5

I'm recently interested in having an paranoid level of privacy but there is little question in my mind for which I cannot find an answer.

I know there is fingerprint of my browser which it gives away to every website it visit. Being a fedora user with bunch of browser extensions, I'm completely unique according to Panopticlick.

My question is, any software other than web browser exhibit such fingerprints. For example can I trust software like filezilla, ssh, telnet or jxplorer(ldap browser) with my privacy? Will they give similar fingerprints to the hosts I have connected?

Thanks for reading.

1
  • You do realize that the bad Goo...ys will make you uniquely identifiable by placing things such as invisible images on their sites anyway (and use web fonts to track which pages you visit even if they don't own them), and the really bad guys (three-letter US agencies) get a complete record of all your activity in near-realtime. That, and every site you visit obviously gets to know your IP address. So really, what do you care if someone knows what browser plugins you have?
    – Damon
    Jul 7, 2014 at 14:31

3 Answers 3

5

No, I wouldn't worry too much about other applications, especially not the ones you've mentioned above.

First of all, they don't send out as much information as your browser does. Depending on the protocol or application there might be a a couple of things like a header describing the used program or version, but usually there are no plugins or extensions making it easy to identify you. Furthermore in most cases there are only a few appliactions to be used, e.g. for SSH it would be the OpenSSH client and PuTTY. Everything else would be quite unusual.

Secondly, you don't use these type of application randomly throughout the web. In a typical scenario you would use them only to interact with a few selected servers. You most probably need to login, in order to be able to use them anyway, so you can't expect any privacy.

Having said that, you can always use a packet sniffer, e.g. Wireshark to look at the things you are sending out and evaluate the situation for yourself.

1

Software that "phones home" usually contains a unique identifier. The most common examples are iPhone apps that are ad-supported, as they transmit your advertising identifier every time they display an ad. But any software that requires you to pay for an online service will identify you every time you use it. Office365 is one such example.

I don't think you'll encounter as much phone-home software in Fedora, but any application that incorporates a browser has the potential to identify you.

1

When you make a request with your browser, the server can request to know capabilities in order to know what to serve you plugins, fonts, etc.

For other general purpose client-server applications like FTP, SCP, the protocols generally don't provide a mechanism to transfer this information. If you do not have a malicious client that is sending files in the background, you are probably okay.

Most other applications are not designed to run another application inside them like a browser, and would be more purpose driven. If I design a chat program, likely the client side and server side are totally under my control or meet my requirements. I would not normally request this information.

However, if I am an application running locally, there is nothing stopping me from collecting any random data for which I have permissions and then sending this back to the server. For example, continuing the example of the chat client above, I may be able to determine your IP address and make all sorts of system calls, so technically any application could make a fingerprint. This is exactly what adware executable try to do. They want to track the unique behavior of a unique client - if its true malware, it unlikely they tricked you into creating a username - perhaps they just generated a unique fingerprint that they store locally, but its of course feasible they will profile your system in case you delete it and they re-infect you later.

File protection schemes, DRM, licensing, trust computing can make fingerprints of your system as well. For example, an operating system during activation may make a fingerprint of your system and transmit this back to the vendor to prevent you from installing on different hardware, but allowing a reinstall on the same hardware.

Also, while less effective its possible for the server to which you connect to do a port scan, if you had a lot of special services running it is possible to fingerprint you. Though it likely would not be enough to be really distinguishing unless you run a special type of server on an abnormal port. Check out nmap fingerprinting


In Summary: It would be difficult in most cases for an FTP server to identify you just based on connecting to it and looking at the data you send. However, in most cases you are authenticating with a specific username so that is going to give you away.

For example, you do not general SSH anonymously to some server on the Internet, but to a server you know or trust and for which you have authentication credentials. Assuming you used some proxy or tor to anonymize your IP address, it would be difficult for a man-in-the-middle to make a profile of you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .