fp block
play

FP-Block usable web privacy by controlling browser fingerprinting - PowerPoint PPT Presentation

FP-Block usable web privacy by controlling browser fingerprinting Joint work with Sjouke Mauw (UL), Christof Ferreira Torres (UL) OUtline Part 1: introduction Part 2: thwarting 3 rd party fingerprint-based web-tracking Introducing


  1. More ways to fingerprint [W2SP11] – fingerprinting JavaScript implementations Hooray for the speedwars! [W2SP12] – fingerprinting HTML5 font rendering All Arials are equal... except most aren't. [W2SP13] – fingerprinting JS engine errors. “Foutje, bedankt.” 64 / 112

  2. More ways to fingerprint [W2SP11] – fingerprinting JavaScript implementations Hooray for the speedwars! [W2SP12] – fingerprinting HTML5 font rendering All Arials are equal... except most aren't. [W2SP13] – fingerprinting JS engine errors. “Foutje, bedankt.” Clock skew can be passively detected, proxies don't help. 65 / 112

  3. Fighting fingerprinting 66 / 112

  4. Fighting fingerprinting • Do Not Track header? [NSDI12]: X 67 / 112

  5. Fighting fingerprinting • Do Not Track header? [NSDI12]: X • Blacklisting fingerprinters? [W2SP11]: X 68 / 112

  6. Fighting fingerprinting • Do Not Track header? [NSDI12]: X • Blacklisting fingerprinters? [W2SP11]: X • FireGloves [NordSec11]? [CCS13]: X • Tor Browser? [CCS13]: X 69 / 112

  7. Fighting fingerprinting • Do Not Track header? [NSDI12]: X • Blacklisting fingerprinters? [W2SP11]: X • FireGloves [NordSec11]? [CCS13]: X • Tor Browser? [CCS13]: X • Again: defensive paradox. 70 / 112

  8. Privacy plugins ... 71 / 112

  9. Typical countermeasures ID' Browser Browser ID 72 / 112

  10. Typical countermeasures Website A Website A A,ID' ID' Browser Browser ID 73 / 112

  11. Typical countermeasures Website A Website A A,ID' B ID' Browser Browser ID 74 / 112

  12. Typical countermeasures Website A Website B Website A Website B A,ID' A,ID' B ID' Browser Browser ID 75 / 112

  13. Typical countermeasures Website A Website B Website C Website A Website B Website C A,ID' A,ID' C,ID' B ID' Browser Browser ID 76 / 112

  14. Typical countermeasures Website A Website B Website C Website A Website B Website C A,ID' A,ID' C,ID' B B ID' Browser Browser ID 77 / 112

  15. Typical countermeasures Website A Website B Website C Website A Website B Website C C,ID' A,ID' A,ID' C,ID' B B ID' Browser Browser ID 78 / 112

  16. Overcoming the defensive paradox The defense can be detected … ... which makes you more unique. 79 / 112

  17. Overcoming the defensive paradox The defense can be detected … ... which makes you more unique. How to overcome? • Leverage this uniqueness; • Allow local tracking. 80 / 112

  18. Option 1: constant fingerprint / site ID* Browser Browser ID 81 / 112

  19. Option 1: constant fingerprint / site Website A Website A A,IDa ID* Browser Browser ID 82 / 112

  20. Option 1: constant fingerprint / site Website A Website A A,IDa B ID* Browser Browser ID 83 / 112

  21. Option 1: constant fingerprint / site Website A Website B Website A Website B A,IDb A,IDa B ID* Browser Browser ID 84 / 112

  22. Option 1: constant fingerprint / site Website A Website B Website C Website A Website B Website C A,IDb A,IDa C,IDc B ID* Browser Browser ID 85 / 112

  23. Option 1: constant fingerprint / site Website A Website B Website C Website A Website B Website C A,IDb A,IDa C,IDc B B ID* Browser Browser ID 86 / 112

  24. Option 1: constant fingerprint / site Website A Website B Website C Website A Website B Website C C,IDb A,IDb A,IDa C,IDc B B ID* Browser Browser ID 87 / 112

  25. Option 1: constant fingerprint / site Website A Website B Website C Website A Website B Website C C,IDb A,IDb A,IDa C,IDc B B ID* Browser Browser ID 88 / 112

  26. Option 1: constant fingerprint / site Website A Website B Website C Website A Website B Website C A,IDa ID* Browser Browser ID 89 / 112

  27. Option 1: constant fingerprint / site A,IDa Website A Website B Website C Website A Website B Website C A,IDa ID* Browser Browser ID 90 / 112

  28. Option 2: separate web identities ID* Browser Browser ID 91 / 112

  29. Option 2: separate web identities Website A Website A A,IDa ID* Browser Browser ID 92 / 112

  30. Option 2: separate web identities Website A Website A A,IDa B ID* Browser Browser ID 93 / 112

  31. Option 2: separate web identities Website A Website B Website A Website B A,IDa A,IDa B ID* Browser Browser ID 94 / 112

  32. Option 2: separate web identities Website A Website B Website C Website A Website B Website C A,IDa A,IDa C,IDc B ID* Browser Browser ID 95 / 112

  33. Option 2: separate web identities Website A Website B Website C Website A Website B Website C A,IDa A,IDa C,IDc B B ID* Browser Browser ID 96 / 112

  34. Option 2: separate web identities Website A Website B Website C Website A Website B Website C C,IDc A,IDa A,IDa C,IDc B B ID* Browser Browser ID 97 / 112

  35. Option 2: separate web identities ID a ≠ ID c Website A Website B Website C Website A Website B Website C C,IDc A,IDa A,IDa C,IDc B B ID* Browser Browser ID 98 / 112

  36. Option 2: separate web identities Website A Website B Website C Website A Website B Website C A,IDa ID* Browser Browser ID 99 / 112

  37. Option 2: separate web identities A,IDa Website A Website B Website C Website A Website B Website C A,IDa ID* Browser Browser ID 100 / 112

Recommend


More recommend