Will duplicate laptops have an identical digital fingerprint?

[Ming the Merciless]

You can only "diguise" your pc/comp/whatever so much. Some sites actually dig deeper, like my above referenced link.

 

[Ming the Merciless]

and btw.... i do APPRECIATE everyone's input!

 

[JFoulds]

FYI I do practice what I say.

I am an experienced network engineer and CISCO qualified.
So I do actually know routing and how the internet actually works from the ground up.
Also I spent several years in IT security, and credited by US-CERT for a vulnerability.

Strings can be written to a cookie to identify visitors mac addresses there are other methods, that I will not speak about here.

If you are on a Local Area Network, those on the internet can't see your MAC address directly, (but still possible if you know what your doing ) because you are connected via NAT, and only the router gets your MAC address via an ARP request to complete the connection. But with a direct internet connection (eg no router), the site needs to know your MAC address to complete the linkage, and can issue an ARP directly to you to find it out. ARP is the protocol that maps IP addresses to MAC addresses so data can connect to whatever your trying to link and pass data to.

Try not to be a prick, accept your wrong and move on.
Next in line please....

Interesting that you work with computer security, as I'm an internationally published computer security author.
I'd love to know where you worked as a network engineer and what vulnerability you were credited for - I've been an active participant and member of Verisign's iDefense program for the last few years, so being credited for a single vulnerability is far from impressive.

Perhaps you need to revisit your qualifications, MAC addresses are handled entirely in the link layer, and are not passed any further up the TCP/IP stack. Yes, it is possible to use client-side Javascript hackery or Java code on the local machine to obtain the local MAC address and forward that to a web server.

I think you might be confusing a 'direct internet connection' with an 'Ethernet connection'.
It is not possible to obtain a MAC address of an origin host from a separate Ethernet network without client-side processing as I've already said, such as Java.

Don't worry about it mate, everyone gets confused some time.
If you've got spare time, I'd recommend obtaining a copy of 'TCP/IP Protocol Suite' by Forouzan Behrouz. It's a great read and should clear things up where you're getting confused - it's sat on my shelf at the moment!

EDIT: I literally have no idea what your last comment means.
EDIT2:
I'm off to bed, suffering from mild flu at the moment and need sleep so I won't be responding for about 10 hours.
Don't bother posting more useless responses, just make a webpage which finds a MAC address of anyone who visits it.
I'm sure this won't be an issue for a qualified gentleman like yourself.

Next?

 

[blackberry]

John,

Let me go into a little more detail because we are kind of on the same page...but both of us are not seeing "why" we gave the responses (ie: context).

So first off I cannot tell you who I worked with as a network engineer, and routing specialist, nor whom I worked with for IT security.
That particular bit is very clear in the NDA.

Now...yes MAC addresses are in the OSI layer 2. However imagine for a moment that you have a direct internet connection (lets just say a modem) to lets say AT&T, in order to establish the connection. However with an ethernet connection behind a router you would be correct.

Yes with java or javascript it would be possible to get the mac of the local machine. Preferably javascript, as java may or may not have to be allowed first, while javascript may not need to be. Again depending on configuration.

Interesting that you work with computer security, as I'm an internationally published computer security author.
I'd love to know where you worked as a network engineer and what vulnerability you were credited for - I've been an active participant and member of Verisign's iDefense program for the last few years, so being credited for a single vulnerability is far from impressive.

Perhaps you need to revisit your qualifications, MAC addresses are handled entirely in the link layer, and are not passed any further up the TCP/IP stack. Yes, it is possible to use client-side Javascript hackery or Java code on the local machine to obtain the local MAC address and forward that to a web server.

I hope that clears it up for ya.

Thanks and get well soon. It sucks to be sick.



I think you might be confusing a 'direct internet connection' with an 'Ethernet connection'.
It is not possible to obtain a MAC address of an origin host from a separate Ethernet network without client-side processing as I've already said, such as Java.

Don't worry about it mate, everyone gets confused some time.
If you've got spare time, I'd recommend obtaining a copy of 'TCP/IP Protocol Suite' by Forouzan Behrouz. It's a great read and should clear things up where you're getting confused - it's sat on my shelf at the moment!

EDIT: I literally have no idea what your last comment means.
EDIT2:
I'm off to bed, suffering from mild flu at the moment and need sleep so I won't be responding for about 10 hours.
Don't bother posting more useless responses, just make a webpage which finds a MAC address of anyone who visits it.
I'm sure this won't be an issue for a qualified gentleman like yourself.

Next?

 

[JFoulds]

blackberry,
First of all, I'm not called 'John'. Not sure if you found that name somewhere or assumed it because it's a common first name, but nope, not me.

Secondly, I have literally never heard of a Non-Disclosure Agreement not permitting an employee to say where they were working. I'm good friends with a number of people working in high-level government SIGINT and, although they are not allowed to discuss the nature of their work, they are allowed to tell me where they work. Having reported a number of vulnerabilities to US-CERT myself, I know for certain that they do not make you sign any NDA forbidding discussion of your vulnerability - so I am certain you could at least say that...

