Race Is On to 'Fingerprint' Phones, PCs

[cory777]

Source: Wall Street Journal

IRVINE, Calif.—David Norris wants to collect the digital equivalent of fingerprints from every computer, cellphone and TV set-top box in the world.

He's off to a good start. So far, Mr. Norris's start-up company, BlueCava Inc., has identified 200 million devices. By the end of next year, BlueCava says it expects to have cataloged one billion of the world's estimated 10 billion devices.

Advertisers no longer want to just buy ads. They want to buy access to specific people. So, Mr. Norris is building a "credit bureau for devices" in which every computer or cellphone will have a "reputation" based on its user's online behavior, shopping habits and demographics. He plans to sell this information to advertisers willing to pay top dollar for granular data about people's interests and activities.

-------

It's tough even for sophisticated Web surfers to tell if their gear is being fingerprinted. Even if people modify their machines—adding or deleting fonts, or updating software—fingerprinters often can still recognize them. There's not yet a way for people to delete fingerprints that have been collected. In short, fingerprinting is largely invisible, tough to fend off and semi-permanent.

Read more: http://online.wsj.com/article/SB10001424052748704679204575646704100959546.html?mod=rss_whats_news_technology

---

Breaking Alternative News http://activistnews.blogspot.com/

[sudopod]

1. "Even if people modify their machines—adding or deleting fonts"

We've got a real computer expert right here.

[cory777]

3. I enjoyed that too, Genius!

[sudopod]

6. lolz nt

[Duer 157099]

7. Fuck! You mean that I just wasted my time deleting a font???

Shit. I was *sure* that would change my MAC address!

[AtheistCrusader]

12. Pro-Tip: Use someone else's MAC address.

[BadgerKid]

8. AIUI, this is real, particularly for web browsers.

Web browsers send their name and version, along with the OS name and version, and fonts installed under Java.

This has been known for almost a year. Pick an article:

http://www.google.com/search?hl=en&safe=off&q=browser+fingerprint

[sudopod]

9. Anyone savvy enough to know that

will just spoof their user agent string, run noscript, etc, wouldn't they?

[boppers]

16. User-Agent, Accept, Accept-Encoding, Accept-Charset, Accept-Language, (etc.)

It's a tad more complex than "User-Agent" and noscript.

If you don't believe me, try running 300 automated google searches in an hour without being flagged, or walled.

I run about 3,000 a day, and it's a fun, messy, field, to simulate thousands of users.

[sudopod]

19. Well sure, if you're using google in industrial quantities I guess you'd have to cover every base

But then, it's not hard to make a browser tell sweet sweet lies. It only takes a few minutes to batten down the hatches on a vanilla Firefox install.

However, I think it's fair to say that deleting fonts, unless that's a euphemism for something else, probably isn't the most efficient way to go about being sneaky. I'm just an amateur though, so maybe I missed something. I'm not the king of nerds around here by a long shot.

[Lasher]

14. I just changed my browser from IE to Mozilla

That should throw them off for a couple of days.

[boppers]

13. Ah. You don't know about that, then.

So, since you possibly think of yourself as an expert, I'll explain how it works..

Both flash and javascript have font calls, and methods of downloading "missing" fonts.

Font=Cookie.

[sudopod]

15. derp derp noscript

a derp

[boppers]

17. Ah, the person outside the herd.

No way to notice and find that, right?

"I'm the rare buffalo standing away from the herd! You can't identify me in the herd! I'm way over here, different from all of them!"

*bang*

"Shit."

[sudopod]

18. eh, my browser got a 1 in 3000 on the panopticlick test.

If it looks like a few hundred other people out of the 1.5 million( http://panopticlick.eff.org/ ), that's ok, imho. Apparently the trick is to get a sufficiently generic user agent string, but for some reason mine is still sticking out even when tuned to a flavor of internet exploder. :shrug:

Never claimed to be a special snowflake, though.

[Blandocyte]

24. That's an amazing site

It showed all my PC info, all my fonts, browser type/version, browser plugins, etc. Also thumbnails of the pr0n I'd looked at and most embarrassingly pics of the Esteban guitar I ordered. OK, kidding about the last 2.

[bemildred]

31. Noscript and Ghostery (and Firefox) can help.

That site will not even load for me, because I have Javascript turned off, I think.

[Recursion]

33. I use random per-request user-agent strings to screw with web programmers' heads

uzbl lets you do fun things.

