Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser Fingerprint Detector

fingerprint.goldenowl.ai

Post reply on HN
Print view View original

21–30 of 70 posts

Re: Browser Fingerprint Detector

#21

Post by everdrive »

I'm deeply confused by a lot of the privacy discourse here. There seems to be opposing goals between preventing the fingerprinting mechanisms and just preventing uniqueness. Under the "preventing uniqueness" model, my Linux computer with custom Firefox and no fonts, and no js, etc. is the "most fingerprint-able" because it's the most unique. Whereas grandma on Windows and Chrome is "less unique," and therefore in some sense less fingerprint-able.

I think there are a few potential problems with this view that I never see discussed:

- Firefox sends some dummy data when making use of privacy.resistFingerprinting, and so you should get a unique fingerprint _every time_ you visit a site, so the fact alone that you're unique might potentially not matter if you're _differently_ unique every time you visit the site. Is there a flaw in this line of thinking?

- My understanding is that the primary utility of browser fingerprinting is for advertising / tracking. In other words, the bulk of the population an advertiser would actually care about would be the huge middle of the bell curve on Chrome using Windows, not the privacy nuts on Linux with a custom browser config. In other words, if "blending in with the crowd" really worked I would think that tracking companies would fail against the most important and largest part of the user pool. If anything, it's more important to target grandma as she will actually click on ads and buy stuff online compulsively.

Can anyone speak to these points? I often feel like the pro-privacy people are just crawling in the dark and not really aware of that real-world tracking is actually occurring vs. what might be possible in a research paper. Maybe I'm just the one that's confused?

Re: Browser Fingerprint Detector

#22

Post by latexr »

dylan604 wrote: post #11
latexr wrote: post #9

Earlier quoted context omitted.

But they are considerably more expensive than more common TLDs, so if you’re getting one you presumably want it specifically and understand the association users will make.

Or it could be that the .com domain was already registered and unavailable, so they started browsing the other TLDs to see where they could find something and felt like .ai is new/hip/trendy

Which we know is not the case here, if you just visit the domain (instead of the submitted subdomain).

https://goldenowl.ai

This is very much an AI-centric website.

Re: Browser Fingerprint Detector

#23

Post by elenchev »

AbraKdabra wrote: post #17

So, what's the solution to all of this? Are there any settings I need to modify to Chrome to not allow certain info to be queried?

yes but then you become a "suspicious user" and you have to fill 100 CPATCHAs every day

at this point browser fingerprinting is a feature, not a bug

Re: Browser Fingerprint Detector

#24

Post by latexr »

kergonath wrote: post #12
latexr wrote: post #9

Earlier quoted context omitted.

But they are considerably more expensive than more common TLDs, so if you’re getting one you presumably want it specifically and understand the association users will make.

Maybe, but there are still many reasons to get one and it does not make anybody less legitimate than AI startups (which was the parent’s point). Besides, they do sell AI-related services.

> and it does not make anybody less legitimate than AI startups (which was the parent’s point)

Was it? I’m interested in what exactly in their post makes you say that. I see confusion, not any accusation regarding legitimacy.

> Besides, they do sell AI-related services.

I know, I checked the main domain. My point was simply that if you spend extra money on a domain which has a strong association with something, it would be expected that whatever you put on it is associated with it (which indeed is the case). Otherwise you’d be wasting money and confusing potential users, which isn’t generally good business practice.

Re: Browser Fingerprint Detector

#25

Post by abhaynayar »

NoboruWataya wrote: post #6

Perhaps I'm missing it but does it explain what aspects of your setup contribute the most to your score or suggest remedial actions? I wasn't that surprised to find that my standard setup is highly fingerprintable (for one, I use Firefox which alone is enough to single me out in a crowd) but I also tried using a vanilla Chromium install via a popular commercial VPN and still got a rating of 100%.

Looking at the JS, in the `calculateUniqueScore` function - it is just checking how many features it was able to detect (it gives a weight to each summing up to 100).

It is not checking how unique you are based off of some data-set it has.

This site also has plenty other such "issues"/"bugs" feels like it was quickly vibe-coded without much care.

