Im c’t-Datenschutz-Podcast geht es darum, mit welchen Mitteln sich Menschen im Internet identifizieren lassen, von der IP-Adresse bis zum Browser-Fingerprint.

New research provides first evidence of the use of browser fingerprints for online tracking.

AliExpress was found using inaudible sound waves for browser fingerprinting. A researcher's accidental discovery revealed the technique's reality and current effectiveness.

Explains how combining browser and device data identifies users, covering mechanisms, data collected, risks, detection, and defenses.

Einem Entwickler ist aufgefallen, dass AliExpress das Web Audio API benutzt, um Geräte per unhörbarem Audiosignal zu erkennen. Fragt sich nur: Wie geht das?

AliExpress nutzte die Web Audio API, um Geräte per unhörbarem Audiosignal zu identifizieren. Ein Entwickler entdeckte das Tracking durch Bluetooth-Probleme.

A new browser utility called Glassbox shows just how easily browsers and devices can be uniquely identified online. Built by security engineer David Dale, the tool runs entirely inside the user’s browser, mimicking common tracking methods without sending any data externally. What Glassbox Actually Shows You Glassbox is designed to reveal a browser’s unique fingerprint […]

  Technology policy challenges are increasingly being exposed in the debate over digital safety: measures that are intended to address one online risk are often used to raise another set of security and privacy concerns. Critics have warned that the collection of additional personal information could broaden surveillance capabilities and create new targets for abuse as governments push for stricter age-verification requirements and expanded identity checks.  Separately, a pervasive wave of security threats is emerging at the level of the consumer, where mobile phone theft operations are exploiting weaknesses in the systems for accessing devices and recovering accounts. Whether regulating oversight, privacy, or physical device security is a concern, these developments represent the growing reality of the digital ecosystem.  Cybersecurity experts, governments, corporations, and cybersecurity professionals are no longer the only ones facing the risks associated with digital tracking and identity information. Increasingly, it is becoming a concern for technology providers, policymakers, and everyday users alike. Digital tracking has become a topic of debate that has moved beyond privacy advocacy into the national security arena.  Recent disclosures from US lawmakers suggest that the same commercial data ecosystem used for profiling consumers and targeting advertisements may also pose operational risks to military personnel. As reported by Senator Ron Wyden, the US Central Command has been informed that it has received several threat reports regarding the exploitation of commercially available location data in order to monitor or potentially target American personnel deployed in active theaters of operation.  In spite of the fact that military officials did not identify the responsible actors or particular locations involved, this revelation represents a significant escalation in concern regarding the market for commercial surveillance. Researchers have long warned that location metadata obtained from smartphones, applications, and connected devices can reveal patterns, routes, and recurring gathering points through the collection of location metadata.  Congress warns that this intelligence can be used to support kinetic threats, including drone strikes, missile attacks, and other forms of battlefield targeting, in addition to surveillance and counterintelligence activities. Increasing scrutiny has been focused on the adtech and data brokerage sectors, where large volumes of geolocation data are routinely collected, aggregated, and resold. Previously considered primarily a consumer privacy issue, this issue is now being examined as a strategic security vulnerability, particularly in light of historical incidents.  The reports that have been reported that commercially acquired location data was used to track the movements of US Special Operations personnel toward a covert staging facility in Syria demonstrate how seemingly routine smartphone data can reveal sensitive military activities that go beyond their original purpose in revealing sensitive information. There is a fundamental concern among lawmakers and security officials about not only isolated incidents, but also the architecture of the modern data economy itself. Through GPS, Wi-Fi and cellular network interactions, as well as advertising identifiers embedded throughout countless applications, smartphones continually generate streams of location intelligence. Upon collecting user activity records, brokers often aggregate, package, and resell them to advertisers, analytics firms, and other third parties via a sprawling commercial marketplace. Security specialists have repeatedly warned against the possibility of using such datasets to reconstruct highly sensitive behavior patterns, including visits to military facilities, operational hubs, and transit routes for deployments. Legislators are calling for stronger safeguards, including disabling advertising identifiers on military-issued devices, limiting the use of data-hungry applications, and reevaluating software ecosystems heavily dependent upon user tracking, in response to these risks. However, lawmakers have renewed criticism of the Defense Department's approach to digital exposure. Increasingly, it is being acknowledged that commercial surveillance infrastructure can inadvertently provide access to intelligence assets that are not intended for the purposes for which they were intended. In previous years, concerns were raised when publicly available fitness-tracking data revealed military installations and patrol activities. This demonstrated how seemingly benign consumer technologies may reveal operationally important information. Considering the ongoing military activity of the United States in the Middle East as well as the threat posed by hostile state-backed and proxy entities, the strategic value of location intelligence can no longer be ignored.  While many large technology companies maintain that their advertising and data-handling systems have security controls, pressure is mounting for stronger federal privacy protections as policymakers reassess the national security implications of data collection on a large scale. Ultimately, the Pentagon's acknowledgement underscores a shift in the threat landscapes of modern civilisations, where intelligence gathering no longer relies solely on satellites, reconnaissance assets, or classified operations, but can also be gained from vast commercial networks, which silently track the digital movements of millions of connected devices every day.  Moreover, the Pentagon's concerns highlight a fundamental weakness in the digital advertising ecosystem: the same infrastructure, designed to deliver personalised marketing, now serves as an effective surveillance network capable of tracking individuals with remarkable accuracy. Military officials have expressed concern that commercially available data, including advertising identifiers, default location-sharing mechanisms, and browser fingerprinting techniques associated with widely used platforms such as Google Chrome, may be accessed by individuals operating in active conflict environments, according to reports cited by Reuters.  Rather than focusing on the collection of data itself, the issue is the ease with which detailed behavioral intelligence can be acquired through commercial channels with little or no oversight of who purchases the information and for what purposes. The Pentagon has been criticised for failing to take sufficient actions to educate and protect its service members from these digital exposure risks; however, lawmakers have also highlighted the large amount of sensitive user information that is monetised by the largely unregulated data brokerage market. Officials argue that, without comprehensive federal privacy safeguards, there are limited practical mechanisms for preventing potentially hostile actors from gaining access to data that can reveal operationally valuable insights. This ecosystem presents an array of threats that go beyond national security concerns. The recent disclosure of an offshore call tracking and analytics company's role in facilitating large-scale fraud operations relating to tech support has highlighted the potential criminal misuse of trusted commercial technology. A court-ordered investigation revealed that the former CEO and Chief Security Officer knowingly provided telephone numbers and communications infrastructure to scammers impersonating Microsoft representatives in order to assist them in evading law enforcement scrutiny, identifying new fraudulent opportunities, and expanding their operations in the process. In addition, investigators allege that the individuals went beyond providing services by participating in similar scam networks and even operating their own fraudulent call centers.  A common challenge that confronts the modern digital economy is illustrated by these developments: systems designed to assist advertisers, analytics analysts, and customers can, when inadequately regulated or maliciously abused, become useful tools for surveillance, deception, and exploitation that go far beyond their intended use.  Digital tracking poses a number of risks that are becoming increasingly difficult to distinguish from everyday life as the boundaries between commercial technology, personal privacy, and national security continue to blur. As illustrated by the examples presented in both military and consumer environments, data collected for convenience, advertising, or analytics can be exposed, misused, or inadequately managed, causing a variety of consequences beyond their original purpose. In today's world, organisations, policymakers, and individuals alike face greater challenges than simply addressing cyber threats after they have already arisen. However, it is also important to understand how seemingly routine digital practices can result in unintended security exposures long before an attack occurs. In light of the increasing importance of personal and operational data, strengthening data governance, limiting unnecessary collection, and improving transparency throughout the digital ecosystem are essential.

