Anonymous browsing / scraping, and overcoming Fingerprints

[BlueWhale27]

Just a few months ago, Mr. Russian-Racket started a thread

https://www.blackhatworld.com/seo/a...facebook-account-is-a-fake-pt-1.981886/page-4

which has now been closed to further comments.



Perhaps I can add a bit to that conversation…



There are a Lot of items on your computer that can be traced, resulting in a basically unique fingerprint, including…

• The USER_AGENT.

https://www.whoishostingthis.com/tools/user-agent/

Tells you a lot about yours.

https://www.scrapehero.com/how-to-fake-and-rotate-user-agents-using-python-3/

Shows how to change yours.

Looking for some sample User-Agent strings? Try

http://www.useragentstring.com/pages/useragentstring.php

and

https://developers.whatismybrowser.com/useragents/explore/

• Honey Pot Traps, as described at

https://www.scrapehero.com/how-to-prevent-getting-blacklisted-while-scraping/

Some websites install honeypots to detect web spiders. These honeypots usually are links that normal user can’t see but a spider can. When following links always take care that the link has proper visibility with no nofollow tag. Some honeypot links to detect spiders will have the CSS style display:none or will be color disguised to blend in with the page’s background color.



Also, do not follow the same crawling pattern. Only robots follow the same crawling pattern because unless specified otherwise, programmed bots follow a logic which is usually very specific.

Sites that have intelligent anti-crawling mechanisms can easily detect spiders by finding a pattern in their actions. Humans generally will not perform repetitive tasks. Incorporate some random clicks on the page; mouse movements and random actions that will make a spider look like a human.

• Canvas fingerprinting, wherein the browser “draws” an image onto a web page, described at

https://multiloginapp.com/how-canvas-fingerprint-blockers-make-you-easily-trackable/

• Even worse than the canvas fingerprinting, the getClientRects vector allows one to get the exact pixel position and size of the box of a given DOM element, as well as tracking the scrolling speed, and/or the scrolling delta of your mouse movements.

http://jcarlosnorte.com/security/2016/03/06/advanced-tor-browser-fingerprinting.html

• WebGL Browser Report fingerprint rendering is a combination of software rendering and hardware rendering in which the hardware contributes more than the software.

• Tracking via Microphone and/or Camera settings.

• Biometric profiling (based on unique keystroke traits)

• Fingerprints from the AudioContext object, even if your speakers are at 0 volume.

SilverPush is one of several companies that uses inaudible, high-frequency sounds to surreptitiously track a person's online behavior Across a range of devices, including phones, TVs, tablets, and computers.

https://arstechnica.com/tech-policy...le-sound-to-link-your-phone-tv-tablet-and-pc/

View your own audio fingerprint at

https://audiofingerprint.openwpm.com/

• Fingerprints from the Navigator.Platform setting

• Fingerprints from the Navigator.HardwareConcurrency setting, the number of CPU virtual cores.

• Evercookies or Supercookies that (almost) never go away.

• Measurement of screen resolution, via the “screen” object under JavaScript, as well as other properties such as availHeight, availWidth, availLeft, availTop, screenOrientation, and color depth.

• Tracking via the list of fonts that are installed.

• Much of the above comes from a thesis / paper at

http://yinzhicao.org/TrackingFree/crossbrowsertracking_NDSS17.pdf

• If you're using a portable device (not a Desktop), they can track the estimated time in seconds that the battery will take to fully discharge, as well the remaining battery capacity.

https://www.theguardian.com/technology/2015/aug/03/privacy-smartphones-battery-life

• Javascript can see what plugins you have installed (and in what order they were installed)

https://forum.palemoon.org/viewtopic.php?t=4406

• Several websites will tell you about your own fingerprint...

https://panopticlick.eff.org/

Tests your browser to see if it is safe against tracking.

https://amiunique.org/

Tells you all about your computer's fingerprint, and

https://amiunique.org/tools

tells of some good tools.

http://uniquemachine.org/

Is similar, gives a more detailed report about your fingerprint.

https://browserleaks.com/

shows all of the crap that your browser is leaking.

Email Privacy Tester

is a tool that will send an Email to your address and perform privacy related tests.

• More interesting and valuable reading...

https://www.comparitech.com/blog/vpn-privacy/what-is-browser-fingerprinting-how-to-protect-yourself/

And

https://www.comparitech.com/blog/vpn-privacy/staying-anonymous-online-silk-road-founder-mistakes/

And there is a LOT of Very interesting and useful Tools and Reading at

https://www.privacytools.io/

• To combat all of this crap, you could start by using Proxies.

And with privacy manager from ivan iovation www.ivanovation.ro , you can allegedly change your geolocation to any location. Change the Location to whatever is the IP location. AND change the Date and Time in your device appropriately.

https://browserleaks.com/geo

• Of course, you could use a Virtual Private Network…

https://www.bestvpn.com/

Compares VPNs.

• https://www.trackoff.com/en

Is an application that allegedly changes your Fingerprint occasionally.

$4/monthly, or $7/monthly includes a VPN.

• You could use a different Browser…

The Mimic browser is a Chromium-based browser that enhances your privacy and allows you to control your browser fingerprints, as shown at

https://multiloginapp.com/advanced-browser-fingerprinting-protection-ever-created-enter-mimic/

• If you want to go to the extreme of using a different Operating System,

https://tails.boum.org/

Is a live operating system that you can start on almost any computer from a USB stick or a DVD.

It aims at preserving your privacy and anonymity.

https://www.whonix.org/

Whonix is a High Security Method of Surfing the Internet. Uses Tor.



Frankly, y'all, I've gathered all of this info by simply reading / researching in the past two weeks.

I'm not a programmer, and I do have a specific need for this anonymity.

If You know how to implement some of this stuff, please PM me, and I'll tell you exactly what I need.

Mr. RussianRacket said that he would post more details if his topic got 100 Likes.

Darn… That apparently didn't happen.
BlueWhale27

 

[BlueWhale27]

Crap. Why are the Links not appearing as clickable Links in the original post?

 

[roseczech]

Crap. Why are the Links not appearing as clickable Links in the original post?

because you are newbie

 

[BlueWhale27]

Yo, Admin,...
You might want to consider an exception for that post?
There is no monetary gain for me in any of those links.
Just trying to give out some info that I think is quite good.

 

[proxygo]

always been rules, low post members cant do links
as this permission is tied to all low post and new members.

 

[eltan]

Is one solution to some this. Using a demo version of linux on USB . Reboot for every new session?

 

[nico.e]

Did anyone took a look at "PRIVATIX"?
Buying VPNs with crypto from peer2peer. Like torrent, but different. This could help additionally.