Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #10741 > unrolled thread

Browser fingerprinting?

Back to article view | Back to comp.lang.php

Contents

  Browser fingerprinting? Gilles <nospam@nospam.com> - 2013-09-12 23:56 +0200
    Re: Browser fingerprinting? Denis McMahon <denismfmcmahon@gmail.com> - 2013-09-12 22:26 +0000
      Re: Browser fingerprinting? Gilles <nospam@nospam.com> - 2013-09-13 00:38 +0200
        Re: Browser fingerprinting? Gilles <nospam@nospam.com> - 2013-09-13 00:43 +0200
          Re: Browser fingerprinting? Denis McMahon <denismfmcmahon@gmail.com> - 2013-09-12 23:29 +0000
            Re: Browser fingerprinting? Gilles <nospam@nospam.com> - 2013-09-13 09:23 +0200
              Re: Browser fingerprinting? Jerry Stuckle <jstucklex@attglobal.net> - 2013-09-13 09:32 -0400
      Re: Browser fingerprinting? Twayne <nobody@spamcop.net> - 2013-09-13 19:13 -0400
        Re: Browser fingerprinting? Christoph Michael Becker <cmbecker69@arcor.de> - 2013-09-14 01:30 +0200
    Re: Browser fingerprinting? jimp@specsol.spam.sux.com - 2013-09-12 22:19 +0000
    Re: Browser fingerprinting? Jerry Stuckle <jstucklex@attglobal.net> - 2013-09-12 20:31 -0400
      Re: Browser fingerprinting? "J.O. Aho" <user@example.net> - 2013-09-13 06:59 +0200
    Re: Browser fingerprinting? Fiver <numeralfive@gmail.com> - 2013-09-13 05:04 +0200
      Re: Browser fingerprinting? Michael Vilain <vilain@NOspamcop.net> - 2013-09-12 22:49 -0700
        Re: Browser fingerprinting? Jerry Stuckle <jstucklex@attglobal.net> - 2013-09-13 09:35 -0400
        Re: Browser fingerprinting? Martin Leese <please@see.Web.for.e-mail.INVALID> - 2013-09-13 08:42 -0600
        Re: Browser fingerprinting? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-09-15 20:57 +0200
      Re: Browser fingerprinting? Gilles <nospam@nospam.com> - 2013-09-13 09:22 +0200
        Re: Browser fingerprinting? Twayne <nobody@spamcop.net> - 2013-09-13 19:30 -0400
          Re: Browser fingerprinting? Gilles <nospam@nospam.com> - 2013-09-15 00:11 +0200
            Re: Browser fingerprinting? Twayne <nobody@spamcop.net> - 2013-09-15 16:27 -0400
              Re: Browser fingerprinting? "Peter H. Coffin" <hellsop@ninehells.com> - 2013-09-15 21:07 -0500
              Re: Browser fingerprinting? Gregor Kofler <usenet@gregorkofler.com> - 2013-09-16 11:36 +0200
                Re: Browser fingerprinting? Twayne <nobody@spamcop.net> - 2013-09-17 20:02 -0400
                  Re: Browser fingerprinting? "Peter H. Coffin" <hellsop@ninehells.com> - 2013-09-17 22:47 -0500
              Re: Browser fingerprinting? Norman Peelman <npeelman@cfl.rr.com> - 2013-09-16 06:13 -0400
                Re: Browser fingerprinting? Denis McMahon <denismfmcmahon@gmail.com> - 2013-09-16 11:03 +0000
                  Re: Browser fingerprinting? Twayne <nobody@spamcop.net> - 2013-09-17 20:11 -0400
                Re: Browser fingerprinting? Twayne <nobody@spamcop.net> - 2013-09-17 20:06 -0400
                  Re: Browser fingerprinting? The Natural Philosopher <tnp@invalid.invalid> - 2013-09-18 01:33 +0100
            Re: Browser fingerprinting? Marc van Lieshout <invalid@example.com> - 2013-09-17 22:53 +0200
              Re: Browser fingerprinting? Twayne <nobody@spamcop.net> - 2013-09-17 20:20 -0400
              Re: Browser fingerprinting? Denis McMahon <denismfmcmahon@gmail.com> - 2013-09-18 05:06 +0000
                Re: Browser fingerprinting? Scott Johnson <noonehome@chalupasworld.com> - 2013-09-18 06:09 -0700
                  Re: Browser fingerprinting? "J.O. Aho" <user@example.net> - 2013-09-18 18:24 +0200

