Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #10741 > unrolled thread

Browser fingerprinting?

Back to article view | Back to comp.lang.php

Contents

  Browser fingerprinting? Gilles <nospam@nospam.com> - 2013-09-12 23:56 +0200
    Re: Browser fingerprinting? Denis McMahon <denismfmcmahon@gmail.com> - 2013-09-12 22:26 +0000
      Re: Browser fingerprinting? Gilles <nospam@nospam.com> - 2013-09-13 00:38 +0200
        Re: Browser fingerprinting? Gilles <nospam@nospam.com> - 2013-09-13 00:43 +0200
          Re: Browser fingerprinting? Denis McMahon <denismfmcmahon@gmail.com> - 2013-09-12 23:29 +0000
            Re: Browser fingerprinting? Gilles <nospam@nospam.com> - 2013-09-13 09:23 +0200
              Re: Browser fingerprinting? Jerry Stuckle <jstucklex@attglobal.net> - 2013-09-13 09:32 -0400
      Re: Browser fingerprinting? Twayne <nobody@spamcop.net> - 2013-09-13 19:13 -0400
        Re: Browser fingerprinting? Christoph Michael Becker <cmbecker69@arcor.de> - 2013-09-14 01:30 +0200
    Re: Browser fingerprinting? jimp@specsol.spam.sux.com - 2013-09-12 22:19 +0000
    Re: Browser fingerprinting? Jerry Stuckle <jstucklex@attglobal.net> - 2013-09-12 20:31 -0400
      Re: Browser fingerprinting? "J.O. Aho" <user@example.net> - 2013-09-13 06:59 +0200
    Re: Browser fingerprinting? Fiver <numeralfive@gmail.com> - 2013-09-13 05:04 +0200
      Re: Browser fingerprinting? Michael Vilain <vilain@NOspamcop.net> - 2013-09-12 22:49 -0700
        Re: Browser fingerprinting? Jerry Stuckle <jstucklex@attglobal.net> - 2013-09-13 09:35 -0400
        Re: Browser fingerprinting? Martin Leese <please@see.Web.for.e-mail.INVALID> - 2013-09-13 08:42 -0600
        Re: Browser fingerprinting? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-09-15 20:57 +0200
      Re: Browser fingerprinting? Gilles <nospam@nospam.com> - 2013-09-13 09:22 +0200
        Re: Browser fingerprinting? Twayne <nobody@spamcop.net> - 2013-09-13 19:30 -0400
          Re: Browser fingerprinting? Gilles <nospam@nospam.com> - 2013-09-15 00:11 +0200
            Re: Browser fingerprinting? Twayne <nobody@spamcop.net> - 2013-09-15 16:27 -0400
              Re: Browser fingerprinting? "Peter H. Coffin" <hellsop@ninehells.com> - 2013-09-15 21:07 -0500
              Re: Browser fingerprinting? Gregor Kofler <usenet@gregorkofler.com> - 2013-09-16 11:36 +0200
                Re: Browser fingerprinting? Twayne <nobody@spamcop.net> - 2013-09-17 20:02 -0400
                  Re: Browser fingerprinting? "Peter H. Coffin" <hellsop@ninehells.com> - 2013-09-17 22:47 -0500
              Re: Browser fingerprinting? Norman Peelman <npeelman@cfl.rr.com> - 2013-09-16 06:13 -0400
                Re: Browser fingerprinting? Denis McMahon <denismfmcmahon@gmail.com> - 2013-09-16 11:03 +0000
                  Re: Browser fingerprinting? Twayne <nobody@spamcop.net> - 2013-09-17 20:11 -0400
                Re: Browser fingerprinting? Twayne <nobody@spamcop.net> - 2013-09-17 20:06 -0400
                  Re: Browser fingerprinting? The Natural Philosopher <tnp@invalid.invalid> - 2013-09-18 01:33 +0100
            Re: Browser fingerprinting? Marc van Lieshout <invalid@example.com> - 2013-09-17 22:53 +0200
              Re: Browser fingerprinting? Twayne <nobody@spamcop.net> - 2013-09-17 20:20 -0400
              Re: Browser fingerprinting? Denis McMahon <denismfmcmahon@gmail.com> - 2013-09-18 05:06 +0000
                Re: Browser fingerprinting? Scott Johnson <noonehome@chalupasworld.com> - 2013-09-18 06:09 -0700
                  Re: Browser fingerprinting? "J.O. Aho" <user@example.net> - 2013-09-18 18:24 +0200

Page 1 of 2  [1] 2  Next page →

#10741 — Browser fingerprinting?

