eBay Browser Fingerprinting

[JHerald]

Hello,

I've seen some talk of canvas fingerprinting on eBay recently and wanted to run some tests to find out whether it is a utilized practice.

I performed this test on eBay UK although it is a possibility that the same practices have been introduced in other countries.

I created two unique eBay UK accounts. Each with their own Fresh IP address and no traditional browser data (cookies, cache etc.) to link to other accounts.

The first account that I created had a fairly good selling allowance. By looking at it, you'd think it was an average but usable account. Whilst logging into the account, I detected the following




As part of a deliberate element of the test, I didn't create a new Windows User Account - I simply removed all browser data from previous use of eBay and switched to a fresh and unused IP address.

As you can see, eBay UK made various fingerprints of my browser during my session. One when logging in, another when requesting a seller allowance and the rest when performing functions like listing an item etc.

Upon listing my first item, it went smoothly and was successfully submitted on the site. About 15 minutes after publishing, the listing was unpublished but not deleted (it was moved to Unsold) and received a message from eBay stating that my account required manual verification and to call eBay.

I didn't bother calling them up since this was a test. The manual verification prompt would have been due to them linking this new account to a previously suspended account through the canvas fingerprint and any other analysis technique that they utilize.

To ensure that this outcome wasn't a coincidence and to ensure a fair test, I repeated the same as above, but with anti-fingerprinting resources installed. This prevented canvas fingerprinting and various other techniques to detect the same user who switches IP and clears their browser data.

This time, the same seller allowance was applied and repeated listing the item. To no surprise, the listing remained on eBay UK and didn't prompt any manual verification process.

I am starting to feel old as only a few years ago, most companies relied on actual browser data like cookies and cache (and of course IPs) to detect the same person with a different identity. It seems as technology evolves, so do their methods of detection.

Since introducing anti-fingerprinting software to my computer and following the stealth guide, my success rate has more than doubled. I am running 4 eBay accounts in different countries without an issue.

I'm not going to tell everyone to start doing the same, but I would advise to consider these new sneaky tactics that eBay (and probably PayPal) are starting to use.

Good luck and keep selling

[zamzam]

What difference would this make if you just created a new user account on your pc for each ebay account? Can they still trace without using any software to block any canvas printing? Finally how long has this been about ie. tracking via canvas? Thank you

[empirestate]

I made a post about it warning people. See below link...

http://www.aspkin.com/forums/ebay-tr...-tracking.html

[steve70000]

can this jump accross to each user account on your pc..if you use 1 user account for 1 stealth with diffrent ip each user you should be ok ..hopfully i am right.

[Play]

Originally Posted by steve70000

can this jump accross to each user account on your pc..if you use 1 user account for 1 stealth with diffrent ip each user you should be ok ..hopfully i am right.

Fingerprints and User Accounts
The issue with fingerprinting is, it takes a fingerprint of the machine your using. So no matter which user account you use, if its on the same machine, its got the same fingerprint.

Is this a cause for concern?
For now, new user accounts suffice. I haven't seen it to be a big issue.

Advice
Amazon have already adopted these extreme measures of tracking techniques, and go far beyond what eBay are doing right now.
So there is a chance eBay/PayPal will follow suite. If you want to ensure your accounts are future safe, consider making virtual machines, each with a different OS. Then use one eBay/PayPal combination per machine. That would ensure a unique fingerprint across the board.

Would it not just be easier if I blocked the fingerprints with add-ons
You could. But ideally you want to keep things as "natural" as possible, and fit in with the crowd, so you don't stand out like a sore thumb. 11% of devices in 2017 use ad-block, so you can image how small the % of users who use fingerprint blocking add-ons would be.

If you follow the advice I've given, you'll be golden.

[JHerald]

Originally Posted by empirestate

I made a post about it warning people. See below link...

http://www.aspkin.com/forums/ebay-tr...-tracking.html

Thanks for sharing that. It confirms that the same techniques are being exercised towards our friends over at eBay America.

[JHerald]

Originally Posted by zamzam

What difference would this make if you just created a new user account on your pc for each ebay account? Can they still trace without using any software to block any canvas printing? Finally how long has this been about ie. tracking via canvas? Thank you

I wouldn't advise that changing a user account would bypass the fingerprinting. You'd need to do more per eBay account to break the checksum - like a virtual OS as someone else has recommended or to avoid that much effort, change the User Agent and install software to bypass the fingerprinting techniques.