Page 2 of 2 — ← Prev page 1 [2]

#10764

On 2013-09-14 6:11 PM, Gilles wrote:
> On Fri, 13 Sep 2013 19:30:18 -0400, Twayne <nobody@spamcop.net> wrote:
>> If it were easy to do, it'd also be widely publicized and available.
>
> Thanks for the feedback.
>

Welcome.
I'm empathetic because I'm working along the same research lines as you 
are. The only thing I'm sure of is, it has to be done server-side; 
anything client-side can weed out some of it and save a tiny bit of 
server traffic, but from the client side it's too easy. Those guys won't 
be allowing js on their machines so js isn't going to be much good.
    Right now all I can see doing is sanitizing and especially 
validation of ALL inputted data. There are ways to catch enough of them 
that at least it becomes too much effort for the bad guys to bother 
with. And  never forget htmlentities and htmlspecialcharacters; along 
with the right sanitizing, they can at least render anything that comes 
through useless.
    The biggest problem IMHO is to make a textarea safe. HTML 5 now 
includes the max length attribute but a miscreant isn't going to be 
using anything 5 compliant if he's got more than one brain cell. 
Personally I've managed so far to avoid javascript and instead look at 
things like ctype, str-replace for validation uses, and whatever filters 
will work. Counting page views help, in addition to keeping a list of 
miscreant IPs and their proxy information when you can get it, but the 
smart ones are still going to be by it.
    All you can do is your  best :)

Twayne`

[toc] | [prev] | [next] | [standalone]

#10765

On Sun, 15 Sep 2013 16:27:28 -0400, Twayne wrote:
>     The biggest problem IMHO is to make a textarea safe. HTML 5 now 
> includes the max length attribute but a miscreant isn't going to be 
> using anything 5 compliant if he's got more than one brain cell. 

substr() does wonders for cutting length for safety. Cosmetically, it
may be less than ideal, but...

-- 
36. I will not imprison members of the same party in the same cell 
    block, let alone the same cell. If they are important prisoners, I 
    will keep the only key to the cell door on my person instead of 
    handing out copies to every bottom-rung guard in the prison. --EOList

[toc] | [prev] | [next] | [standalone]

#10767

Am 15.09.2013 22:27, Twayne meinte:

>     The biggest problem IMHO is to make a textarea safe. HTML 5 now
> includes the max length attribute but a miscreant isn't going to be
> using anything 5 compliant if he's got more than one brain cell.

Maybe he/she isn't even using a browser...

[toc] | [prev] | [next] | [standalone]

#10792

On 2013-09-16 5:36 AM, Gregor Kofler wrote:
> Am 15.09.2013 22:27, Twayne meinte:
>
>>     The biggest problem IMHO is to make a textarea safe. HTML 5 now
>> includes the max length attribute but a miscreant isn't going to be
>> using anything 5 compliant if he's got more than one brain cell.
>
> Maybe he/she isn't even using a browser...
>

Very true; I didn't mention that because I didn't want to start any side 
convos :)

Twayne`

[toc] | [prev] | [next] | [standalone]

#10798

On Tue, 17 Sep 2013 20:02:43 -0400, Twayne wrote:
> On 2013-09-16 5:36 AM, Gregor Kofler wrote:
>> Am 15.09.2013 22:27, Twayne meinte:
>>
>>>     The biggest problem IMHO is to make a textarea safe. HTML 5 now
>>> includes the max length attribute but a miscreant isn't going to be
>>> using anything 5 compliant if he's got more than one brain cell.
>>
>> Maybe he/she isn't even using a browser...
>>
>
> Very true; I didn't mention that because I didn't want to start any side 
> convos :)

But... but... That's what we DO here!

-- 
Windows is a pane in the ass....