Hello

I googled the archives of this ng, but didn't find much.

I'd like to find some good PHP code that does what Panopticlick does,
namely uniquely identify a user's browser even when they connect as
anonymously as they can, ie. either in incognito mode or by running a
browser in a virtual host:

www.lifehacker.com/5458513/panopticlick-shows-how-easy-your-browser-is-to-track

The goal is to keep trolls away from a site. As there aren't that many
browser available, they should tire quickly, profited they even think
of installing another browser.

Is there some code PHP code for that?

Thank you.

[toc] | [next] | [standalone]

#10742

On Thu, 12 Sep 2013 23:56:12 +0200, Gilles wrote:

> I googled the archives of this ng, but didn't find much.

Did you try a wider google search?

http://www.lmgtfy.com/q=php+browser+fingerprinting

-- 
Denis McMahon, denismfmcmahon@gmail.com

[toc] | [prev] | [next] | [standalone]

#10744

On Thu, 12 Sep 2013 22:26:46 +0000 (UTC), Denis McMahon
<denismfmcmahon@gmail.com> wrote:
>Did you try a wider google search?
>
>http://www.lmgtfy.com/q=php+browser+fingerprinting

Yes, but mostly found some theoretical discussions rather than some
actual working solution.

[toc] | [prev] | [next] | [standalone]

#10745

On Fri, 13 Sep 2013 00:38:57 +0200, Gilles <nospam@nospam.com> wrote:

>On Thu, 12 Sep 2013 22:26:46 +0000 (UTC), Denis McMahon
><denismfmcmahon@gmail.com> wrote:
>>Did you try a wider google search?
>>
>>http://www.lmgtfy.com/q=php+browser+fingerprinting
>
>Yes, but mostly found some theoretical discussions rather than some
>actual working solution.

I'll experiment with eg. "md5(implode('',$_SERVER));" and see how it
goes.

Thank you.

[toc] | [prev] | [next] | [standalone]

#10746

On Fri, 13 Sep 2013 00:43:49 +0200, Gilles wrote:

> I'll experiment with eg. "md5(implode('',$_SERVER));" and see how it
> goes.

Comparing md5s of anything that contains timestamps is unlikely to match 
across multiple checks.

Comparing md5s of anything that contains remote ports is unlikely to 
match across multiple browser sessions.

Comparing md5s of anything that contains remote ip addresses is unlikely 
to uniquely identify any sort of malicious user using proxies / tor etc.

Note - it's a lot easier to work out what won't work than to work out 
what will.

-- 
Denis McMahon, denismfmcmahon@gmail.com

[toc] | [prev] | [next] | [standalone]

#10752

On Thu, 12 Sep 2013 23:29:14 +0000 (UTC), Denis McMahon
<denismfmcmahon@gmail.com> wrote:
>Note - it's a lot easier to work out what won't work than to work out 
>what will.

Thanks for the tip. This looks interesting:

"Is browser fingerprinting a viable technique for identifying
anonymous users?"
http://programmers.stackexchange.com/questions/122372/

[toc] | [prev] | [next] | [standalone]

#10753

On 9/13/2013 3:23 AM, Gilles wrote:
> On Thu, 12 Sep 2013 23:29:14 +0000 (UTC), Denis McMahon
> <denismfmcmahon@gmail.com> wrote:
>> Note - it's a lot easier to work out what won't work than to work out
>> what will.
>
> Thanks for the tip. This looks interesting:
>
> "Is browser fingerprinting a viable technique for identifying
> anonymous users?"
> http://programmers.stackexchange.com/questions/122372/
>

No.

