Brute-forcing a macOS user’s real name from a browser using mDNS

Re:Brute-forcing a macOS user’s real name from a browser usi... by Syonyk on Thursday July 13, 2023 @05:24PM (#36716191)

The more time passes, the more comfortable I feel about mostly interacting with the internet from a Qubes box, in a disposable Whonix/Tor VM, with Javascript disabled...

This is just gross. I mean, not surprising. But appalling in so many ways that it's even possible.

If you're not familiar with fingerprint.com, they do "deep user profiling" - think "maintaining a constant user ID across computers, browsers, OSes, etc." They have a demo on the main page that's a little bit creepy in how good it is.

[ Parent | on HN ]

Re:Brute-forcing a macOS user’s real name from a browser usi... by nop_slide on Thursday July 13, 2023 @10:56PM (#36718922)

Wow it totally recognizes my same device across different VPN IPs. Creepy indeed

[ Parent | on HN ]

Re:Brute-forcing a macOS user’s real name from a browser usi... by nier on Friday July 14, 2023 @02:12AM (#36720075)

In my tests it only recognizes the same browser. I’m a different person when using different browsers. I noticed that I can still be correctly fingerprinted after resetting the browser or using a private window.

[ Parent | on HN ]

Re:Brute-forcing a macOS user’s real name from a browser usi... by Ycdr4thfdd on Friday July 14, 2023 @02:25AM (#36720153)

Using Firefox (on a Linux laptop) with resistfingerpriting=true or Mull (on an Android) with its default settings, I'm able to get assigned a new fingerprint whenever I clear cookies or use a new Incognito session.

I haven't tested it, but presumably they also wouldn't be able to track me between domains, even without clearing cookies.

[ Parent | on HN ]

Re:Brute-forcing a macOS user’s real name from a browser usi... by Affric on Friday July 14, 2023 @02:46AM (#36720277)

So it gets me on MacOS with safari, lynx, and firefox with strict anti-tracking on.

Tor works for blocking it.

All in all they have created a creepy wee tool.

[ Parent | on HN ]

Re:Brute-forcing a macOS user’s real name from a browser usi... by jonnycomputer on Friday July 14, 2023 @09:49AM (#36724005)

On MacOS, on Firefox, resistFingerprint=1 and clearing out recent history, or going in incognito mode, (cookies, cache, etc.) defeats the fingerprint.

A little disappointed that Privacy Badger didn't seem to make any difference. Was active the whole time.

[ Parent | on HN ]

Re:Brute-forcing a macOS user’s real name from a browser usi... by utsuro on Friday July 14, 2023 @12:44PM (#36726436)

Doesn’t seem to be the case on iOS unfortunately which is really creepy. Still get tracked regardless of Cookie & Cache Reset/VPN/Private Browsing with Safari

[ Parent | on HN ]

Re:Brute-forcing a macOS user’s real name from a browser usi... by smallpipe on Friday July 14, 2023 @07:56AM (#36722563)

Eww this is gross. I'm impressed it manages to do it on a stock iphone in incognito with two different IPs, surely it must look like any other iphone

Edit: ublock origin filter, which breaks the demo:

  ||fpjscdn.net

[ Parent | on HN ]