Supercookie: Browser Fingerprinting via Favicon

Re:Supercookie: Browser Fingerprinting via Favicon by bastawhiz on Saturday February 06, 2021 @10:59PM (#26052513)

This is a neat approach, but I'm not sure I'd expect it to be used in the wild. ~32 consecutive document redirects every time you want to fingerprint a browser would be slow: twelve (?) redirects on my (~fast) internet takes about ten seconds. On 3g, I could imagine this taking much longer.

You'd also likely need to do this at the (root) page level (i.e., it wouldn't work inside an iframe, since iframes don't have favicons), and it breaks the back button really hard. I'm not sure I can think of a practical situation where this could actually be used for tracking. Maybe if it was done in a popup?

[ Parent | on HN ]

Re:Supercookie: Browser Fingerprinting via Favicon by toomanybeersies on Sunday February 07, 2021 @01:07AM (#26053047)

> Maybe if it was done in a popup?

Funny you mention that, one of my friends was on a torrent site the other day and had tiny popup that appeared to keep redirecting. I assumed it was redirecting through multiple pages to generate fake ad impressions, but this is another possibility.

[ Parent | on HN ]

Re:Supercookie: Browser Fingerprinting via Favicon by Philip-J-Fry on Sunday February 07, 2021 @07:17AM (#26054533)

The site says that 34 redirects takes about 4 seconds.

The demo page is 1 redirect per second on purpose.

[ Parent | on HN ]

Re:Supercookie: Browser Fingerprinting via Favicon by jonasstrehle on Sunday February 07, 2021 @11:50AM (#26056193)

Yeah, the demo page is using a ±800ms timeout on purpose.

I chose the threshold so that even with a bad internet connection, slow browser, etc. the favicon is requested without the redirect being faster than that.

So it is definitely possible to reduce the timeout significantly but it is not useful for demonstration purposes... ~jonas

[ Parent | on HN ]

Re:Supercookie: Browser Fingerprinting via Favicon by cmeacham98 on Sunday February 07, 2021 @02:03AM (#26053261)

Potential workaround: redirect a more bearable amount of times (2-3) every time a user clicks a link on your website. An aggressive ad network could also do this across websites.

[ Parent | on HN ]

Re:Supercookie: Browser Fingerprinting via Favicon by BiteCode_dev on Sunday February 07, 2021 @04:51AM (#26053881)

If the browser supports JS, maybe you can quickly generate uuid based on the same pattern, load the favicon as data url and with onload, check if it's in cache. This would make it significantly faster.

[ Parent | on HN ]

Re:Supercookie: Browser Fingerprinting via Favicon by jonasstrehle on Sunday February 07, 2021 @12:00PM (#26056271)

Great idea but favicons used in meta-tags does not support the onload event! I've found a workaround for this but it's only working in chrome. ~jonas

[ Parent | on HN ]

Re:Supercookie: Browser Fingerprinting via Favicon by nielsbot on Sunday February 07, 2021 @12:54AM (#26052996)

I you wanted to track just a handful of users for nefarious purposes tho...

[ Parent | on HN ]

Re:Supercookie: Browser Fingerprinting via Favicon by jaflo on Sunday February 07, 2021 @01:21AM (#26053101)

I think you could also run this on an iframe embedded in a page

[ Parent | on HN ]

Re:Supercookie: Browser Fingerprinting via Favicon by infogulch on Sunday February 07, 2021 @01:51AM (#26053208)

What is your response to parent's comment that "it wouldn't work inside an iframe, since iframes don't have favicons"?

[ Parent | on HN ]

Re:Supercookie: Browser Fingerprinting via Favicon by scotty79 on Sunday February 07, 2021 @02:33AM (#26053355)

Browsers send requests for favicons for pages in iframes even though they are not showing them.

[ Parent | on HN ]