Internet License Plates? We Already Have 'em!
Web security is tracked quite heavily, and recently a Homeland Security official suggested "internet license plates." Read more about this Orwellian concept.
A few days ago, Erik Barnett, a US Department of Homeland Security official, penned a piece suggesting that the US Government require "license plates" for those of us who cruise around the internet. This, of course, was met with the usual disdain from expected corners of the interwebs. It initial suggestion certainly exudes the usual "trust us, we won't track you if you don't have anything to hide" kind of thinking we've come to expect from law enforcement today. Look, I'm not claiming that Erik's interested in turning the US into a police state, or that he honestly believes that internet access and use should be regulated like it is in slightly more oppressive regimes like, say, Iran or North Korea. I don't think he believes this. I choose to believe in the examples he outlines in his article as motivation for his thinking. Which are pretty horrible. But then, whenever people bring these kinds of things up, these are always the kinds of examples used to justify these kinds of ideas, so perhaps I should be a bit more skeptical of his motivations than I am.
Anyway, it's a bit too late for this debate anyway. Erik doesn't know this, but we already have internet "license plates". With browser fingerprinting, just about everybody out there already has a unique fingerprint associated with their browsing (and please, don't bring up Tor, it was broken late last year). The flexibility of modern browsers and operating systems gives each browser on each computer a potentially unique profile that can be tracked and associated with internet use. We can look at the browser resolution, we can examine accepted and submitted HTTP Headers, we can look at fonts and language preferences, and other things, too. With all of this in hand we can identify who's looking at what, when, and from where, especially when tied to IP addresses. Not only can the somebody already identify who you are, they can identify where you go. They can see your wifi preferences and locations - do you use your laptop with wifi at a friends house? the analysts could see that. Internet cafes? that too. Libraries? you bet. Navigate over to https://panopticlick.eff.org/ to see this kind of fingerprinting in action.
Advertisers have been doing this kind of thing for a year or two now. It's not a leap to think that someone else has had the same kind of ideas.
Monitoring SQL Server Security: What's Required?