I understand what you think you're saying.
Lets imagine for a minute that the OP is in fact in 1990's Mexico and using a modem connection:

The OP sends the HTTP GET request for tacos.com directly to the modem; requiring transfer of the local computers MAC address.
The OP's modem then sends the HTTP GET request to tacos.com via his ISP, trascending through LACNIC address pools until it reaches the web server tacos.com points at.

This second part is happening without the MAC address ever being sent to any other network.
A MAC address is required by the link layer for communication between nodes in the local network.

Picture the situation like a series of postmen delivering a letter saying 'GET /tacos/tacolist.txt HTTP/1.1'.

Little Jimmy goes to the post office and hands a stamped letter to Postman A.
Postman A goes and hands the letter to Postman B, sat in the post van.
The post van drives 3,300 miles from Mexico City to New York.
Postman B hands the letter to Postman C (the postmaster in the New York post office).
Postman C hands the letter to Postman D, who gets in his post van and takes the letter to the New York Taco Appreciation Society, handing it to Tacoman 1 (the man with the unfortunate job of manually responding to every HTTP request via post).

As Little Jimmy only provided his address on the letter, Tacoman 1 is easily capable of responding to it (writing down the correct response and mailing it back to his address) but he is completely incapable of knowing that the boys name was Little Jimmy.

Little Jimmy knows Postman A by name.
Postman A knows Postman B by name.
Postman B knows Postman C by name.
Postman C knows Postman D by name.
Postman D knows Tacoman 1 by name.

Tacoman 1 does not, and cannot, know the names of Postman A, B or C, nor Little Jimmy.
Nor does he need to. MAC addresses are used to communicate on a physical layer of a network. On the internet layer, they are completely useless.

A MAC address is 4 bytes long.
A tracert between myself and Google.com shows that my request goes through an average of 10 nodes before arriving at the destination. As my request could have originated from any one of these nodes, if your theory was correct then the MAC address would have to be sent with every single one of the requests - a total of 40 extra useless bytes per HTTP get request for Google.com.

According to some quick Googled statistics, there are well over 2.5 billion Google searches per day.
This would mean that Google alone was dealing with almost 100GB of completely, utterly useless MAC addresses per day. Scale this up over the entire globe with every single website and every single application layer and you would have hundreds of terrabytes of wasted TCP/IP traffic per day. This is exactly the reason that it does not work how you think.

It doesn't matter if he is connecting via a modem; as soon as the communication involves the Internet layer then the MAC address of the origin host is not sent.

John,

Let me go into a little more detail because we are kind of on the same page...but both of us are not seeing "why" we gave the responses (ie: context).

So first off I cannot tell you who I worked with as a network engineer, and routing specialist, nor whom I worked with for IT security.
That particular bit is very clear in the NDA.

Now...yes MAC addresses are in the OSI layer 2. However imagine for a moment that you have a direct internet connection (lets just say a modem) to lets say AT&T, in order to establish the connection. However with an ethernet connection behind a router you would be correct.

Yes with java or javascript it would be possible to get the mac of the local machine. Preferably javascript, as java may or may not have to be allowed first, while javascript may not need to be. Again depending on configuration.

 

[guvenor]

blackberry,
First of all, I'm not called 'John'. Not sure if you found that name somewhere or assumed it because it's a common first name, but nope, not me.

Secondly, I have literally never heard of a Non-Disclosure Agreement not permitting an employee to say where they were working. I'm good friends with a number of people working in high-level government SIGINT and, although they are not allowed to discuss the nature of their work, they are allowed to tell me where they work. Having reported a number of vulnerabilities to US-CERT myself, I know for certain that they do not make you sign any NDA forbidding discussion of your vulnerability - so I am certain you could at least say that...

I understand what you think you're saying.
Lets imagine for a minute that the OP is in fact in 1990's Mexico and using a modem connection:

The OP sends the HTTP GET request for tacos.com directly to the modem; requiring transfer of the local computers MAC address.
The OP's modem then sends the HTTP GET request to tacos.com via his ISP, trascending through LACNIC address pools until it reaches the web server tacos.com points at.

This second part is happening without the MAC address ever being sent to any other network.
A MAC address is required by the link layer for communication between nodes in the local network.

Picture the situation like a series of postmen delivering a letter saying 'GET /tacos/tacolist.txt HTTP/1.1'.

Little Jimmy goes to the post office and hands a stamped letter to Postman A.
Postman A goes and hands the letter to Postman B, sat in the post van.
The post van drives 3,300 miles from Mexico City to New York.
Postman B hands the letter to Postman C (the postmaster in the New York post office).
Postman C hands the letter to Postman D, who gets in his post van and takes the letter to the New York Taco Appreciation Society, handing it to Tacoman 1 (the man with the unfortunate job of manually responding to every HTTP request via post).

As Little Jimmy only provided his address on the letter, Tacoman 1 is easily capable of responding to it (writing down the correct response and mailing it back to his address) but he is completely incapable of knowing that the boys name was Little Jimmy.

Little Jimmy knows Postman A by name.
Postman A knows Postman B by name.
Postman B knows Postman C by name.
Postman C knows Postman D by name.
Postman D knows Tacoman 1 by name.

