Browsing on the web may seem harmless to most, but we SuperUsers are typically a secretive bunch. We’ don’t like data being shared about us unless we tell them to.
So when user Pickledegg asked about how much info can websites can get, it became a pretty popular question.
I am trying to determine if the information shown on the website
www.whatsmyip.orgis the absolute maximum amount of information that a webserver can obtain from a web visitor. Does anyone know of any other sites that will be able to get more information from the user passively like this? I’m not talking about port-sniffing or any kind of interaction from the user, just the info that a server can get from a ‘dumb’ visit.
So what’s the verdict?
Here’s what we found. From What’s my IP they can determine the following (I removed un-important info, if I missed something feel free to comment):
- External IP
- Internal (LAN) IP
- Operating System and version
- Screen Resolution
- Cookies Enabled
- Browser Plugins
- Location (kinda sorta)
- And a WHOIS Lookup
Basically is looked like this (I put green checkmarks across things that were correct):
But there’s more! A browser can also give away your installed fonts! GASP. Wait… what? Why is that important?
User Informaficker had this to say:
Installed fonts are probably the most identifying piece of information as soon as you start adding one or two. Just because of the amount of fonts out there, it is unlikely to have the same set of fonts on two different computers. (As long as they are used by different persons)
This means that if you have any custom installed fonts on your computer, you have a greater likelihood to have a different “Font Identity” than others since there are lots of fonts out there.
How do I stop this monstrosity?
First DON’T LET IT!!!
Browsers are typically good at telling you what’s going on. I suggest that you NEVER select Always run on this site (or other browser equivalents), and only allow trusted websites to run Java or Flash. Disabling Java or Flash is another option, however with a majority of websites using either Java or Flash this can be difficult and annoying.
However, the browser can still access your External IP address. A way around that is to use a Virtual Private Network (VPN). I tested this out and it worked, including getting the wrong internal IP, since it picked up the VPN’s Internal IP and not my actual home networks IP.
Overall, it goes without saying to just be careful when ever your browsing the interwebs.