[toc] | [prev] | [next] | [standalone]

#10768

On 09/15/2013 04:27 PM, Twayne wrote:
> On 2013-09-14 6:11 PM, Gilles wrote:
>> On Fri, 13 Sep 2013 19:30:18 -0400, Twayne <nobody@spamcop.net> wrote:
>>> If it were easy to do, it'd also be widely publicized and available.
>>
>> Thanks for the feedback.
>>
>
> Welcome.
> I'm empathetic because I'm working along the same research lines as you
> are. The only thing I'm sure of is, it has to be done server-side;
> anything client-side can weed out some of it and save a tiny bit of
> server traffic, but from the client side it's too easy. Those guys won't
> be allowing js on their machines so js isn't going to be much good.
>     Right now all I can see doing is sanitizing and especially
> validation of ALL inputted data. There are ways to catch enough of them
> that at least it becomes too much effort for the bad guys to bother
> with. And  never forget htmlentities and htmlspecialcharacters; along
> with the right sanitizing, they can at least render anything that comes
> through useless.
>     The biggest problem IMHO is to make a textarea safe. HTML 5 now
> includes the max length attribute but a miscreant isn't going to be
> using anything 5 compliant if he's got more than one brain cell.
> Personally I've managed so far to avoid javascript and instead look at
> things like ctype, str-replace for validation uses, and whatever filters
> will work. Counting page views help, in addition to keeping a list of
> miscreant IPs and their proxy information when you can get it, but the
> smart ones are still going to be by it.
>     All you can do is your  best :)
>
> Twayne`
>

   Why is a textarea any different than any other form control?

-- 
Norman
Registered Linux user #461062
-Have you been to www.php.net yet?-

[toc] | [prev] | [next] | [standalone]

#10770

On Mon, 16 Sep 2013 06:13:52 -0400, Norman Peelman wrote:

> On 09/15/2013 04:27 PM, Twayne wrote:

> > The biggest problem IMHO is to make a textarea safe. .....

> Why is a textarea any different than any other form control?

It's not. Any form control is fine provided that it's sensibly[1] handled 
in the server. I know that, you know that, most intelligent web 
developers know that regardless of whether their server side is java, js, 
asp, php, python, perl, a compiled cgi or something esoteric, but some 
people seem to have their own unique worldview which doesn't seem to 
involve what most of us would consider sensible handling of form controls 
in the server.

[1] appropriate verification, validation and handling of data to prevent 
injection of potentially harmful content.

-- 
Denis McMahon, denismfmcmahon@gmail.com

[toc] | [prev] | [next] | [standalone]

#10794

On 2013-09-16 7:03 AM, Denis McMahon wrote:
> On Mon, 16 Sep 2013 06:13:52 -0400, Norman Peelman wrote:
>
>> On 09/15/2013 04:27 PM, Twayne wrote:
>
>>> The biggest problem IMHO is to make a textarea safe. .....
>
>> Why is a textarea any different than any other form control?
>
> It's not. Any form control is fine provided that it's sensibly[1] handled
> in the server. I know that, you know that, most intelligent web
> developers know that regardless of whether their server side is java, js,
> asp, php, python, perl, a compiled cgi or something esoteric, but some
> people seem to have their own unique worldview which doesn't seem to
> involve what most of us would consider sensible handling of form controls
> in the server.
>
> [1] appropriate verification, validation and handling of data to prevent
> injection of potentially harmful content.
>

Didn't understand much of that long run-on sentence, but there was a 
reason that at the time probably sounded logical. But I've wondered the 
same thing myself; seems like it was unnecessary to have to wait for 5 
to come along to implement it. Shoulda been done years ago!

Twayne`

[toc] | [prev] | [next] | [standalone]

#10793

On 2013-09-16 6:13 AM, Norman Peelman wrote:
> 4:27 PM, Twayne wrote:
>> On 2013-09-14 6:11 PM, Gilles wrote:
>>> On Fri, 13 Sep 2013 19:30:18 -0400, Twayne <nobody@spamcop.net> wrote:
>>>> If it were easy to do, it'd also be widely publicized and available.
>>>
>>> Thanks for the feedback.
>>>
>>
>> Welcome.

...

>>     All you can do is your  best :)

 >  Why is a textarea any different than any other form control?

Don't recall the details & history, but it is different from text boxes 
et al.

Wikipedia, I think, had a history on it with plenty of links.