You can't stop the trolls.  And some are more technically literate than 
you think.  After all, they're used to being banned, and have learned 
how to get around those bans.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10756

On 2013-09-12 6:26 PM, Denis McMahon wrote:
> On Thu, 12 Sep 2013 23:56:12 +0200, Gilles wrote:
>
>> I googled the archives of this ng, but didn't find much.
>
> Did you try a wider google search?
>
> http://www.lmgtfy.com/q=php+browser+fingerprinting
>
That link now seems to be a 404

[toc] | [prev] | [next] | [standalone]

#10757

Twayne wrote:

> On 2013-09-12 6:26 PM, Denis McMahon wrote:
>> On Thu, 12 Sep 2013 23:56:12 +0200, Gilles wrote:
>>
>>> I googled the archives of this ng, but didn't find much.
>>
>> Did you try a wider google search?
>>
>> http://www.lmgtfy.com/q=php+browser+fingerprinting
>>
> That link now seems to be a 404

It should have been:

<http://www.lmgtfy.com/?q=php+browser+fingerprinting>

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

#10743

Gilles <nospam@nospam.com> wrote:
> Hello
> 
> I googled the archives of this ng, but didn't find much.
> 
> I'd like to find some good PHP code that does what Panopticlick does,
> namely uniquely identify a user's browser even when they connect as
> anonymously as they can, ie. either in incognito mode or by running a
> browser in a virtual host:
> 
> www.lifehacker.com/5458513/panopticlick-shows-how-easy-your-browser-is-to-track
> 
> The goal is to keep trolls away from a site. As there aren't that many
> browser available, they should tire quickly, profited they even think
> of installing another browser.
> 
> Is there some code PHP code for that?
> 
> Thank you.

Look at the PHP documentation for the get_browser function.

Be sure to read all the notes.

FYI it is rather trivial to fake what browser is in use.



-- 
Jim Pennino

[toc] | [prev] | [next] | [standalone]

#10747

On 9/12/2013 5:56 PM, Gilles wrote:
> Hello
>
> I googled the archives of this ng, but didn't find much.
>
> I'd like to find some good PHP code that does what Panopticlick does,
> namely uniquely identify a user's browser even when they connect as
> anonymously as they can, ie. either in incognito mode or by running a
> browser in a virtual host:
>
> www.lifehacker.com/5458513/panopticlick-shows-how-easy-your-browser-is-to-track
>
> The goal is to keep trolls away from a site. As there aren't that many
> browser available, they should tire quickly, profited they even think
> of installing another browser.
>
> Is there some code PHP code for that?
>
> Thank you.
>

You can easily detect the browser the user is using, and you can detect 
the IP address.

However, browsers can easily be forged (as others have indicated), and 
since there are only a few browsers available, a lot of people use them.

You can detect IP addresses, but there is no way to determine the REAL 
IP address if the user is using an anonymous proxy.

The bottom line is - you really can't protect against trolls; they have 
too many ways around things.

The article you reference is good marketing material - I would suspect 
it works on both browser and IP address.  But in real life it has more 
holes than swiss cheese.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10749

On 13/09/13 02:31, Jerry Stuckle wrote:
> On 9/12/2013 5:56 PM, Gilles wrote:
>> Hello
>>
>> I googled the archives of this ng, but didn't find much.
>>
>> I'd like to find some good PHP code that does what Panopticlick does,
>> namely uniquely identify a user's browser even when they connect as
>> anonymously as they can, ie. either in incognito mode or by running a
>> browser in a virtual host:
>>
>> www.lifehacker.com/5458513/panopticlick-shows-how-easy-your-browser-is-to-track
>>
>>
>> The goal is to keep trolls away from a site. As there aren't that many
>> browser available, they should tire quickly, profited they even think
>> of installing another browser.
>>
>> Is there some code PHP code for that?
>>
>> Thank you.
>>
>
> You can easily detect the browser the user is using, and you can detect
> the IP address.
>
> However, browsers can easily be forged (as others have indicated), and
> since there are only a few browsers available, a lot of people use them.

The idea with browser fingerprint is to look other things than the 
browser itself as operating system, installed plugins and supported 
fonts, those usually will stay the same even if you change browser, but 
the information need ain't accessible for PHP, you would need to relay 
on javascript and then we are off topic and the OP should be looking for 
answers elsewhere.

-- 

  //Aho

[toc] | [prev] | [next] | [standalone]

#10748

On 2013-09-12 23:56, Gilles wrote:
> I'd like to find some good PHP code that does what Panopticlick does,
> namely uniquely identify a user's browser even when they connect as
> anonymously as they can, ie. either in incognito mode or by running a
> browser in a virtual host:
> 
> www.lifehacker.com/5458513/panopticlick-shows-how-easy-your-browser-is-to-track
> 
> The goal is to keep trolls away from a site.

