Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No-JavaScript Fingerprinting

noscriptfingerprint.com

Post reply on HN
Print view View original

61–70 of 107 posts

Re: No-JavaScript Fingerprinting

#61

Post by easrng »

Arnavion wrote: post #46
easrng wrote: post #18

Earlier quoted context omitted.

It works on Fennec, even in private mode. (Fennec is the F-Droid Firefox build.) Do you have any addons? It works with uBlock Origin on desktop, haven't tried mobile.

I'm on a desktop using FF with uBO, both with fairly locked-down configs, and it doesn't work for me. That is, both websites eventually lead to a broken page because of too many redirects, and the URLs in the URL bars of each tab do not contain the same ID. Without digging too deep into what your websites are doing, I did notice that they're trying to set / read cookies, which is a) being blocked by uMatrix in genera…

Oh yeah, it needs 1st party cookies enabled.

Re: No-JavaScript Fingerprinting

#63

Post by zelphirkalt »

dsnr wrote: post #59
khalby786 wrote: post #56

How practical would this method of recognising your fingerprint with CSS be?

This, and also the power of tracking comes from being able to share data/track across domains. So the best way to mitigate this is not to dumb down our browsers but to fight cross domain access to this data. This can be done either by regulation (see GDPR) or technical measures (disabling cross-site scripting, cookies etc)

They can simply exchange the data server side, no?

Re: No-JavaScript Fingerprinting

#64

Post by dsnr »

zelphirkalt wrote: post #63
dsnr wrote: post #59

Earlier quoted context omitted.

This, and also the power of tracking comes from being able to share data/track across domains. So the best way to mitigate this is not to dumb down our browsers but to fight cross domain access to this data. This can be done either by regulation (see GDPR) or technical measures (disabling cross-site scripting, cookies etc)

They can simply exchange the data server side, no?

In theory yes, but they can't use the data for legitimate business while also complying with the regulations.

Re: No-JavaScript Fingerprinting

#65

Post by cookiengineer »

gtsop wrote: post #51
cookiengineer wrote: post #48

Note that among a sea of tracked browsers, the untrackable browser shines like a bright star. Statistical analysis of these values over time (matched with client hints, ETags, If-Modified-Since, and IPs) will make most browsers uniquely identifiable. If the malicious vendor is good, they even correlate the size and order of requests. Because that's unique as well and can identify TOR browsers pretty easily. It's like…

Wait, but the case for TOR isn't to hide you are using TOR, but to blend in with the crowd of TOR users. Does my TOR browser give a different fingerprint than yours?

The IPs of TOR exit nodes are publicly known. I'm not sure people using TOR are aware of how the concept and peer discovery mechanism works.

I mean, at some point you gotta ask yourself why cloudflare shows all TOR users a captcha in a targeted manner :)

Re: No-JavaScript Fingerprinting

#66

Post by twhitmore »

zaik wrote: post #57

I wonder how unique this fingerprint really is. Getting the same fingerprint every time is only half of what makes a good fingerprint. Fennec on Android: cdec914cb91d1a88fbd3e7834b7968c8

Agreed. It's not a "fingerprint" at all as in most cases, it won't be remotely unique.

For example: every user in the world with the same screen size, browser & platform will get the same result. For desktop it's window size rather than screen, but coarsely bucketed.

Thousands or millions will share the same fingerprint. It seems somewhat unrealistic to ascribe much advertisement or tracking value to this.

Re: No-JavaScript Fingerprinting

#67

Post by capableweb »

shp0ngle wrote: post #43

The actual blogpost is here https://fingerprintjs.com/blog/disabling-javascript-wont-sto... basically they use CSS trickery together with server-side stuff. It's pretty clever. @font-face { font-family: 'Helvetica'; src: local('Helvetica'), url('/signal/(token)/fontHelvetica') format('truetype'); } to detect font (which detects OS), and @media (featureX: value1) { .css_probe_42 { background: url('/signal/(token)/feat…

navigator.useragent will still have more precise answer as the amount of people who fake their useragent (or have JS disabled) are less than the amount of Windows/Linux users that have Helvetica (clone/real one) installed.

Re: No-JavaScript Fingerprinting

#68

Post by octoberfranklin »

cookiengineer wrote: post #48

Note that among a sea of tracked browsers, the untrackable browser shines like a bright star. Statistical analysis of these values over time (matched with client hints, ETags, If-Modified-Since, and IPs) will make most browsers uniquely identifiable. If the malicious vendor is good, they even correlate the size and order of requests. Because that's unique as well and can identify TOR browsers pretty easily. It's like…

So what? There are plenty of stars in the sky, and if you are farbling [1] your star shimmers differently every time the surveillance-monster glances skyward.

The comment above regurgitates a misconception frequently found on HN: the assumption that the only defense against fingerprinting is to look exactly identical to everybody else. That is incredibly shortsighted.

[1] https://github.com/brave/brave-browser/issues/12069

Re: No-JavaScript Fingerprinting

#70

Post by niffydroid »

While this is cool and handy, sadly not of any use to me.

According to Uk ICO (Information Commissioner Office) Fingerprinting has to have consent.

https://ico.org.uk/for-organisations/guide-to-pecr/what-are-... "PECR also applies to ‘similar technologies’ like fingerprinting techniques. Therefore, unless an exemption applies, any use of device fingerprinting requires the provision of clear and comprehensive information as well as the consent of the user or subscriber."

Post reply on HN