[toc] | [prev] | [next] | [standalone]

#10797

On 18/09/13 01:06, Twayne wrote:
> On 2013-09-16 6:13 AM, Norman Peelman wrote:
>> 4:27 PM, Twayne wrote:
>>> On 2013-09-14 6:11 PM, Gilles wrote:
>>>> On Fri, 13 Sep 2013 19:30:18 -0400, Twayne <nobody@spamcop.net> wrote:
>>>>> If it were easy to do, it'd also be widely publicized and available.
>>>>
>>>> Thanks for the feedback.
>>>>
>>>
>>> Welcome.
>
> ...
>
>>>     All you can do is your  best :)
>
> >  Why is a textarea any different than any other form control?
>
> Don't recall the details & history, but it is different from text 
> boxes et al.
>
yep

most textareas will auto add scroll bars to accommodate 'more text'

> Wikipedia, I think, had a history on it with plenty of links.
>


-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to lead are elected by the least capable of producing, and where the members of society least likely to sustain themselves or succeed, are rewarded with goods and services paid for by the confiscated wealth of a diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#10791

On 15-09-13 00:11, Gilles wrote:
> On Fri, 13 Sep 2013 19:30:18 -0400, Twayne <nobody@spamcop.net> wrote:
>> If it were easy to do, it'd also be widely publicized and available.
>
> Thanks for the feedback.
>

It IS easy to do and widely available.

Look at the firefox add-on called SecretAgent. It's at:
https://www.dephormation.org.uk/?page=81

It has some 150 browser identification strings aboard (Including Amaya, 
Dillo, Bluefish), spoofs x-forwarded-for and via, spoof ETags and send 
random Accept: headers.

Then rethink your question.

[toc] | [prev] | [next] | [standalone]

#10795

On 2013-09-17 4:53 PM, Marc van Lieshout wrote:
> On 15-09-13 00:11, Gilles wrote:
>> On Fri, 13 Sep 2013 19:30:18 -0400, Twayne <nobody@spamcop.net> wrote:
>>> If it were easy to do, it'd also be widely publicized and available.
>>
>> Thanks for the feedback.
>>
>
> It IS easy to do and widely available.
For only one browser? And what if the miscreant isn't using a browser? 
Such apps are readily available and have been for years, and they grow 
smarter with each iteration.
    So, no, it's not easy to do with the exception of keeping say FF 
users from over-typing the boundaries. And if they are running js, which 
miscreants are not going to do.
>
> Look at the firefox add-on called SecretAgent. It's at:
> https://www.dephormation.org.uk/?page=81
>
> It has some 150 browser identification strings aboard (Including Amaya,
> Dillo, Bluefish), spoofs x-forwarded-for and via, spoof ETags and send
> random Accept: headers.
>
> Then rethink your question.
>

I wasn't aware of FF's addon for that, but it wouldn't influence me in 
any way; one browser amongst many and thinking they're going to be used 
by all miscreants is a dangerous assumption when what you want to avoid 
is a message bomb which is the max an OS can handle. And as has been 
mentioned a few times, it's not enough for actual security purposes; 
it's only one possibility to watch out for. A text bomb can be a real PITA.
    I'm not sure rethinking the question based on that is a wise decision.

Twayne`

Twayne`

[toc] | [prev] | [next] | [standalone]

#10799

On Tue, 17 Sep 2013 22:53:30 +0200, Marc van Lieshout wrote:

> On 15-09-13 00:11, Gilles wrote:
>> On Fri, 13 Sep 2013 19:30:18 -0400, Twayne <nobody@spamcop.net> wrote:
>>> If it were easy to do, it'd also be widely publicized and available.

>> Thanks for the feedback.

> It IS easy to do and widely available.

No it's not.

> Look at the firefox add-on called SecretAgent. It's at:
> https://www.dephormation.org.uk/?page=81

> It has some 150 browser identification strings aboard (Including Amaya,
> Dillo, Bluefish), spoofs x-forwarded-for and via, spoof ETags and send
> random Accept: headers.

That's spoofing, not fingerprinting.

Spoofing is easy. Fingerprinting is not. Fingerprinting is attempting to 
uniquely identify visitors to a site at the site server. Spoofing is  
trying to tell the server you're someone different in some way to who you 
really are. They're not the same thing, and while spoofing is easy, 
fingerprinting accurately and reliably is incredibly difficult.

