Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Websites can now fingerprint a device when multiple browser instances are used

arstechnica.co.uk

Post reply on HN
Print view View original

51–60 of 154 posts

Re: Websites can now fingerprint a device when multiple browser instances are used

#51

Post by na85 »

netsharc wrote: post #44
na85 wrote: post #12

I note without surprise that most of this tracking leverages JavaScript. When do we say that enough is enough? When do we finally agree that the web was better without JavaScript tracking us everywhere we go, and when do we finally admit that not all ideas (JavaScript) were good ideas? My browser works against me these days. Sad times.

Throwing web-interactivity (via Javascript) away today is like throwing your computer away. Computers help you be more productive, but it also helps the people who want to profile you. What's the alternative? If it's not Javascript, any functionality that offers access to the hardware (via however many layers) to "apps" from the "cloud" can be exploited this way. Maybe we should disallow hardware access, how will You…

>Computers help you be more productive, but it also helps the people who want to profile you

I disagree with the idea that computers == JavaScript, and furthermore with the idea that JavaScript helps me be more productive.

Excel makes me productive. React.js as a service does not.

Re: Websites can now fingerprint a device when multiple browser instances are used

#53

Post by zzzcpan »

osoba wrote: post #8

Random idea: Couldn't browsers have two modes of browsing, one lightweight one where only the most basic of JS features are enabled by default (this is something that 99% of websites actually need) and the full version where everything is enabled. The lightweight one is the default state and the users can manually switch to full version. Or even better use logistic regression or a neural network to decide when a webs…

> Couldn't browsers have two modes of browsing

They could, they could even use click-to-play like interfaces or similar for pretty much everything that might hurt user experience or weaken their privacy, but enabling by default all of the features required to show ads is much more important for all major browsers. They are only interested in helping users as long as their backers can benefit from it, i.e. can show them ads or drmed content. Even Mozilla is like that. There is no incentive for privacy there, except for PR purposes, but PR is not something you can install on your computer. Best bet is probably to donate to privacy oriented forks and use them.

Re: Websites can now fingerprint a device when multiple browser instances are used

#54

Post by Silhouette »

mikegerwitz wrote: post #49
netsharc wrote: post #44

Earlier quoted context omitted.

Throwing web-interactivity (via Javascript) away today is like throwing your computer away. Computers help you be more productive, but it also helps the people who want to profile you. What's the alternative? If it's not Javascript, any functionality that offers access to the hardware (via however many layers) to "apps" from the "cloud" can be exploited this way. Maybe we should disallow hardware access, how will You…

JS is different---your browser automatically downloads and executes untrusted, unsigned, arbitrary, ephemeral code that can do whatever it feels like. Almost worse: is does so silently without the user's knowledge, and has the illusion of remote execution, misleading the user into thinking no software is actually running on their own computer.

JS is different---your browser automatically downloads and executes untrusted, unsigned, arbitrary, ephemeral code that can do whatever it feels like.

It really doesn't. There are severe limits on what JS downloaded from some random site can do via a browser on your local device. A few tricks to detect some environment-based signals and invade privacy might be undesirable, but that intrusion is nothing compared to the kind of stunts native software has pulled over the years, and the major desktop and mobile operating systems are pathetically ineffective at sandboxing that software compared to what browsers do with JS, even taking into account the unwanted side effects of recently expanded capabilities that we're discussing here.

Re: Websites can now fingerprint a device when multiple browser instances are used

#55

Post by pc86 »

coldpie wrote: post #39
Aoyagi wrote: post #3

Earlier quoted context omitted.

When we get to critical mass? More like "if". I doubt the majority (crushing majority even) of active web browsers will ever get to that length. Especially noscript, which makes some sites completely useless.

It makes many more completely usable. Floating headers and footers? Dead. Survey pop-ups? Dead. Pop-ups begging for your email address? Dead. Dumb fading in text and images? Dead. Needless whiz-bang animations? Dead. Site load times? Dramatically reduced. Browsing the web with NoScript is far more pleasant, even if I have to sometimes open a menu to enable a couple domains to make a poorly developed website usable. I…

TIL utilizing the most widely available programming language in the world makes a website "poorly developed."

Re: Websites can now fingerprint a device when multiple browser instances are used

#57

Post by a_imho »

Aoyagi wrote: post #3
sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

When we get to critical mass? More like "if". I doubt the majority (crushing majority even) of active web browsers will ever get to that length. Especially noscript, which makes some sites completely useless.

Well, afaik Opera has content blocking by default, Firefox should do the same. MS and Apple could potentially add it.

Re: Websites can now fingerprint a device when multiple browser instances are used

#58

Post by dest »

sleepychu wrote: post #20
xkxx wrote: post #17

Earlier quoted context omitted.

Hmm, a good idea would be to make it possible to use Tor Browser without Tor, for those who don't need strong anonymity, but still want to resist browser fingerprinting.

I really want to just use my browser though, if it's possible to make it work without confessing all the bits that make my fingerprint.

I think those bits of information are closely tied to your browser functionalities. E.g. resolution, plugins installed. Keeping those bits for you would degrade your browsing experience.

Have a look at the parameters that bring the highest amount of fingerprinting bits in your config https://panopticlick.eff.org/ then see if it possible to disable them. I think it's just plain hard.

Re: Websites can now fingerprint a device when multiple browser instances are used

#59

Post by codingdave »

sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

Not all of those identifying bits have anything to do with the web. For example, your OS, your monitor size and color depth, the fonts you have installed. Those things make your overall computing experience useful, whether or not they improve your web experience.

It might be more practical to work towards browsers that do not have access to data that is not relevant to the web experience. I do need to know the size of your browser window. I do not need to know anything more about your video capabilities. In an ideal world, I wouldn't even need to know your browser, I would just need to know its capabilities. Your browser needs to know which fonts it can display, but my web server doesn't need to know that.

Re: Websites can now fingerprint a device when multiple browser instances are used

#60

Post by spaceboy »

sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

> I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

https://anonymous-proxy-servers.net/en/jondofox.html

JonDofox with JS turned off and uBlock origin installed. There's actually a small pool of users with this config but it needs to be bigger. As you said, as soon as we get consensus on what config to use, we can all switch to it en-masse.

Post reply on HN