141–150 of 207 posts
I've always assumed I have zero privacy on all social media apps. I am more worried that if the next few major social media apps are all Chinese, then the Communist Party of China will control what the world sees and believes.
Earlier quoted context omitted.
That shouldn't be necessary if the browser didn't report accurate window sizing information
Exposing the window size is needed for many festures. CSS media queries change what's displayed based on the screen size, and pure css can cause effects that can be independently measured (set a css property and the read it with JS and log the result, or have the css load a background image with tracking data embedded in ths url). Webapps that manually position elements using JavaScript use the API as well. It's also…
The only place that needs it, are those JS apps that manually position items.
Measuring text overflow is only possible by the APIs exposed by the CSSOM set [0], which also happens to include the window sizing elements. If we only allowed a subset of that group, all those problems might evaporate or become extremely difficult to successfully use.
Earlier quoted context omitted.
> You missed it, this doesn't require an Allow, because it's not actually accessing the microphone. Presumably, without an allow the API doesn't function at all, so it works perfectly well. When denied access, the API should either not exist, or (more appropriately) just return errors.
> Presumably, without an allow the API doesn't function at all An incorrect presumption. The API works perfectly fine without the need for permissions. This is not a new technique. There's a decent write up here [0]. Permissions are only required to play to the actual device, or record from the actual device. Recording from nothing and not playing is allowed. [0] https://iq.opengenus.org/audio-fingerprinting/
> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…
99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups…
Earlier quoted context omitted.
> Presumably, without an allow the API doesn't function at all An incorrect presumption. The API works perfectly fine without the need for permissions. This is not a new technique. There's a decent write up here [0]. Permissions are only required to play to the actual device, or record from the actual device. Recording from nothing and not playing is allowed. [0] https://iq.opengenus.org/audio-fingerprinting/
We're talking about a theoretical situation where we gate the canvas and audio api behind a permission prompt. My "presumably" is about how that would be theoretically implemented.
That'd require rewriting the API itself.
The GDPR law is complex, but I'm 99% sure that this guy is misinterpreting it here. Sending data to Google, FaceBook and AppsFlyer (and other American companies) is generally legal under GDPR. All three companies are covered under the US-EU Privacy Shield framework: https://www.privacyshield.gov/participant_search Furthermore, sending PII data to a non-EU country is also allowed under GDPR as long as the company in q…
Sandboxing with randomisation is what we need. Like a VM or a container to launch a browser. A canvas fingerprint needs to be different everytime it's calculated.
> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream,…
This is interesting because a cookie with a uuid is probably a better tracker, specially with shared computers. I know cookies can be deleted but expect the majority of their users wouldn’t be deleting cookies or using ad blockers
If you're using Firefox, consider using the CanvasBlocker add-on to reduce the effectiveness of canvas fingerprinting. https://addons.mozilla.org/en-US/firefox/addon/canvasblocker https://github.com/kkapsner/CanvasBlocker
Just enable privacy.resistFingerprinting in about:config, no addons needed
Well done. I think that after this research, journalists will better understanding of how TikTok actually breaks the law and they can cover this story using the information from this article as a reference,.