a lot where you can use your Facebook account, but it's nothing more than an option.
>Also means you can never use an online repository that has your real name attached to it.
Sure you can.
>>55366924
The whole point of tracking you is so they can serve you relevant ads. What incentive is there for them to go out of their way to track you when you've already blocked their ads and their *most obvious* trackers?
Give me a live example of the non obvious stuff before you spout FUD.
>>55366881
Not him but you're a fucking idiot. In firefox it's currently difficult (impossible?) to hide system fonts from websites. Canvas information is also hard to hide, as is screen size. The tor browser has patches for these things, but it's not available as simply an add-on, they compiled it in.
>>55366983
You don't seem to understand.
It doesn't matter if they get your real name from facebook, your credit card, or your github account, once they have it your browsing habits are no longer anonymous
>>55367032
You don't seem to understand. The claim was that you need a Facebook account to do that shit. You don't need it for any of it
>credit card
I've only got a prepaid debit card
>>55367009
>difficult (impossible?) to hide
Difficult things like BLOCKING JAVASCRIPTS? Because that's how they get you system font or whatnot, VIA JAVASCRIPT
You're the fucking idiot. Learn how a computer works you fucking retard.
>>55366559
If you use the same browser on the new machine with saved settings, there's a chance it still wouldn't help. Especially if you imported cookies or something dumb like that.
>>55366601
>>55366711
Well, if you just want proof that large tracking companies are using it, AddThis was the first to be outed, and they've since admitted it.
>>55366991
Why would they stop tracking you just because you block ads?
That doesn't make sense at all.
Your info is still valuable as statistical info.
Your info is still valuable to governments.
Your info is still valuable for customizing your web experience (e.g. showing you items on Amazon you're more likely to want to purchase).
Your info is still valuable to employers, and we might see a future where they can buy your browsing habits as a sort of background check when you apply for a job.
>>55367061
Where did I claim facebook was a requirement?
It's just an example of an obvious pool of personal info
>>55367064
Oh really? Are you going to keep talking out of your ass now?
>>55367153
Also, OP can you add the site:
ip-check.info
to the OP next time? It's a good site, just ignore their push for their own product.
>>55366881
By not serving ads, and hence never being added to a block list. Even so, there are fingerprintable exploits that don't involve running scripts or user agent strings. Other HTTP header exploits, TCP header and timing analysis, or really any of the same stuff used in OS fingerprinting. No existing adblocker currently even defeats the simple panopticlick demo from the EFF.
>>55367180
Will do.
It's a good site
>>55367032
Do government websites really use google analytics now? We should complain to our senators of the privacy breach that represents.
>>55366991
They never stop looking for ways to make ads unblockable. We shouldn't let them get away with making us un-untrackable.
>>55367153
I'M talking out of MY ass? HOW THE FUCK IS FINGERPRINTING DONE WITHOUT JAVASCRIPT HOLY FUCK YOU FUCKING MORON
YOU'VE NEVER WRITTEN A SINGLE FUCKING LINE OF CODE IN YOUR LIFE, HAVE YOU
YOU MUST BE SOOO PROUD OF YOURSELF HAVING JUST FOUND THIS BOARD AND READ A FEW SHITPOSTS AND THINK YOU KNOW SHIT ALL ABOUT COMPUTERS
GET THE FUCK OUT
>>55367086
Oh look, more tinfoil bullshit and still no live instance where this is actually happening.
Let me guess, you found /g/, or maybe 4chan in general too, a couple months ago?
>>55367253
Literally addressed none of my arguments.
>>55367272
You didn't make an argument. You asked what incentive to blah blah blah blah blah.
>>55367224
Well, I'm sure some pool your basic info with trackers, but I doubt they all do.
I probably got a bit ahead of myself.
That being said both the Australian Liberal and Labor party's websites serve Google scripts.
Pretend I didn't say government websites and instead said job applications.
>>55367272
I literally showed a screenshot of that site (ip-check.info) grabbing my screen size and detecting my system fonts. I'm convinced at this point you're simply trying to troll; either that or stop using all caps, it's annoying.
>>55367272
The best fingerprinting tests rely on JavaScript, that's true.
But not all of them do.
Additionally some websites require JS to be enabled to work, so it's a choice between risking being fingerprinted or not using the site at all.
Disabling JavaScript completely is far too restrictive for normies and casuals to do
>>55367326
It's a troll, dude.
>>55364561
>There is currently NO FOOLPROOF DEFENCE against fingerprinting.
Can't you just block scripts and randomize your user agent? It seems like almost all of the currently available fingerprinting techniques require javascript and the information they would be able to get through the ones that don't really wouldn't be enough to reliably identify you out of all the other people who care about privacy on the internet.
>>55367361
Which is why we need something new. A way to make javascript lie tactically to be less fingerprintable but still potentially let websites function.
