4

Many web services such as ie: google collect machine (hardware) identifiers, and they of course state this in their privacy policy.

Usually to hide/change our online identity we could clean reinstall OS, and set up new online accounts in order to completely hide our previous browsing details.

But if hardware ID's are exposed then this doesn't make much sense unless we start using new hardware (ie: buy new computer/router)

Question is:

1) what techniques do they use to collect machine ID's

2) what can we do to prevent sending machine ID's to web sites

2
  • I think it will be best to ask a single question per post so as to keep its scope concise for better responses. Nov 9, 2016 at 23:05
  • Xprivacy is a very powerful tool which can spoof your machine identifiers.
    – defalt
    Nov 10, 2016 at 2:36

4 Answers 4

3

I will disagree with John Wu. There is a lot of information that a website you connect to can gather about your computer from the simple TCP connection performed.

p0f - the first (and still active) passive fingerprinter, analyses details of your connection including:

  • Order of TCP options (gives away the OS, often the version of the OS)
  • MTU (gives away the type of connection used: ADSL, PPoP)
  • TTL (gives away the OS to some extent, and can map your NAT if combined with timestamping, see below).

The README for p0f cites almost a hundred little information disclosure vectors. But the most important one is TCP timestamping, by which a website you connect to can determine the uptime of the system.

You may think that knowing the uptime of your system is no big deal, but by the contrary. Several OSes send the TCP timestamp based on their uptime and to the granularity of miliseconds, and, therefore, the timestamp identifies your system very well. There are not many computers that were booted exactly on the 22nd of October, 2016 at 5PM, 32 minutes and 4.589 seconds.

Of course, the ability to track your machine through passive fingerprinting decreases significantly once you reboot it. But companies like google are more interested about a browsing session performed, not necessarily your repeating habits day by day.

Extra references

7
  • 1
    from your link, it looks like TCP timestamping is a problem for servers, not clients.
    – dandavis
    Nov 10, 2016 at 20:46
  • @dandavis - Hell, I pasted the wrong link! That is not such a bad link in terms of TCP stack but not the one I intended. Fixed now.
    – grochmal
    Nov 10, 2016 at 21:51
  • hmm. the new link appears to be 15 years old, which is an eternity in infosec vulnerabilities, are you sure this is still a widespread client issue?
    – dandavis
    Nov 10, 2016 at 23:28
  • @dandavis - yep, it is all about RFC1323 (1992). RFC7323 (2014) superseded it, but did not really do anything about the information disclosure vector.
    – grochmal
    Nov 10, 2016 at 23:45
  • Which means there is always a way to (at least) track clients. either by using known or not yet known techniques.
    – gmlox
    Nov 11, 2016 at 19:22
2

I think we can change the PCs 'MAC address' and change 'Hardware ID' through 'regedit' while deleting all browser logs and cookies. So that Google and other internet services would identify the PC as a different device. But I don't know the effect on PC when changing our device ID through 'regedit'.

1

The Google privacy policy doesn't say anything about "machine ID" or "hardware ID." It refers to device information. A device is typically a phone or tablet, and in this context Google is referring to retrieval of the device ID via an API that is called by code executing on the device inside of an app. You can of course deny the app permissions to do so, although this may cause the app to malfunction.

In terms of using a browser, from a desktop computer, with no installed app or other software, there is actually very little information available about the computer other than the user agent string that is sent by your browser. In addition, they may set cookies, such as an "advertising ID," which essentially identifies your machine uniquely, but can easily erased/reset/bypassed using your browser's privacy mode or by simply deleting them.

1
  • At the end of the page in google privacy policy, I think "Unique device identifier" or UUID or ID of specific piece of hardware... can be accessed by google in case if chrome is installed. I think same thing can be done by any software vendor whose software we install, not just google. but in case of google they it's not illegal because we accept the policy :/ It looks there is no way of preventing this.
    – gmlox
    Nov 10, 2016 at 2:07
1

There are numerous ways to track you on the internet by web services such as Google, etc. Assume that you are visiting some website addressed: WWW.example.com, this website has been written in PHP and includes a script that reaches your ID by your IP Address. This script finds your IP Address by some piece of code such as the following:

$ip = $_SERVER['REMOTE_ADDR'];
$browser = $_SERVER['HTTP_USER_AGENT'];
$dateTime = date('Y/m/d G:i:s');
$file = "visitors.html";
$file = fopen($file, "a");
$data = "<pre><b>User IP</b>: $ip <b> Browser</b>: $browser <br>on Time :    $dateTime <br></pre>";
fwrite($file, $data);
fclose($file);

Another way to do this, is cookies. Some websites are always gathering your cookies with or without your permission, these include your IP Address, operating system and browser type. You can always bypass all of these mechanisms by searching Google, there are a lot of videos out there for you to watch and learn.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .