Ask HN: Refusing all cookies, still targeted by ads. How? • Hacker News Board

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#61

Post by iudqnolq » Wed, Jun 21, 2023, 3:51 PM UTC

adrian_b wrote: post #59

gcoakes wrote: post #22

Earlier quoted context omitted.

My favorite thing from that uniqueness website is that it shows cookies enabled as more common and thus more anonymizing. Not that they wouldn't just fingerprint you using those cookies if it was enabled. The other interesting thing is that it lists my plugins and "do not track" settings. They are both fairly unique. So, someone who attempts to anonimize themselves using plugins or browser features are just highlight…

I have also looked there and what makes me unique is that nobody else has the same list of installed fonts, which is not a surprise for me, because I have bought several commercial high-quality typefaces, while most people have only the fonts installed by the operating system and by popular office suites. Besides the fonts, only 3% of the people recorded in their database have their monitors configured for 30-bit col…

Have you tried Firefox's resistFingerprinting abou:config flag? I don't know if they've implemented those but technically speaking I don't think a vm is necessary.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#62

Post by iudqnolq » Wed, Jun 21, 2023, 3:52 PM UTC

jerf wrote: post #34

comfypotato wrote: post #30

Earlier quoted context omitted.

I’ve been on a team doing fingerprinting research (specifically entropy sources). It’s amusing that you’re 100% unique and browsing HN commenting about fingerprinting. (You’re exactly a demographic that would be unique.) Most people aren’t unique, far from it. Consider iPhone 14 Pro Max users browsing through a 5G connection. All the users in the same cell look exactly the same. If I had to guess, based on what I kno…

I'm on Linux in Brave, so in general that I'm unique didn't surprise me. As you say, that part is expected. Stock Dell laptop, though. Quite a lot of the specific details did surprise me though, to the point of wondering if there's a bug somewhere in their code determining percentages. "Audio context": "sampleRate : 44100, state : suspended" 0.05%? Gyroscope is a green check (I don't even 100% know what that means) a…

I suspect their database is very small and doesn't include many normal people. I also think they aren't taking into account the dimension of time: they say that the latest version of chrome is unusual.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#63

Post by code_duck » Wed, Jun 21, 2023, 3:53 PM UTC

digging wrote: post #33

gcoakes wrote: post #22

Earlier quoted context omitted.

My favorite thing from that uniqueness website is that it shows cookies enabled as more common and thus more anonymizing. Not that they wouldn't just fingerprint you using those cookies if it was enabled. The other interesting thing is that it lists my plugins and "do not track" settings. They are both fairly unique. So, someone who attempts to anonimize themselves using plugins or browser features are just highlight…

Yes, I reduced my plugins count in firefox to slightly decrease my uniqueness. piling on additional tracking prevention addons means getting tracked more.

Simply using Firefox is a problem in that regard. I think most recent number I saw for Firefox usage was 1%.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#64

Post by gorbachev » Wed, Jun 21, 2023, 3:53 PM UTC

gcoakes wrote: post #22

jerf wrote: post #14

Cookies was a simple concept that politicians could glom on to and legislate around, but, yes, they're quite unimportant in the grand scale of things. In the end, you've got two things to work with: Things you can convince the browser to actively identify itself with, and the things you can track regardless. Cookies are in the first category, but they are not alone. You can get things as simple as presenting an entir…

My favorite thing from that uniqueness website is that it shows cookies enabled as more common and thus more anonymizing. Not that they wouldn't just fingerprint you using those cookies if it was enabled. The other interesting thing is that it lists my plugins and "do not track" settings. They are both fairly unique. So, someone who attempts to anonimize themselves using plugins or browser features are just highlight…

My most unique settings were:

list of fonts, list of plugins, media devices (the combo of webcams and microphones my work computer uses)

Great site for understanding what your browser tells about who you are.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#65

Post by hospitalJail » Wed, Jun 21, 2023, 4:03 PM UTC

mabbo wrote: post #12

Fingerprinting. Everything about you that isn't identical to everyone else can be combined to guess who you likely are. Your exact browser version, OS, supported APIs, your IP address, your latency to Google servers... Anything that isn't a complete match to everyone else. You may have a new install, but your IP and latency match your old install. What are the odds you're not the same person? It's all probabilistic.…

Are we sure its Google?

