Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Websites can now fingerprint a device when multiple browser instances are used

arstechnica.co.uk

Post reply on HN
Print view View original

101–110 of 154 posts

Re: Websites can now fingerprint a device when multiple browser instances are used

#101

Post by mpeg »

ikeboy wrote: post #94
mpeg wrote: post #88

Earlier quoted context omitted.

Yes and yes. Take a look at the work of Steven Englehardt around cookie syncing and gpu fingerprinting [0] [1] [0]: https://freedom-to-tinker.com/2014/08/07/the-hidden-perils-o... [1]: https://freedom-to-tinker.com/2016/01/12/retrospective-look-...

Checking what sites use specific techniques is not the same as reversing JS to find new techniques.

There's no new techniques, this stuff all uses the same javascript APIs and that's what the crawlers that look for this stuff look for.

People have been doing GPU fingerprinting since the canvas APIs were available, with accuracy rates of over 90%, this further refines it by exploiting subtle differences in 3D rendering via webgl but the API surface is pretty small

And you really don't need to reverse JS, you can just run it in a controlled environment and hook into certain calls etc. not too different to how you'd do analysis of vm / packed binaries though some of the scripts that do this stuff will try to detect these sandboxed environments and deactivate themselves (google does that, for example, cause they run their fingerprinting inside a custom VM in javascript)

Re: Websites can now fingerprint a device when multiple browser instances are used

#102

Post by angry_octet »

taf2 wrote: post #23
sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. Sure you could disable JavaScript but then you have basically disabled any website that depends on it which might equivalently disable the parts of the internet you wanted to access. Also it becomes obvious that your location has…

If the browser reports that your OS is GNU Hurd you could only be RMS, so fingerprinting would be redundant.

Re: Websites can now fingerprint a device when multiple browser instances are used

#104

Post by zeveb »

samfisher83 wrote: post #86
sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

Unless you disable JavaScript it would be to hard to stop the fingerprinting. If you shut off JavaScript a lot of sites won't work

> If you shut off JavaScript a lot of sites won't work

If a site requires JavaScript, it already doesn't work. If a site requires JavaScript, its owner clearly doesn't care about either your security or your privacy.

Why use a site which requires JavaScript?

JavaScript delenda est.

Re: Websites can now fingerprint a device when multiple browser instances are used

#105

Post by zeveb »

Silhouette wrote: post #82
wtbob wrote: post #76

Earlier quoted context omitted.

> Given that popular uses for the Web today include social networking, e-commerce, web apps, and online access to services like banking, I think the idea that sites should just display static information and should work better without JS and cookies is at least a decade out of date. Do you realise that every item on your list wasn't just possible but flourished without JavaScript, and works fine without third-party c…

Do you realise that every item on your list wasn't just possible but flourished without JavaScript No, I don't realise that at all. Imagine how tedious it would be even to use a relatively simple discussion forum like HN if you had to wait for a full page reload every time you hit a voting button or expanded/contracted a thread. That's about as simple an interaction as you can get, but there are countless other simpl…

> Imagine how tedious it would be even to use a relatively simple discussion forum like HN if you had to wait for a full page reload every time you hit a voting button or expanded/contracted a thread.

You don't need a full page reload to implement voting; that's what the 204 No Content response is for: your browser sends the vote & doesn't refresh the page.

Re: Websites can now fingerprint a device when multiple browser instances are used

#106

Post by pdkl95 »

netsharc wrote: post #44
na85 wrote: post #12

I note without surprise that most of this tracking leverages JavaScript. When do we say that enough is enough? When do we finally agree that the web was better without JavaScript tracking us everywhere we go, and when do we finally admit that not all ideas (JavaScript) were good ideas? My browser works against me these days. Sad times.

Throwing web-interactivity (via Javascript) away today is like throwing your computer away. Computers help you be more productive, but it also helps the people who want to profile you. What's the alternative? If it's not Javascript, any functionality that offers access to the hardware (via however many layers) to "apps" from the "cloud" can be exploited this way. Maybe we should disallow hardware access, how will You…

> Throwing web-interactivity (via Javascript) away

Javascript is not the only way to provide interactivity. CSS, for example, provides some form validation methods in a declarative style. Sometimes you can do it server-side. Many types of interactivity were possible before the current JS mess.

If there is a type of common interactivity that is not supported without JS, we can always add it as a new browser features, just like we did with everything else in the browser.

> any functionality that offers access to the hardware (via however many layers) to "apps" from the "cloud" can be exploited this way

That's why you don't provide an runtime environment for "apps". Rendering data (a document, an image, video, etc.) does not need arbitrary software. It only needs a way to send a media file to the appropriate renderer. and tags should work fine.

> how will YouTube play videos?

Why is this even a question? They can serve an mp4 (or whatever) at some URL, and reference it in the tag. Video playback doesn't require running arbitrary software, because we already have local video players.

Re: Websites can now fingerprint a device when multiple browser instances are used

#107

Post by romaniv »

pdkl95 wrote: post #98
samfisher83 wrote: post #86

Earlier quoted context omitted.

Unless you disable JavaScript it would be to hard to stop the fingerprinting. If you shut off JavaScript a lot of sites won't work

If a website doesn't have at least minimal functionality (i.e. the article can be read), then the website is broken. Fortunately, most websites that aren't complete trash work ok without JS. Very few websites need to have their JS whitelisted, which only has to be done on the first visit. Running unknown programs from random hosts on the internet - even in a limited environment - is a bad idea. Fortunately, documents…

>If a website doesn't have at least minimal functionality, then the website is broken.

Curious. This goes completely against the sentiment in all of the discussions around modern SPA frameworks and JS libraries I've seen on this very website. It seems that for most fronted devs today JS is a natural prerequisite for using their product. Progressive enhancement is often sneered at[1] as impractical and unnecessary. This leads me to believe that there are two mostly disjoint groups of people commenting on this issue in different threads.

---

[1] - Good example: https://www.viget.com/articles/the-case-against-progressive-...

Re: Websites can now fingerprint a device when multiple browser instances are used

#108

Post by jampa »

lucaspiller wrote: post #6

I'd imagine for most home users the combination of the following is enough to track them across multiple browsers: {ip, device pixel ratio, screen resolution, time zone} You can then identify more unique browser features to track them across multiple locations. Even if it's not completely unique, you can build up a network graph that's probably good enough for most things - people living in the same house probably ha…

Probably not on mobile, carriers the tend to share IPv4 address, you would get the same fingerprint ID on every AT&T iPhone 7 in France, for example.

Re: Websites can now fingerprint a device when multiple browser instances are used

#109

Post by rxlim »

I have been browsing the web without Javascript enabled since 2006. The worst is that once in a while you will click on a link to read some text, but arrive at a completely blank page. Many times this can be solved by disabling CSS for that page or using the Google cache, but it's still annoying.

I my view requiring Javascript just to display text or pictures is completely brain-dead, web "designers" that think this is a good idea should probably no be allowed to design anything. It also makes it hard for disabled people that rely on accessibility tools to use the web.

I don't expect "web apps" like a video player to work without Javascript, but basic things like reading text, viewing pictures or clicking on links should never depend on it.

Re: Websites can now fingerprint a device when multiple browser instances are used

#110

Post by colept »

na85 wrote: post #12

I note without surprise that most of this tracking leverages JavaScript. When do we say that enough is enough? When do we finally agree that the web was better without JavaScript tracking us everywhere we go, and when do we finally admit that not all ideas (JavaScript) were good ideas? My browser works against me these days. Sad times.

The problem is not Javascript - throwing out JavaScript is like throwing out your utensils because your meal is too sweet.

The problem is browsers are made by advertising entities that also leverage these same abilities.

Post reply on HN