3

In the manners of Browser fingerprinting, is it possible to obtain a somewhat unique fingerprint for the device OS and hardware (a 1 out 1000 entropy score would be good enough for my needs)

Edit: For more context, I am trying to differentiate as accurately as possible unique visitors on a web page. Ideally, if someone already visited the page but returns with a different IP and via a different browser I would be able to make an "informed" guess whether or not that visitor is returning.

  • Have you've looked at the details of nmap remote OS detection? – Steffen Ullrich Oct 23 '16 at 14:08
  • @SteffenUllrich Thanks, I am looking at them now, from what I gather it would allow to get a OS version of a target IP ? In my context the OS version is easy to get as I will be running JS on the client side. I am more in need of a somewhat unique fingerprint. Do you know if nmap could help there ? – silkAdmin Oct 23 '16 at 14:24
  • 2
    Is it not trivial for a fraudster to generate fake fingerprints? Remember that you cannot trust the code that runs on the client, especially if runs on a browser. – ktorn Oct 23 '16 at 14:34
  • @silkAdmin: You might try with the uptime guess in OS detection, i.e. distinguish different systems with same OS based on the TCP timestamp. And you could also make a system fingerprint, i.e. which services are running, which banners etc. But on clients there will probably no useful services for fingerprinting. – Steffen Ullrich Oct 23 '16 at 14:41
  • 2
    If you need it for fraud prevention than maybe you should have a look at higher layers, like requiring a client certificate for TLS connection. And maybe you should add more context to the question, i.e. what kind of attacks you exactly want to prevent. Fraud protection is a very weak description. – Steffen Ullrich Oct 23 '16 at 14:43
3
+25

The Electronic Frontier Foundation (EFF)'s Panopticlick site is dedicated to browser fingerprinting that goes well beyond your desired 1:1000 entropy (using these methods, pretty much every browser is unique).

Their implementation is designed to show you how hard it is to be anonymous online, so the site has a good amount of explanation, including a detailed technical writeup as well as some pointers in how to defend against this sort of tracking.

Please respect people's privacy. It's one thing to track people through logins. It's another thing to track them without their knowledge and/or permission.

Ideally, if someone already visited the page but returns with a different IP and via a different browser I would be able to make an "informed" guess whether or not that visitor is returning.

There should be enough data specific to hardware and OS to get a fingerprint that is agnostic to the browser within your desired 1:1000, but you may be able to get further with fuzzy matching so long as you are comfortable with collisions between different users (which is another privacy issue).

0

One idea.

It's difficult and not perfect. The more accurate the more complex, but I think it could be possible to get all info you can gather like OS, time, time on page, mouse patterns, resolution, engines, visited pages... putting it in a deep learning process and use your authenticated users for the learning purpose.

It's not easy to implement, but the good part is that neural networks have the capacity to learn from themselves and you can use genetic algorithms also.

Using this method you shouldn't care about specific properties or data because I.A. will discover the best process to do it and become better with time, data and new sources. You should also take into account how to discard bad or false data but... you can use Machine Learning also for this.

Opinions are welcome :-)

  • 1
    I really do love when website sends data every time i move my mouse. Your idea is unrealistic... – axapaxa Oct 27 '16 at 22:51
  • good point! I really love too :-) but it's only a concept idea. You can do different approaches depending on the application. We really don't know what kind of web or service is the target. For example: add this info to other requests as a payload, or, may be use time between requests as another variable, or may be, add the navigation path as an input. Only with a good knowledge of the kind of application, it's possible to create a more realistic and accurate answer. – gavioto20 Oct 27 '16 at 23:40
  • Furthermore, the question is really about identifying the real identity of a user (one of 12 principles of cybersecurity) but without their consent, and fighting across the anonymity principle of the web.... so I give a creative, technically possible, state-of-the-art answer. In the worst case it may inspire someone to do something. – gavioto20 Oct 27 '16 at 23:40
  • 1
    Presumably, systems like Google Analytics does this kind of thing too. That's primarily aimed at UX design, but could probably be used for user identification via behavior modeling. I wouldn't at all be surprised to hear Google already does this, which is why so many privacy tools block google-analytics.com and friends. – Adam Katz Nov 3 '16 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.