I have been fingerprinted on sites completely unrelated to serving Google Ads.

Wait until the nsfw blackmail comes.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#66

Post by cccbbbaaa » Wed, Jun 21, 2023, 4:05 PM UTC

IanCal wrote: post #29

jerf wrote: post #14

Cookies was a simple concept that politicians could glom on to and legislate around, but, yes, they're quite unimportant in the grand scale of things. In the end, you've got two things to work with: Things you can convince the browser to actively identify itself with, and the things you can track regardless. Cookies are in the first category, but they are not alone. You can get things as simple as presenting an entir…

> Cookies was a simple concept that politicians could glom on to and legislate around, but, yes, they're quite unimportant in the grand scale of things. GDPR absolutely does not rely on specific implementations. Even earlier things I'm pretty sure don't, but GDPR has a much more general coverage. It's extremely important people understand this when they're writing software.

Correct; the actual “cookie law” (ePrivacy 2002/58/CE) talks about “the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user”. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

So local storage is also covered by this law. For other fingerprinting techniques, if you can identify a user, GDPR applies. And for ad purposes, the only realistic legal basis is consent.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#67

Post by daniel_reetz » Wed, Jun 21, 2023, 4:08 PM UTC

leonidasv wrote: post #27

Recently, I discovered that SwiftKey keyboard (I assume) was leaking tracking data from Incognito on Android. I would open an Incognito tab in Chrome, the keyboard would show up in "anonymous" mode, but products I searched for still turned into ads in Facebook/Instagram and AdSense in a couple of minutes. I assume it was SwiftKey since it was the only piece of software that had access to those keywords besides Chrome…

I had a similar experience with the Samsung keyboard. It's seemingly sending data to Facebook/Instagram, and also it had Grammarly embedded in it. I never knowingly consented to having my conversations sent to Grammarly and I was furious about it.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#68

Post by hosh » Wed, Jun 21, 2023, 4:09 PM UTC

The current techniques pushes as many signals as possible to get a device fingerprint, which is then correlated with activity. It uses the pre-LLM machine learning methods to get such a picture.

Sources of these signals are often abuses of protocols used to enhance UX across devices. Examples include:

- Fonts installed (https://gist.github.com/szepeviktor/d28dfcfc889fe61763f3)

- Power saving telemetry (https://developer.mozilla.org/en-US/docs/Web/API/Battery_Sta...)

- Screen size - https://developer.mozilla.org/en-US/docs/Web/API/Screen

- Deep Packet Inspection — not just IP addresses anymore - https://en.m.wikipedia.org/wiki/Deep_packet_inspection

These are all tools meant to help users, but they can be used for collecting signals for targeted ads.

I am sure there are more techniques that are just not publicly talked about.

I have been asked by extended family members about blocking transmissions from devices so they cannot be tracked. There really is an illusion that the device actively listens on the microphone in order to target ads. I told them that, some places don’t need to transmit microphone in order to collect signals for device fingerprinting, and that is scarier.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#69

Post by Thorrez » Wed, Jun 21, 2023, 4:10 PM UTC

robin_reala wrote: post #49

misja111 wrote: post #23

Earlier quoted context omitted.

Under which law is this illegal? I'm only aware of legislation that forces websites to ask for consent for storing cookies.

The ePrivacy Directive (collaqually Cookie Law) doesn’t actual specify only cookies. Section 66 of https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... just talks about third parties storing information on equipment: Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain typ…

That sounds like it applies to cookies and local storage, not all tracking. It doesn't sound like it applies to IP-based or device fingerprint-based tracking.

Re: Ask HN: Refusing all cookies, still targeted by ads. How?

#70

Post by digging » Wed, Jun 21, 2023, 4:15 PM UTC

code_duck wrote: post #63

digging wrote: post #33

Earlier quoted context omitted.

Yes, I reduced my plugins count in firefox to slightly decrease my uniqueness. piling on additional tracking prevention addons means getting tracked more.

Simply using Firefox is a problem in that regard. I think most recent number I saw for Firefox usage was 1%.

Yes, that's true. I think Firefox now tries to hide itself by sending a false user agent? Everything is a trade-off though... using a version of firefox that's closer to stock is probably helping a tiny bit. Or maybe it's not, since Firefox wants people to use plugins (and for some reason, doesn't warn of the dingerprinting danger).