Fingerprint de Discourse - Plugin de Fingerprinting de Navegador

[dan (Dan Ungureanu)]

Huella Digital de Discourse

Discourse Fingerprint llega como una herramienta para los administradores de comunidades en su lucha contra los trolls de internet. Funciona calculando un identificador único (una huella digital) de cada usuario registrado, teniendo en cuenta más de 20 características del navegador, como el agente de usuario, la resolución de pantalla, la zona horaria, la memoria del dispositivo, etc.

Cuando cada una de estas características del navegador se considera por separado, no son suficientes para determinar si dos usuarios son el mismo. Existe un número relativamente pequeño de agentes de usuario, resoluciones de pantalla, etc. Sin embargo, cuando se tienen en cuenta todos estos 20 factores, existe una probabilidad muy baja de que dos usuarios tengan la misma clave.

Debido a la baja diversidad en las configuraciones de teléfonos móviles y a los esfuerzos activos de Apple y otros proveedores de navegadores, este método no garantiza una alta precisión.

Momento matemático: Supongamos que solo hay 20 características del navegador y solo 4 valores posibles para cada una de ellas (nota: hay más de 20 características del navegador con muchos más de 4 valores), lo que significa que hay 4\u003csup\u003e20\u003c/sup\u003e combinaciones (huellas digitales). Eso son 1.099.511.627.776 combinaciones… y solo hay 7.640.175.882 personas en la Tierra. Bueno, algunas características del navegador pueden ser inútiles (por ejemplo, la zona horaria será la misma para todos los usuarios de un foro comunitario local)… pero es probable que los foros tampoco tengan 7.600 millones de usuarios.

¿Cómo funciona?

Cuando un usuario navega por un foro, se le asigna una huella digital y el resultado se almacena junto con las últimas huellas digitales (por defecto, las 10 más recientes). Luego, los administradores pueden utilizar una interfaz sencilla para verificar las coincidencias de huellas digitales más recientes (conflictos) y determinar si un usuario está en conflicto con otra persona.

El plugin no tiene absolutamente ningún impacto en los usuarios y asigna la huella digital al usuario 3 segundos después de que se haya cargado una página por primera vez.

¿Cómo se ve?

Consideremos un pequeño escenario de prueba:

• Los usuarios Dan, Oliver y Jack han estado usando algún dispositivo (sesiones incógnito y regulares).
• Los usuarios Harry, Jacob y William han estado usando un dispositivo diferente (también sesiones incógnito y regulares).
• En algún momento, el usuario William inició sesión utilizando exactamente la misma máquina y navegador que Oliver.

El panel de control mostrará que hay dos conflictos. Uno es entre Dan, Oliver, Jack y William, y el otro involucra a Harry, Jacob y William. Tenga en cuenta que la relación de conflicto no es transitiva (es decir, Dan está en conflicto con William, Harry también está en conflicto con William, pero Dan no está en conflicto con Harry).

Una vista detallada de Dan nos dirá cuáles son sus huellas digitales, cuándo se vieron por primera vez y por última vez, y con quién está en conflicto según esa firma.

Una vista detallada de William nos dará información similar, pero esta vez mostrando dos huellas digitales.

Un administrador puede optar por actuar en consecuencia o hacer clic en el botón “ignorar” para ocultar este conflicto. Tenga en cuenta que incluso si ignora un conflicto, seguirá apareciendo en “Últimos conflictos” hasta que surjan nuevos conflictos.

¿Cómo lo instalo?

Siga Instalar un plugin, utilizando git clone https://github.com/discourse/discourse-fingerprint.git como comando del plugin.

Básicamente, edite su archivo app.yml para incluir el comando especificado anteriormente.

[lucasbasquerotto]

Thanks for the plugin!

@dan

i.e. Dan is in conflict with William, Harry is also in conflict with William, but Dan is not in conflict with William

Don’t you mean:

i.e. Dan is in conflict with William, Harry is also in conflict with William, but Dan is not in conflict with Harry

[dan (Dan Ungureanu)]

That is correct. Thank you, I have fixed the post.

[FelicianoTech (Ricardo N Feliciano)]

Is there a case study for this showing how well it has worked in the real world?

[Stranik (Evgeny)]

Thanks for the plugin!
This is a wonderful thing. It would be great to see him on: transifex

[ljpp]

We are very interested in this, but should we be worried about the GDPR? Based on the plugin description it doesn’t seem to collect anything that GAnalytics already does.

How is the data stored? Is it automatically purged at some point of time or can it be purged manually?

