Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser Fingerprint Detector

fingerprint.goldenowl.ai

Post reply on HN
Print view View original

51–60 of 70 posts

Re: Browser Fingerprint Detector

#51

Post by godelski »

everdrive wrote: post #21

I'm deeply confused by a lot of the privacy discourse here. There seems to be opposing goals between preventing the fingerprinting mechanisms and just preventing uniqueness. Under the "preventing uniqueness" model, my Linux computer with custom Firefox and no fonts, and no js, etc. is the "most fingerprint-able" because it's the most unique. Whereas grandma on Windows and Chrome is "less unique," and therefore in som…

  > Whereas grandma on Windows and Chrome is "less unique," and therefore in some sense less fingerprint-able.
I got highly unique on FF so I tested Safari on a M2 Air. Still says I'm highly unique. I'm on a university campus internet, there's thousands of people with that exact same setup. I don't think I've ever seen a finger printing site that doesn't say I'm very unique.

I think the problem I have with these types of sites is that they do not really offer advice on how to become less unique and how to protect one's self. It's probably pretty easy to identify machines through things like canvas fingerprinting or through all the other things that the browser actually exposes. Many privacy browsers like Tor or Mullvad will just send no data to those. That makes them "unique" because there's not many people using browsers that do that but it's unique in a way that makes you fungible. There's unique as in "uncommon" but also unique as "differentiable." I can't understand how these sites never make that distinction.

Re: Browser Fingerprint Detector

#52

Post by foresto »

jay-barronville wrote: post #39
elenchev wrote: post #23

Earlier quoted context omitted.

yes but then you become a "suspicious user" and you have to fill 100 CPATCHAs every day at this point browser fingerprinting is a feature, not a bug

To be frank, in my book, relative to inadvertently being fingerprinted and tracked wherever I go, I consider being consistently faced with “let’s confirm you’re not a robot” popups and pages to be a minor inconvenience.

Consider that all those CAPTCHAs are fingerprinting your browser anyway, and probably also your biometrics (through your inputs while solving each CAPTCHA).

Re: Browser Fingerprint Detector

#53

Post by franga2000 »

rsync wrote: post #28
everdrive wrote: post #21

I'm deeply confused by a lot of the privacy discourse here. There seems to be opposing goals between preventing the fingerprinting mechanisms and just preventing uniqueness. Under the "preventing uniqueness" model, my Linux computer with custom Firefox and no fonts, and no js, etc. is the "most fingerprint-able" because it's the most unique. Whereas grandma on Windows and Chrome is "less unique," and therefore in som…

"... so the fact alone that you're unique might potentially not matter if you're _differently_ unique every time you visit the site. Is there a flaw in this line of thinking?" No, you're thinking correctly and the odd discourse that you (and I) see is based on two implicit assumptions: 1) Your threat model is a global observer that notices - and tracks and exploits - your supposed perfect per-request uniqueness. 2) O…

> Unfortunately, I am wary of browser plug-ins and have no good way to build a trust model with the 12 different plug-ins this behavior would require. This is the fault of firefox and the bad decisions they continue to make.

I see so many people paranoid about browser extensions and I really don't see the point. It's like any other software. If you trust the author, install it. If you don't trust the author, check the source code, install it (ideally from source), disable automatic updates and subscribe to the changelog. Is this any different from any other thing you install on your device?

Re: Browser Fingerprint Detector

#54

Post by jszymborski »

ranger_danger wrote: post #3

Still nowhere near as good as creepjs: https://abrahamjuliot.github.io/creepjs/ Doesn't even detect common browser extensions.

One thing I find odd is that, on LibreWolf, a lot of these fingerprint tests are disabled or even worse, randomized. How is it able to generate a stable fingerprint?

Re: Browser Fingerprint Detector

#55

Post by joahnn_s »

everdrive wrote: post #21

I'm deeply confused by a lot of the privacy discourse here. There seems to be opposing goals between preventing the fingerprinting mechanisms and just preventing uniqueness. Under the "preventing uniqueness" model, my Linux computer with custom Firefox and no fonts, and no js, etc. is the "most fingerprint-able" because it's the most unique. Whereas grandma on Windows and Chrome is "less unique," and therefore in som…

This is the paradox: Imagine walking dressed in red in the middle of a crowd dressed in black.

