Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser Fingerprinting Without JavaScript

fingerprintjs.com

Post reply on HN
Print view View original

41–50 of 124 posts

Re: Browser Fingerprinting Without JavaScript

#41

Post by toastal »

godelski wrote: post #10
iamcurious wrote: post #4

I used to think that privacy was a technical problem, then I thought it was a legal problem, now I think it is a reaction problem. We are not disgusted enough. I do wonder if that will change.

I thought Smarter Every Day's analogy to carbon emissions was great for this exact reason. It's hard to feel like it is a problem because it is difficult to see the pollutant and small amounts don't cause major problems. But when that pollutant reaches a critical mass then it becomes a very large problem for everyone, not just a particular individual.

Though I think it's fishy he's trying to get VC funding for a privacy product that does similar stuff to current FOSS projects. How on Earth do you expect to make profit for investors on a privacy product?

Re: Browser Fingerprinting Without JavaScript

#42

Post by saxonww »

EMM_386 wrote: post #31

> The demo should show the same fingerprint I get a different fingerprint every time on refresh. Brave Version 1.31.87 Chromium: 95.0.4638.54 (Official Build) (64-bit) with uBlock Origin.

I don't, but it seems to cache the fingerprint so a normal refresh doesn't regenerate. If I use their 'start over' control or just shift-refresh, I do get a different fingerprint every time.

Firefox, Ubuntu, and a handful of common plugins.

Re: Browser Fingerprinting Without JavaScript

#43

Post by zarzavat »

DenseComet wrote: post #40
zarzavat wrote: post #39

Earlier quoted context omitted.

It should ask permission after N fonts.

More permissions are not the right answer. Too many and users get conditioned to blindly clicking accept.

Users do not always click yes reflexively. I filled in a form recently that asked "Do you consent for us to send you marketing emails" (default unchecked), and I laughed because I could not imagine why they expended engineering effort to ask that question and store the answer when almost nobody will check it.

It depends how the question is framed and presented. If the permission prompt is modal and the user believes that they will be prevented from accessing the application unless they click Yes, then they will always click Yes.

But if the website loads first and then they are asked for permission to load some additional feature, they are much less likely to reflexively click Yes rather than to press X to close the non-modal.

Re: Browser Fingerprinting Without JavaScript

#44

Post by simonw »

zarzavat wrote: post #43
DenseComet wrote: post #40

Earlier quoted context omitted.

More permissions are not the right answer. Too many and users get conditioned to blindly clicking accept.

Users do not always click yes reflexively. I filled in a form recently that asked "Do you consent for us to send you marketing emails" (default unchecked), and I laughed because I could not imagine why they expended engineering effort to ask that question and store the answer when almost nobody will check it. It depends how the question is framed and presented. If the permission prompt is modal and the user believes…

You don't sound like a very typical user.

Re: Browser Fingerprinting Without JavaScript

#45

Post by ranger_danger »

tyingq wrote: post #27
ranger_danger wrote: post #18

Earlier quoted context omitted.

Can you elaborate on this?

Sure. Etag stands for "Entity Tag", and it's a header value that comes from the web server and related to caching. A normal implementation would use something like a CRC or MD5 hash of the requested page/image/etc to calculate a tag, and send it to the web browser. The browser stores it for later. The browser, if it's asked to retrieve that thing (image, page, etc) later, sends the "etag" back in the request via a If…

What if I am using an extension that blocks/ignores etag headers?

And what if my browser sends requests via multiple proxies? Would the etag likely be different then as well?

Re: Browser Fingerprinting Without JavaScript

#46

Post by tyingq »

ranger_danger wrote: post #45
tyingq wrote: post #27

Earlier quoted context omitted.

Sure. Etag stands for "Entity Tag", and it's a header value that comes from the web server and related to caching. A normal implementation would use something like a CRC or MD5 hash of the requested page/image/etc to calculate a tag, and send it to the web browser. The browser stores it for later. The browser, if it's asked to retrieve that thing (image, page, etc) later, sends the "etag" back in the request via a If…

What if I am using an extension that blocks/ignores etag headers? And what if my browser sends requests via multiple proxies? Would the etag likely be different then as well?

You can get around it, yes. But it's stealthy in the sense that nobody thinks about it being (ab)used this way.

Re: Browser Fingerprinting Without JavaScript

#47

Post by kevingadd »

onion2k wrote: post #11

Browsers should limit every webpage to displaying a maximum of two fonts, and should silently ignore any font face rules after the first two. Maybe three if you're feeling generous. With variable fonts available in every browser it wouldn't impact typography much. It would stop this sort of privacy attack, and it'd have the additional benefit of making the web look a lot nicer.

Different languages often require you to use different fonts, there are very few fonts that contain characters for all languages. Ranges using specific languages are tagged with the 'lang' attribute so the browser can use the appropriate font. If you aren't allowed to include any font face rules you lose the ability to handle multiple languages (unless all the languages you care about use codepoints below 255).

Italic and Bold are also separate fonts (albeit in the same family).

Re: Browser Fingerprinting Without JavaScript

#49

Post by robbedpeter »

anonypla wrote: post #29
southerntofu wrote: post #21

Being a fervent Tor Browser user, i just tried with it and of course the fingerprinting failed. Several copies of it give me the same fingerprints: e56952dba176a47af3c051b626b64ff3 (Safer mode) 632e305f8a939e5ba6afd24eced586f0 (Safest mode) That's because the Tor Browser, contrary to urban legend, is not just a browser that routes trafic through the tor network, but a firefox reworked (most of which is being upstream…

The "Safest" mode gives me different fingerprints each time. The "Standard" and "Safer" modes give the same fingerprint tho.

So how crippled does regular web browsing become using Tor safest mode?

I'm tempted to give it a whirl for a week.

Root my phone, flash something secure, leave VPN always on, and limit web browsing to Tor to get a feel for how bad or good it is.

The self inflicted contortions developers go through to justify the need to spy drive me crazy. Modern devices and bandwidth are more than sufficient to handle a vast majority of applications, but everything has to be cloud based rent-seeking-as-a-service.

Post reply on HN