Browser Fingerprinting: What Is It and What Should You Do About It?
A web browser fingerprint is the identification of someone’s web browser in an attempt to track you regardless of what IP address you are coming from.
Basically your web browser is probed to determine what add-ons you have installed, what fonts are installed on your computer, what video card your computer has (via WebGL), PNG hash, what operating system you are using, your web browser’s 2D canvas, etc. All of this information is combined to form a fingerprint of your web browser.
Now you may be asking, “How does this allow someone to track my online visits?” Good question. People can make use of this fingerprinting to track you even if you take measures to deter people from monitoring your online activity (e.g., using a VPN).
If you have ever visited a website (without using a VPN) and later on you visit the same website (this time, using a VPN), they can still have a pretty good guess that it is you just by looking at your browser fingerprint you left the last time you visited (without the VPN).
This is how websites like YouTube still show you relevant recommendations, even if you use another IP address to access their web service.
Is there any way to stop browser fingerprinting? Not really. You can help confuse trackers into thinking you are someone else by spoofing the fingerprint, but this is not guaranteed to always work.
A browser fingerprint spoofer basically “lies” to a website giving it false information about the web browser. This of course causes the fingerprint to be different than it normally would be. The result? A website thinks you are someone else regardless of the IP address you are connecting from.
(This does not take into account tracking cookies. Websites can also track you with cookies, regardless if they use web browser fingerprinting techniques.)
So what do I recommend to do to help stop browser fingerprinting? Well you can do the following (my opinions, of course):
- use Mozilla Firefox – this is a good web browser for security and privacy
- use the Canvas Blocker for Firefox add-on – this spoofs your browser fingerprint
That should help protect your real fingerprint from being found out. I should note that spoofing your fingerprint may end up breaking certain websites. You will just have to try it out.
Please keep in mind, a browser fingerprint spoofer can end up making your fingerprint unique to everyone else’s fingerprint. This can cause you to stand out like a sore thumb, and cause you to be even more easily tracked. 🙁
This is because most people are not using a fingerprint spoofer and it would become obvious that you (and maybe a couple of other people) are the only ones faking your browser fingerprints. In other words, you do not “blend into the crowd”.
Another trick is to turn on Mozilla Firefox’s “resist fingerprint” feature. This feature, among other things, causes your web browser’s fingerprint to match that of the TOR web browser. This makes you blend into the crowd of TOR users, since they all should be using the same fingerprint.
To turn this feature on:
- at the about:config webpage (on Firefox), find the option privacy.resistFingerprinting and set it to true, then restart the web browser
However this feature (in my experience) causes some websites to break (animations are slowed down, current time of day will not be correct, etc.) This all helps to prevent websites from fingerprinting the browser.
Please remember that there is no way to be 100% anonymous on the Internet. Always someone out there who can track you. All you are doing is making it harder to be tracked.
I hope I have helped someone with this blog post. It took me a bit to write it, but it is worth it if it helps. 🙂
Posted in Computers, Security, Software, VPN
What Can People Tell from My IP Address?
So what can people tell by looking at your IP address? That is a good question. I will go through the different ways people can try to figure out who is behind an IP address.
Before we start, I need to make sure you know that just because someone has your IP address, does not mean that they can easily figure out who you are. This is because ISPs (Internet Service Providers) keep this information confidential, and usually only law enforcement agencies (with the proper papers) can even have a chance to find out who is / was using a particular IP address.
Also, please keep in mind that many IP addresses are “shared”. There could be dozens (if not hundreds) of computers behind one IP address. So even if you found out who is in charge of an IP address, that information does not prove that the IP administrator is the same person who did something malicious. It could have been any one of those “computers” that did the malicious deed.
Here are different ways a “non-connected” (an average Internet user with no ties to any government agency) can try to figure out who you are.
Geo-Location
This is when someone uses an online service to get the location of an IP address. One such online tool is located here: https://iplocation.com/
The problem with IP Geo-location services is that they are typically inaccurate. You never know for sure if the user is anywhere close to where these services say they are. In addition, if the user is using a VPN service, they are usually not anywhere close to the stated location anyway.
Summary: Geo-Location lookup services are typically useless to find out someone’s true location.
Reverse IP Lookup
This is when someone does a reverse lookup on an IP address to determine if there is anything identifying the user (typically a domain name that is associated with an IP address).
If someone can pair the domain name with an IP address, this might give away who is running a particular IP address.
However, this method is usually useless since most people are going to have an IP address that does not have any custom reverse lookup name. This is especially true for people using a dynamic IP address via a residential connection.
Even if you find a unique domain name being used for an IP address’ reverse name, you still would have to know who registered the domain name.
Summary: A reverse IP lookup usually does not provide any useful information (especially for residential IP addresses).
Being Careless Online
This is when you give out too much information about yourself on the Internet. This would make it a whole lot easier for someone who is running a website (e.g., a web forum) to know who you are, regardless of the IP address you are connecting from.
Summary: Being careless online with your information does not help you to stay anonymous.