[nukeador]

Related/Unrelated note: Some browsers are actively working on avoiding fingerprinting. For example Firefox will soon ship with the ability to block this and will be blocked by default soon too.

[dan (Dan Ungureanu)]

@FelicianoTech

Is there a case study for this showing how well it has worked in the real world?

Unfortunately I am not aware of any big communities that run this plugin. However, in the real world it seems to work pretty well. See https://panopticlick.eff.org/

@ljpp

We are very interested in this, but should we be worried about the GDPR? Based on the plugin description it doesn’t seem to collect anything that GAnalytics already does.

It depends on how you see it. Every piece of information that is stored cannot be tied to a single individual, which is GDPR compliant. Combining them, you might be able to track individuals.

@ljpp

How is the data stored? Is it automatically purged at some point of time or can it be purged manually?

The plugin uses PluginStore to store at most max_fingerprints fingerprints (default value: 10), purging the oldest to make room for new ones.

@nukeador

Related/Unrelated note: Some browsers are actively working on avoiding fingerprinting. For example Firefox will soon ship with the ability to block this and will be blocked by default soon too.

I am not sure how their new protection works. In the past, browser extensions were relying on filenames or hashes to do it. Those methods are fragile and minor changes in the fingerprinting script can make them go undetectable.

[ljpp]

@dan

Unfortunately I am not aware of any big communities

Big is relative, but I am going to try this in production (tappara.co) when we have our next service break. Could be as soon as next week or one after that.

So it stores 10 most recent prints. Is there a way to purge the prints manually? Are they purged if the user is deleted?

[Mr.X_Mr.X]

I had high hopes from this plugin but unfortunately ios browsers mess up the whole plugin.

[nukeador]

@dan

I am not sure how their new protection works. In the past, browser extensions were relying on filenames or hashes to do it. Those methods are fragile and minor changes in the fingerprinting script can make them go undetectable.

The latest Firefox version already have this protection, opt-in for now. You can test it from Preferences - Privacy - Content blocking.

[dan (Dan Ungureanu)]

@ljpp

So it stores 10 most recent prints. Is there a way to purge the prints manually? Are they purged if the user is deleted?

There is no way from the UI, but technically, you could do it from the Rails console. Deleting the user does not purge old Fingerprints, but that is a bug I will have to fix.

user = User.find_by_username("dan")
DiscourseFingerprint::Fingerprint.get_fingerprints(user.id).each do |fp|
  DiscourseFingerprint::Fingerprint.remove(user.id, fp)
end

@Mr.X_Mr.X

I had high hopes from this plugin but unfortunately ios browsers mess up the whole plugin.

Yes, I believe so. I remember a community had the same problem with mobile devices, especially iPhones due to their build similarity.

@nukeador

The latest Firefox version already have this protection, opt-in for now . You can test it from Preferences - Privacy - Content blocking.

I will try and have a look. The news I read said they were using Disconnect’s list which could have been tricked with some little effort.

[ljpp]

Our trial in production is now live.

Should we expect a performance penalty due to this? Our traffic has extreme spikes, based on real time events. Summer time is off-season, so things will be quiet, but during the hockey season we are likely to meet the limits of our server.

One additional idea for fingerprinting the user – what about tagging the users with a unique cookie? That would provide additional information that Harry’s browser has Dan’s cookie? This would obviously happen on shared devices, but might potentially expose trolls that lack technical expertise.

Many thanks for the development efforts and we are most interested in seeing the results.

[preterive]

I would really like a feature to ban a fingerprint.

[Foriusz]

Missing translation

[MarcP]

How do I delete this plugin? Did a rebuild after removing the line from my app.yml but the plugin is still there.

Edit: no one can help deleting this?

[preterive]

How to ban a fingerprint?
I really need this feature.

[Justin_Vega]

@nukeador

The latest Firefox version already have this protection, opt-in for now . You can test it from Preferences - Privacy - Content blocking.

It’s now enabled by default.

Quick look review Firefox 72 Released January 7th 2020 A few Privacy improvements and many security

[RubyRhod]

Gran idea para el plugin.

Faltan algunas traducciones:
[en_US.dates.medium.x_years]
[en_US.admin.flags.ignore_flag]

Además, no puedo hacer clic en la opción de ignorar la bandera. Esto es importante porque, como administrador del sitio, necesito un «alter ego» para publicar como un usuario regular, no como administrador.

[Heliosurge (Dan DeMontmorency)]

¿Dónde encuentro el emparejador de huellas dactilares?

Lo veo en los complementos, pero no el emparejador.

(RESUELTO)
Olvidé actualizar la página. Mi culpa.