Re: Browser Fingerprint Detector

#26

Post by everdrive »

avastel wrote: post #18

I recently wrote about the limits of these kinds of fingerprinting tests. They tend to overly focus on uniqueness without taking into account stability. Moreover sample size is often really small which tends to artificially make a lot of users unique https://blog.castle.io/what-browser-fingerprinting-tests-lik...

This is great, and exactly the kind of nuance I almost never see when this topics come up. Thanks for posting this. Far too often, the pro-privacy crowd is much more _upset_ than they are precise, and to the point of your article are spending extra effort without really accomplishing much.

Re: Browser Fingerprint Detector

#27

Post by Bilal_io »

croemer wrote: post #19
ranger_danger wrote: post #3

Still nowhere near as good as creepjs: https://abrahamjuliot.github.io/creepjs/ Doesn't even detect common browser extensions.

Wow, this blows it completely out of the water. Even detects battery level, free storage, fonts etc

It depends on the browser you're using, Brave is obfuscating a lot of this info, for me using Brave on Android it shows 100% battery while my actual battery is 62%.

Re: Browser Fingerprint Detector

#28

Post by rsync »

everdrive wrote: post #21

I'm deeply confused by a lot of the privacy discourse here. There seems to be opposing goals between preventing the fingerprinting mechanisms and just preventing uniqueness. Under the "preventing uniqueness" model, my Linux computer with custom Firefox and no fonts, and no js, etc. is the "most fingerprint-able" because it's the most unique. Whereas grandma on Windows and Chrome is "less unique," and therefore in som…

"... so the fact alone that you're unique might potentially not matter if you're _differently_ unique every time you visit the site. Is there a flaw in this line of thinking?"

No, you're thinking correctly and the odd discourse that you (and I) see is based on two implicit assumptions:

1) Your threat model is a global observer that notices - and tracks and exploits - your supposed perfect per-request uniqueness.

2) Our browsers do not give us fine grained control over every observable value so if only one variable is randomized per request, that can be discarded and you are still identifiable by (insert collection of resolution and fan speed or mouse jiggle or whatever).

Item (1) I don't care about. I'd prefer per-hit uniqueness to what I have now.

Item (2) is a valid concern and speaks to the blunt and user-hostile tools available to us (browsers, that is) which barely rise to the level of any definition of "user agent" we might imagine.

I repeat: I would much prefer fully randomized per-request variables and I don't care how unique they are relative to other traffic. I care about how unique they are relative to my other requests. Unfortunately, I am wary of browser plug-ins and have no good way to build a trust model with the 12 different plug-ins this behavior would require. This is the fault of firefox and the bad decisions they continue to make.

Re: Browser Fingerprint Detector

#30

Post by gruez »

everdrive wrote: post #21

I'm deeply confused by a lot of the privacy discourse here. There seems to be opposing goals between preventing the fingerprinting mechanisms and just preventing uniqueness. Under the "preventing uniqueness" model, my Linux computer with custom Firefox and no fonts, and no js, etc. is the "most fingerprint-able" because it's the most unique. Whereas grandma on Windows and Chrome is "less unique," and therefore in som…

>- Firefox sends some dummy data when making use of privacy.resistFingerprinting, and so you should get a unique fingerprint _every time_ you visit a site, so the fact alone that you're unique might potentially not matter if you're _differently_ unique every time you visit the site. Is there a flaw in this line of thinking?

Yes, because those randomized results can be detected, and that can be incorporated into your fingerprint. Think of a site that asks you about your birthday. If you put in obviously false answers like "February 31, 1901", a smart implementation could just round those answers off to "lies about birthday" rather than taking them at face value.

>- My understanding is that the primary utility of browser fingerprinting is for advertising / tracking. In other words, the bulk of the population an advertiser would actually care about would be the huge middle of the bell curve on Chrome using Windows, not the privacy nuts on Linux with a custom browser config. In other words, if "blending in with the crowd" really worked I would think that tracking companies would fail against the most important and largest part of the user pool. If anything, it's more important to target grandma as she will actually click on ads and buy stuff online compulsively.

The problem is all this fingerprinting/profiling machinery ends up building a profile on privacy conscious people, even if they're impossible to sell to. That can later be exploited if the data gets leaked, or the government demands it. "I'm not a normie so nobody would want to show ads to me" doesn't address this.

Post reply on HN