As you can see, most (if not all) average Internet users would have a hard time trying to figure out who is behind an IP address, without someone purposely exposing information about themselves.
Therefore, unless you are doing something to attract the attention of a large, well-connected organization (e.g., a government agency) or giving out too much personal information online, you should be fine.
In addition, using a reputable VPN service will pretty much prevent any average Internet user from ever knowing your true IP address, much less your true location.
Posted in Computers, Internet and Servers, Security, VPN
Something Interesting that Happened with a VPN Service
Since my last couple of posts have been about VPNs, I decided to share a recent experience I had with a paid VPN service (not going to give out the name).
I have a website I have been working on for a little while now (brand new; only two friends know about it; Google had not listed it yet).
I tested my new website by browsing to it from a remote location (via a paid VPN service) to see if it came up fine.
Unexpectedly, later on that day, a computer from France suddenly accessed my website (Quick Note: the VPN IP address I used was not located in France).
Soon after, Google suddenly knew about my website and the next day indexed it.
Now I admit I did not have the website password protected before launch (I should have), but what I find strange is that there was no real web traffic to my website until I used the VPN service.
I am not the type of person to become paranoid, but I find that to be quite a coincidence. I was left wondering if my VPN service was in fact spying on me. As I said, there was practically no traffic to my new website, and that was the case for around a week.
Please keep in mind I have no proof that my VPN service was spying on me. It may have been Google (and the other random computer from France) just happened to find out about the website the same day I used the VPN.
I guess I am left with an unsolved mystery. 🙂
Posted in Computers, Internet and Servers, Security, VPN
Should You Setup Your Own VPN Server?
In this post, I am going to go through the different ways a VPN can be hosted.
I am just going to talk about VPNs in the context of people using them to secure their connection and/or hide their IP address (not about using a VPN for connecting two company networks together).
Should you setup your own VPN server? Only if you just require security not privacy. Otherwise I recommend going with a reputable VPN service.
Self-Hosted VPN
This is when you run your own VPN server from your home/office. The main advantage of going this route is that you control your network, and you completely control your computer that runs the VPN server.
The Good: You get the advantage of extra security when connecting over a potentially hostile network (e.g., coffee shops, hotels, etc.).
The Bad: You get no privacy what so ever, since your online activity is under the IP address you have been assigned by your ISP (Internet Service Provider).
VPN on a Virtual Private Server
Many online companies offer virtual server hosting solutions. Many of these companies allow their users to setup their own OpenVPN server. You technically are running your own VPN server, but the server itself is being hosted elsewhere.
The Good: You get some privacy since the IP address of your server is owned by your web hosting company, not your ISP. In addition, you still get the extra security when connecting over a potentially hostile network.
The Bad: Since you are the only one using the assigned IP address from the web hosting company, there is very little “wiggle room” in-case someone wanted to track you down for some reason (e.g., for posting “offensive” comments or something).
In addition, since you do not operate the network your server is on, you can never be sure if your web hosting company is spying on you (always assume that they are). They can even spy on your virtual server too.
VPN via a VPN Service
This is when you go to an actual VPN service and pay to make use of their vast array of servers that they have specifically setup for people to use for privacy.
I am not going to recommend any particular VPN service. You must make that decision for yourself.
The Good: Going this route is usually quick and easy to get setup. Most VPN companies focus on your privacy (that is what they are supposed to be in business for anyway). This is the best way for someone to get started with using VPNs when they have never used one before.
In addition, since many other people are using the same VPN server you are on (hence, the same IP address), you “blend into the crowd”.
The Bad: VPN servers can get overloaded, since VPN companies usually have thousands of customers using their services at any given time. In addition, not all “no logging” VPNs are really doing what they say. I am not going to point any fingers, but just be careful when choosing a VPN service.
The following chart is my opinions for each type of VPN hosting.
Security Level – Determined by how much control you have over the VPN server and its network.
Privacy Level – Determined by how much the VPN hosting will protect your privacy.
| Self-Hosted at Home/Office | VPN on a Virtual Private Server | VPN Service | |
| Security Level | High | Low | None |
| Privacy Level | None | Medium | High |
Things to Keep in Mind
- VPNs cannot keep you completely anonymous. All you are doing by using a VPN is making the VPN your “new” ISP. They can potentially mess with your data that you are sending through their servers. In addition, someone could be tapping the Internet link that your VPN provider is using. This may compromise your privacy.
- Doing something malicious. No VPN will completely protect you if your are doing something to attract the attention of a large, well-connected organization (e.g., a government agency).
- Using a VPN because of “no logs” is not a good idea. I am sure there are some that really do not log, but even if they didn’t at some point, how do you know that they will not start logging without your knowledge?
- A VPN will not protect you from viruses. A virus (e.g., from a file download) can still infect your computer even if your are using a VPN.
- A VPN will not completely protect you from hackers either.
( Click here to read my “Popular Misconceptions About VPNs” article. )
Posted in Computers, Internet and Servers, Security, Software, VPN