Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The privacy nightmare of browser fingerprinting

kevinboone.me

Post reply on HN
Print view View original

321–330 of 456 posts

Re: The privacy nightmare of browser fingerprinting

#321

Post by ykonstant »

maks198 wrote: post #114
drnick1 wrote: post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

>Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. No. It's LARP. You either don't care or go with Tor Browser and/or commercial antidetect browsers. But you shouldn't care, this issue of fingerprinting is overblown. (really reminds me of AI)

Unfortunately, recently more and more sites fail to work with Tor Browser. Notably, I am informed by people who are not me, Anna's archive and libgen.

Re: The privacy nightmare of browser fingerprinting

#322

Post by ykonstant »

Buttons840 wrote: post #131
jwr wrote: post #124

Earlier quoted context omitted.

> content creators are compensated for their work I have a gut feeling that we've been tricked (by ad companies) into thinking that this is somehow realistic and that casual "content creators" can get meaningful money from us reading their articles. Realistically, while professional content creators can make a living, writing a blog post every once in a while will not provide meaningful income. Instead of trying to "…

You mean I shouldn't make a comfortable living off my valuable HN comments? I was about to consider this comment a good days work. Maybe if I put this comment on my own webpage it would be more valuable?

Best I can do is tree fiddy. Perhaps a little ragebait could give it that extra oomph it needs.

Re: The privacy nightmare of browser fingerprinting

#323

Post by Juliate »

thaumasiotes wrote: post #221
aragonite wrote: post #171

Some time ago I noticed that in Chrome, every time you click "Never translate $language", $language quietly gets added to the Accept-Language header that Chrome sends to every website! My header ended up looking like a permuted version of this: en-US,en;q=0.9,zh-CN;q=0.8,de;q=0.7,ja;q=0.6 I never manually configured any of those extra languages in the browser settings. All I had done was tell Chrome not to translate…

> There was even a proposal to reduce this surface area, but it wasn't adopted: >> Instead of sending a full list of the users' preferred languages from browsers and letting sites figure out which language to use, we propose a language negotiation process in the browser, which means in addition to the Content-Language header, the site also needs to respond with a header indicating all languages it supports Who though…

More and more international audiences websites literally do this themselves, putting a language (sometimes even currency) select box option on top when they detect your settings don’t match best at first the page you are on.

Why not have this negotiation implemented at the browser level?

Re: The privacy nightmare of browser fingerprinting

#324

Post by h33t-l4x0r »

mmooss wrote: post #283
alcide wrote: post #63

Earlier quoted context omitted.

Orion Browser (Kagi Product) prevents fingerprinters from running by default. https://help.kagi.com/orion/privacy-and-security/preventing-...

To ask the obvious question: Doesn't blocking fingerprinters itself fingerprint the browser. (Also, what is a 'fingerprinter'? Isn't it something that runs server-side, out of reach of the browser, based on data collected?)

No it's usually a javascript script that does weird things like drawing strings on an invisible canvas and sends it back to the server. I'm wondering if a browser extension that intercepts those payloads and randomizes them with other people's payloads is what's called for here.

Re: The privacy nightmare of browser fingerprinting

#325

Post by geocar »

doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

> I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator.

This is false: We're the ones who pay the creator, because:

> I'm not going to pay $5/month for every blog that I occasionally read

If that upsets you, please understand it upsets me to, because

> but at the unacceptable price of privacy

I want you to consider a different toothbrush brand, or maybe a hot location for a holiday, and the idea that I am "invading" your privacy in trying to do this is disconcerting.

I understand there are actors who want to use your private personalising data to harm you. I think that is bad, but I am telling you friend, that isn't me.

> I'm not quite sure what the answer is.

Listen, as an insider I am not quite sure what the answer is either, but I'm telling you that content creators need to eat because you have threatened them with capitalism which murders you if you don't participate, and I am the one feeding them and not you.

I think though, it probably takes the form of better laws that prevent people from using personalised data to harm you without public (judicial) review, and I think that is going to require people like you thinking of the outcome that you want, instead of foolishly trying the impossible to conserve your personal privacy.

Re: The privacy nightmare of browser fingerprinting

#326

Post by pteraspidomorph »

0xy wrote: post #139
drnick1 wrote: post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

As someone who utilizes these tools for anti-fraud purposes, Firefox is just as trackable if not more trackable than Chrome (especially because you stand out by using a niche browser in the first place). Firefox exposes a massive amount of identifiable information via canvas, audio device and feature detection methods. There's also active methods to detect private windows, use of the developer console and more.