[JHerald]

An eBay representative has confirmed that "computer information" is one of the techniques of various used to link one account to another.

Generally, eBay's system isn't advanced enough (yet) to analyse and cognate massively advanced bits of data retrieved from these checks.

They are matching together known associations like:

email addresses, IP addresses, internal computer fingerprint hash database, selling patterns, EXIF data in photographs on listings and the About Me avatar, HTML used on past removed listings, financial information stored on eBay Payments + PayPal, transaction histories, risk level, financial associations, credit reference agencies, name + address check and more.

Follow the stealth guide and Play's advice above to avoid being captured.

Judging from the data that their system holds, once you're linked there is no going back, even if you've not been punished yet.

[newjerseymax]

Originally Posted by JHerald

An eBay representative has confirmed that "computer information" is one of the techniques of various used to link one account to another.

Generally, eBay's system isn't advanced enough (yet) to analyse and cognate massively advanced bits of data retrieved from these checks.

They are matching together known associations like:

email addresses, IP addresses, internal computer fingerprint hash database, selling patterns, EXIF data in photographs on listings and the About Me avatar, HTML used on past removed listings, financial information stored on eBay Payments + PayPal, transaction histories, risk level, financial associations, credit reference agencies, name + address check and more.

Follow the stealth guide and Play's advice above to avoid being captured.

Judging from the data that their system holds, once you're linked there is no going back, even if you've not been punished yet.

You link came up blocked as Malware

[css1]

I'm using windows accounts and firefox.

Look up the "canvas defender" plugin, it seems to work and fool the tests. It doesn't remove, it just spoofs it, and you can renew it as you like.

[es124]

VmWare is Uniqueness
100% (0 of 176794 user agents have the same signature)


My computer is
Uniqueness 99.71% (518 of 176794 user agents have the same signature)
for all browser, i use this computer for ebay and paypal and limited everytime

[Ebayorbust]

Lots of unsubstantiated claims are being made on here (once again, lol).

Whilst it is common knowledge that ebay records canvas fingerprints (and have done for sometime), NOBODY on here knows exactly what they are being used for and how much weighting ebay puts on it to determine links between accounts.

The results of the experiment carried out by the OP are inconclusive and could be put down to coincidence. I think if they ran the same experiment another dozen times and got the same result everytime then it would make their claim more plausible that the verification restriction was a result of canvas fingerprinting (as opposed to other unknown factors).

Using an addon like canvas defender is all that's needed to help mask your PC from ebay. This is far better to use as it spoofs your canvas fingerprint as opposing to blocking it.

[oompaloompa]

firefox has a user string spoofing add on. I think it is the fonts that you cannot change, that is the weak spot, so make sure they are all standard no extra ones you added in yourself etc....oh, yes and screen size is always the same...

[JHerald]

Originally Posted by Ebayorbust

Lots of unsubstantiated claims are being made on here (once again, lol).

Whilst it is common knowledge that ebay records canvas fingerprints (and have done for sometime), NOBODY on here knows exactly what they are being used for and how much weighting ebay puts on it to determine links between accounts.

The results of the experiment carried out by the OP are inconclusive and could be put down to coincidence. I think if they ran the same experiment another dozen times and got the same result everytime then it would make their claim more plausible that the verification restriction was a result of canvas fingerprinting (as opposed to other unknown factors).

Using an addon like canvas defender is all that's needed to help mask your PC from ebay. This is far better to use as it spoofs your canvas fingerprint as opposing to blocking it.

I agree. I don't intend to cause scaremongering because I am sure that canvas fingerprinting is a tip of the iceberg when it comes to linking accounts, but I wanted to share tests that were ran to determine the increased likelihood of a verification restriction when using a computer that is already hashed to a banned eBay account on their systems.

Whilst the results could be of mere coincidence, the eBay representative that I spoke with confirmed that my account specifically was 'linked to a suspended account' and further explained that computer information and financial records are among various other techniques used to identify links between eBay accounts. This is the first time I've had an eBay employee mention computer-related data, so this questioned whether this is a new canned response for their live chat in the UK.