A web page that tells you what your browser gave away the moment you arrived. No login, no form, no permission. Most pages do this. None of them tell you.

Browser fingerprinting detects bots or unwanted web traffic by checking various client-side factors to establish browser identities.

Browser fingerprinting detects bots or unwanted web traffic by checking various client-side factors to establish browser identities.

<p>The idea of using just <a class="mention hashtag" href="https://qoto.org/tags/CSS" rel="tag">#<span>CSS</span></a> to fingerprint email clients and browsers is wild. The approach suggested in this repo</p><p><a href="https://github.com/cispa/cascading-spy-sheets" rel="nofollow noopener noreferrer" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/cispa/cascading-spy</span><span class="invisible">-sheets</span></a></p><p>and further <a class="mention hashtag" href="https://qoto.org/tags/research" rel="tag">#<span>research</span></a> paper</p><p><a href="https://publications.cispa.de/articles/conference_contribution/Cascading_Spy_Sheets_Exploiting_the_Complexity_of_Modern_CSS_for_Email_and_Browser_Fingerprinting/27194472" rel="nofollow noopener noreferrer" target="_blank"><span class="invisible">https://</span><span class="ellipsis">publications.cispa.de/articles</span><span class="invisible">/conference_contribution/Cascading_Spy_Sheets_Exploiting_the_Complexity_of_Modern_CSS_for_Email_and_Browser_Fingerprinting/27194472</span></a></p><p>explain the technique that works even if <a class="mention hashtag" href="https://qoto.org/tags/javascript" rel="tag">#<span>javascript</span></a> is disabled.</p><p>They further explain that they reached out both to <a class="mention hashtag" href="https://qoto.org/tags/Tor" rel="tag">#<span>Tor</span></a> and <a class="mention hashtag" href="https://qoto.org/tags/BraveBrowser" rel="tag">#<span>BraveBrowser</span></a> where such exploits should be mitigated.</p><p>One example where such an exploit can cause even more precision is when it is incorporated into <a class="mention hashtag" href="https://qoto.org/tags/phishing" rel="tag">#<span>phishing</span></a> attacks. Since the exploit was also able to depict the operating system, meaning one could combine existing exploits for a more targeted attack.</p><p><a class="mention hashtag" href="https://qoto.org/tags/security" rel="tag">#<span>security</span></a> <a class="mention hashtag" href="https://qoto.org/tags/privacy" rel="tag">#<span>privacy</span></a> <a class="mention hashtag" href="https://qoto.org/tags/opsec" rel="tag">#<span>opsec</span></a> <a class="mention hashtag" href="https://qoto.org/tags/linux" rel="tag">#<span>linux</span></a></p>

8 likes, 1 comments - henningtillmann on September 1, 201...