Super User 
Browsing on the web may seem harmless to most, but we SuperUsers are typically a secretive bunch. We’ don’t like data being shared about us unless we tell them to.
So when user Pickledegg asked about how much info can websites can get, it became a pretty popular question.
I am trying to determine if the information shown on the website www.whatsmyip.org is the absolute maximum amount of information that a webserver can obtain from a web visitor.
Does anyone know of any other sites that will be able to get more information from the user passively like this? I’m not talking about port-sniffing or any kind of interaction from the user, just the info that a server can get from a ‘dumb’ visit.
So what’s the verdict?
Here’s what we found. From What’s my IP they can determine the following (I removed un-important info, if I missed something feel free to comment):
- External IP
- Homename
- Proxy
- Internal (LAN) IP
- Operating System and version
- Screen Resolution
- Cookies Enabled
- Browser Plugins
- Location (kinda sorta)
- And a WHOIS Lookup
Basically is looked like this (I put green checkmarks across things that were correct):
But there’s more! A browser can also give away your installed fonts! GASP. Wait… what? Why is that important?
User Informaficker had this to say:
Installed fonts are probably the most identifying piece of information as soon as you start adding one or two. Just because of the amount of fonts out there, it is unlikely to have the same set of fonts on two different computers. (As long as they are used by different persons)
This means that if you have any custom installed fonts on your computer, you have a greater likelihood to have a different “Font Identity” than others since there are lots of fonts out there.
How do I stop this monstrosity?
First DON’T LET IT!!!
Browsers are typically good at telling you what’s going on. I suggest that you NEVER select Always run on this site (or other browser equivalents), and only allow trusted websites to run Java or Flash. Disabling Java or Flash is another option, however with a majority of websites using either Java or Flash this can be difficult and annoying.
However, the browser can still access your External IP address. A way around that is to use a Virtual Private Network (VPN). I tested this out and it worked, including getting the wrong internal IP, since it picked up the VPN’s Internal IP and not my actual home networks IP.
Overall, it goes without saying to just be careful when ever your browsing the interwebs.
Filed under Browsers Question of the Week
It is also possible for a site to know if you are logged into Gmail, Twitter and Facebook in one of the open tabs of your browser – http://hacks.mozilla.org/2011/02/an-interesting-way-to-determine-if-you-are-logged-into-social-web-sites/
I use the Google Mobilizer service through a bookmarklet when accessing less popular/suspicious looking websites – http://mvark.blogspot.com/2012/04/google-mobilizer-bookmarklet-view-just.html
If you want some really scary stuff take a look at panopticlick https://panopticlick.eff.org/ – its just browser fingerprinting and gets enough information to (allegedly?) identify my system uniquely.
Java should not be installed, you don’t need it for day-to-day browsing; it’s full of security leaks (yes, two big ones last month) and is often more an actual risk to the user than it is useful. I’ve seen a lot of Blackhole exploited computers the last month…
Flash is making its room for HTML5, although it’ll still take a while before we finally progress to that next stage, but Flash is overall somewhat more secure and I believe it can determine much less than Java can.
Bottom line: Get rid of Java! Without Java and accepting warnings for other plug-ins you for example can’t determine the internal IP. Let’s wait a bit longer for the time we can get rid of Adobe PDF and Flash as well…
If you enable the
pingservice, I can in most cases track you down to a city. And in the best cases even a suburb.You write: “Disabling Java or Flash is another option, however with a majority of websites using either Java or Flash this can be difficult and annoying.”
I don’t agree with this statement. A majority of websites does not use either Java or Flash. A small amount of websites still use Flash and it becomes less every day.
And for Java, besides internet banking etc., there is not much justification to use it anywhere, which is one of the reasons why it isn’t widely used any longer.