Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Websites can now fingerprint a device when multiple browser instances are used

arstechnica.co.uk

Post reply on HN
Print view View original

131–140 of 154 posts

Re: Websites can now fingerprint a device when multiple browser instances are used

#131

Post by dreamcompiler »

rsync wrote: post #124
sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

"Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can." For the fourth or fifth time this year, in response to a thread about browser privacy, I am reminded that what I really want is the ability to jail/chroot a browser. Firing up a full-blown VM for a browser ("banking profile", "twitter profile", "sketchy online store profile") is way too heavyweight and resource i…

Logging in to the Guest account on OSX accomplishes what you want, no?

Re: Websites can now fingerprint a device when multiple browser instances are used

#132

Post by manigandham »

harshreality wrote: post #126
manigandham wrote: post #119

Earlier quoted context omitted.

A standard UUID generated at the OS level and passed through seamlessly through a browser? Yes. Client-side control means that you can turn it off depending on TOR, private-mode, VPN, or whatever else. The technical aspects though would make the web faster and easier to deal with.

So you turn it off, and half the web stops working for you because websites don't want to serve you content unless their ad networks receive your unique hardware id from some mandatory hardware TPM? Then, since a TPM is effectively mandatory once the web can't be used without it, all media content can be DRM'd with less customer push-back. I get that the web is a mess, but is this the best idea anyone can come up wit…

It's just a UUID number. Private browsing mode just generates a new UUID for that session by that browser. Otherwise use the default system UUID. And at any time, you can reset that default system UUID.

Easy and seamless. Why turn it off? If you do, then the networks would just generate their own ID numbers and we're back to the same scenario as today. There's nothing technically wrong with not using it but having a stable API to program against helps a lot and is the main reason this would improve the web. Android and iOS get somewhat close to this, although both are broken and unfinished.

I'm not sure why this requires any hardware TPM or DRM though.

Re: Websites can now fingerprint a device when multiple browser instances are used

#133

Post by thinkling »

dreamcompiler wrote: post #131
rsync wrote: post #124

Earlier quoted context omitted.

"Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can." For the fourth or fifth time this year, in response to a thread about browser privacy, I am reminded that what I really want is the ability to jail/chroot a browser. Firing up a full-blown VM for a browser ("banking profile", "twitter profile", "sketchy online store profile") is way too heavyweight and resource i…

Logging in to the Guest account on OSX accomplishes what you want, no?

Some of the fingerprinting involves not the user-controlled configuration of the machine, but hardware-related aspects like the canvas fingerprinting which looks at pixel level details of a small rendered figure. That combined with IP address will go a long way.

Re: Websites can now fingerprint a device when multiple browser instances are used

#134

Post by thinkling »

dest wrote: post #58
sleepychu wrote: post #20

Earlier quoted context omitted.

I really want to just use my browser though, if it's possible to make it work without confessing all the bits that make my fingerprint.

I think those bits of information are closely tied to your browser functionalities. E.g. resolution, plugins installed. Keeping those bits for you would degrade your browsing experience. Have a look at the parameters that bring the highest amount of fingerprinting bits in your config https://panopticlick.eff.org/ then see if it possible to disable them. I think it's just plain hard.

It's plain hard because the moment the browser blocks some of the fingerprinting techniques, the fingerprint developers will look for something else and move on. Just like spam and ads, it's an arms race.

Re: Websites can now fingerprint a device when multiple browser instances are used

#135

Post by OJFord »

throwaway2048 wrote: post #130
OJFord wrote: post #84

Earlier quoted context omitted.

Cloudflare blocks access to sites behind it to users with JS enabled? Even if there's no JS on the site? 1. Is there anything the site owner can do to turn that off? 2. Is it because they inject some kind of DDoS prevention/tracking thing? This suggests crawlers load JS, which I wouldn't have necessarily assumed.

cloudflare can whitelist crawlers like google. The fact it blocks other automatic robots is more of a feature than a flaw.

Requiring visitors to have JS enabled isn't (a very good) feature.

