Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I believe that hole was closed quite some time ago, wasn't it? Do you have any specifics on how you could accomplish that today?


Just attempt to load an image from the particular add-on you want to check for.

<img src='chrome://flashblock/skin/flash-on-24.png' onload='usingFlashBlock=true' onerror='usingFlashBlock=false'>

Should work fine, and even a small number of extension checks is useful for browser fingerprinting. There's no need to write cookies to track you if you're the only one running your particular configuration.


> There's no need to write cookies to track you if you're the only one running your particular configuration.

Doesn't this methodology fall over the next (and subsequent) time your addins are updated? I average eight addins in Firefox, and most of them are updated at least once a month, so I'd think my "fingerprint" would change every other week.


Since your fingerprint is going to be primarily based off your user agent, if I was running this in the wild I'd only check for presence of a handful of extensions and I'd ignore their version entirely. I'd just be looking for a couple bits more information to add to standard browser fingerprinting techniques.

For most advertising purposes, you don't need to track a user for that long anyway. Conversion tracking, view-through attribution, frequency capping, retargeting, interest-based behavioral targeting... sure, businesses would ideally prefer that the unique identifier last for thirty days, but 'every other week' would capture the bulk of the benefit.

A truly shady business could rely primarily on cookies, local storage, etc. but use browser fingerprinting only to repopulate user IDs after data deletion. Incorporating extensions into the fingerprinting could make this technique a lot more effective.


I believe this doesn't work for most extensions and only works for those that have explicitly set contentaccessible=true. https://developer.mozilla.org/en/Chrome_Registration#content...


I thought the same, but Panopticlick (panopticlick.eff.org) says otherwise. :-\

(and thanks to dfc for reminding me about Panopticlick)


You can also check the EFF panopticlick webpage.

PS if I add the link can I get down voted more than I did last post for being correct?


Panopticlick will tell you what plug-ins you have. As far as I know, it's not possible to test for what extensions you have.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: