Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Websites can now fingerprint a device when multiple browser instances are used

arstechnica.co.uk

Post reply on HN
Print view View original

121–130 of 154 posts

Re: Websites can now fingerprint a device when multiple browser instances are used

#121

Post by rsync »

rxlim wrote: post #109

I have been browsing the web without Javascript enabled since 2006. The worst is that once in a while you will click on a link to read some text, but arrive at a completely blank page. Many times this can be solved by disabling CSS for that page or using the Google cache, but it's still annoying. I my view requiring Javascript just to display text or pictures is completely brain-dead, web "designers" that think this…

I use ublock origin with chrome.

Do I understand correctly that the simple tool to block javascript (noscript) is not available on chrome ?

I'd like to disable javascript but the non-noscript recipes seem very complex ...

Re: Websites can now fingerprint a device when multiple browser instances are used

#122

Post by manigandham »

erikrothoff wrote: post #19

I can see why the industry didn't adopt the Do Not Track header, as it would basically kill all targeting revenue goodness that's been built up over the years. Why not try and push for a unified IDFA instead, which has its benefits for targeting but also more control from a user perspective? I don't really see an industry adoption of these fingerprinting techniques. The linked page took 20 seconds and 100% CPU before…

Yes. Device/OS level "advertising ID" that can be reset at anytime by the client is sorely needed and would be used by every ad network, greatly improving privacy and performance of ads on the web.

Re: Websites can now fingerprint a device when multiple browser instances are used

#123

Post by pikzen »

romaniv wrote: post #107
pdkl95 wrote: post #98

Earlier quoted context omitted.

If a website doesn't have at least minimal functionality (i.e. the article can be read), then the website is broken. Fortunately, most websites that aren't complete trash work ok without JS. Very few websites need to have their JS whitelisted, which only has to be done on the first visit. Running unknown programs from random hosts on the internet - even in a limited environment - is a bad idea. Fortunately, documents…

>If a website doesn't have at least minimal functionality, then the website is broken. Curious. This goes completely against the sentiment in all of the discussions around modern SPA frameworks and JS libraries I've seen on this very website. It seems that for most fronted devs today JS is a natural prerequisite for using their product. Progressive enhancement is often sneered at[1] as impractical and unnecessary. Th…

Their landing page doesn't work without Javascript. It doesn't load images without Javascript. And they're advocating for no PE.

I don't know which world JS devs are dragging us in, but it certainly looks shitty and ignoring every single thing software engineers have learned in the past thirty years.

Re: Websites can now fingerprint a device when multiple browser instances are used

#124

Post by rsync »

sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

"Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can."

For the fourth or fifth time this year, in response to a thread about browser privacy, I am reminded that what I really want is the ability to jail/chroot a browser.

Firing up a full-blown VM for a browser ("banking profile", "twitter profile", "sketchy online store profile") is way too heavyweight and resource intensive. I want a totally, totally clean slate (restored to post-install defaults) to restart certain browsing sessions with (and dispose of when I am done) but a full virtual machine is too expensive in time and resources.

But if I could jail a GUI application ... then there would be almost zero resource overhead and the jail would die quickly when you're done.

jailing a GUI application is not that well developed of a use-case. Further, OSX doesn't even have a jail command.

I wish this was an established use-case - I would really like a totally throwaway browser profile that I could reset and re-use.

Re: Websites can now fingerprint a device when multiple browser instances are used

#126

Post by harshreality »

manigandham wrote: post #119
harshreality wrote: post #117

Earlier quoted context omitted.

Services where security matters already manage it: they have a handful of contact points for each user, and they alert when an unknown browser/device/profile logs into the service. You want that centralized and made universal? An internet passport? Goodbye vpn services. Goodbye, tor. Goodbye doing anything that's not in your permanent browsing profile stored by advertisers, google, facebook, twitter.

A standard UUID generated at the OS level and passed through seamlessly through a browser? Yes. Client-side control means that you can turn it off depending on TOR, private-mode, VPN, or whatever else. The technical aspects though would make the web faster and easier to deal with.

So you turn it off, and half the web stops working for you because websites don't want to serve you content unless their ad networks receive your unique hardware id from some mandatory hardware TPM?

Then, since a TPM is effectively mandatory once the web can't be used without it, all media content can be DRM'd with less customer push-back.

I get that the web is a mess, but is this the best idea anyone can come up with to fix it? And does this actually fix it?

Re: Websites can now fingerprint a device when multiple browser instances are used

#127

Post by taf2 »

stymaar wrote: post #36
taf2 wrote: post #23

Earlier quoted context omitted.

I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. Sure you could disable JavaScript but then you have basically disabled any website that depends on it which might equivalently disable the parts of the internet you wanted to access. Also it becomes obvious that your location has…

> I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. In my generation (I'm 28), and even more in my cousins' (early twenties) it looks like the hurd is using an adblocker. And I'm talking about art students, acountants and chefs not IT engineers. You just can't spend hours on You…

You could also pay ... $9.99 a month for ad-free youtube...

Re: Websites can now fingerprint a device when multiple browser instances are used

#128

Post by EGreg »

zeveb wrote: post #116
na85 wrote: post #74

Earlier quoted context omitted.

Is it, though? To the best of my knowledge, macros don't execute by default, silently, and in so doing facilitate my being tracked by people wanting to sell me generic brand pharmaceuticals.

Yes, JavaScript is worse than Word macros — and they are terrible!

If it's so bad then turn it off :)

Re: Websites can now fingerprint a device when multiple browser instances are used

#129

Post by stymaar »

taf2 wrote: post #127
stymaar wrote: post #36

Earlier quoted context omitted.

> I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious. In my generation (I'm 28), and even more in my cousins' (early twenties) it looks like the hurd is using an adblocker. And I'm talking about art students, acountants and chefs not IT engineers. You just can't spend hours on You…

You could also pay ... $9.99 a month for ad-free youtube...

Not available in my country. And I'm not sure any of the aforementioned people would be willing to pay for something an adblocker provides for free.

Re: Websites can now fingerprint a device when multiple browser instances are used

#130

Post by throwaway2048 »

OJFord wrote: post #84
zzzcpan wrote: post #68

Earlier quoted context omitted.

Very few websites, maybe 1 out of 100, most offenders are just rendering content in the browser for some reason. Although even bigger offenders are not individuals, but companies, outright blocking access to client's websites without javascript. So far it's mostly Cloudflare, I think most people using the web without javascript hate them the most, hopefully the trend won't continue.

Cloudflare blocks access to sites behind it to users with JS enabled? Even if there's no JS on the site? 1. Is there anything the site owner can do to turn that off? 2. Is it because they inject some kind of DDoS prevention/tracking thing? This suggests crawlers load JS, which I wouldn't have necessarily assumed.

cloudflare can whitelist crawlers like google. The fact it blocks other automatic robots is more of a feature than a flaw.
Post reply on HN