Favicon Fingerprinting - What To Do About It?

[BugHunter1000]

https://old.reddit.com/r/netsec/comments/ldyova/demo_abusing_favicons_for_fingerprinting/

Does UC have a solution to this the way Firefox does?

Thanks.

[jstkdng]

What's firefox's solution for this? I guess sending a GET request regardless of the f-cache could solve this.

[kramred]

This will most likely be fixed in chromium, see here and issue 1096660 (once that is available without security clearance)

Firefox is not loading favicons from cache due to a bug, which turned out to be a feature in this case of fingerprinting…

This seems to be kind of a hot potato right now as the scientific publication by Jason Polakis has also been (temporarily) removed – although there is an proof of concept (describing the method) here: https://supercookie.me/workwise

[kramred]

This behaviour is bound to your profile (mainly the SQLite 3.x database file Favicons), so switching profiles will probably give you different fingerprints. Browsing as Guest user will give you a new fingerprint each time you start a Guest browsing session.