Re: Websites can now fingerprint a device when multiple browser instances are used

#136

Post by thinkling »

rsync wrote: post #124
sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

"Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can." For the fourth or fifth time this year, in response to a thread about browser privacy, I am reminded that what I really want is the ability to jail/chroot a browser. Firing up a full-blown VM for a browser ("banking profile", "twitter profile", "sketchy online store profile") is way too heavyweight and resource i…

> I am reminded that what I really want is the ability to jail/chroot a browser.

Sounds a bit like local Docker for browsing?

Everyone would download the same Chrome container with the exact same clean config and software rendering so the canvas/WebGL fingerprinting yielded nothing?

Re: Websites can now fingerprint a device when multiple browser instances are used

#137

Post by thinkling »

colept wrote: post #110
na85 wrote: post #12

I note without surprise that most of this tracking leverages JavaScript. When do we say that enough is enough? When do we finally agree that the web was better without JavaScript tracking us everywhere we go, and when do we finally admit that not all ideas (JavaScript) were good ideas? My browser works against me these days. Sad times.

The problem is not Javascript - throwing out JavaScript is like throwing out your utensils because your meal is too sweet. The problem is browsers are made by advertising entities that also leverage these same abilities.

Are you implying that Firefox hasn't solved this problem only because Mozilla takes money from Google for search referrals?

Re: Websites can now fingerprint a device when multiple browser instances are used

#138

Post by x1798DE »

rsync wrote: post #121
rxlim wrote: post #109

I have been browsing the web without Javascript enabled since 2006. The worst is that once in a while you will click on a link to read some text, but arrive at a completely blank page. Many times this can be solved by disabling CSS for that page or using the Google cache, but it's still annoying. I my view requiring Javascript just to display text or pictures is completely brain-dead, web "designers" that think this…

I use ublock origin with chrome. Do I understand correctly that the simple tool to block javascript (noscript) is not available on chrome ? I'd like to disable javascript but the non-noscript recipes seem very complex ...

Try uMatrix. It's available on both Firefox and Chrome, and I actually like it better than NoScript.

Re: Websites can now fingerprint a device when multiple browser instances are used

#139

Post by nojvek »

ptero wrote: post #33
sleepychu wrote: post #2

Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can. When we get to critical mass, the advertising networks will come back with a new deal. I wonder if we can come up with a widely adopt(able|ed) fingerprint that we can mask ourselves with, do any of these identifying bits actually make the web more usable for us?

IMO the hope lies in the fact that many vendors do not depend on privacy invasions in their main business model, e.g. Amazon or Panera will sell me roughly the same stuff regardless of which photos I was staring at yesterday. Selling my info on the side is a profitable add-on, but not strictly required for their main business. Maybe unnecessary tracking will eventually be competed away (this does require that a much…

For a lot of single page applications, javascript makes sense. Less data to load from server on subsequent requests. Your app is a lot richer.

Sure you can disable js, but for the majority the Web would be really broken without js.

As a culture, tracking is everywhere. Disabling js still logs your up, referrer and a bunch of other things.

I do like what uorigin/adblock and other extensions are doing.

Re: Websites can now fingerprint a device when multiple browser instances are used

#140

Post by rsync »

dreamcompiler wrote: post #131
rsync wrote: post #124

Earlier quoted context omitted.

"Resist! Use adblockers, disable cookies which live over the session by default, turn off JS if you can." For the fourth or fifth time this year, in response to a thread about browser privacy, I am reminded that what I really want is the ability to jail/chroot a browser. Firing up a full-blown VM for a browser ("banking profile", "twitter profile", "sketchy online store profile") is way too heavyweight and resource i…

Logging in to the Guest account on OSX accomplishes what you want, no?

"Logging in to the Guest account on OSX accomplishes what you want, no?"

No ...

That is, unless I can easily script the destruction and recreation of the guest account, and automated install and configuration of my chrome setup ...

The idea here is that I set up chrome just how I want it and deploy and redeploy that "container" over and over - destroying it and recreating it after each use. Possibly with multiple instances running simultaneously ...

Post reply on HN