Panopticlick is a bunch of fearmongering nonsense. I'm on an ipad right now, and they tell me that "only one in 350000 browsers has the same fingerprint as mine". All fully-updated iPads have the exact same fingerprint, you can't even come close to uniquely identifying me with that.
You're forgetting localization. Your timezone alone makes you more identifiable. Add in your IP address and you're pretty identifiable. Not to mention that iPads don't really have any private browsing mode.
> Not to mention that iPads don't really have any private browsing mode.
Safari on iOS certainly does have "private browsing". Just go to the Settings app and select "Safari" from the top level and it's the first setting under the "Privacy" (just below the "General" section). When it's enabled, the browser looks different to let you know -- the normally gray bezel UI becomes black. This has been a feature ever since iOS 5.0 was released in 2011.
I just tried Panopticlick both before and after enabling private browsing in Safari (Mac OS X) and the site identified the same number of identifiable pieces of information about me. So it looks like that has no effect.
Which sort of makes sense - the info it's looking at is basically the header info. Screen size, installed fonts, IP address, and so on. It's not relying on cookies, as cookies can't be seen/read across domains (you can't tell I'm an Amazon customer if I just visit you out of the blue).
CSS may color visited links red, but they hacked getComputedStyle to return the normal color instead. So, you can't tell if that link to Amazon you just created is visited or not.
And you can no longer set, for example, font-weight:bold for visited links, because that would change the size of the element, and they decided, unlike in the color case, that it would be too complicated to get all the APIs to lie about the new geometry.
True, timezone could be a biggie. Although in my case (GMT) is 1/22. Screen res is another possibility (1920x1080) = 1/28.
All the site doesn't mention anything about IP address on the report page and presumably doesn't have access to third party tracking cookies however so private browsing shouldn't make much difference (I cleared my cookies and got the same score).
iOS Chrome has "Incognito Mode*". The asterisk is there because WebKit does not have any way to make localStorage private, meaning it's shared between Incognito and Normal browsing modes, so there's a possible leak of information there, especially if they're using a third party tracking service. This is true for any of the private web surfing apps that use WebKit.
It only clears your browsing traces locally (history, cookies, cache, etc). Everything else can still be tracked on server-side. BTW, every private browsing mode that I know works pretty much that way.
In the current model real privacy can only be achieved running something like Tor.
I'm confused as well, apparently my browser (stock firefox on Ubuntu) is completely unique. I would expect it to be reasonably rare but certainly not that rare.
I haven't done the math, but I have a feeling it just keeps dividing by the "one in x browsers have this value". Maybe it doesn't look at the intersections , for example: Using Totem as the default wmv player is rare and using Ubuntu is rare but reporting Totem as .wmv player is going to be a lot less rare amongst Ubuntu users that it is amongst Windows users.
>I haven't done the math, but I have a feeling it just keeps dividing...
Why would it have to use division, or for that matter, any kind of math at all? I imagine that as each new visitor is recorded, they simply count how many other visitors had the exact same browser configuration.
The "one in x browsers have this value" column is probably just for informative purposes (and not the raw data that was somehow munged to determine the uniqueness of your browser fingerprint).
I'm not sure what you mean by "resolution"; the site doesn't claim that a browser fingerprint is unique among all instances of all browser software ever run, just that (for example, to quote from my test results) "Your browser fingerprint appears to be unique among the 2,568,783 tested so far".
One in 350k means you are similar to ~1100 other Americans. A large crowd to be sure, but not great for being completely anonymous. There is still a lot of value in even making groups with this many members.
but still: so I'm only as unique as any iPad users in GMT-7, not all iPad users globally. That's not information that is of any use in identifying me, but EFF insists on presenting it as though SWAT teams from adwords will be breaking down my door any day now to shove targeted marketing materials down my throat.
Next time I visit the Apple Store, I should remember to visit Panopticlick from some of the machines on display and see what only-one-in numbers it reports.
Panopticlick also glosses over the fact that the browser characteristics it uses for 'fingerprinting' change over time. In the time it took me to write this comment, Chrome updated itself three times, for example.
Comments
Panopticlick is a bunch of fearmongering nonsense. I'm on an ipad right now, and they tell me that "only one in 350000 browsers has the same fingerprint as mine". All fully-updated iPads have the exact same fingerprint, you can't even come close to uniquely identifying me with that.
You're forgetting localization. Your timezone alone makes you more identifiable. Add in your IP address and you're pretty identifiable. Not to mention that iPads don't really have any private browsing mode.
> Not to mention that iPads don't really have any private browsing mode.