If I visit your website today using firefox on my unix pc over my adsl 
connection, and tomorrow using chrome on my android tablet over it's 3g 
connection, how are you going to fingerprint me? I don't need to use 
anything as "technical" as spoofing the browser id. You lost the game as 
soon as I started playing!

-- 
Denis McMahon, denismfmcmahon@gmail.com

[toc] | [prev] | [next] | [standalone]

#10800

On 9/17/2013 10:06 PM, Denis McMahon wrote:
> On Tue, 17 Sep 2013 22:53:30 +0200, Marc van Lieshout wrote:
>
>> On 15-09-13 00:11, Gilles wrote:
>>> On Fri, 13 Sep 2013 19:30:18 -0400, Twayne <nobody@spamcop.net> wrote:
>>>> If it were easy to do, it'd also be widely publicized and available.
>
>>> Thanks for the feedback.
>
>> It IS easy to do and widely available.
>
> No it's not.
>
>> Look at the firefox add-on called SecretAgent. It's at:
>> https://www.dephormation.org.uk/?page=81
>
>> It has some 150 browser identification strings aboard (Including Amaya,
>> Dillo, Bluefish), spoofs x-forwarded-for and via, spoof ETags and send
>> random Accept: headers.
>
> That's spoofing, not fingerprinting.
>
> Spoofing is easy. Fingerprinting is not. Fingerprinting is attempting to
> uniquely identify visitors to a site at the site server. Spoofing is
> trying to tell the server you're someone different in some way to who you
> really are. They're not the same thing, and while spoofing is easy,
> fingerprinting accurately and reliably is incredibly difficult.
>
> If I visit your website today using firefox on my unix pc over my adsl
> connection, and tomorrow using chrome on my android tablet over it's 3g
> connection, how are you going to fingerprint me? I don't need to use
> anything as "technical" as spoofing the browser id. You lost the game as
> soon as I started playing!
>

I think the point he was trying to make, which is what I took out of it, 
was how easy it is to minimize the practical use of fingerprinting. 
Spoofing and fingerprinting are related in those terms.

The easier and multiple way to spoof the harder to fingerprint a single 
source reliably.

In a prior post, I think the OP, was asking for proof on how easy it is 
to make fingerprinting unreliable, and one particular way was shown.

Scotty

[toc] | [prev] | [next] | [standalone]

#10801

On 18/09/13 15:09, Scott Johnson wrote:
> On 9/17/2013 10:06 PM, Denis McMahon wrote:
>> On Tue, 17 Sep 2013 22:53:30 +0200, Marc van Lieshout wrote:

>>> It has some 150 browser identification strings aboard (Including Amaya,
>>> Dillo, Bluefish), spoofs x-forwarded-for and via, spoof ETags and send
>>> random Accept: headers.
>>
>> That's spoofing, not fingerprinting.
>>
>> Spoofing is easy. Fingerprinting is not. Fingerprinting is attempting to
>> uniquely identify visitors to a site at the site server. Spoofing is
>> trying to tell the server you're someone different in some way to who you
>> really are. They're not the same thing, and while spoofing is easy,
>> fingerprinting accurately and reliably is incredibly difficult.
>>
>> If I visit your website today using firefox on my unix pc over my adsl
>> connection, and tomorrow using chrome on my android tablet over it's 3g
>> connection, how are you going to fingerprint me? I don't need to use
>> anything as "technical" as spoofing the browser id. You lost the game as
>> soon as I started playing!
>>
>
> I think the point he was trying to make, which is what I took out of it,
> was how easy it is to minimize the practical use of fingerprinting.
> Spoofing and fingerprinting are related in those terms.

Fingerprinting will most likely disregard the UA-string and just look 
what they can get out of the plug-ins and fonts installed, those are 
fare more static for a user over a long time. There are companies who 
offer this kind of fingerprint detection to those willing to pay for it.


> In a prior post, I think the OP, was asking for proof on how easy it is
> to make fingerprinting unreliable, and one particular way was shown.

That really depends on the method for fingerprinting" and most of the 
techniques are out of scope in the usergroup.


-- 

   //Aho

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | comp.lang.php

csiph-web