OT Can a website get your GUID through your browser?

Can a website get your GUID through your browser?

Global unique identifier. I'm wondering if websites can retrieve my
GUID through my browser.

Thanks.

On 6/27/2013 9:47 AM, John Doe wrote:
Can a website get your GUID through your browser?

Global unique identifier. I'm wondering if websites can retrieve my
GUID through my browser.

Thanks.

Without knowing for sure, I'd have to say that it's likely.
With things like Java, and if "Private Browsing" is not in force,
A heck of a lot can be done via a browser.

On Thu, 27 Jun 2013 13:47:39 +0000 (UTC), John Doe wrote:
Can a website get your GUID through your browser?

Global unique identifier. I'm wondering if websites can retrieve my
GUID through my browser.

Possible but it'll be unreliable. Mainly because there's no such thing as
unique hardware ID (or hardware fingerprint) if you access the net using an
OS that was booted from a LiveCD on a computer with no harddisk.

On 6/27/2013 8:47 AM, John Doe wrote:
Can a website get your GUID through your browser?

Global unique identifier. I'm wondering if websites can retrieve my
GUID through my browser.

Thanks.


https://www.grc.com/intro.htm

This website will show you exactly what information your browser is
providing for websites.

Click on Shields Up on the first page. Scroll down to the bottom of the
next page and click on Shields Up again, then click on Browser information.

On 27/06/2013 9:47 PM, John Doe wrote:
Can a website get your GUID through your browser?

Window$ activation?

Global unique identifier. I'm wondering if websites can retrieve my
GUID through my browser.

You should look at the formula used to generate the GUID first! There
are many ways of doing it....

--
@~@ Remain silent. Nothing from soldiers and magicians is real!
/ v \ Simplicity is Beauty! May the Force and farces be with you!
/( _ )\ (Fedora 18 i686) Linux 3.9.6-200.fc18.i686
^ ^ 00:48:01 up 6:29 0 users load average: 0.00 0.01 0.05
�借貸! ��騙! ��交! �打交! �打劫! �自殺! 請考慮綜� (CSSA):
http://www.swd.gov.hk/tc/index/site_...sub_addressesa

On Thu, 27 Jun 2013 13:47:39 +0000 (UTC), John Doe
wrote:

Can a website get your GUID through your browser?

Global unique identifier. I'm wondering if websites can retrieve my
GUID through my browser.

Thanks.

What do you mean, "your" GUID?

GUIDs are things used by programs.

On 2013-06-27 23:47:39 +1000, John Doe said:

Can a website get your GUID through your browser?

Global unique identifier. I'm wondering if websites can retrieve my
GUID through my browser.

Thanks.

Your computer probably has several hundred GUIDs stored in it. Which
one of these GUIDs is "your" GUID?

Browsers do not allow access to system resources and Javascript (the
language that browsers execute) does not allow access to resources that
are not owned by the browser. Javascript cannot even access resources
that are not owned by the window it is running within.

If your browser is running add-ins then all bets are off. It is
trivially easy for an add-in written in a language like C++ to access
any system resources for which it can gain privilges. The same goes for
any browser with Flash enabled. So if you disable add-ins and Flash and
Java applets you are safe from third-party snooping.

That said, there is nothing stopping a browser manufacturer writing
some code to read "your" GUID and sending it back to the browser
manufacturer when it starts up. Google Chrome sends back an encrypted
packet of data to the mothership whenever it starts. Who knows what
information it is sending home. Any sensible person blocks these
connections with something like LittleSnitch or NetLimiter.

As I already said, the acronym GUID stands for "global unique
identifier". I suppose any programmer could make his own GUID
generator, but that's not what I'm talking about. I'm talking
about the GUID "generated on demand by a Microsoft library
function". Apparently that's the same (unique as the acronym
plainly states) GUID Microsoft uses for activation purposes. If
there were no way to consistently generate a GUID, Microsoft
wouldn't be able to check to make sure that you're using the same
hardware. Using that library function, apparently there is one
unique GUID for your given set of hardware. That is assuming the
same algorithm. But of course Microsoft is it going to change the
algorithm without using some key to decipher the new GUIDs. But
that might be silly.

--
Astropher astropher notatthisaddress.invalid wrote:

Path: eternal-september.org!mx05.eternal-september.org!feeder.eternal-september.org!aioe.org!.POSTED!not-for-mail
From: Astropher astropher notatthisaddress.invalid
Newsgroups: alt.comp.hardware.pc-homebuilt
Subject: OT Can a website get your GUID through your browser?
Date: Fri, 28 Jun 2013 09:46:13 +1000
Organization: Aioe.org NNTP Server
Lines: 31
Message-ID: kqiis5$qb3$1 speranza.aioe.org
References: kqhfpq$lu0$2 dont-email.me
NNTP-Posting-Host: qdIwExMnsSPL+rw1NfZc0w.user.speranza.aioe.org
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
X-Complaints-To: abuse aioe.org
User-Agent: Unison/2.1
X-Notice: Filtered by postfilter v. 0.8.2
Xref: mx05.eternal-september.org alt.comp.hardware.pc-homebuilt:27579

On 2013-06-27 23:47:39 +1000, John Doe said:

Can a website get your GUID through your browser?

Global unique identifier. I'm wondering if websites can retrieve my
GUID through my browser.

Thanks.

Your computer probably has several hundred GUIDs stored in it. Which
one of these GUIDs is "your" GUID?

