Comments on: Dear Snowflake: Happy ‘Data Privacy Day’ http://krebsonsecurity.com/2010/01/dear-snowflake-happy-data-privacy-day/ In-depth security news and investigation Sat, 11 Feb 2012 19:29:31 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Seth Wisely http://krebsonsecurity.com/2010/01/dear-snowflake-happy-data-privacy-day/comment-page-1/#comment-2435 Seth Wisely Fri, 19 Feb 2010 23:02:30 +0000 http://www.krebsonsecurity.com/?p=792#comment-2435 ^^ you're bucket == your bucket ^^
you’re bucket == your bucket

Like or Dislike: Thumb up 0 Thumb down 1
]]> By: Seth Wisely http://krebsonsecurity.com/2010/01/dear-snowflake-happy-data-privacy-day/comment-page-1/#comment-2434 Seth Wisely Fri, 19 Feb 2010 23:00:35 +0000 http://www.krebsonsecurity.com/?p=792#comment-2434 fingerprinting is a kind of datamining. as such its vulnerable to the same kind of poisoning strategy: provide enough bad data and you're bucket is devalued. FX could be rigged to ratchet up the chaos. @ AlphaCentauri re: security do not surf the web with admin privileges. that problem solved. sandox/vm is not sufficient alone. @ Wladimir Palant re: flash cookies / SOL firefox extension: BetterPrivacy. I wager the next version of FX will contain these features. I don't want to be prompted about plug-ins so the only plug-in I have allowed to stay active is flash. (@..@others.. you can change your FX to not-scan for plug-ins and drop the flash bits in ... to switch between flash versions to avoid breathing hollywood tainted AIR) @ mozilla I don't want my browser to be info leaky, but you're probably going to continue moving toward OpenID integration and creepy google-wave-like features. yay? no! why not? How many people choose flock OVER firefox? yeah.. so you can bet it won't be popular with any other than itards and fanbois. fingerprinting is a kind of datamining. as such its vulnerable to the same kind of poisoning strategy: provide enough bad data and you’re bucket is devalued.

FX could be rigged to ratchet up the chaos.

@ AlphaCentauri

re: security

do not surf the web with admin privileges. that problem solved. sandox/vm is not sufficient alone.

@ Wladimir Palant

re: flash cookies / SOL

firefox extension: BetterPrivacy. I wager the next version of FX will contain these features.

I don’t want to be prompted about plug-ins so the only plug-in I have allowed to stay active is flash.

(@..@others.. you can change your FX to not-scan for plug-ins and drop the flash bits in … to switch between flash versions to avoid breathing hollywood tainted AIR)

@ mozilla

I don’t want my browser to be info leaky, but you’re probably going to continue moving toward OpenID integration and creepy google-wave-like features.

yay? no!

why not? How many people choose flock OVER firefox? yeah.. so you can bet it won’t be popular with any other than itards and fanbois.

Like or Dislike: Thumb up 0 Thumb down 1
]]> By: AlphaCentauri http://krebsonsecurity.com/2010/01/dear-snowflake-happy-data-privacy-day/comment-page-1/#comment-1281 AlphaCentauri Fri, 29 Jan 2010 23:39:19 +0000 http://www.krebsonsecurity.com/?p=792#comment-1281 Apparently only 1:332 people is using the most recent version of Firefox with Javascripts turned off. It's not my privacy I'm worried about there so much as everyone else using more vulnerable browser configurations. I'm unique among nearly 250,000 people if I use IE8 but manually override the Internet settings to have the lowest privacy and security levels. But that probably just means that people with trojans that change their setting aren't visiting the Electronic Frontier Foundation website. Apparently only 1:332 people is using the most recent version of Firefox with Javascripts turned off. It’s not my privacy I’m worried about there so much as everyone else using more vulnerable browser configurations.

I’m unique among nearly 250,000 people if I use IE8 but manually override the Internet settings to have the lowest privacy and security levels. But that probably just means that people with trojans that change their setting aren’t visiting the Electronic Frontier Foundation website.