Safari on iOS certainly does have "private browsing". Just go to the Settings app and select "Safari" from the top level and it's the first setting under the "Privacy" (just below the "General" section). When it's enabled, the browser looks different to let you know -- the normally gray bezel UI becomes black. This has been a feature ever since iOS 5.0 was released in 2011.
More info here: http://support.apple.com/kb/HT1677
I just tried Panopticlick both before and after enabling private browsing in Safari (Mac OS X) and the site identified the same number of identifiable pieces of information about me. So it looks like that has no effect.
Which sort of makes sense - the info it's looking at is basically the header info. Screen size, installed fonts, IP address, and so on. It's not relying on cookies, as cookies can't be seen/read across domains (you can't tell I'm an Amazon customer if I just visit you out of the blue).
You used to be able to by reading back CSS styles of visited links. May be fixed now. http://blog.adrianroselli.com/2010/03/mozilla-to-modify-how-...
It is fixed.
CSS may color visited links red, but they hacked getComputedStyle to return the normal color instead. So, you can't tell if that link to Amazon you just created is visited or not.
And you can no longer set, for example, font-weight:bold for visited links, because that would change the size of the element, and they decided, unlike in the color case, that it would be too complicated to get all the APIs to lie about the new geometry.
Is it fixed in all browsers?
Not everyone's using an appliance. My fingerprint is unique in their list.
True, timezone could be a biggie. Although in my case (GMT) is 1/22. Screen res is another possibility (1920x1080) = 1/28.
All the site doesn't mention anything about IP address on the report page and presumably doesn't have access to third party tracking cookies however so private browsing shouldn't make much difference (I cleared my cookies and got the same score).
iOS Chrome has private browsing. There are also s number of dedicated apps for private web surfing.
iOS Chrome has "Incognito Mode*". The asterisk is there because WebKit does not have any way to make localStorage private, meaning it's shared between Incognito and Normal browsing modes, so there's a possible leak of information there, especially if they're using a third party tracking service. This is true for any of the private web surfing apps that use WebKit.
Now I'm curious—what does "Private Browsing" do when enabled in Settings > Safari?
It only clears your browsing traces locally (history, cookies, cache, etc). Everything else can still be tracked on server-side. BTW, every private browsing mode that I know works pretty much that way.
In the current model real privacy can only be achieved running something like Tor.
Onion browser on iOS professes tor based anonymity
I'm confused as well, apparently my browser (stock firefox on Ubuntu) is completely unique. I would expect it to be reasonably rare but certainly not that rare.
I haven't done the math, but I have a feeling it just keeps dividing by the "one in x browsers have this value". Maybe it doesn't look at the intersections , for example: Using Totem as the default wmv player is rare and using Ubuntu is rare but reporting Totem as .wmv player is going to be a lot less rare amongst Ubuntu users that it is amongst Windows users.
>I haven't done the math, but I have a feeling it just keeps dividing...
Why would it have to use division, or for that matter, any kind of math at all? I imagine that as each new visitor is recorded, they simply count how many other visitors had the exact same browser configuration.
The "one in x browsers have this value" column is probably just for informative purposes (and not the raw data that was somehow munged to determine the uniqueness of your browser fingerprint).
It has nowhere near the traffic to give the resolution it claims based on simple counting.
I'm not sure what you mean by "resolution"; the site doesn't claim that a browser fingerprint is unique among all instances of all browser software ever run, just that (for example, to quote from my test results) "Your browser fingerprint appears to be unique among the 2,568,783 tested so far".
One in 350k means you are similar to ~1100 other Americans. A large crowd to be sure, but not great for being completely anonymous. There is still a lot of value in even making groups with this many members.
My previous comment on this: http://news.ycombinator.com/item?id=4479876
Not disagreeing with the bogosity of the numbers - but isn't the time zone part of the fingerprint? So not all iPads are the same?
Yeah, you're right
but still: so I'm only as unique as any iPad users in GMT-7, not all iPad users globally. That's not information that is of any use in identifying me, but EFF insists on presenting it as though SWAT teams from adwords will be breaking down my door any day now to shove targeted marketing materials down my throat.
Next time I visit the Apple Store, I should remember to visit Panopticlick from some of the machines on display and see what only-one-in numbers it reports.
Panopticlick also glosses over the fact that the browser characteristics it uses for 'fingerprinting' change over time. In the time it took me to write this comment, Chrome updated itself three times, for example.
My iPhone 5 is 1 in 214,000; my Galaxy S3 was unique.
Since the iPhone 5 makes up more than one in 200,000 of the Internet's traffic, even that "relatively low" uniqueness is worrisome.