Maybe it's forgotten. Maybe it lies. Maybe every time I rev Firefox Nightly I change identity.

What is true is that every time I leave an email address, it's tagged with the name of the site where I left it.

But note that a constantly changing fingerprint doesn't make it useless for tracking - if a site can keep any kind of cookie to persist between browser updates, it could add the updated signature. Then when you purge cookies and persistent storage, a site can re-add the cookie to keep on identifying you if your signature hasn't changed.

You'd have to purge all persistant storage at the same time as an update to avoid this, and even then (or if you never had persistent data to begin with) your IP or even geographical location will likely be enough to identify you again.

I use Google Apps (possibly not a good idea but soo convenient :/) with a catchall. I didn't catch any offender so far...

However (off topic), spammers are spoofing addresses as if they were coming from my domain. I receive two to three dozens automatic replies from mail servers (this address does not exist...).

I've properly set up DKIM and SPF records, making it obvious that these mails are spoofed, but I'm afraid my domain will end up on grey/black lists... Anyone out here familiar with this kind of issue?

Obviously you can never give out the "[email protected]" address and then assume that everything that goes to that address must be spam, but I've had legitimate contact from companies who have had to email me by removing the + portion because their internal email system wouldn't allow addresses with a + in them.

If you do go this route, I'd recommend using a whitelisting approach. I do get a lot of spam sent to random addresses at my domain.

  ^[a-z0-9_.]+@(?:[a-z0-9-]+\.)+\.[a-z0-9]+$

https://en.wikipedia.org/wiki/Email_address#Valid_email_addr...

Unless the nightlies have a different behavior than the releases, the patch level is not reported anymore. The changes went into 16.0.2 which was released on 10/26/2012. initial report on b.m.o[1] reads as follows:

  Steps to reproduce:

  1) Load http://www.delorie.com:81/some/url.txt

  Actual results:

  The User-Agent header exposes the security patch level as either a minor version
  number or as an alpha/beta/pre indicator. This data is exposed twice: in the 
  Gecko version and in the application version.

  While it is of value to expose this data to e.g. AMO, exposing it to all sites
  makes the browser more fingerprintable (see https://panopticlick.eff.org/ ) and
  doesn't serve a purpose more important than user privacy. Point releases don't
  change functionality beyond security and stability fixes, so sites shouldn't be
  sniffing the patch level anyway.

  Making trunk, alpha and beta builds look like release builds for sniffing
  purposes reduces sniffing-related failures that waste time when treated as
  functionality-related regressions by mistake.

  Expected results:
  Expected the version numbers to show the major version of the most recent 
  Firefox beta that Mozilla has shipped and not to show the security patch level 
  or an alpha/beta/pre indicator.

  Additional information:
  Internet Explorer doesn't expose the security patch level in its UA string."

"Within our dataset of several million visitors, only one in 857,908 browsers have the same fingerprint as yours."

As it doesn't allow for plugins, my fingerprint should (cookies aside) match that of any other <popular device> user.

So maybe the solution here is coming up with a 'secure browse' profile that every browser reports the same fake fingerprint.

Security in numbers.

There already is: https://www.torproject.org/projects/torbrowser.html.en

This also has the advantage that no other solution has: it completely hides your location as well, whereas even with a "standard" browser, your IP address + time zone alone can do a lot to identify you.

Just mentioning this lest anyone get the wrong idea that setting your browser to update frequently might be a defense.

Indeed; the user agent is part of the fingerprint.

Google, Mozilla, Opera, can you hear me?

== This. The system needs to be fixed. Need to know (only) vs nice to know info exch, etc.

This is another problem with having an advertising company (Google) supply a browser that is very popular (Chrome). In fact, Safari and IE are also run by companies with large presences in the online ad market.

I doubt Google in particular will risk antitrust suits by blocking these kinds of very, very unsettling but unfortunately legal trackers, which in part are not so technologically different to GA but combine a few more bits of tech which makes them awfully invasive. We might be able to hack technological solutions together here but this stuff rarely makes it out into people's mainstream browsers.

The most important way of securing people's data over the next 10 years is going to be by way of the browser and the mobile OS, but the thing that is most easily achievable is to have a solid browser that people can trust on to implement privacy-preserving technologies. The only browser I can realistically see doing that is Firefox.

Maybe taking a page out of the enterprise play book and using a proxy, like Squid, would make sense. From reading the Squid manual, it seems like it could play a role as it is quite extensible and sophisticated. Making it easy to setup and customize would be pretty difficult from what I can tell, unfortunately.

First, the precise browser version and OS can probably always be identified by checking for supported features, bugs etc. even if the extreme measure would be taken to remove the user agent string.

Add the screen resolution, IP, timing and request patterns (+) and we are all screwed.

(+) e.g. rule out users that are using other sites at the same time. Note that it would be possible to determine if a page is in the currently focused and visible browser tab and forward that information to the tracker.

The trick is not to remove information, but to poison it.

For example, Panopticlick sees that I have dozens of "system fonts", enough to stand out. I want my browser to lie about the fonts I have, based on settings I choose.

There are many details about my browser and system that are irrelevant to what most sites need to do so lying about them should not interfere with viewing a site.

Force them to do detailed packet timing and their costs will go up, and it will become less economical for black hats to play around with your personal data.

I don't know if nuking the user agent string is a horrible idea, but it's less of a problem today than it was 5 years ago: today, a website can assume all browsers conform pretty closely to a standard. Only really advanced features require user agent sniffing (arguably, if you're sniffing the UA you're doing it wrong).

I think we should make that kind of fingerprinting opt-in, not opt-out.

Rather than trying to hide everything another tactic is to provide random misinformation (different user-agent strings, only presenting a subset of fonts and plugins, etc). Enough to defeat the fuzzy matching that does go on.

Sure you've got to be careful that you don't do things that may break some sites that rely on this information remaining stable during a session, but that's got far less common with the frequent browser upgrades that go on nowadays.

imho the best strategy would be to copy one behaviour everywhere, so that there could be no way to differentiate between users.

    +-------+       +----------------+       +------------+
    |Browser|<==A==>| Visited server |<==B==>| ID service |
    +-------+       +----------------+       +------------+

The data acquisition scripts would be served directly by the web sites.

you can certainly make something that is "ghostery proof", but (1) this isn't it and (2) it would be more complex to deploy and so gain less traction.

It wasn't about this very company, but tracking in general, which can be implemented without serving code from a third party server.

If solutions like Ghostery become the norm, there are still workarounds, and they will catch up if nothing else works.

Not really. If they share data on the server side, they wouldn't be able to share a cookie - they would have to rely on other means to identify you, such as IP address etc. Not entirely impossible, but not as precise either. And that is spoofable through proxies etc.

These scripts will only track you and not receive information.

I've worked on a similar tracking snippet/system for http://www.projectcounter.org/ and this was one of the first things we attempted.

If you block the leadlander domain(s) the script will obviously not run and also consequently won't be able to send fingerprint details back.

In Firefox, the plugins get them to 1 in 860,000 which leaves only 3 possibilities in their DB of 2.5 mln, even though Firefox loads only QuickTime and Flash.

It must be the combination of codecs I have installed. How do I go about cleaning that up?

The browser UA is only one component of the fingerprint, and probably not the most important one.

Plus one for this. I wonder if a plugin alone could change enough info to fool the trackers?