I'm not claiming that the results indicate a definitive conclusion but my aim is to make people who might not be already aware of this technique (less advanced users) to avoid being linked despite following all other stealth recommendations. Even I wasn't aware that they even did this until I discovered it, as it's not a widespread alert at the moment and as you said, there's no conclusive answer to whether it should be.

[bramblewill]

Originally Posted by Ebayorbust

Lots of unsubstantiated claims are being made on here (once again, lol).
Using an addon like canvas defender is all that's needed to help mask your PC from ebay. This is far better to use as it spoofs your canvas fingerprint as opposing to blocking it.

Every time I come on the forum I start worrying about something else.
Ebayorbust would you suggest using this canvas defender on every user account. Does it work better with a specific browser?
Thanks

[JHerald]

eBay are using it with intent - I think the possibility of it being a feature instead of a tracker is now low.

Here's a canvas generated from eBay:




Naughty Naughty eBay

[Ebayorbust]

Originally Posted by bramblewill

Every time I come on the forum I start worrying about something else.
Ebayorbust would you suggest using this canvas defender on every user account. Does it work better with a specific browser?
Thanks

It works exactly the same way with Chrome and Firefox.

I'm not going to suggest that people should use it or not as I have yet to come across any solid evidence that it is a strong linking factor.

If you follow all the other "known" stealth rules of keeping cookies separate and using a Fresh IP along with cleaning photo images, etc, you are not going to be linking your accounts and getting them suspended.

eBay are using it with intent

....In your opinion......

I wanted to share tests that were ran to determine the increased likelihood of a verification restriction when using a computer that is already hashed to a banned eBay account on their systems.

And IN MY OPINION, those tests did not prove that.

[arktech]

Originally Posted by JHerald

An eBay representative has confirmed that "computer information" is one of the techniques of various used to link one account to another.

what were the circumstances that you had this conversation please ?

Do none stealthers need to or have such conversations with ebay paypal staff ?

[JHerald]

Originally Posted by arktech

what were the circumstances that you had this conversation please ?

Do none stealthers need to or have such conversations with ebay paypal staff ?

Each time an account of mine, whether deliberate or not, is suspended or restricted I will contact their live chat for some digging.

Most of the time I receive canned responses but on one occasion I had the pleasure of speaking to a Michael Brian (little shoutout for any eBay bosses reading this thread ) who clarified that computer information, financial information among other things are what contribute to linking.

Non-Stealthers may do if they become restricted or suspended for whatever reason.

[arktech]

Originally Posted by JHerald

Each time an account of mine, whether deliberate or not, is suspended or restricted I will contact their live chat for some digging.

Most of the time I receive canned responses but on one occasion I had the pleasure of speaking to a Michael Brian (little shoutout for any eBay bosses reading this thread ) who clarified that computer information, financial information among other things are what contribute to linking.

Non-Stealthers may do if they become restricted or suspended for whatever reason.

did you get a copy of the live chat please ?
could you check what he was specific about "computer information" ?
did he mention cookies IP addresses please ?

[JHerald]

Originally Posted by arktech

did you get a copy of the live chat please ?
could you check what he was specific about "computer information" ?
did he mention cookies IP addresses please ?

Unfortunately he didn't elaborate, as it was a security risk enough to even tell me what he did - I was surprised as normally they'd refuse to reveal anything in terms of linking or what's happened to cause your account to restrict.

I think Michael Brian was probably either more experienced or from a higher tier on the live chat service, as I know there are different departments that you can be connected to, depending on what you click on or say to the first agent.

I will attempt to retrieve a transcript but the agent didn't send one to my email so I'll have to see if someone else over at eBay can do that for me.

[arktech]

Originally Posted by JHerald

Unfortunately he didn't elaborate, as it was a security risk enough to even tell me what he did - I was surprised as normally they'd refuse to reveal anything in terms of linking or what's happened to cause your account to restrict.

I think Michael Brian was probably either more experienced or from a higher tier on the live chat service, as I know there are different departments that you can be connected to, depending on what you click on or say to the first agent.

I will attempt to retrieve a transcript but the agent didn't send one to my email so I'll have to see if someone else over at eBay can do that for me.

I believe when i have text chat i automatically get a copy of the txt transcript emailled to me ??

Are you basing your concern to have started this thread on your instincts
from text chats please ?

Do you have copies of any of your text chats please ?