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: M Henri Day http://krebsonsecurity.com/2010/01/dear-snowflake-happy-data-privacy-day/comment-page-1/#comment-1273 M Henri Day Fri, 29 Jan 2010 21:52:18 +0000 http://www.krebsonsecurity.com/?p=792#comment-1273 Thanks for clearing that up, Solo Owl ! So the information provided by the third column is the same as that provided by the second column ; all one has to do is perform 2^x to derive the latter from the former. I can confirm that the «bits of identifying information» score does increase as more people take the text - now, for example, I am 0.11 points more frightened than I was when I posted above. I see I'd better not check again tomorrow !... Henri Thanks for clearing that up, Solo Owl ! So the information provided by the third column is the same as that provided by the second column ; all one has to do is perform 2^x to derive the latter from the former. I can confirm that the «bits of identifying information» score does increase as more people take the text – now, for example, I am 0.11 points more frightened than I was when I posted above. I see I’d better not check again tomorrow !…

Henri

Like or Dislike: Thumb up 2 Thumb down 0
]]> By: Solo Owl http://krebsonsecurity.com/2010/01/dear-snowflake-happy-data-privacy-day/comment-page-1/#comment-1271 Solo Owl Fri, 29 Jan 2010 21:32:31 +0000 http://www.krebsonsecurity.com/?p=792#comment-1271 The "bits of information" feature is just the logarithm, base 2, of the number in the sentence "Your browser fingerprint appears to be unique among the N tested so far". Based on the very limited sample in the comments, just about everyone is "unique". As more people submit to the test, the "bits of info" scores will increase. Therefore I think this number, this smidgen of information is actually meaningless. What we should take away from this is simple. After a few days of service, any installation of an OS is as unique as its user (who has been adding software and extensions and plugins, and tweaking settings). No two humans are alike, so no two computers are alike. No way you can change that. No way you can completely hide, as the human species is highly social. The “bits of information” feature is just the logarithm, base 2, of the number in the sentence “Your browser fingerprint appears to be unique among the N tested so far”.

Based on the very limited sample in the comments, just about everyone is “unique”. As more people submit to the test, the “bits of info” scores will increase. Therefore I think this number, this smidgen of information is actually meaningless.

What we should take away from this is simple. After a few days of service, any installation of an OS is as unique as its user (who has been adding software and extensions and plugins, and tweaking settings). No two humans are alike, so no two computers are alike.

No way you can change that. No way you can completely hide, as the human species is highly social.

Like or Dislike: Thumb up 2 Thumb down 1
]]> By: M Henri Day http://krebsonsecurity.com/2010/01/dear-snowflake-happy-data-privacy-day/comment-page-1/#comment-1260 M Henri Day Fri, 29 Jan 2010 19:30:38 +0000 http://www.krebsonsecurity.com/?p=792#comment-1260 «Your browser fingerprint appears to be unique among the 223,259 tested so far. Currently, we estimate that your browser has a fingerprint that conveys at least 17.77 bits of identifying information.» The above rating corresponds precisely to that for my «Browser Plugin Details» - and, to my perhaps naive surprise, to that for my «System Fonts». Values for other parametres, such as «Time Zone», «Are cookies enabled ?» «Limited supercookie test», and «Screen Size and Colour Depth» are much less, with that for «HTTP_ACCEPT headers» somewhere in between. But how worried need we be ? 17.77 bits of information, corresponding to a little more than two bytes or, in other words a little more than the information needed to encode two letters in the alphabet, doesn't seem a great deal. Given that, say, Echelon is busy sifting all my communications - and yours as well ! - for certain key words (strings), I'm not certain the above constitutes the greatest privacy invasion to which we are being subject.... Henri «Your browser fingerprint appears to be unique among the 223,259 tested so far.

Currently, we estimate that your browser has a fingerprint that conveys at least 17.77 bits of identifying information.»

