2

I have developed a custom web browser for Windows using C# (based on Internet Explorer 11) and I'm trying to understand & solve the next issues:

1. I adjusted the User Agent string and the platform changes as well, but when I run a uniqueness check in https://panopticlick.eff.org , a slightly different string shows in the results. For example, for the following adjusted string:

"Mozilla/5.0 (iPhone; CPU iPhone OS 8_1 like Mac OS X) AppleWebKit/537.51.2 (KHTML like Gecko) GSA/4.2.2.38484 Mobile/12B411 Safari/9537.53"

This string shows up:

"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; HPNTDFJS; GWX:RESERVED)"

When I run the same check in a custom webbrowser I developed for android, the adjusted User Agent string stays exactly as written. Even custom characters show up the same in the result. What may cause this change in the browser that I developed for Windows? And what would be a reasonable solution?

2. How does panopticlick find my System fonts, my Screen size & Color depth and my Browser plugin details? How can I hide/customize this data in my custom web browser?

2

Clearly panopticlick is not showing the user-agent string you think you are sending to it.

I'm confused by your description of what happenned. The page at https://panopticlick.eff.org does not display any user agent.

The page at https://panopticlick.eff.org/index.php?action=log&js=yes displays the user agent I supplied whenever I changed the string. If you are seeing the original user agent string after asking your application to use a different one, then I would be more inclined to believe there is a bug in your code than some fiendish capability of panopticlick.

This is however a completely different question than how you should go about fooling a fingerprinting script. I have no idea what method Panopticlick uses, but there are large range of metrics a script might use. Since I presume you and the EFF bear no mutual ill-will, you would need to direct your efforts against whomever you intend to foil.

  • Thanks for the reference. If you're familiar with C#, I can share the code snippet so you can take a look and share your opinion – Sahar Avr Sep 25 '15 at 15:17
2

In answer to question 1, the difference is the browser itself. The IE basis for your custom desktop browser is designed to be more interactive with other Microsoft products thus all the .NET details. Were you to use a Microsoft phone/table instead of Android you would probably see the same on your second test.

The EFF folks who created panopticlik have an in-depth explanation for question 2 at How Unique Is Your Web Browser? Browsers need to do a lot of housekeeping to render pleasing content on a broad spectrum of systems so they routinely exchange details about available fonts and system features. Furthermore the EFF developers were able to make highly reliable inferences from setting that are missing or turned off. The reference is a fantastic read for your questions.

Finally, as to how you can make a unique custom browser that does none of these things --- ahh there is the rub as you just became unique. I have seen no effort to defeat this capability on a large scale. Only with a large deployment of identically behaving browsers (with highly limited features - probably not much more than a text based browser in the end) can you address this shortfall if your focus is the desktop.

  • 1
    I have seen no effort to defeat this capability on a large scale. - The Tor browser has spent a lot of time trying to prevent fingerprinting. It is difficult. – Neil Smithline Sep 25 '15 at 15:08
  • 2
    I suppose they interact with the many 3rd party extensions available in the browser (such as AJAX and Flash). dotNET's web-browser engine is pretty solid. I will probably have to develop an entire web-browser engine from scratch, and then lmit my checks on JavaScript interactions only. Thank you for the reply – Sahar Avr Sep 25 '15 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.