3

I am asked about my opinion in a case as follows:

Someone visited a (totally legal, in fact US government) website A and identified themselves. At a very different point in time they - allegedly - visited a (doubtlessly very) illegal website B.

US law enforcement claims there is no doubt that the access to B was by the same person/from the same PC as the access to A. If the identification were based on the client's IPv4 address (outside the US!), say, I'd argue that these are typically reassigned to new client's every few hours or days (not to mention shared/NATed use by multiple entities, including WiFi guests), hence is at most very weak evidence. In addition, it currently seems that the non-US ISP was not asked to reveal the identity of their customer associated with the IP in question at the point of time in question. Rather the claim of identity is by comparison with said access to A. Meanwhile, it seems that the identification is not claimed to be done by IPv4 address, but rather by something referenced as a "GUID" identifying the PC. I am not aware of a standard or wide-spread use of any such GUID in any internet protocol that would allow cross-site identification between sites that do not even wish to collaborate on such an issue.

Note that the term GUID was specifically mentioned, i.e., we are not talking about browser fingerprinting or cookies.

Q: Is there anything "GUID-like" that can act as described to identify a PC/device across multiple unrelated(!) sites? In TCP? In http? In TLS? "Anywhere else" in the process?

  • 2
    There is no such "GUID" which gets transmitted when accessing an arbitrary website and is visible from the website (i.e. not a MAC of the network card which is only visible in the local network). But from the way you ask it looks like that you are referring to some specific case. It would be helpful if you actually reference public information about this case instead of only giving your interpretation of it. – Steffen Ullrich Nov 16 '19 at 12:52
  • If this was the case for 2 unrelated sites then the whole concept of finger-printing would be irrelevant and that's a thing. – HelpingHand Nov 16 '19 at 19:15
  • 3
    Is it possible that this person had third-party cookies enabled in their browser? If so, then it's possible that a third party (such as a social network or an advertising network or a web analytics service) would have been able to track this person from site A to site B, if their code was installed on both sites. – mti2935 Nov 16 '19 at 19:43
1

There is no universal GUID that uniquely identifies a computer. It's not possible either, strangely for philosophical reasons.

If you know what the Ship of Theseus is, then feel free to skip this part, as you know where I am getting. Otherwise, imagine me having a computer. As it gets older, I sell parts of the hardware (e.g. graphics card, RAM, etc.) to upgrade it. At some point, none of the original parts remain. Is it still the same computer?

Further, what if someone happens to buy all the obsolete parts to assemble another computer. Would that be my computer then?

It's not a question we can answer, because "a computer" is not an atomic entity. It's a composition of various pieces. Each individual piece can uniquely be identified (serial number, etc.), but the composition can not.

Of course, you could take one piece of hardware (e.g. the motherboard) and use that as the identity, but at that point you require every motherboard to have a unique identifier.

What could they possibly have used?

That's a tough question, and it depends on the details of the scope. One possible candidate would have been third-party tracking cookies. ISPs can use the connection being used to identify customers (not individual devices though), and there have been several instances where ISPs have been found to use such things to track customers.

| improve this answer | |
  • Re your last part "it currently seems that the non-US ISP was not asked ..." – Hagen von Eitzen Dec 15 '19 at 22:21
0

It's possible that this GUID was created by similar browser fingerprinting techniques used on both sites. DeviceInfo is good for testing what information is easily available through web browsers. Maybe something as simple as the hostname contained the modem/router's WAN MAC address, and was logged on each site.

| improve this answer | |
0

Browsers can have an identifier that has some variations depending on what you have installed on your computer, it can be used to identify a client (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/User-Agent), I do not think this would be the best option as it is dubious.

Other option is the usage of cookies, imagine that you got a cookie form google analytics that cookie can be used to correlate you in all your browser visits from any site that is using google analytics it would be easy to identify that the machine is the same as they will have the same ID... That is how google identifies your computer and checks your browsing habits. (https://safety.google/privacy/data/) This will be related to you if you have some type of google account like gmail or google drive and you do not take extra precautions when you login.

Other option is the ability to execute code in the client either by activeX, Java, javascript or any other software, in those situations the finger print will be as detailed as the requests that the code will execute and you allow in your machine.

If you wish to know what google knows about you, check it here.

Hope that this did not make you paranoid...

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.