Tacoman 1 does not, and cannot, know the names of Postman A, B or C, nor Little Jimmy.
Nor does he need to. MAC addresses are used to communicate on a physical layer of a network. On the internet layer, they are completely useless.

A MAC address is 4 bytes long.
A tracert between myself and Google.com shows that my request goes through an average of 10 nodes before arriving at the destination. As my request could have originated from any one of these nodes, if your theory was correct then the MAC address would have to be sent with every single one of the requests - a total of 40 extra useless bytes per HTTP get request for Google.com.

According to some quick Googled statistics, there are well over 2.5 billion Google searches per day.
This would mean that Google alone was dealing with almost 100GB of completely, utterly useless MAC addresses per day. Scale this up over the entire globe with every single website and every single application layer and you would have hundreds of terrabytes of wasted TCP/IP traffic per day. This is exactly the reason that it does not work how you think.

It doesn't matter if he is connecting via a modem; as soon as the communication involves the Internet layer then the MAC address of the origin host is not sent.

This is my understanding too

 

[toney]

No never
To start both will have a different MAC address's and a different IP address's so it will be easy to tell one from the other.These are the unique for all the pc/laptops.

 

[JFoulds]

To start both will have a different MAC address's [...] so it will be easy to tell one from the other.

...Fml.

 

[guvenor]

No never
To start both will have a different MAC address's and a different IP address's so it will be easy to tell one from the other.These are the unique for all the pc/laptops.

DAFUQ are you smoking man ! computers don't come with an IP address when you buy them !

 

[JFoulds]

DAFUQ are you smoking man ! computers don't come with an IP address when you buy them !

Correct.
And as many people in this thread have pointed out, the IP address the webserver will see would be the external Internet IP address of your network - which will be exactly the same whether you have 1 or 100 people on the network.

You can check this out yourself if you want:
Go to http://www.IPChicken.com from one PC on your local network, then visit the URL again from a completely different computer on your network - the IP's it shows you will match!

 

[guvenor]

There are only certain things a website can tell about the user who is accessing it :-
Refferer
IP address
Screen Res
OS
Browser type (firefox,IE,opera,safari) etc.

All these can be spoofed apart from the IP address to make the user appear unique. IP address can be spoofed by using a proxy or VPN.

Any information about hardware ID's or MAC addresses cannot be passed to the website unless the website has implemented some code running on your computer locally that reads this information.

So unless you have downloaded some sort of Trojan/Virus/Malware then it is absolutely not possible for a website to gain this kind of information.

 

[Ming the Merciless]

I appreciate all the responses. Quite entertaining to read really. Unfortunately I do not understand everything that has been said, although I do comprehend most of it. How can I "spoof" my browser fingerprint? When I go to this particular website, I change my IP, obviously clear out all cookies,etc. I use an agent switcher on Firefox to look like a different browser and I turn off javascript. It will work for a few logins, then they start to "catch on". I purchased a new laptop in case it was the device fingerprint. I did all stated above. It worked for a few days and now it is not working. This site is obviously pretty advanced on how they detect devices.

 

[Ming the Merciless]

Oh, also, I have logged in with my iphone (turning airplane mode off/on to switch IP) and turn off javascript. Again, it worked for a few days but now...nope. I am at a loss.

 

[JFoulds]

Out of curiosity, what's the website?

 

[Allanstorm]

No, they will not.

 

[Furious George]

You can't really spoof your browser fingerprint, just use a different browser. Or install an older version of the same browser, remove add-ons, plugins, etc... make a new user account on the pc.

If you tell us what website it's for, we can probably help a lot better. There's a good chance it's something other than what you think it is that's getting you linked.

 

[tacopalypse]

there's a simple way to settle the mac address debate, even without technical understanding.

you can go to google and type searches like "what is my ip address", "what is my screen resolution", "what is my operating system", and you'll get tons of websites that will detect it for you.

there's not a single website on the internet that can answer "what is my mac address". if it was at all possible, you'd think somebody would have done it by now.

so going back to the original question, 2 identical laptops straight out of the box would indeed have identical browser fingerprints.

https://panopticlick.eff.org/ pretty much shows you the extent of what's visible to a website just by visiting it.

however, that's not everything that can be used to track you. i can tell you that here at bhw, if somebody tried to evade a ban by randomizing all of that junk, it wouldn't make an ounce of difference

 

[Furious George]

MAC addresses aren't available to a website.
Everyone posting about IP addresses and MAC addresses are morons. Your problem would be with cookies.

That's awesome that you think this, but you're wrong.
I just neg repped you btw.
I don't appreciate when people insult others AND are talking out of their ass.

The website itself can't see the MAC, but it is possible to track you by your MAC.

 

[travanx]

What about changing the router Mac address daily? That can be done to force my cable modem to pull a new IP address.

Sent from my EVO using Tapatalk 2

 

[Ming the Merciless]

What about changing the router Mac address daily? That can be done to force my cable modem to pull a new IP address.

Sent from my EVO using Tapatalk 2

Again. IP address is not the issue. I have private proxies.