Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Websites can now fingerprint a device when multiple browser instances are used

arstechnica.co.uk

Post reply on HN
Print view View original

21–30 of 154 posts

Re: Websites can now fingerprint a device when multiple browser instances are used

#21

Post by basicplus2 »

reirob wrote: post #11

tldr: "The new technique relies on code that instructs browsers to perform a variety of tasks. Those tasks, in turn, draw on operating-system and hardware resources—including graphics cards, multiple CPU cores, audio cards, and installed fonts—that are slightly different for each computer. For instance, the cross-browser fingerprinting carries out 20 carefully selected tasks that use the WebGL standard for rendering…

And a bit more... "Specifically, because many of such OS and hardware level functions are exposed to JavaScript via browser APIs, we can extract features when asking the browser to perform certain tasks through these APIs. The extracted features can be used for both single- and cross-browser fingerprinting"

Re: Websites can now fingerprint a device when multiple browser instances are used

#22

Post by Cieplak »

Time to start patching your browser or proxying requests to munge http headers and strip out all identifiable data, and to throw random garbage in there. Obviously you can detect this pattern as well, but it makes it harder. Browser vendors are not on our side. Spend a couple minutes with tcpdump and a fresh install of any modern browser, and you'll see what I mean.

Re: Websites can now fingerprint a device when multiple browser instances are used

#23

Post by taf2 »

sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. Sure you could disable JavaScript but then you have basically disabled any website that depends on it which might equivalently disable the parts of the internet you wanted to access. Also it becomes obvious that your location has a broken experience. Perhaps there is a balance of blocking and blending in. My view on this is what kind of websites are you visiting that make you feel you need to disable parts of it?

Re: Websites can now fingerprint a device when multiple browser instances are used

#24

Post by EGreg »

Is there a point to third party cookie policies, given this?

What is the extent of the ability to track a user between sites these days even if they blocked third party cookies? Meaning, given an advertiser with 1,000,000 users what are the chances it knows that you just visited sites A, B, C if it has ads installed on each one?

Re: Websites can now fingerprint a device when multiple browser instances are used

#26

Post by EGreg »

na85 wrote: post #12

I note without surprise that most of this tracking leverages JavaScript. When do we say that enough is enough? When do we finally agree that the web was better without JavaScript tracking us everywhere we go, and when do we finally admit that not all ideas (JavaScript) were good ideas? My browser works against me these days. Sad times.

It is similar to macros in Word documents

Re: Websites can now fingerprint a device when multiple browser instances are used

#28

Post by angry_octet »

taf2 wrote: post #23
sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. Sure you could disable JavaScript but then you have basically disabled any website that depends on it which might equivalently disable the parts of the internet you wanted to access. Also it becomes obvious that your location has…

If the browser reports that your OS is GNU Hurd you could only be RMS, so fingerprinting would be redundant.

Re: Websites can now fingerprint a device when multiple browser instances are used

#29

Post by dagenleg »

taf2 wrote: post #23
sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. Sure you could disable JavaScript but then you have basically disabled any website that depends on it which might equivalently disable the parts of the internet you wanted to access. Also it becomes obvious that your location has…

You can just enable those parts that you need while still avoiding vast majority of bloat. At least for Firefox there's uMatrix that allows for finetuning of what exactly you want to enable/disable.

Re: Websites can now fingerprint a device when multiple browser instances are used

#30

Post by sleepychu »

taf2 wrote: post #23
sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. Sure you could disable JavaScript but then you have basically disabled any website that depends on it which might equivalently disable the parts of the internet you wanted to access. Also it becomes obvious that your location has…

So my two points are perhaps overlapping.

I don't want people to track me on the internet, I think the main reason they bother is that they can show me ads that will be more interesting to me and make them more money. I can resist this by not showing the adverts to myself.

I'd like to make it harder for them to track me at all, though this is always an arms war it seems like I'm labeling myself at the moment. I'm not familiar with the technology they use to detect adblockers, does it detect "U-Block Origin (Firefox) Ver 17.3" or does it just detect "I can't seem to see the ad I know should be here, this user is blocking my ads." if it's the latter then my proposal to adopt a blank/universal fingerprint is willing to confess the single bit of information of whether the user has decided to refuse adverts.

Post reply on HN