[frylock]

22. you need root for that

[Recursion]

32. sudo make me a sandwich (nt)

[Newsjock]

2. I'll sell access to the fingerprint of my computer

For only $19.95 per month per advertiser.

[TheWatcher]

4. Welcome To Slavery.

No Privacy for anyone, anywhere.

All for the Greater Greed.

Makes me wonder sometimes if the developers of the Original Deus Ex had a point.

Blow It All Up and Start It The Fuck Over.

http://www.youtube.com/watch?v=ZGhVxTxjS-Y

[sat110]

5. Always try and research before purchase

I build all my Laptops and Desktops, what has me concerned
is my Phone and maybe my router one day, anyways cant a
wireless or internet provider just sell that them-self?

TP

[me b zola]

10. The devil inside

Until recently, fingerprinting was used mainly to prevent illegal copying of computer software or to thwart credit-card fraud. BlueCava's own fingerprinting technology traces its unlikely roots to an inventor who, in the early 1990s, wanted to protect the software he used to program music keyboards for the Australian pop band INXS.

[pam4water]

11. Damn it I just figure out how managing my cookies and block scripts ;_; K&R N/T

[IScreamSundays]

20. Really let's face it: The internet was designed for the Police State.

Are you on Facebook?? That is information assimilated. Aside from your DNA, they know who you know, what you buy, the websites you visit, who you know, your political leanings, what you say, what you think. How does that feel?? There is no such thing as privacy anymorel

[FinGovi]

21. Plenty of privacy

if you lie all the time while face/spybooking. So much demographic data exists and so little ability to process it. I don't have any portable devices, except for this laptop...

[superduperfarleft]

25. No, it was designed to sell you stuff.

Just like TV.

[Recursion]

28. Well, no, it was *designed* for military communications after a nuclear strike

And expanded to allow research scientists to exchange pornography^H^H^H^H^H research papers.

[LanternWaste]

34. Police state? How about the Corporate State?

Police state? How about the Corporate State?

Seems to me it's the market that collecting, tabulating and collating this information on everyone they can. And the market seems to be a lot more effective and efficient at it that your local PD or even the Feds.

I'm much more concerned about my personal info reaching the market than I am it reaching the Feds.

[PeaceNikki]

23. OH MY GOD!! THEY MIGHT DIRECT MARKET ME!?!!?

Not everything is nefarious, ya know?

[Blue_Tires]

26. Good luck with THAT shit...

Once I've researched exactly what a proxy is and how it works, there will be quite a few buffers between myself and the impending fascist conspiracy:freak:

[Recursion]

27. Flash is a big culprit here

Macromedia essentially gutted the security restrictions Java and Javascript had been operating under, and nobody cared because we were too enamored of being able to watch videos of pandas sneezing.

[Countdown_3_2_1]

29. Hmmmm. OK. How about an encryption device between your computer and the net.?

I doubt hacker types will be intimidated. Watch the techno sites for a counter measure.

I'll bet its under $50.

[karynnj]

30. This is why we need legislation that protects our online and telephone privacy

Yesterday, Kerry introduced legislation written to deal with this. (Coincidentally, his brother, Cam Kerry is heading Obama's task force on this.

During the process of drafting legislation, I’ve concluded that consumers should have three nonnegotiable rights. First, all firms must put procedures in place to secure personally identifiable information. Second, consumers have a right to know in clear and concise terms what firms intend to collect, why, and how it will be used. Third, consumers should be given a simple mechanism for opting out of the process.

“Information collection is now a routine part of commerce, but proper stewardship of information is as important as how it is collected. Firms should have to notify consumers when privacy policies change and allow consumers to have their information anonymized if the company goes bankrupt or they want to terminate the relationship. Companies should make an effort to minimize the data collected, ensure it is protected while being transferred, and ensure continued accuracy of information throughout the process.

http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=433x538934

[sofa king]

35. Anyone who moved DIMMs in a Microsoft box knows that's a bunch of crap.

Anyone who has tested their second RAM channel knows exactly what I mean: just moving the memory over one centimeter used to be enough to force a phone call to Microsoft to re-validate Windows XP, because Windows interpreted that movement as a previously used copy of XP being installed on a new machine.

Toss in zombies, burners, wide-open routers, images, sock puppets, proxies, and clouds, and the quality of the data being collected becomes the proverbial teaspoon of wine in the gallon of sewage, or vice versa--either way, it's shit. It's shit, and it will be used against us.