In that case, forget it.

The Panopticlick demo isn't intended as something to emulate in
practice, but rather as something to be aware of. It works best on
visitors who don't know or don't care about how much information they
divulge. When I visit the demo site with all of the default plugins
enabled, I'm a unique snowflake. On the other hand, if I wanted to hide,
I'd turn plugins and scripting off for that site, and maybe go through a
proxy, and then I'm just one in a million.

If you target your troll too closely, he can trivially evade your
filter. If your constraints are too loose, you'll hit some legitimate
visitors. There's just no way you can win this battle by fingerprinting
the troll.

Forget it.


regards,
5er

[toc] | [prev] | [next] | [standalone]

#10750

In article <l0tvb5$2ot$1@dont-email.me>, Fiver <numeralfive@gmail.com> 
wrote:

> On 2013-09-12 23:56, Gilles wrote:
> > I'd like to find some good PHP code that does what Panopticlick does,
> > namely uniquely identify a user's browser even when they connect as
> > anonymously as they can, ie. either in incognito mode or by running a
> > browser in a virtual host:
> > 
> > www.lifehacker.com/5458513/panopticlick-shows-how-easy-your-browser-is-to-tr
> > ack
> > 
> > The goal is to keep trolls away from a site.
> 
> In that case, forget it.
> 
> The Panopticlick demo isn't intended as something to emulate in
> practice, but rather as something to be aware of. It works best on
> visitors who don't know or don't care about how much information they
> divulge. When I visit the demo site with all of the default plugins
> enabled, I'm a unique snowflake. On the other hand, if I wanted to hide,
> I'd turn plugins and scripting off for that site, and maybe go through a
> proxy, and then I'm just one in a million.
> 
> If you target your troll too closely, he can trivially evade your
> filter. If your constraints are too loose, you'll hit some legitimate
> visitors. There's just no way you can win this battle by fingerprinting
> the troll.
> 
> Forget it.
> 
> 
> regards,
> 5er

I kept getting humans evading my CAPATCHA and sending me marketing SPAM 
through my web site's contact form.  After a while, I would just go 
through the web long and find the IP address that completed the form and 
block the entire subnet.  So far, entire swaths of China, South America, 
and Russia can't view my site.  Their connection is refused based on 
their IP address.

A broad brush, I know, but I haven't had any marketing emails to improve 
my SEO score, improve my site, or better my mortgage interest rate.

-- 
DeeDee, don't press that button!  DeeDee!  NO!  Dee...
[I filter all Goggle Groups posts, so any reply may be automatically ignored]

[toc] | [prev] | [next] | [standalone]

#10754

On 9/13/2013 1:49 AM, Michael Vilain wrote:
> In article <l0tvb5$2ot$1@dont-email.me>, Fiver <numeralfive@gmail.com>
> wrote:
>
>> On 2013-09-12 23:56, Gilles wrote:
>>> I'd like to find some good PHP code that does what Panopticlick does,
>>> namely uniquely identify a user's browser even when they connect as
>>> anonymously as they can, ie. either in incognito mode or by running a
>>> browser in a virtual host:
>>>
>>> www.lifehacker.com/5458513/panopticlick-shows-how-easy-your-browser-is-to-tr
>>> ack
>>>
>>> The goal is to keep trolls away from a site.
>>
>> In that case, forget it.
>>
>> The Panopticlick demo isn't intended as something to emulate in
>> practice, but rather as something to be aware of. It works best on
>> visitors who don't know or don't care about how much information they
>> divulge. When I visit the demo site with all of the default plugins
>> enabled, I'm a unique snowflake. On the other hand, if I wanted to hide,
>> I'd turn plugins and scripting off for that site, and maybe go through a
>> proxy, and then I'm just one in a million.
>>
>> If you target your troll too closely, he can trivially evade your
>> filter. If your constraints are too loose, you'll hit some legitimate
>> visitors. There's just no way you can win this battle by fingerprinting
>> the troll.
>>
>> Forget it.
>>
>>
>> regards,
>> 5er
>
> I kept getting humans evading my CAPATCHA and sending me marketing SPAM
> through my web site's contact form.  After a while, I would just go
> through the web long and find the IP address that completed the form and
> block the entire subnet.  So far, entire swaths of China, South America,
> and Russia can't view my site.  Their connection is refused based on
> their IP address.
>
> A broad brush, I know, but I haven't had any marketing emails to improve
> my SEO score, improve my site, or better my mortgage interest rate.
>

You probably need a different CAPTCHA.  Many of the commonly available 
ones have been broken.

