Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Websites can now fingerprint a device when multiple browser instances are used

arstechnica.co.uk

Post reply on HN
Print view View original

91–100 of 154 posts

Re: Websites can now fingerprint a device when multiple browser instances are used

#91

Post by logfromblammo »

samfisher83 wrote: post #86
sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

Unless you disable JavaScript it would be to hard to stop the fingerprinting. If you shut off JavaScript a lot of sites won't work

Since many of those sites "work" by tracking you and relentlessly analyzing your behavior, I'd say that's a good thing.

If a site shows me nothing but a blank screen when I load it up with scripts disabled, I am very reluctant to enable 14 different script domains just to see a paged article, or worse, a slide show.

Allowing scripts to run only from whitelisted domains makes the web a better place.

Re: Websites can now fingerprint a device when multiple browser instances are used

#92

Post by eeZah7Ux »

Silhouette wrote: post #82
wtbob wrote: post #76

Earlier quoted context omitted.

> Given that popular uses for the Web today include social networking, e-commerce, web apps, and online access to services like banking, I think the idea that sites should just display static information and should work better without JS and cookies is at least a decade out of date. Do you realise that every item on your list wasn't just possible but flourished without JavaScript, and works fine without third-party c…

Do you realise that every item on your list wasn't just possible but flourished without JavaScript No, I don't realise that at all. Imagine how tedious it would be even to use a relatively simple discussion forum like HN if you had to wait for a full page reload every time you hit a voting button or expanded/contracted a thread. That's about as simple an interaction as you can get, but there are countless other simpl…

> Imagine how tedious it would be even to use a relatively simple discussion forum like HN if you had to wait for a full page reload every time you hit a voting button or expanded/contracted a thread.

If javascript did not exist HTML/CSS/SVG would have evolved simple features like submitting a POST when an element is clicked without reloading a page.

Iframes were already enabling something similar and CSS supports animations.

Re: Websites can now fingerprint a device when multiple browser instances are used

#93

Post by Balgair »

sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

This should help in addition to your suggestions:

https://addons.mozilla.org/en-US/firefox/addon/random-agent-...

https://addons.mozilla.org/en-US/firefox/addon/trackmenot/

https://addons.mozilla.org/en-US/firefox/addon/adnauseam/ (doesn't work well for me, though, YMMV)

Re: Websites can now fingerprint a device when multiple browser instances are used

#94

Post by ikeboy »

mpeg wrote: post #88
ikeboy wrote: post #38

1. Are ad companies ahead of the research and have been doing things like this all along? 2. In theory you can look at JavaScript served from ad sites and reverse engineer to see what they are tracking. Has anybody tried to make a database of which ad vendors run which things in browsers? (Similar to how malware is reverse engineered?)

Yes and yes. Take a look at the work of Steven Englehardt around cookie syncing and gpu fingerprinting [0] [1] [0]: https://freedom-to-tinker.com/2014/08/07/the-hidden-perils-o... [1]: https://freedom-to-tinker.com/2016/01/12/retrospective-look-...

Checking what sites use specific techniques is not the same as reversing JS to find new techniques.

Re: Websites can now fingerprint a device when multiple browser instances are used

#95

Post by inetknght »

stymaar wrote: post #36
taf2 wrote: post #23

Earlier quoted context omitted.

I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. Sure you could disable JavaScript but then you have basically disabled any website that depends on it which might equivalently disable the parts of the internet you wanted to access. Also it becomes obvious that your location has…

> I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. In my generation (I'm 28), and even more in my cousins' (early twenties) it looks like the hurd is using an adblocker. And I'm talking about art students, acountants and chefs not IT engineers. You just can't spend hours on You…

> You just can't spend hours on YouTube videos without an adblocker on …

...actually, you can. But those hours won't be filled with the videos you wanted to watch. ;)

Re: Websites can now fingerprint a device when multiple browser instances are used

#96

Post by ioulian »

coldpie wrote: post #40
ioulian wrote: post #14

Earlier quoted context omitted.

These are my thoughts (as a webdeveloper): We have 5 big browsers and 3 OS's that we need to support (different rendering, different canvas rendering, not to mention 3d rendering quircks, different installed fonts), I think we don't need yet another way to make our lives difficult. I understand that privacy is a big issue, but think about "normal" web developers who just want to show a cool working website to their u…

> I understand that privacy is a big issue, but think about "normal" web developers who just want to show a cool working website to their users, but need to display this message to them: "Thank you for looking at our website, but unfortunately your browser is in lite JavaScript mode. Please set it to full functionality again and restart your browser en go to our site once more.". My brain melted out of my ears when I…

As a developer in a web agency, we create a lot of "fancy" (= sites that are interesting to look at, and they need to draw attention) websites, no it is not to create a text fade that can be done in CSS btw.

It is to validate forms with ajax, it is to display ajax loaded content, it is to upload a file without needing a page refresh, to create a simple image slider/viewer, ...

