Forum

eBay Browser Fingerprinting
 

Hello,

I've seen some talk of canvas fingerprinting on eBay recently and wanted to run some tests to find out whether it is a utilized practice.

I performed this test on eBay UK although it is a possibility that the same practices have been introduced in other countries.

I created two unique eBay UK accounts. Each with their own fresh IP address and no traditional browser data (cookies, cache etc.) to link to other accounts.

The first account that I created had a fairly good selling allowance. By looking at it, you'd think it was an average but usable account. Whilst logging into the account, I detected the following

https://image.ibb.co/eJxnfQ/canvascheck.png


As part of a deliberate element of the test, I didn't create a new Windows User Account - I simply removed all browser data from previous use of eBay and switched to a fresh and unused IP address.

As you can see, eBay UK made various fingerprints of my browser during my session. One when logging in, another when requesting a seller allowance and the rest when performing functions like listing an item etc.

Upon listing my first item, it went smoothly and was successfully submitted on the site. About 15 minutes after publishing, the listing was unpublished but not deleted (it was moved to Unsold) and received a message from eBay stating that my account required manual verification and to call eBay.

I didn't bother calling them up since this was a test. The manual verification prompt would have been due to them linking this new account to a previously suspended account through the canvas fingerprint and any other analysis technique that they utilize.

To ensure that this outcome wasn't a coincidence and to ensure a fair test, I repeated the same as above, but with anti-fingerprinting resources installed. This prevented canvas fingerprinting and various other techniques to detect the same user who switches IP and clears their browser data.

This time, the same seller allowance was applied and repeated listing the item. To no surprise, the listing remained on eBay UK and didn't prompt any manual verification process.

I am starting to feel old as only a few years ago, most companies relied on actual browser data like cookies and cache (and of course IPs) to detect the same person with a different identity. It seems as technology evolves, so do their methods of detection.

Since introducing anti-fingerprinting software to my computer and following the Stealth Guide, my success rate has more than doubled. I am running 4 eBay accounts in different countries without an issue.

I'm not going to tell everyone to start doing the same, but I would advise to consider these new sneaky tactics that eBay (and probably PayPal) are starting to use.

Good luck and keep selling :typing:

Re: eBay Browser Fingerprinting
 

What difference would this make if you just created a new user account on your pc for each ebay account? Can they still trace without using any software to block any canvas printing? Finally how long has this been about ie. tracking via canvas? Thank you

Re: eBay Browser Fingerprinting
 

I made a post about it warning people. See below link...

http://www.aspkin.com/forums/ebay-tr...-tracking.html

Re: eBay Browser Fingerprinting
 

can this jump accross to each user account on your pc..if you use 1 user account for 1 stealth with diffrent ip each user you should be ok ..hopfully i am right.

Re: eBay Browser Fingerprinting
 

Fingerprints and User Accounts
The issue with fingerprinting is, it takes a fingerprint of the machine your using. So no matter which user account you use, if its on the same machine, its got the same fingerprint.

Is this a cause for concern?
For now, new user accounts suffice. I haven't seen it to be a big issue.

Advice
Amazon have already adopted these extreme measures of tracking techniques, and go far beyond what eBay are doing right now.
So there is a chance eBay/PayPal will follow suite. If you want to ensure your accounts are future safe, consider making virtual machines, each with a different OS. Then use one eBay/PayPal combination per machine. That would ensure a unique fingerprint across the board.

Would it not just be easier if I blocked the fingerprints with add-ons
You could. But ideally you want to keep things as "natural" as possible, and fit in with the crowd, so you don't stand out like a sore thumb. 11% of devices in 2017 use ad-block, so you can image how small the % of users who use fingerprint blocking add-ons would be.

If you follow the advice I've given, you'll be golden.

Re: eBay Browser Fingerprinting
 

Thanks for sharing that. It confirms that the same techniques are being exercised towards our friends over at eBay America.

Re: eBay Browser Fingerprinting
 

I wouldn't advise that changing a user account would bypass the fingerprinting. You'd need to do more per eBay account to break the checksum - like a virtual OS as someone else has recommended or to avoid that much effort, change the User Agent and install software to bypass the fingerprinting techniques.

Re: eBay Browser Fingerprinting
 

An eBay representative has confirmed that "computer information" is one of the techniques of various used to link one account to another.

Generally, eBay's system isn't advanced enough (yet) to analyse and cognate massively advanced bits of data retrieved from these checks.

They are matching together known associations like:

email addresses, IP addresses, internal computer fingerprint hash database, selling patterns, EXIF data in photographs on listings and the About Me avatar, HTML used on past removed listings, financial information stored on eBay Payments + PayPal, transaction histories, risk level, financial associations, credit reference agencies, name + address check and more.

Follow the Stealth Guide and Play's advice above to avoid being captured.

Judging from the data that their system holds, once you're linked there is no going back, even if you've not been punished yet.

