For some reason, this didn't fully work for me. I tried Safari, Chrome, and Firefox on MacOS. The results for the Audio feature were the same for Chrome and Firefox, but different for Safari.
Websites can now fingerprint a device when multiple browser instances are used
41–50 of 154 posts
Re: Websites can now fingerprint a device when multiple browser instances are used
#42Earlier quoted context omitted.
This is why I use uMatrix.
Sometimes it's frustrating to get sites working with it, but it's nice to know I can have such fine grained control over every (I think?) connection each website is making. Sometimes I'm just astonished - some sites are making network requests to dozens and dozens of other domains!
Observe, a local newspaper website: http://i.imgur.com/hmFaW3M.png
Re: Websites can now fingerprint a device when multiple browser instances are used
#43If you don't want to be tracked, the simplest solution is to disable WebGL and HTML5 stuff, and minimize use of Javascript. That's part of what Tor browser does. If you want that stuff, you can compartmentalize in multiple VMs.
However, even that can be vulnerable. Browsers in all Debian-based VMs have the same HTML5 canvas fingerprint on given hardware. Because the fingerprint is based on both the VM's graphics driver and the host's graphics hardware. To avoid that, you can use unrelated OS in your VMs. In my experience, Windows, OSX, Fedora, PC-BSD and Debian VMs have distinct HTML5 canvas fingerprints on given hardware.
Re: Websites can now fingerprint a device when multiple browser instances are used
#44I note without surprise that most of this tracking leverages JavaScript. When do we say that enough is enough? When do we finally agree that the web was better without JavaScript tracking us everywhere we go, and when do we finally admit that not all ideas (JavaScript) were good ideas? My browser works against me these days. Sad times.
Throwing web-interactivity (via Javascript) away today is like throwing your computer away. Computers help you be more productive, but it also helps the people who want to profile you. What's the alternative?
If it's not Javascript, any functionality that offers access to the hardware (via however many layers) to "apps" from the "cloud" can be exploited this way. Maybe we should disallow hardware access, how will YouTube play videos? Should we all install youtubeplayer.exe ?
Re: Websites can now fingerprint a device when multiple browser instances are used
#45This script crashed here on FF:
Skript: http://www.uniquemachine.org/fingerprint/js/fontdetect.js:61
Re: Websites can now fingerprint a device when multiple browser instances are used
#46tldr: "The new technique relies on code that instructs browsers to perform a variety of tasks. Those tasks, in turn, draw on operating-system and hardware resources—including graphics cards, multiple CPU cores, audio cards, and installed fonts—that are slightly different for each computer. For instance, the cross-browser fingerprinting carries out 20 carefully selected tasks that use the WebGL standard for rendering…
The browsers should have an incognito mode that lies about that stuff - that just says it's a generic new macbook of something like that. 99% of sites would still work even with the wrong info on your OS, screen size etc.
Re: Websites can now fingerprint a device when multiple browser instances are used
#47Earlier quoted context omitted.
I understand the view and pains of the webdeveloper, but quite frankly I think privacy issues are way more important. Not even in the same order of magnitude. Your comment feels like a restaurant saying 'Ok, I understand cleanliness is important, but as a cook washing dishes all the time is really annoying so I only wash them if customers ask for clean dishes'
Haha, good one, but joking aside, I would rather prefer that the dishes can never get dirty, no matter what. I don't think it's in Google best interest to add anti tracking features into Chrome browser (and same with MS and Apple). So for now on we must bring our own cloth to clean out the dishes or go to another restaurant where the dishes are always clean. The problem is that it's impossible to change the current b…
The problem is that it's impossible to change the current behaviour of the browsers without breaking the whole internet.
That just doesn't track, sorry.
For one thing, plenty of sites would continue to work just fine if browsers (for example) wouldn't allow any JS to upload anything without the user's explicit consent. That would immediately solve a significant part of the problem, for a cost of one click the first time a user visits a site where they do want to allow it.
For another thing, web developers respond plenty quick enough to new opportunities to exploit browser functionality. If the major browser developers told them where to go, they'd fix their broken sites plenty quickly too.
IoT devices are really booming now, and everything is tracking us, our watches, refrigerators, thermostats, ... we can't just install a AdBlocker there.
Maybe they're booming where you are. I've yet to see anyone, from my most gadget-obsessed geek friends to my least technical family members, actually use one, other than devices specifically made for some communications purpose or whose main/only function is to provide access to some remote service. Certainly I've yet to meet anyone who thought everyday household appliances like their fridge or thermostat needed to phone home to do their jobs.
As for installing a blocker, I've already seen multiple places interested in implementing something that is essentially a privacy firewall for home devices and/or building a database of which devices try to communicate with which remote hosts for which purposes. If IoT really does outgrow the marketing hype, tools to limit its capabilities for privacy and security reasons will surely follow, maybe even at ISP level in the same way that a lot of spam no longer even reaches our junk folders.
Re: Websites can now fingerprint a device when multiple browser instances are used
#48I note without surprise that most of this tracking leverages JavaScript. When do we say that enough is enough? When do we finally agree that the web was better without JavaScript tracking us everywhere we go, and when do we finally admit that not all ideas (JavaScript) were good ideas? My browser works against me these days. Sad times.
There's numerous issues with executing untrusted, ephemeral code on the client---with both security and freedom. I gave a talk addressing some of it at LibrePlanet 2016 last year:
https://media.libreplanet.org/u/libreplanet/collection/resto...
Re: Websites can now fingerprint a device when multiple browser instances are used
#49I note without surprise that most of this tracking leverages JavaScript. When do we say that enough is enough? When do we finally agree that the web was better without JavaScript tracking us everywhere we go, and when do we finally admit that not all ideas (JavaScript) were good ideas? My browser works against me these days. Sad times.
Throwing web-interactivity (via Javascript) away today is like throwing your computer away. Computers help you be more productive, but it also helps the people who want to profile you. What's the alternative? If it's not Javascript, any functionality that offers access to the hardware (via however many layers) to "apps" from the "cloud" can be exploited this way. Maybe we should disallow hardware access, how will You…
JS is different---your browser automatically downloads and executes untrusted, unsigned, arbitrary, ephemeral code that can do whatever it feels like. Almost worse: is does so silently without the user's knowledge, and has the illusion of remote execution, misleading the user into thinking no software is actually running on their own computer.
Re: Websites can now fingerprint a device when multiple browser instances are used
#50Earlier quoted context omitted.
These are my thoughts (as a webdeveloper): We have 5 big browsers and 3 OS's that we need to support (different rendering, different canvas rendering, not to mention 3d rendering quircks, different installed fonts), I think we don't need yet another way to make our lives difficult. I understand that privacy is a big issue, but think about "normal" web developers who just want to show a cool working website to their u…
Let me address the "normal" web developers then: Don't use cookies. Don't use Javascript. And to use your own words: "It would be better to add the functionality you are suggesting as an option and not by default, so people, who understand the "risks" of not viewing some sites properly in favor of more privacy, will turn it on by themselves." Turning off all the cruft makes websites MORE usable not less. Plain text,…
Given that popular uses for the Web today include social networking, e-commerce, web apps, and online access to services like banking, I think the idea that sites should just display static information and should work better without JS and cookies is at least a decade out of date. Pushing for a very limited web is a battle that was lost long ago.
What needs to stop is the idea that just because JS is useful for interactive aspects of sites, it should also provide access by default to 1,945,255 other features that 99.9999% of sites have no legitimate use for.