Live data from Hacker News

Web fingerprinting is worse than I thought (2023)

bitestring.com

121–130 of 219 posts

Re: Web fingerprinting is worse than I thought (2023)

#121
post #90

Earlier quoted context omitted.

You should share details on your setup.

Nothing special just Firefox and the normal privacy plugins.

It also might be (as it proved in my case) that your address block (including the whole neighborhood from an ISP perspective) includes a compromised device. I discovered one of my neighbors has a compromised device that's sending a couple million spam emails per month, and it tainted the reputation of the entire network address block.

Re: Web fingerprinting is worse than I thought (2023)

#122

This isn't exactly browser fingerprinting (though it may involve browser fingerprinting.) But the biggest open question I have right now is: what is Meta doing to get around Apple's iOS privacy protections? A couple of years ago, Apple launched App Tracking Transparency as a way to reduce tracking across their iOS app ecosystem. People predicted that this would be devastating for companies like Meta and Snap, and it…

"But companies found another way to uniquely identify you across different sessions and websites without using cookies or other persistent storage. It’s called web fingerprinting. Fingerprinting is a more sophisticated approach to identify a user among millions of others. It works by studying your web browser and hardware configuration. Many websites use a fingerprinting library to generate a unique ID. This library…

This most likely makes you more identifiable, not less, until a critical mass of people are using a browser with the exact same randomness properties.

Re: Web fingerprinting is worse than I thought (2023)

#124

This isn't exactly browser fingerprinting (though it may involve browser fingerprinting.) But the biggest open question I have right now is: what is Meta doing to get around Apple's iOS privacy protections? A couple of years ago, Apple launched App Tracking Transparency as a way to reduce tracking across their iOS app ecosystem. People predicted that this would be devastating for companies like Meta and Snap, and it…

probably just ignored them. Aren't those privacy protections basically you saying "pretty please don't track me?"

You're confusing IDFA with Do Not Track.

Re: Web fingerprinting is worse than I thought (2023)

#125
post #93

Earlier quoted context omitted.

IP addresses are quite static. Most phones and laptops come "home" once a day and get attached to the home IP. Do it for long enough and you can household all the other IP v6s, MACs etc. that are untethered.

My impression would be the opposite. IPv6s get constantly rotated by most ISPs. MACs are always randomized, even when connecting to the same network. At least as far as modern devices go. Am I wrong?

Last I heard, the default on Android was to randomize MAC address across networks but keep them static for each network.

Re: Web fingerprinting is worse than I thought (2023)

#126
post #90

Earlier quoted context omitted.

Nothing special just Firefox and the normal privacy plugins.

It also might be (as it proved in my case) that your address block (including the whole neighborhood from an ISP perspective) includes a compromised device. I discovered one of my neighbors has a compromised device that's sending a couple million spam emails per month, and it tainted the reputation of the entire network address block.

Well it happens on both my laptop and my phone, both of which are firefox with a lot of the fingerprinting stuff like useragent knocked out, as well as adblock, etc.

Re: Web fingerprinting is worse than I thought (2023)

#127
post #78
post #42

Earlier quoted context omitted.

I think it's both. It wasn't a problem when browsers were simple content display engines, but now that they are full VMs for application software, they need some of that capability just to function. FWIW, I think this was a mistake, but the genie is out of the bottle. I suppose one technical mitigation might be a permissions dialog when a script requests access to a high-risk API like canvas or WebGL. But that's unfo…

I'm loathe to suggest it, but perhaps LLM's could help here? Once local LLMs are a couple orders of magnitude better and resource efficient, a user agent LLM could decide what features are actually needed for each page.

Until the LLM learned that Cloudflare and friends will bomb you with Captchas until you allow all features again.

Re: Web fingerprinting is worse than I thought (2023)

#128

This isn't exactly browser fingerprinting (though it may involve browser fingerprinting.) But the biggest open question I have right now is: what is Meta doing to get around Apple's iOS privacy protections? A couple of years ago, Apple launched App Tracking Transparency as a way to reduce tracking across their iOS app ecosystem. People predicted that this would be devastating for companies like Meta and Snap, and it…

https://news.ycombinator.com/item?id=44169115 They found sneaky ways on Android. There is no way they aren't trying to do so on iOS. One must always assume malice with anything Meta.

It always freaked me out that WhatsApp found the SMS code sent to verify the phone number without requiring any action from me.

Also, WhatsApp refuses to be usable without giving it Contacts access. I had to use the app, login to the web client, and then I was finally able to type a phone number to start a new chat.

I ended up uninstalling it, but there's plenty of people AND business that nowadays mainly or even only use WhatsApp that it's painful to be on the privacy-first side.

Re: Web fingerprinting is worse than I thought (2023)

#129
post #97

Earlier quoted context omitted.

Apple included?

Yes. Apple is a huge corporation and I feel confident that such an entity would happily harm any person or group of persons in the pursuit of profit.

Are there any examples?

Re: Web fingerprinting is worse than I thought (2023)

#130
There's a company, currently called Tie (meettie.com), formerly known as Revenue Roll, who promises to "de-anonymize your highest value web traffic", which in practice means that they give you an email address for retargeting, for a user who visited your site without ever explicitly providing any identifying info.

The old site had a blog post [0] where they explicitly said they were using fingerprinting, and even called it "privacy-compliant".

I'm sure they're not unique in the service they provide, but that was the first time I'd seen someone brag about browser fingerprinting.

[0] https://web.archive.org/web/20240527125312/https://www.reven...

Post reply on HN