Network, Browser and Website Fingerprint
Donate
About Kicksecure Network, Bridge/Guard, Internet Service Provider (ISP) Fingerprint and Website Traffic Fingerprinting.
Introduction
[edit]In this chapter, the term fingerprint refers to the specific way Kicksecure behaves on the Internet. Those specificities could be used to determine whether a particular user is running Kicksecure or not.
Fingerprinting Information
[edit]Various types of information can be leaked about the user's browser, (host) operating system and hardware depending on the external party in question.
Entry Guards or Bridges
[edit]The very same wiki chapter as in the Whonix wiki applies. Entry Guards or Bridges
ISP or Local Network Administrators
[edit]| Domain | Description |
|---|---|
| Network Stack Hardening | Kicksecure has implemented various security hardening  measures like disabling TCP timestamps, ICMP redirections, firewalling invalid packages, and more. Unfortunately these measures can increase the risk of ISP or Local Network fingerprinting. Despite this, security hardening has been prioritized.
|
| Random ISN Generation | Kicksecure prevents TCP ISN leaks through Tirdad kernel module for random ISN generation. Unfortunately this reduces ISP or Local Network fingerprinting resistance. Despite this, security has been prioritized.
|
| Tor Entry Guards | Kicksecure uses an unmodified version of Tor, Tor Entry Guards are used as the default mechanism to connect to the Tor network. [1] Consequently, a Tor user will maintain the same relay as the first hop for an extended period, [2] which is a security feature. |
| Time Synchronization | When Kicksecure is started, the system clock is synchronized to make sure it slightly differs from the host clock via sdwdate. [3]
|
| systemcheck | systemcheck also issues some network traffic over Tor to check for updates and Warrant Canary Check, which all passes through different circuits. This behavior might be specific to Kicksecure.
|
| Website Traffic Fingerprinting | Website traffic fingerprinting is also an open Tor research question, which is unspecific to Kicksecure. [4] A related and unresearched issue is whether fingerprinting risks also apply to other traffic, such as apt traffic.
|
Advanced Traffic Fingerprinting
[edit]See Advanced Traffic Fingerprinting.
Visited Websites
[edit]Destination websites can retrieve a lot of information about a user's browser and system, while advanced adversaries have even greater capabilities.
This is not the focus of Kicksecure. For that, use Whonix instead.
Website Traffic Fingerprinting
[edit]See Website Traffic Fingerprinting.
Project Goals and Non-Goals
[edit]See Privacy Goals and Non-Goals of Kicksecure.
Non-Existing Network Fingerprint Research and Implementation
[edit]The following do not exist, based on currently available public information. This is applicable to Kicksecure, but also unspecific to Kicksecure. It is also applicable to other operating systems such as Qubes OS.
- A) No phone home research: There is no ongoing research project that regularly checks whether software that comes pre-installed with Kicksecure (or is commonly installed by users) secretly connects to the internet (called "phoning home") using regular, non-anonymous internet connections (clearnet), without user action or consent. This kind of research would be important to ensure that the system is not leaking information in the background.
- B) No fingerprint research: There is no active project that regularly studies and compares how different operating systems (like Microsoft Windows, Debian, Tor Browser Bundle (TBB), Tails, Whonix, Kicksecure, etc.) appear on the internet, known as their "network fingerprint." A network fingerprint is a set of technical clues that the internet service provider (ISP) or servers can use to recognize what kind of system you're using, even without cookies or login information. These fingerprints can vary depending on the software and hardware combination, and without this kind of research, users may be more identifiable online than they realize.
- C) No fingerprint emulation development team: Based on the lack of the above research, there is also no development team working on making Kicksecure (or similar systems) mimic the network fingerprint of more commonly used systems. The goal of such emulation would be to make users harder to identify or track by blending in with the crowd — for example, by making their internet traffic look like that of a typical Windows or Debian user.
Project Goal and Non-Goal Comparison
[edit]Users can check what goals a software project explicitly states.
Many software projects do not list "radio silence" as a main objective. In this context, "radio silence" means that the system should not automatically send any network traffic unless the user initiates it. In more technical terms, this means avoiding clearnet traffic, which refers to regular, non-anonymous internet traffic that does not go through privacy networks like Tor.
- Qubes OS: Avoiding clearnet traffic is not a goal of Qubes OS. It is also unlikely to become a major goal in the future.
- Qubes FAQ entry What about privacy in non-Whonix qubes? - This FAQ shows that privacy protection in non-Whonix parts of Qubes is not a focus.
- Qubes FAQ entry What is Qubes’ attitude toward changing guest distros? - Suggests limited willingness to adopt major changes aimed at improving privacy.
- Qubes issue ticket create or fork a Linux distribution for default use by App Qubes for better security Discusses whether to create a more secure Linux distribution for Qubes, but not focused on traffic anonymity.
- See the issue:
sys-netphones home to fedoraproject.org for captive portal detection. This means that the network component of Qubes OS was connecting to Fedora’s servers automatically to check for internet restrictions. The issue was reported in 2016, and no action was taken until 2022, when the issue resolved itself without deliberate changes. This indicates that preventing such traffic was not treated as a high priority. - See list of issues Qubes Important Anonymity related Network Issues.
- Qubes FAQ entry What about privacy in non-Whonix qubes?
- Kicksecure: There is a possible future feature that would allow blocking or allowing network access based on specific Linux user accounts or IP addresses. However, this feature has not been implemented yet. For the most recent updates, see: Kicksecure Firewall
- Whonix-Host: This project aims to avoid clearnet traffic entirely, but as of the time of writing, it does not yet exist.
As a user, knowing which goals are officially supported by a project helps manage expectations. If a feature or behavior is not listed as a goal or has not been implemented, users should assume it is not available and act accordingly to protect their privacy.
Non-Existing Solutions
[edit]Solution:
C) security hardened networking + emulating "popular" network fingerprints: does not exist anywhere.
Future
[edit]Kicksecure: Might get a feature to restrict outgoing traffic to specific Linux user accounts and/or IP addresses. But it’s not yet implemented. For latest status, see ticket: Kicksecure Firewall
This however does not magically fix all advanced fingerprinting techniques.
Forum Discussions
[edit]- https://forums.kicksecure.com/t/how-many-details-are-there-in-kicksecures-fingerprint-revealing-to-isp-the-os/1044
- https://forums.kicksecure.com/t/outbound-traffic-security-kicksecure-and-qubes/1059
- https://forums.whonix.org/t/what-exaclty-tells-to-isp-generating-by-whonix-traffic/21549
- https://forum.qubes-os.org/t/question-to-develepors-what-hardware-information-reveals-qubes-system-clearnet-traffic-to-an-isp/33778
Footnotes
[edit]- ↑
https://support.torproject.org/#about_entry-guards
- ↑ Typically the entry guards are rotated after a few months.
- ↑ It is unknown if an ISP can detect whether a user has many different Tor circuits open. On the other hand, Tor seems to only open X entry guards and maintain them for a period, thus not opening as many entry guards as streams.
- ↑
See Tor Browser Design for further exploration of this issue.
A secure by default operating system with the latest security research in place.
At
Kicksecure we value freedom and trust, supporting Open Source and Freedom Software
2012-
2025 ENCRYPTED SUPPORT LLC
We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!