cooperq
commented
8 years ago You are absolutely correct. Because of privacy badger's heuristic it does generate a unique block list for each user. An attacker with control of n different third parties could randomly decide to set tracking or not on each of them. After those n parties were loaded on 3 different sites the tracking ones could be blocked. Via introspection about which domains loaded the attacker would then be able to get n bits of entropy to identify the person. With 32 domains this would be enough to uniquely identify everyone.
Unfortunately I don't think there is anything that we can do about this attack, but I am certainly open to suggestions.
From what I see, Privacy Badger seems to decide what sites to block or allow based on browsing behaviour, which would seem to generate an unique list of sites to block based on what sites the user visits.
Couldn't malicious sites simply use JavaScript to load data from third-party sites and check if the requests are blocked or not to fingerprint the user?
Does Privacy Badger have any mechanisms to prevent creating an additional metric that can be used to fingerprint, thus making the browser more fingerprintable?