News for hackers. Stuff that matters.

A comment on DuckDuckGo on CNBC: We’ve grown 600% since NSA surveillance news broke. Parent comment

Re:DuckDuckGo on CNBC: We’ve grown 600% since NSA surveillan... by asdfaoeu on Wednesday June 17, 2015 @08:30AM (#9731328)
Except they aren't dropping cookies on your machine so it'd be harder for them to track users and that's something that can be verified externally.
[ Parent | on HN ]
Re:DuckDuckGo on CNBC: We’ve grown 600% since NSA surveillan... by falcolas on Wednesday June 17, 2015 @08:36AM (#9731348)
Browser fingerprinting is unique enough that they can likely track you without sending a single persistent byte to your machine.
[ Parent | on HN ]
Re:DuckDuckGo on CNBC: We’ve grown 600% since NSA surveillan... by logn on Wednesday June 17, 2015 @09:20AM (#9731584)
Yes, but you can also use DDG without CSS or JS, https://duckduckgo.com/html/
[ Parent | on HN ]
Re:DuckDuckGo on CNBC: We’ve grown 600% since NSA surveillan... by sangnoir on Wednesday June 17, 2015 @09:31AM (#9731627)
You can still be fingerprinted by HTTP request headers alone. You can test the number of identifying bits your browser generates at EFF's Panopticlick[1]. It's scary.

https://panopticlick.eff.org/index.php?action=log&js=no

[ Parent | on HN ]
Re:DuckDuckGo on CNBC: We’ve grown 600% since NSA surveillan... by dceddia on Wednesday June 17, 2015 @12:39PM (#9733191)
They explain their methodology and some defenses in a linked paper (PDF):

https://panopticlick.eff.org/browser-uniqueness.pdf

All in all it's pretty scary though. My browser is unique among 5.3 million or something. And then there's the algorithm they mention that can detect fingerprint changes with 99.1% accuracy, and be used to do things like recreate cookies that you deleted.

[ Parent | on HN ]
Re:DuckDuckGo on CNBC: We’ve grown 600% since NSA surveillan... by geomark on Wednesday June 17, 2015 @10:47AM (#9732078)
That's pretty cool (from a technical point of view, not cool from a privacy point of view). It says my particular configuration of browser plugins is unique among 1,827,392 browsers tested. Taken together with all the other unique things means I'm unique among 5,482,178 browsers tested. Shouldn't there be a way to hide most of that so you would be far less unique?
[ Parent | on HN ]
Re:DuckDuckGo on CNBC: We’ve grown 600% since NSA surveillan... by sangnoir on Wednesday June 17, 2015 @11:11AM (#9732307)
You could manually set your user-agent string to a more polular one (IE on Windows 7?). There are several browser extensions that allow you to set UA string manually for Chrome and Firefox.

However, an adversary can also fingerprint your OS/patch level based on packet structure[1][2] - which can't be easily changed. This will add more identifying bits.

1.http://nmap.org/book/osdetect-fingerprint-format.html

2.http://www.windowsecurity.com/articles-tutorials/intrusion_d...

[ Parent | on HN ]
Re:DuckDuckGo on CNBC: We’ve grown 600% since NSA surveillan... by timboslice on Wednesday June 17, 2015 @11:36AM (#9732545)
Disable javascript, use ublock/umatrix, and browse in incognito mode
[ Parent | on HN ]
Re:DuckDuckGo on CNBC: We’ve grown 600% since NSA surveillan... by yellowapple on Wednesday June 17, 2015 @04:11PM (#9734916)
Huh. So apparently I'm the only Conkeror user in the world (or at least that Panopticlick has encountered).
[ Parent | on HN ]
Re:DuckDuckGo on CNBC: We’ve grown 600% since NSA surveillan... by sugarfactory on Wednesday June 17, 2015 @08:43AM (#9731374)
Why is it hard to track users when DuckDuckGo has access logs (tuples of date/times, ip addresses and queries) and ISPs have a pair of a date/time and an ip address -> a real identity mappings?
[ Parent | on HN ]
Re:DuckDuckGo on CNBC: We’ve grown 600% since NSA surveillan... by relicscattergun on Wednesday June 17, 2015 @09:25AM (#9731599)
Well, according to tracker detection service Ghostery, an I.P. address is considered Pseudonymous information, unless you live in Europe, apparently.
[ Parent | on HN ]
Re:DuckDuckGo on CNBC: We’ve grown 600% since NSA surveillan... by yclept on Wednesday June 17, 2015 @09:30AM (#9731620)
IP addresses are not people
[ Parent | on HN ]