Re: eBay Browser Fingerprinting
 

You link came up blocked as Malware

Re: eBay Browser Fingerprinting
 

I'm using windows accounts and firefox.

Look up the "canvas defender" plugin, it seems to work and fool the tests. It doesn't remove, it just spoofs it, and you can renew it as you like.

Re: eBay Browser Fingerprinting
 

VmWare is Uniqueness
100% (0 of 176794 user agents have the same signature)


My computer is
Uniqueness 99.71% (518 of 176794 user agents have the same signature)
for all browser, i use this computer for ebay and paypal and limited everytime

Re: eBay Browser Fingerprinting
 

Lots of unsubstantiated claims are being made on here (once again, lol).

Whilst it is common knowledge that ebay records canvas fingerprints (and have done for sometime), NOBODY on here knows exactly what they are being used for and how much weighting ebay puts on it to determine links between accounts.

The results of the experiment carried out by the OP are inconclusive and could be put down to coincidence. I think if they ran the same experiment another dozen times and got the same result everytime then it would make their claim more plausible that the verification restriction was a result of canvas fingerprinting (as opposed to other unknown factors).

Using an addon like canvas defender is all that's needed to help mask your PC from ebay. This is far better to use as it spoofs your canvas fingerprint as opposing to blocking it.

Re: eBay Browser Fingerprinting
 

firefox has a user string spoofing add on. I think it is the fonts that you cannot change, that is the weak spot, so make sure they are all standard no extra ones you added in yourself etc....oh, yes and screen size is always the same...

Re: eBay Browser Fingerprinting
 

I agree. I don't intend to cause scaremongering because I am sure that canvas fingerprinting is a tip of the iceberg when it comes to linking accounts, but I wanted to share tests that were ran to determine the increased likelihood of a verification restriction when using a computer that is already hashed to a banned eBay account on their systems.

Whilst the results could be of mere coincidence, the eBay representative that I spoke with confirmed that my account specifically was 'linked to a suspended account' and further explained that computer information and financial records are among various other techniques used to identify links between eBay accounts. This is the first time I've had an eBay employee mention computer-related data, so this questioned whether this is a new canned response for their live chat in the UK.

I'm not claiming that the results indicate a definitive conclusion but my aim is to make people who might not be already aware of this technique (less advanced users) to avoid being linked despite following all other stealth recommendations. Even I wasn't aware that they even did this until I discovered it, as it's not a widespread alert at the moment and as you said, there's no conclusive answer to whether it should be.

Re: eBay Browser Fingerprinting
 

Every time I come on the forum I start worrying about something else.
Ebayorbust would you suggest using this canvas defender on every user account. Does it work better with a specific browser?
Thanks

Re: eBay Browser Fingerprinting
 

eBay are using it with intent - I think the possibility of it being a feature instead of a tracker is now low.

Here's a canvas generated from eBay:

https://image.ibb.co/i2pQ25/download.png


Naughty Naughty eBay ;)

Re: eBay Browser Fingerprinting
 

It works exactly the same way with Chrome and Firefox.

I'm not going to suggest that people should use it or not as I have yet to come across any solid evidence that it is a strong linking factor.

If you follow all the other "known" stealth rules of keeping cookies separate and using a fresh IP along with cleaning photo images, etc, you are not going to be linking your accounts and getting them suspended.

....In your opinion......

And IN MY OPINION, those tests did not prove that.

Re: eBay Browser Fingerprinting
 

what were the circumstances that you had this conversation please ?

Do none stealthers need to or have such conversations with ebay paypal staff ?

Re: eBay Browser Fingerprinting
 

Each time an account of mine, whether deliberate or not, is suspended or restricted I will contact their live chat for some digging.

Most of the time I receive canned responses but on one occasion I had the pleasure of speaking to a Michael Brian (little shoutout for any eBay bosses reading this thread :typing:) who clarified that computer information, financial information among other things are what contribute to linking.

Non-Stealthers may do if they become restricted or suspended for whatever reason.

Re: eBay Browser Fingerprinting
 

did you get a copy of the live chat please ?
could you check what he was specific about "computer information" ?
did he mention cookies IP addresses please ?

Re: eBay Browser Fingerprinting
 

Unfortunately he didn't elaborate, as it was a security risk enough to even tell me what he did - I was surprised as normally they'd refuse to reveal anything in terms of linking or what's happened to cause your account to restrict.

I think Michael Brian was probably either more experienced or from a higher tier on the live chat service, as I know there are different departments that you can be connected to, depending on what you click on or say to the first agent.

I will attempt to retrieve a transcript but the agent didn't send one to my email so I'll have to see if someone else over at eBay can do that for me.

Re: eBay Browser Fingerprinting
 

I believe when i have text chat i automatically get a copy of the txt transcript emailled to me ??

Are you basing your concern to have started this thread on your instincts
from text chats please ?

Do you have copies of any of your text chats please ?

