2

Assuming one wants to be able to access a site from one device without the site realizing that the same device has visited multiple times, what are all the identifiers that one would have to consider/that could be used to identify?

I'm trying to make a relatively complete list of any viable methods that could/are likely to be used.

So far I have: -IPv4 -IPv6 -Screen resolution -Installed fonts -User agent -WebGL hash -Canvas Hash -Cookies -Installed plugins -Flash on/off -Do not track on/off

I'm not sure how viable it is for a site to secretly install permanent trackers that record things like MAC address, installed software, registry configuration and other particularly damning identifiers.

And if I may ask a follow-up question, would using a virtual machine completely protect the host device from identification?

  • 3
  • See browserleaks.com. I think the easy way would be to use Tor Browser. – Aria Dec 9 '16 at 13:31
  • 1
    @Aria for many "uses Tor" would be an even more specific identification than everything else, as you're likely to be the only device that does that, making it trivial to link all your connections together - Tor will prevent linking that identity back to your real world location, but if instead you want to be inconspicuous, you need to avoid Tor and use e.g. commercial VPNs instead and use (or show) only very common software e.g. a freshly installed windows VM with all the default options enabled, and none of changes that a security conscious user would make, as that's uncommon behavior. – Peteris Dec 9 '16 at 16:43
2

The list is far more extensive than you have already identified - there's explicit history, sound processor fingerprinting, timezone, time drift, HTTP cache content, HSTS history....even if you could assemble a comprehensive list today, it will grow tomorrow.

(That you have not included the most obvious user agents, referers and cookies in your list makes me think you need to up your game a lot to be able to use this information effectively.)

I suspect you'll find that your adversaries are not using all this data to identify you - indexing and resolving the data would be far too expensive. They will use a hash of the data as an identifier; so mapping out every possible opportunity for tracking is of limited value in designing countermeasures.

0

how viable it is for a site to secretly install permanent trackers

Very viable and very common. Though they don't actually need to be "installed", they can mostly be tracked server-side as well.

would using a virtual machine completely protect the host device from identification?

Yes and no. No in the sense that your public IP will be tracked regardless of the VM used. Otherwise pretty much yes.

0

Rent an AWS Virtual Desktop + tor browser if your really want a throw-away online presence.

But as soon as you start interacting with stuff, you will likely become identifiable again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.