Of course the content is king, but do not forget that there are a lot of stuff going around content. Look at Facebook, Youtube, Pinterest, ... Sure they could work without any Javascript at all, but it will not be the same experience.

Like somebody here already said, we beginning to create web apps because it's possible and because it's cheaper to do directly in the browser than to hire a native device developer (another discussion).

We can't forget Javascript nowadays, it's a big and popular language for a reason, it allows the developers to create interesting user experiences (and apps) inside a browser. There are a lot of fine examples of good javascript implementations, but of course there are also companies that use it the "bad" way.

Re: Websites can now fingerprint a device when multiple browser instances are used

#97

Post by Jailout2000 »

coldpie wrote: post #39
Aoyagi wrote: post #3

Earlier quoted context omitted.

When we get to critical mass? More like "if". I doubt the majority (crushing majority even) of active web browsers will ever get to that length. Especially noscript, which makes some sites completely useless.

It makes many more completely usable. Floating headers and footers? Dead. Survey pop-ups? Dead. Pop-ups begging for your email address? Dead. Dumb fading in text and images? Dead. Needless whiz-bang animations? Dead. Site load times? Dramatically reduced. Browsing the web with NoScript is far more pleasant, even if I have to sometimes open a menu to enable a couple domains to make a poorly developed website usable. I…

I'd love to use NoScript, but even being as technical as I am, the UI/UX for it makes it completely unusable for me. I'm not a Firefox primary user, I primarily am on Chromium Opera these days. The equivalent of NoScript is an extension called NoScript Suite Lite: https://chrome.google.com/webstore/detail/no-script-suite-li...

Re: Websites can now fingerprint a device when multiple browser instances are used

#98

Post by pdkl95 »

samfisher83 wrote: post #86
sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

Unless you disable JavaScript it would be to hard to stop the fingerprinting. If you shut off JavaScript a lot of sites won't work

If a website doesn't have at least minimal functionality (i.e. the article can be read), then the website is broken. Fortunately, most websites that aren't complete trash work ok without JS. Very few websites need to have their JS whitelisted, which only has to be done on the first visit.

Running unknown programs from random hosts on the internet - even in a limited environment - is a bad idea. Fortunately, documents (including images, audio, video, etc.) do not need Turing completeness. A lot of people will react strongly against the idea of not using JS, often because their income depends on tricking users into running spyware/malware,

Re: Websites can now fingerprint a device when multiple browser instances are used

#99

Post by logfromblammo »

pc86 wrote: post #55
coldpie wrote: post #39

Earlier quoted context omitted.

It makes many more completely usable. Floating headers and footers? Dead. Survey pop-ups? Dead. Pop-ups begging for your email address? Dead. Dumb fading in text and images? Dead. Needless whiz-bang animations? Dead. Site load times? Dramatically reduced. Browsing the web with NoScript is far more pleasant, even if I have to sometimes open a menu to enable a couple domains to make a poorly developed website usable. I…

TIL utilizing the most widely available programming language in the world makes a website "poorly developed."

The worst offender I have seen in this respect is blog sites that won't even load static text without scripts enabled.

The complaint isn't with the scripting language, but with the blatantly unnecessary use of it.

One of the principles of human-friendly design is graceful degradation. For instance, you might design a museum for people that can walk. But some visitors might not be able to walk, so for them you install ramps and elevators when the stairs are not usable.

At the very minimum level, where someone is manually typing in HTTP requests, over a direct TCP connection to port 80 of your site, you should be returning something that can be read. Some people (or bots) may be fetching your site with curl or wget or links. Some people may be using screen readers. Some people may need machine assistance with pointer movement or scrolling. Some people may have extremely limited bandwidth, and won't automatically download images or frame contents.

If you can't degrade gracefully, your website is "poorly developed". So if you are utterly reliant on scripting to display anything at all, that certainly qualifies.

Re: Websites can now fingerprint a device when multiple browser instances are used

#100

Post by Paul-ish »

manigandham wrote: post #83

Identity (as in a stable handle for your browser/device/profile) is an important part of the web. It's tied into all kinds of functionality and security. What we really need is a device/OS level "ID" that can be read by any app or website so that it is stable. Since it's controlled by the OS, resetting your identity is as simple as generating a new ID. This single change would improve security and performance across…

This wouldn't give us any more privacy. It would just become another signal in the tracker's model, they wouldn't solely rely on it. Cookies were the same idea limited to a single website. We were told to clear our cookies and we could prevent tracking. We have seen what cookies have become, with zombie cookies[1][2] raising from the dead after we think they are gone. At the end of the day, advertisers and trackers didn't really want us to have the capability to reset our identity with them.

If you try to change the ID, trackers will use other things to try to keep tracking your browser session.

[1] https://en.wikipedia.org/wiki/Zombie_cookie

[2] https://en.wikipedia.org/wiki/Evercookie

Post reply on HN