The above rating corresponds precisely to that for my «Browser Plugin Details» – and, to my perhaps naive surprise, to that for my «System Fonts». Values for other parametres, such as «Time Zone», «Are cookies enabled ?» «Limited supercookie test», and «Screen Size and Colour Depth» are much less, with that for «HTTP_ACCEPT headers» somewhere in between. But how worried need we be ? 17.77 bits of information, corresponding to a little more than two bytes or, in other words a little more than the information needed to encode two letters in the alphabet, doesn’t seem a great deal. Given that, say, Echelon is busy sifting all my communications – and yours as well ! – for certain key words (strings), I’m not certain the above constitutes the greatest privacy invasion to which we are being subject….

Henri

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: Jonathan http://krebsonsecurity.com/2010/01/dear-snowflake-happy-data-privacy-day/comment-page-1/#comment-1258 Jonathan Fri, 29 Jan 2010 19:25:17 +0000 http://www.krebsonsecurity.com/?p=792#comment-1258 Thanks to this test I've just discovered that Microsoft had installed an internet plug-in for "OfficeLive" (isn't that still in beta and not even officially available?) on my system, which must have come with the last update to Office 2008 I performed. Not once was I asked if I wanted to install this and I'm bloody furious. It's bad enough that I even have to use Office 2008 (it is complete, utter tosh) but it is worse that MS chose to go behind my back in such a sneaky and diabolical fashion. Damned scumbags. Thanks to this test I’ve just discovered that Microsoft had installed an internet plug-in for “OfficeLive” (isn’t that still in beta and not even officially available?) on my system, which must have come with the last update to Office 2008 I performed. Not once was I asked if I wanted to install this and I’m bloody furious. It’s bad enough that I even have to use Office 2008 (it is complete, utter tosh) but it is worse that MS chose to go behind my back in such a sneaky and diabolical fashion. Damned scumbags.

Like or Dislike: Thumb up 1 Thumb down 1
]]> By: DMoser http://krebsonsecurity.com/2010/01/dear-snowflake-happy-data-privacy-day/comment-page-1/#comment-1250 DMoser Fri, 29 Jan 2010 17:05:43 +0000 http://www.krebsonsecurity.com/?p=792#comment-1250 Many of your links for articles (EFF, CNN) go to items that were authored almost a decade ago (2001, 2002). While the principles explained are similar, the names have changed and there is newer technology (Netscape, not FireFox?), I sort of expected something more current. However, there may not be anything more recent to link too. Many of your links for articles (EFF, CNN) go to items that were authored almost a decade ago (2001, 2002). While the principles explained are similar, the names have changed and there is newer technology (Netscape, not FireFox?), I sort of expected something more current. However, there may not be anything more recent to link too.

Like or Dislike: Thumb up 2 Thumb down 1
]]> By: Private Pete (talking to himself) http://krebsonsecurity.com/2010/01/dear-snowflake-happy-data-privacy-day/comment-page-1/#comment-1241 Private Pete (talking to himself) Fri, 29 Jan 2010 08:28:57 +0000 http://www.krebsonsecurity.com/?p=792#comment-1241 Looks like Joomla according to Praetorian Prefect http://praetorianprefect.com/archives/2010/01/congressional-web-site-defacements-follow-the-state-of-the-union/ Go figure: http://osvdb.org/vendor/4358-joomla/1 ;) Looks like Joomla according to Praetorian Prefect
http://praetorianprefect.com/archives/2010/01/congressional-web-site-defacements-follow-the-state-of-the-union/

Go figure: http://osvdb.org/vendor/4358-joomla/1 ;)

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: !op http://krebsonsecurity.com/2010/01/dear-snowflake-happy-data-privacy-day/comment-page-1/#comment-1240 !op Fri, 29 Jan 2010 08:03:49 +0000 http://www.krebsonsecurity.com/?p=792#comment-1240 49 House PR sites. 49 House PR sites.

Like or Dislike: Thumb up 1 Thumb down 1
]]>