Being unique makes one easily identifiable and requires less effort to correlate one's past activity, while non-unique ones are full of noises and low confidence.

Re: Browser Fingerprint Detector

#56

Post by jszymborski »

malfist wrote: post #33
Bilal_io wrote: post #27

Earlier quoted context omitted.

It depends on the browser you're using, Brave is obfuscating a lot of this info, for me using Brave on Android it shows 100% battery while my actual battery is 62%.

On Firefox on android almost everything except the basics you expect are "unsupported" It has file system free space, but it's wrong.

Sure, but is the fingerprint at the top stable? It is for me despite most of the tests being blocked, spoofed, or randomized.

Re: Browser Fingerprint Detector

#57

Post by ranger_danger »

chipsrafferty wrote: post #45
dylan604 wrote: post #10

Earlier quoted context omitted.

> (you can invite them to not use abusing services though) First, you'd have to define how one can determine what an abusive service is. Is Facebook an abusive service? Is some random website that happens to use FB's SDK an abusive service? How does a normie internet user find out the site they are using has abusive code? Some plugin/extension that has a moderated list that prevents a page from loading and instead lo…

> Is Facebook an abusive service? Yes > Is some random website that happens to use FB's SDK an abusive service? Yes

Now write it down and get a majority of the population to agree with you.

Re: Browser Fingerprint Detector

#58

Post by aerostable_slug »

everdrive wrote: post #47
aerostable_slug wrote: post #43

Earlier quoted context omitted.

I used to work in adtech a long while back. We found that our system could effectively target people who tried not to be targeted. By that I mean we realized a better ROI that without said targeting and click-throughs & conversions were happening for our customers at a nice rate. At the end of the day the object of the exercise is generally less about building a perfect profile of a person and a lot more about gettin…

Can you describe in more detail what sort of techniques were used to target and track people? What sort of privacy mitigations were feckless?

It wasn't so much that privacy mitigations were feckless, it was the fact that people who did things like falsify their User-Agent strings tended to cluster into distinct groups very nicely, and hence it was easy for the targeting algorithms to feed them effective ads, landing pages, etc.

The targeting system went "oh goody, privacy geeks" and was able to very effectively do its job. This is because ad tech systems care less about you as everdrive the named individual with privacy interests and other human aspects, and more about you as some potential consumer of goods.

While it's possible to use the systems to profile people in the sense that a stalker might, that's not really the intent (in the way people like to think of it). I (in the past tense, I don't do adtech anymore) honestly don't care about you, I just want you to buy shit from the people who pay me to sell you their particular flavor of shit. If you hiding your exact name or browser details or whatever makes that more likely (it turns out it did), then hooray! There's no conflict there, where to some there would be (because their assumptions about motive are all wrong).

In terms of what techniques, we found machine learning (stats) way back then did a pretty good job of clustering people based on things browsers return (monitor resolution, OS, etc.) coupled with time of day, search terms, and other things you can't really suppress. A completely contrived example might be pushing expensive pediatric electrolytes to someone with a large-screened Mac looking up baby flu symptoms at 2 am. The "system" did a far better job of real time targeting with this stuff than any human could, and the things it would cluster on were often rather unintuitive.

Re: Browser Fingerprint Detector

#59

Post by runlaszlorun »

aerostable_slug wrote: post #43
everdrive wrote: post #21

I'm deeply confused by a lot of the privacy discourse here. There seems to be opposing goals between preventing the fingerprinting mechanisms and just preventing uniqueness. Under the "preventing uniqueness" model, my Linux computer with custom Firefox and no fonts, and no js, etc. is the "most fingerprint-able" because it's the most unique. Whereas grandma on Windows and Chrome is "less unique," and therefore in som…

I used to work in adtech a long while back. We found that our system could effectively target people who tried not to be targeted. By that I mean we realized a better ROI that without said targeting and click-throughs & conversions were happening for our customers at a nice rate. At the end of the day the object of the exercise is generally less about building a perfect profile of a person and a lot more about gettin…

Informative, thanks for sharing.

Re: Browser Fingerprint Detector

#60

Post by just_human »

Interesting, even with a VPN on mobile safari on an iPhone over a carrier connection I get a uniqueness score of 100%. This is a neat tool, but I'm skeptical of its accuracy. I've run similar tests of uniqueness in the past and this just isn't accurate.
Post reply on HN