If you enable privacy.resistFingerprinting in about:config I believe instead of trying to prevent fingerprinting entirely, it's supposed to make things annoying for the fingerprinters by regularly changing the various spoofed factors.

Re: The privacy nightmare of browser fingerprinting

#327

Post by pr3dr49 »

prymitive wrote: post #15
doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

> I'm not going to pay $5/month for every blog that I occasionally read Would you pay per view? Most people (me included) would probably hesitate to say yes, because we’re used to not paying for that. But what if it meant that ad based model is gone and everything you buy is cheaper because the price does not include the cost of running ads?

Charge the provider per view. Charge the sender of that spam email per message delivered. The new internet. Would this work?

Re: The privacy nightmare of browser fingerprinting

#328

Post by imiric »

notatoad wrote: post #157
imiric wrote: post #82

Earlier quoted context omitted.

The fact that advertising is more profitable doesn't mean that the PPV model is not viable. It could certainly be so. Every site could set their own price, or specific tiers, which users can agree to, just like they do with subscription-based content today. The problem is skewed incentives, of course. Advertising is acceptable to most users and easy to integrate, so why should website authors go out of their way to p…

>Every site could set their own price, or specific tiers, which users can agree to, just like they do with subscription-based content today. you're describing the model of a product called blendle, a service which i loved but which totally failed. they failed to attract users, and they failed to attract publishers. this isn't some new idea that nobody had tried. it's been done. and it failed, not just for blendle. pe…

I wasn't aware of Blendle, but I'm not surprised that it failed.

Advertising is ubiquitous on the web. Integrating it into web sites is simple, it works well for generating revenue at scale, and users have been conditioned from every other media industry to accessing content for "free". There is practically no friction for users, save for the degraded user experience, which most people have learned to live with or ignore.

So right off the bat, anyone trying to deploy alternative business models is going against the current of a trillion-dollar industry, and well established consumer expectations.

> readers and publishers both hate it.

Why do you think that is? Is it because the micropayment model is inherently bad, or because implementing it is difficult for website owners, it is annoying to use for users, and ultimately brings little revenue?

What if implementing it were as easy and convenient as advertising is today? What if users had an easy and convenient way to link their payment method into their browser, and from then on it required no maintenance? What if they understood that the web is not "free", but someone on the other end should be paid for their work if they find it valuable? What if this model actually generated significant revenue for publishers? What if all this was simply the way the web operated from the start?

Clearly this model hinges on a bunch of hypotheticals, but hopefully you get the point. There's nothing fundamentally wrong about users paying for consuming content. This is the way business transactions work in most respectable industries. You want something, you pay for it directly. You don't ask a third party to step in between you and the seller, to show you manipulative content that directly benefits them and their associates, while indirectly paying for the thing you actually want to buy. The fact we've accepted this corrupt business model as normal in many facets of life is absolutely insane. Never mind the fact that it's being used to manipulate us into thinking and acting in ways which corrupt democratic processes and cause sociopolitical instability, or that it's abusing our right to privacy and exploiting our data. To hell with all of that.

Re: The privacy nightmare of browser fingerprinting

#329

Post by geocar »

jwr wrote: post #124
doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

> content creators are compensated for their work I have a gut feeling that we've been tricked (by ad companies) into thinking that this is somehow realistic and that casual "content creators" can get meaningful money from us reading their articles. Realistically, while professional content creators can make a living, writing a blog post every once in a while will not provide meaningful income. Instead of trying to "…

> writing a blog post every once in a while will not provide meaningful income

Should people receive meaningful income for writing a blog post every once in a while?

I feel like that's the real question and not everyone agrees on the answer

> we would be better off with free content like on the internet of old

Well as someone who was there you used to need meaningful income to use the Internet of old. Nowadays everyone needs the Internet and it's a pretty big expense in most peoples' budget, and I think that's why so many people are willing to try something at it,

I figure if you just gave everyone meaningful income we could have that again

Re: The privacy nightmare of browser fingerprinting

#330

Post by robertlagrant »

seba_dos1 wrote: post #309
faidit wrote: post #290

Earlier quoted context omitted.

Translating pages is literally the only thing I use Chrome for. The built-in translation works way better than other browsers, even though they also use Google Translate.

Firefox does not use Google Translate and performs the translation locally, which works great for the most common languages out there. For the less common ones you still have to go to Google Translate, but IME it's definitely not worth changing the browser to Chrome over.

Yeah I really like the Firefox translate. A rare win for recent Firefox.
Post reply on HN