I have a new service and websites already seem to know it! How?

Virtual Dedicated Servers / Virtual Private Servers
Post Reply
User avatar
Edge100x
Founder
Founder
Posts: 12945
https://www.youtube.com/channel/UC40BgXanDqOYoVCYFDSTfHA
Joined: Thu Apr 18, 2002 11:04 pm
Location: Seattle
Contact:

I have a new service and websites already seem to know it! How?

Post by Edge100x »

After creating a new VDS or dedicated machine and visiting a website in the browser, you may find that 3rd-party websites seem to do strange and sometimes alarming things, such as:

- Guessing a different language than you would expect, such as Spanish or Portuguese for a server in the US, or French for a server in Germany.
- Displaying a search history that you haven't entered, or auto-completing search terms in unusual ways.
- Showing tailored ads rather than generic ones, such as for specific product categories.
- Suggesting login names that you have never used.

This happens due to design flaws in these third-party sites combined with a technique called "browser fingerprinting". In "browser fingerprinting", a website uses a variety of techniques to secretly gather information on your VDS client's environment, looking at such details as its IP address, what OS it appears to be running, the browser and browser version being used, default screen resolution, fonts and plugins installed, websites it has visited, and defined cookies. It combines these observations and compares them with previous results to guess whether a specific visitor matches a client who visited the website before. It makes decisions on what to do and show based on what the visitor did and his or her preferences.

The problem with this strategy is that VDSes are all created from identical base images. All VDSes running the same OS start off with exactly the same configuration, meaning that two different customers can appear to have the same fingerprint. A site that uses fingerprints will draw the wrong conclusions and show the wrong things.

Workarounds for dealing with broken websites include switching browsers, using options on the website to change its behavior, installing new font packs, running the browser in incognito/private mode, and other measures that change the browser profile. In the extreme case, a customer experiencing problems with a specific site could consider installing a different OS or changing the server's IP address.
Post Reply