Live data from Hacker News

Websites can now fingerprint a device when multiple browser instances are used

arstechnica.co.uk

61–70 of 154 posts

Re: Websites can now fingerprint a device when multiple browser instances are used

#61
post #55
post #39

Earlier quoted context omitted.

It makes many more completely usable. Floating headers and footers? Dead. Survey pop-ups? Dead. Pop-ups begging for your email address? Dead. Dumb fading in text and images? Dead. Needless whiz-bang animations? Dead. Site load times? Dramatically reduced. Browsing the web with NoScript is far more pleasant, even if I have to sometimes open a menu to enable a couple domains to make a poorly developed website usable. I…

TIL utilizing the most widely available programming language in the world makes a website "poorly developed."

If your website requires active content in order to display plaintext, images and navigation, then yes, it is poorly developed. You failed to use the right tool for the job.

Re: Websites can now fingerprint a device when multiple browser instances are used

#63
post #56
post #32

Earlier quoted context omitted.

Nothing much. What do you think could go wrong?

Letting a browser access video graphics processor is a terrible idea.

It's also a useful idea if you want to have fast 3D graphics in your webapps. And the way you interact with the GPU is sandboxed anyway, and protected with various tactics (e.g. not enabled on known buggy cards etc).

So?

Not having access to the video graphics processor would be an even more terrible idea. And Tor is probably the most "privacy-theater" concept.

Re: Websites can now fingerprint a device when multiple browser instances are used

#65
post #61
post #55

Earlier quoted context omitted.

TIL utilizing the most widely available programming language in the world makes a website "poorly developed."

If your website requires active content in order to display plaintext, images and navigation, then yes, it is poorly developed. You failed to use the right tool for the job.

Navigation is typically comprised of text and/or images.

Some websites need more than text or images.

Re: Websites can now fingerprint a device when multiple browser instances are used

#66

Earlier quoted context omitted.

JS is different---your browser automatically downloads and executes untrusted, unsigned, arbitrary, ephemeral code that can do whatever it feels like. Almost worse: is does so silently without the user's knowledge, and has the illusion of remote execution, misleading the user into thinking no software is actually running on their own computer.

JS is different---your browser automatically downloads and executes untrusted, unsigned, arbitrary, ephemeral code that can do whatever it feels like. It really doesn't. There are severe limits on what JS downloaded from some random site can do via a browser on your local device. A few tricks to detect some environment-based signals and invade privacy might be undesirable, but that intrusion is nothing compared to th…

>It really doesn't. There are severe limits on what JS downloaded from some random site can do via a browser on your local device.

That's missing the point.

With respect to tracking a user, most of those restrictions don't matter. Your browser does download/execute untrusted, unsigned, arbitrary, ephemeral code that can do any kind of tracking it wants.

Re: Websites can now fingerprint a device when multiple browser instances are used

#67
Well, if we can't have privacy, at least lets make it clear that we DO want it and do what we can to have it.

Not being able to defend ourselves doesn't mean that we should give up.

A crowd can gather in front of a building and demand changes, unarmed and shouting. They may be heard or not, but still they fight. Sometimes the crowd is really huge and the other side has no option but to hear.

Use Firefox. Use uBlock Origin. Use uMatrix or NoScript if you can. Use HTTPS Everywhere. Use DecentralEyes and Privacy Settings (an addon to streamline setting the cryptic browser settings in favor of your security and privacy).

If you can, edit text fields through an external editor using things like Vimperator/Pentadactyl C-i command or extensions such as Its All Text or Wasavi.

Use a firewall. Use a firewall in your phone as well.

Search through DuckDuckGo or Startpage. Use F-Droid apps on your Android device, it even has a privacy conscious browser called Privacy Browser, a great and encryption friendly email client called K-9 and key wallet called OpenKeychain. Use Free Software.

Drop the use of Google Drive and Dropbox in favor of solutions such as Syncthing.

Use a password manager and strong passwords.

Fight the good fight. Using this tools you can still enable resources for websites where you need them, literally unblocking the web with each use case. It works if you need to work and learn through browsers. For anything else, use Tor Browser. Maintain an installed version. Open it and update it often.

Privacy is a right that we must fight for everyday and, sincerely, its an honor to be part of the resistance in this dark age.

User rights actvists know how hard it can be to teach people the importance of this things. Its hard and not always effective and often backfires.

If you are a developer, don't put your tail between your legs and accept that you must for monetary reasons circumvent user rights, talk with your team, be the guy with weird thoughts and be proud. You know the importance and they don't. Isn't it like this when a math teacher struggles with his younglings? They just don't know. Be patient.

We can BE the change we want.

Edit: Use Signal. Support Riot. SUPPORT THE EFF! There are so many beautiful people fighting the fight with us. Thanks to everyone involved in the development of this products and services, often left in the shadows and unpaid. You are love.

Re: Websites can now fingerprint a device when multiple browser instances are used

#68
post #65
post #61

Earlier quoted context omitted.

If your website requires active content in order to display plaintext, images and navigation, then yes, it is poorly developed. You failed to use the right tool for the job.

Navigation is typically comprised of text and/or images. Some websites need more than text or images.

Very few websites, maybe 1 out of 100, most offenders are just rendering content in the browser for some reason. Although even bigger offenders are not individuals, but companies, outright blocking access to client's websites without javascript. So far it's mostly Cloudflare, I think most people using the web without javascript hate them the most, hopefully the trend won't continue.

Re: Websites can now fingerprint a device when multiple browser instances are used

#69

Well, if we can't have privacy, at least lets make it clear that we DO want it and do what we can to have it. Not being able to defend ourselves doesn't mean that we should give up. A crowd can gather in front of a building and demand changes, unarmed and shouting. They may be heard or not, but still they fight. Sometimes the crowd is really huge and the other side has no option but to hear. Use Firefox. Use uBlock O…

Do all of this and you'll be fingerprinted as being in the fringe minority of privacy-craving web users, so for this effort to succeed, it might help for there to be some form of orchestration/automation and education to achieve all of these together with a wide population of people.

That'd be a startup or nonprofit project, not necessarily anything any of us can individually do and not stick out like a sore thumb unless somebody capitalizes on anti-privacy revelations which can galvanize the population in favor of self-education on privacy hygiene.

Paraphrasing (probably inaccurately) Bruce Schneier's answer to a question of mine on this topic at DEF CON: the best privacy solutions are the ones embraced by many people.

Re: Websites can now fingerprint a device when multiple browser instances are used

#70
post #32

Using WebGL while browsing with Tor? What could go wrong!

Nothing much. What do you think could go wrong?

I don't know, maybe massive pwnage?

I'm sure you know that and are just being difficult. Its because OpenGL/DirectX drivers run a large compiler in the kernel and then send the compiled code to the GPU. None of that code is inspectable. Drivers routinely have special hacks to tweak the performance of particular games or matching patterns of use that tweak special paths, making thorough testing particularly hard.

https://medium.com/@afd_icl/hey-a-web-page-just-restarted-my... https://twitter.com/alexstamos/status/829124727289544704

Post reply on HN