Re: eBay Browser Fingerprinting
 

I couldn't retrieve a transcript from that chat but I've reached out to eBay again and had this conversation with Vincent:


https://image.ibb.co/kVF04k/spa.png


https://image.ibb.co/dX2PVQ/Capture.png


https://image.ibb.co/kNmjVQ/Ca4pture.png



INFORMATION ACCURATE AS AT 22:03 PM - 29TH JULY 2017

Re: eBay Browser Fingerprinting
 

I used the prescribed 'canvas defender' on some accts. It wanted the phone number question to know who you you are on every one. I think all of you are F.O.S. so to be important on his site...pathetic.

Re: eBay Browser Fingerprinting
 

That's some way to spend a Saturday evening - speaking with your "friends" at Ebay. :d

We already know they detect canvas because if you use canvas spoofing software it tells you when an attempt to record your canvas is made. The only thing that's debatable is to what extent it is used to link accounts. Given that hundreds of members on here have operated multiple ebay accounts for years without spoofing or blocking canvas, that to me would indicate that it's importance in account linking is low (certainly for the time being).

Re: eBay Browser Fingerprinting
 

Just because for years I have had no problems either. That's not the point. If people recommend something without testing, at least let us know it is NOT tested to use 'canvas Defender'. I've been here longer than you have. Un written law is to never do such a thing and you know that. Ebay changes with the wind, don't you know that?

Re: eBay Browser Fingerprinting
 

I've been using it for the last few months and created several hundred accounts in that time.

Just for the record, I'm not actually advocating that people need to use it either. I only use it due to the sheer volume of accounts that I create to help minimise the risks of links being made between accounts.

Good for you.

I could tell you why you got the phone verification on your accounts but given your attitude, I'm not going to bother. :)

Re: eBay Browser Fingerprinting
 

Oh great another trump supporter..

So being here 9 months longer than EbayOrBust makes you some kind of hero does it?
If thats the case, then maybe try posting advice/questions more than once every 2 months (over someone who is actually online everyday) then you can actually use that idiotic comment..

But i for one would rather take advice from someone who makes up to 50 accounts a day over someone who makes one every couple of months...

Re: eBay Browser Fingerprinting
 

[QUOTE=JHerald;861927]I couldn't retrieve a transcript from that chat but I've reached out to eBay again and had this conversation with Vincent:
/QUOTE]

Wow Vincent really does type perfect and articulate English. Most of the text chat i have with people form eBay could not get a sentence out without a typo.

How long did this call take please ?

Was he in a specialist department of ebay or first line customer support please ?

Re: eBay Browser Fingerprinting
 

[quote=arktech;862029]Vincent isn't an Indian name, so I'd predict that his English skills would be of a good standard.

It wasn't a call, it was a live chat which I posted screenshots of above. It lasted about 15 minutes until the point where he refused to answer further questions pertaining to eBay.

He wasn't a specialized department, he was on the first tier of support.

Your questions would insinuate that it didn't happen - these aren't exclusive conversations, so I would suggest you to reach out to them yourself and I am sure you'll receive the same responses as did I for your gratification. You need to push them to give you detail, simply asking one question and then leaving it at that won't suffice.

Re: eBay Browser Fingerprinting
 

What can I say, I guess that's how interesting my Saturday evenings have become :d

Yes I understand that and as you're a high-volume stealther, I'd take your experience of it seriously.

I posted them shots because another user wanted to see what eBay have been saying about it.

Re: eBay Browser Fingerprinting
 

[quote=JHerald;862034]I am not insinuating anything and that was not my intention. It is easy to take text and "text chat" LOL out of context and read things that are not there.

I welcome you taking the trouble to give us your concerns

I know I do not have your skills and my questions were to discover as much information as possible about things I have no experience or skills to get the information myself.

My experience has been different on my use of text chat with eBay representatives.

Thanks you for sharing your concerns with us.

Re: eBay Browser Fingerprinting
 

You would for a box of McVitie's Dark Chocolate Digestives Cookies!

Re: eBay Browser Fingerprinting
 

I prefer Jaffa Cakes but digestives would work too, lol.

Re: eBay Browser Fingerprinting
 

no hobnobbing then ?

Re: eBay Browser Fingerprinting
 

Damn, that reminds me...im running low on Jaffa Cakes, time to order more!

Re: eBay Browser Fingerprinting
 

This thread really does take the Biscuit.

Personally, I'm a bit crackers.

:pound:

Re: eBay Browser Fingerprinting
 

Order me some too?
__________________
How to use Paypal correctly
Run multiple portable Firefox, 1 user account
How to add new PP to eBay
How to clean photos
Best image resizer

Re: eBay Browser Fingerprinting
 

is jaffa cake a cake or a biscuit (cookie or are they flash cookies) ?

Re: eBay Browser Fingerprinting
 

That makes me glad I decided to use different machines from the start to prevent my ADD from screwing me up.