>>55367382
Nope. They have enough other stuff to stiil track you. Try out the provided fingerprinting demos. JS+UA doesn't work.
>>55367382
I would say that currently that could work, for some cases, provided you didn't use the same user-agent string on multiple websites.
But when people start doing that the trackers will just shift their focus away from user-agent string and rely on other parts of your fingerprint that aren't as easy to spoof.
It's not a perfect solution
>>55367272
>YOU'VE NEVER WRITTEN A SINGLE FUCKING LINE OF CODE IN YOUR LIFE, HAVE YOU
Words you'll never hear:
"Is that the code-monkey's Ferrari?"
I've never written code in my life, I'm proud to say. And if having written code, even for money, is your life's highlight you must live in pretty humble circumstances.
If I need code written there are always dozens of un/under-employed code-monkeys to do it for me.
>>55367153
>>55367326
There's a way you can stop it from detecting your system fonts (other than disabling CSS) but I can't remember how.
>>55367189
>By not serving ads, and hence never being added to a block list.
Google analytics doesn't serve ads and they still get blocked by ad blockers. You do realize adblockers despite their name block more than just ads, right?
>>55367305
>You asked what incentive to blah blah blah blah blah.
That is the argument since I'm saying there's no incentive. And also I asked you to provide an instance where a tracking script bypasses adblockers, which is another argument.
>>55367326
>detecting my system fonts
No they didn't. Pic related is what it would show if they can detect your fucking system fonts.
>enable "force noscript captcha"
>captcha window just says "sorry, something went wrong"
help?
>>55367482
Doesn't do a thing about e-tags or other HTTP exploits.
>>55367556
I stand corrected, but this is the message they give me.
>>55367153
>>55367608
How exactly would the server detect your system fonts with javascript disabled? Sure the local page could know what fonts you have, but unless every link on that page then sends a hash of that back to the server in the link (which could be stopped with an addon like Clean Links) how are they going to get that information back to the sever?
>>55367616
Nevermind, the @font-face attribute makes your browser request the fonts if you don't have them which is done without javascript. They could tell by what fonts you needed to request.
>>55367556
Well let's go for the obvious:
Browserprint.info
The fingerprinting scripts are not blocked by Adblock, Adblock Plus, or uBlock
>>55367572
Yeah noscript captcha is broken for a lot of people
>>55367608
The fuck? That gibberish is the webfont they fucking sent you. How the fuck does that count as part of your system fonts?
>>55367682
>The fingerprinting scripts are not blocked by Adblock, Adblock Plus, or uBlock
Well no fucking shit! They didn't exclude it from blocklists because they weren't aware of it
>>55367695
Your blind faith in ad blocking software is disturbing.
Ad blockers are very primitive and rely on a lot of work by humans
>>55367695
>The fuck? That gibberish is the webfont they fucking sent you. How the fuck does that count as part of your system fonts?
see >>55367661
>>55367744
I don't have blind faith in adblockers. I have blind faith in ad companies to not bother to spend time and resources on tracking me across websites when they can't even monetize it.
>>55367828
You can block webfonts in ublock.
>>55367837
I costs nothing extra to track you despite you blocking ads, in fact it would cost them time to provide you special treatment.
And they can monetize it
>>55367837
They can still sell the data. We're in the midst of a datamining boom. Everyone wants to do it these days, so they all want huge datasets.
It's OK, they can't track me because I have Do Not Track enabled
>>55367938
Really? It costs them no effort, no money having to consistently buy up new, stealth domains to bypass blocklists and invest in tracking solutions beyond javascript?
>>55367981
Nope. They just make their service/content break when you don't run their ad scripts. For a particularly adamant example of this, see http://streamlive.to/
>>55368028
Or maybe I'll just not visit malicious streaming websites. Who the fuck even uses those in this day and age?
>>55368028
>For a particularly adamant example of this, see http://streamlive.to/
Source?
>>55367153
>>55367326
>>55367517
>>55367608
>>55367616
>>55367661
The way to stop the font detection is by setting gfx.downloadable_fonts.enabled to false in your about:config. Only problem is that you would be surprised about how many icons you come across that are actually fonts.
>>55367981
>stealth domains
If you didn't see earlier in the thread, Google fingerprints through their Captcha service that they host on google.com and gstatic.com. They aren't stealth domains, they're domains that some websites need you to allow scripts from to function. Stealth domains are easy to take care of if you use uMatrix and simply don't allow the scripts that you don't need, malicious scripts hosted on common websites that also have needed scripts are much worse.
Can anybody explain the CSS only font test on JonDo's IP check?
BUT there is one FOOLPROOF WAY to avoid being tracked fingerprinted v& for anything on the internet....
QUIT THE INTERNET.
>>55368998
gud idea.
>>55368998
Nice blog
