tldr: "The new technique relies on code that instructs browsers to perform a variety of tasks. Those tasks, in turn, draw on operating-system and hardware resources—including graphics cards, multiple CPU cores, audio cards, and installed fonts—that are slightly different for each computer. For instance, the cross-browser fingerprinting carries out 20 carefully selected tasks that use the WebGL standard for rendering 3D graphics in browsers. In all, 36 new features work independent of a specific browser."
Websites can now fingerprint a device when multiple browser instances are used
11–20 of 154 posts
Re: Websites can now fingerprint a device when multiple browser instances are used
#12I note without surprise that most of this tracking leverages JavaScript. When do we say that enough is enough? When do we finally agree that the web was better without JavaScript tracking us everywhere we go, and when do we finally admit that not all ideas (JavaScript) were good ideas?
My browser works against me these days. Sad times.
Re: Websites can now fingerprint a device when multiple browser instances are used
#13Does anyone actually bother to do this? I mean to ctach the 99% of normal users for advertising you don't have to go through any trouble.
Re: Websites can now fingerprint a device when multiple browser instances are used
#14Random idea: Couldn't browsers have two modes of browsing, one lightweight one where only the most basic of JS features are enabled by default (this is something that 99% of websites actually need) and the full version where everything is enabled. The lightweight one is the default state and the users can manually switch to full version. Or even better use logistic regression or a neural network to decide when a webs…
These are my thoughts (as a webdeveloper):
We have 5 big browsers and 3 OS's that we need to support (different rendering, different canvas rendering, not to mention 3d rendering quircks, different installed fonts), I think we don't need yet another way to make our lives difficult.
I understand that privacy is a big issue, but think about "normal" web developers who just want to show a cool working website to their users, but need to display this message to them: "Thank you for looking at our website, but unfortunately your browser is in lite JavaScript mode. Please set it to full functionality again and restart your browser en go to our site once more.".
I have already used dirty hacks to support the default setting of 3rd party cookies in Safari, while developing facebook apps or some apps inside an iframe that have different domains. It's there to make users feel more secure, but there are always ways around it.
It would be better to add the functionality you are suggesting as an option and not by default, so people, who understand the "risks" of not viewing some sites properly in favor of more privacy, will turn it on by themselves.
Re: Websites can now fingerprint a device when multiple browser instances are used
#15Random idea: Couldn't browsers have two modes of browsing, one lightweight one where only the most basic of JS features are enabled by default (this is something that 99% of websites actually need) and the full version where everything is enabled. The lightweight one is the default state and the users can manually switch to full version. Or even better use logistic regression or a neural network to decide when a webs…
These are my thoughts (as a webdeveloper): We have 5 big browsers and 3 OS's that we need to support (different rendering, different canvas rendering, not to mention 3d rendering quircks, different installed fonts), I think we don't need yet another way to make our lives difficult. I understand that privacy is a big issue, but think about "normal" web developers who just want to show a cool working website to their u…
Good point. So maybe browsers should make the full version the default and then add the following options for more tech savvy users (and users can set the permanent default or per website setting):
1) full mode (all JS is enabled)
2) lite mode (only the bare JS is enabled, no tracking possible)
3) suggested mode (a machine learning algorithm decides what is really needed to be enabled and what is there for tracking purposes)
4) manual mode (somewhere in the settings you can tick and untick verious JS APIs that you want enabled and disabled, like websockets, WebGL etc)
Re: Websites can now fingerprint a device when multiple browser instances are used
#16Random idea: Couldn't browsers have two modes of browsing, one lightweight one where only the most basic of JS features are enabled by default (this is something that 99% of websites actually need) and the full version where everything is enabled. The lightweight one is the default state and the users can manually switch to full version. Or even better use logistic regression or a neural network to decide when a webs…
These are my thoughts (as a webdeveloper): We have 5 big browsers and 3 OS's that we need to support (different rendering, different canvas rendering, not to mention 3d rendering quircks, different installed fonts), I think we don't need yet another way to make our lives difficult. I understand that privacy is a big issue, but think about "normal" web developers who just want to show a cool working website to their u…
I understand the view and pains of the webdeveloper, but quite frankly I think privacy issues are way more important. Not even in the same order of magnitude.
Your comment feels like a restaurant saying 'Ok, I understand cleanliness is important, but as a cook washing dishes all the time is really annoying so I only wash them if customers ask for clean dishes'
Re: Websites can now fingerprint a device when multiple browser instances are used
#17Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?
As stated in the article, the Tor Browser Bundle seems a good candidate of a widely adopted fingerprint. But it's just Tor of course, not browsers in general.
Hmm, a good idea would be to make it possible to use Tor Browser without Tor, for those who don't need strong anonymity, but still want to resist browser fingerprinting.
Re: Websites can now fingerprint a device when multiple browser instances are used
#18Earlier quoted context omitted.
These are my thoughts (as a webdeveloper): We have 5 big browsers and 3 OS's that we need to support (different rendering, different canvas rendering, not to mention 3d rendering quircks, different installed fonts), I think we don't need yet another way to make our lives difficult. I understand that privacy is a big issue, but think about "normal" web developers who just want to show a cool working website to their u…
I understand the view and pains of the webdeveloper, but quite frankly I think privacy issues are way more important. Not even in the same order of magnitude. Your comment feels like a restaurant saying 'Ok, I understand cleanliness is important, but as a cook washing dishes all the time is really annoying so I only wash them if customers ask for clean dishes'
Haha, good one, but joking aside, I would rather prefer that the dishes can never get dirty, no matter what.
I don't think it's in Google best interest to add anti tracking features into Chrome browser (and same with MS and Apple). So for now on we must bring our own cloth to clean out the dishes or go to another restaurant where the dishes are always clean.
The problem is that it's impossible to change the current behaviour of the browsers without breaking the whole internet. It would be much easier and better to create a new browser (look at Tor Browser for example), that has a lot of anti tracking features enabled by default.
People know that if they want privacy, they can use this browser. But it's still a "big" hassle to install it, not to mention my grandmother knows Chrome/Firefox, but not Tor Browser so she will never use it.
We do not need to change the browsers to let them defend us, but to teach folk what privacy is and what to do if you don't want to get tracked.
PS: keep in mind that browser is 1 item in the big picture of "tracking private data". IoT devices are really booming now, and everything is tracking us, our watches, refrigerators, thermostats, ... we can't just install a AdBlocker there.
Re: Websites can now fingerprint a device when multiple browser instances are used
#19I can see why the industry didn't adopt the Do Not Track header, as it would basically kill all targeting revenue goodness that's been built up over the years. Why not try and push for a unified IDFA instead, which has its benefits for targeting but also more control from a user perspective?
I don't really see an industry adoption of these fingerprinting techniques. The linked page took 20 seconds and 100% CPU before getting a fingerprint ID, so running that at scale seems pretty useless?
Re: Websites can now fingerprint a device when multiple browser instances are used
#20Earlier quoted context omitted.
As stated in the article, the Tor Browser Bundle seems a good candidate of a widely adopted fingerprint. But it's just Tor of course, not browsers in general.
Hmm, a good idea would be to make it possible to use Tor Browser without Tor, for those who don't need strong anonymity, but still want to resist browser fingerprinting.
I really want to just use my browser though, if it's possible to make it work without confessing all the bits that make my fingerprint.