Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The privacy nightmare of browser fingerprinting

kevinboone.me

Post reply on HN
Print view View original

11–20 of 456 posts

Re: The privacy nightmare of browser fingerprinting

#11

Post by Xelbair »

doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

how about donating to the creator directly? not subscription, just occasional donations whenever people feel like it - content is more widely available, and people who really enjoy it or are well off can actually fund the development

Re: The privacy nightmare of browser fingerprinting

#12

Post by norman784 »

doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

Ads are annoying, but they are ok, what is not ok is collecting data and then selling it, so they can profile you without your consent across different platforms.

Re: The privacy nightmare of browser fingerprinting

#13

Post by balamatom »

>And even though my personal safety and liberty probably aren’t at stake, I don’t want to give any support to the global advertising behemoth, by allowing advertisers access to better information about me.

Giving the surveillance economy access to your habits means making them slightly better informed about everyone. That won't directly endanger you; the SE will just become slightly better informed about how people like you function.

This will enable it to increase the amount of risk faced by some other person that you will never hear of (and vice versa) if any of you is even suspected of endangering the SE, in proportion to the risk to the SE which people like you may hypothetically pose, as quantified by the methods of nepotism-powered pseudoscience.

Re: The privacy nightmare of browser fingerprinting

#14

Post by Xelbair »

dringov wrote: post #3

> Worst of all, perhaps, it can extract a canvas fingerprint. Canvas fingerprinting works by having the browser run code that draws text (perhaps invisibly), and then retrieving the individual pixel data that it drew. This pixel data will differ subtly from one system to another, even drawing the same text, because of subtle differences in the graphics hardware and the operating system. I am concerned about the detai…

>I am concerned about the detail here: does this mean per hardware class (e.g. same model of GPU), or per each individual device?

per combination of hardware(GPU, resolution of display) and software(exact drivers)

Re: The privacy nightmare of browser fingerprinting

#15

Post by prymitive »

doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

> I'm not going to pay $5/month for every blog that I occasionally read

Would you pay per view? Most people (me included) would probably hesitate to say yes, because we’re used to not paying for that. But what if it meant that ad based model is gone and everything you buy is cheaper because the price does not include the cost of running ads?

Re: The privacy nightmare of browser fingerprinting

#16

Post by lobsterthief »

Xelbair wrote: post #11
doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

how about donating to the creator directly? not subscription, just occasional donations whenever people feel like it - content is more widely available, and people who really enjoy it or are well off can actually fund the development

Yes, but you need a scalable and low-friction donation solution. Patreon is the closest but it doesn’t pay the bills for most creators. Maybe some micro-tipping solution, but nobody has made that work yet.

Re: The privacy nightmare of browser fingerprinting

#17

Post by abigail95 »

To extend the closing remarks from a SIGINT perspective, sure some fingerprints are non unique and short lived, have little data. But hang onto it long enough and sure enough some slower data from another band might eventually correlate it with something else.

The last time I looked at this seriously I was trying to find out how much fidelity (if it was possible at all) was necessary to identify someone by their mouse and keyboard input.

It's not just what you do but how you do it.

Re: The privacy nightmare of browser fingerprinting

#18

Post by johnisgood »

peetistaken wrote: post #9
ArcHound wrote: post #2

You missed one of our best guarded secrets: ja3 hashes and their successors. Basically, we can identify browsers based on the supported ciphers in TLS handshake (order matters too AFAIK). Then when your declared identity is not matching the ja3 hash, you're automatically suspicious, if not blocked right away. I think that's the reason for so many Capchas.

I built a nice tool to visualize that: https://tls.peet.ws . Its not that secret anymore though, more and more libraries are starting to allow spoofing for browser tls configs. There isnt really a cat/mouse game here - once you match the latest chrome, there is nothing to fingerprint

I do not think I understand that website. I see that JA3 always gets changed after refresh, but not sure what JA3 is. Why is it always different, and is it good or bad?

Re: The privacy nightmare of browser fingerprinting

#20

Post by lilsoso »

Thanks for the browser recommendations.

I switched to the Mullvad browser. The other recommendation, LibreWolf, provides the following warning on install which scared me away: "Warning: librewolf has been deprecated because it does not pass the macOS Gatekeeper check! It will be disabled on 2026-09-01."

Post reply on HN