I wrote my own and my spam rate has dropped to zero.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10755

Michael Vilain wrote:

> I kept getting humans evading my CAPATCHA and sending me marketing SPAM 
> through my web site's contact form.  After a while, I would just go 
> through the web long and find the IP address that completed the form and 
> block the entire subnet.  So far, entire swaths of China, South America, 
> and Russia can't view my site.  Their connection is refused based on 
> their IP address.
> 
> A broad brush, I know, but I haven't had any marketing emails to improve 
> my SEO score, improve my site, or better my mortgage interest rate.

You can improve on this by flicking the
power switch on your computer.  Then you
will be guaranteed to receive no SPAM at
all.

-- 
Regards,
Martin Leese
E-mail: please@see.Web.for.e-mail.INVALID
Web: http://members.tripod.com/martin_leese/

[toc] | [prev] | [next] | [standalone]

#10763

Michael Vilain wrote:

> I kept getting humans evading my CAPATCHA and sending me marketing SPAM
> through my web site's contact form.  After a while, I would just go
> through the web long and find the IP address that completed the form and
> block the entire subnet.  So far, entire swaths of China, South America,
> and Russia can't view my site.  Their connection is refused based on
> their IP address.
> 
> A broad brush, I know, but I haven't had any marketing emails to improve
> my SEO score, improve my site, or better my mortgage interest rate.

And no serious attempts at communication from those places either.  Your 
logic is flawed.


PointedEars
-- 
Danny Goodman's books are out of date and teach practices that are
positively harmful for cross-browser scripting.
  -- Richard Cornford, cljs, <cife6q$253$1$8300dec7@news.demon.co.uk> (2004)

[toc] | [prev] | [next] | [standalone]

#10751

On Fri, 13 Sep 2013 05:04:04 +0200, Fiver <numeralfive@gmail.com>
wrote:
>The Panopticlick demo isn't intended as something to emulate in
>practice, but rather as something to be aware of. It works best on
>visitors who don't know or don't care about how much information they
>divulge. When I visit the demo site with all of the default plugins
>enabled, I'm a unique snowflake. On the other hand, if I wanted to hide,
>I'd turn plugins and scripting off for that site, and maybe go through a
>proxy, and then I'm just one in a million.

But then, most trolls aren't technically-savvy, and wouldn't even
think of installing a new browser after being banned.

And even then, after trying Chrome, Firefox, and IE, what else would
most of them think of doing?

I'll read up on what PHP + JS can do about that.

Thank you.

[toc] | [prev] | [next] | [standalone]

#10758

On 2013-09-13 3:22 AM, Gilles wrote:
> On Fri, 13 Sep 2013 05:04:04 +0200, Fiver <numeralfive@gmail.com>
> wrote:
...


  then I'm just one in a million.
>
> But then, most trolls aren't technically-savvy, and wouldn't even
> think of installing a new browser after being banned.
>
> And even then, after trying Chrome, Firefox, and IE, what else would
> most of them think of doing?

They don't need tech-savvy; all they need are the easily available 
spam/scam et al applications of which there are many. There is very 
little you can do about it at all. In the end you can  end up making it 
as hard on humans as it is for robots and other miscreants who want to 
compromise you for whatever reason.
    IMO solid, as unbreakable as you know how to make it, validation is 
about all you can do. If there are no reasons to have tags in anything, 
then strip the out and throw it away. Same for say hex, where there is 
no reason to expect hex in a text. Stop the data and you stop the abuse. 
But of course there is no 100% solution and I doubt there ever will be. 
EVERY data input can be spoofed, so instead of over-watching for that, 
be pro-active about ANY unexpected data!

If it were easy to do, it'd also be widely publicized and available.

HTH,

Twayne`

[toc] | [prev] | [next] | [standalone]

#10762

On Fri, 13 Sep 2013 19:30:18 -0400, Twayne <nobody@spamcop.net> wrote:
>If it were easy to do, it'd also be widely publicized and available.

Thanks for the feedback.

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.lang.php

csiph-web