Browsers do not allow access to system resources and Javascript (the
language that browsers execute) does not allow access to resources that
are not owned by the browser. Javascript cannot even access resources
that are not owned by the window it is running within.

If your browser is running add-ins then all bets are off. It is
trivially easy for an add-in written in a language like C++ to access
any system resources for which it can gain privilges. The same goes for
any browser with Flash enabled. So if you disable add-ins and Flash and
Java applets you are safe from third-party snooping.

That said, there is nothing stopping a browser manufacturer writing
some code to read "your" GUID and sending it back to the browser
manufacturer when it starts up. Google Chrome sends back an encrypted
packet of data to the mothership whenever it starts. Who knows what
information it is sending home. Any sensible person blocks these
connections with something like LittleSnitch or NetLimiter.

On Fri, 28 Jun 2013 01:24:38 +0000 (UTC), John Doe
wrote:

As I already said, the acronym GUID stands for "global unique
identifier". I suppose any programmer could make his own GUID
generator, but that's not what I'm talking about. I'm talking
about the GUID "generated on demand by a Microsoft library
function". Apparently that's the same (unique as the acronym
plainly states) GUID Microsoft uses for activation purposes. If
there were no way to consistently generate a GUID, Microsoft
wouldn't be able to check to make sure that you're using the same
hardware. Using that library function, apparently there is one
unique GUID for your given set of hardware. That is assuming the
same algorithm. But of course Microsoft is it going to change the
algorithm without using some key to decipher the new GUIDs. But
that might be silly.

You misunderstand.

Every time you call that library function you get a different result.
While duplicates are in theory possible the error rate from assuming
they are truly unique will be miniscule.

Thus I (I am a programmer) can create a GUID as a name for an object
and be confident that no other such object will have the same name. I
can store the object into my database here and then later transmit it
to another branch and be sure that it won't conflict.

There *USED TO* be some system-specific information in the GUID but it
was about your hardware, not your Windows license. This wasn't done
for spying reasons but rather to decrease the odds of a collision.
Since the ID off your network card was part of it it was impossible to
have a collision with a GUID created on any other computer unless
someone had been messing with network card IDs. (They're unique as
they come from the factory but some can be changed and you can have
virtual cards as well that have no protection against duplicates--for
example, this "machine", it's really a virtual machine and it can't
see the real network card.)

They changed this becuase it was a security issue--it leaked the
identity of the machine that created the GUID. The crypto guys care
about that sort of thing.

I just don't get it.

--
Loren Pechtel lorenpechtel hotmail.com wrote:

Path: eternal-september.org!mx05.eternal-september.org!feeder.eternal-september.org!usenet.blueworldhosting.com!news.glo rb.com!news.astraweb.com!border5.newsrouter.astraw eb.com!not-for-mail
From: Loren Pechtel lorenpechtel hotmail.com
Newsgroups: alt.comp.hardware.pc-homebuilt
Subject: OT Can a website get your GUID through your browser?
Date: Fri, 28 Jun 2013 09:41:02 -0700
Message-ID: lhers8l3i08edd7u8h9un76kj51io7ucdm 4ax.com
References: kqhfpq$lu0$2 dont-email.me kqiis5$qb3$1 speranza.aioe.org kqiokm$pci$1 dont-email.me
X-Newsreader: Forte Agent 4.2/32.1118
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 42
Organization: Unlimited download news at news.astraweb.com
NNTP-Posting-Host: 66ce942e.news.astraweb.com
X-Trace: DXC=eb Pl57`;IHnC;ELbe^;L?0kYOcDh :P`SSoGE?R`33:Wm\C]Q?JMhG?lE6de=VP3VEJcI2N8KjD^HTU ]3KdhU_F8P4?jH9jMlbS=Q:
Xref: mx05.eternal-september.org alt.comp.hardware.pc-homebuilt:27595

On Fri, 28 Jun 2013 01:24:38 +0000 (UTC), John Doe
jdoe usenetlove.invalid wrote:

As I already said, the acronym GUID stands for "global unique
identifier". I suppose any programmer could make his own GUID
generator, but that's not what I'm talking about. I'm talking
about the GUID "generated on demand by a Microsoft library
function". Apparently that's the same (unique as the acronym
plainly states) GUID Microsoft uses for activation purposes. If
there were no way to consistently generate a GUID, Microsoft
wouldn't be able to check to make sure that you're using the same
hardware. Using that library function, apparently there is one
unique GUID for your given set of hardware. That is assuming the
same algorithm. But of course Microsoft is it going to change the
algorithm without using some key to decipher the new GUIDs. But
that might be silly.

You misunderstand.

Every time you call that library function you get a different result.
While duplicates are in theory possible the error rate from assuming
they are truly unique will be miniscule.

Thus I (I am a programmer) can create a GUID as a name for an object
and be confident that no other such object will have the same name. I
can store the object into my database here and then later transmit it
to another branch and be sure that it won't conflict.

There *USED TO* be some system-specific information in the GUID but it
was about your hardware, not your Windows license. This wasn't done
for spying reasons but rather to decrease the odds of a collision.
Since the ID off your network card was part of it it was impossible to
have a collision with a GUID created on any other computer unless
someone had been messing with network card IDs. (They're unique as
they come from the factory but some can be changed and you can have
virtual cards as well that have no protection against duplicates--for
example, this "machine", it's really a virtual machine and it can't
see the real network card.)

They changed this becuase it was a security issue--it leaked the
identity of the machine that created the GUID. The crypto guys care
about that sort of thing.