Unsanctioned Web Tracking

That is, the add-on would discover one-pixel transparent gifs, take note of what query parameters they used, then every time it found that same gif in the future it would issue a GET with randomly selected parameters drawn from the instances of that same gif it had seen in the past.

For extra crispy electronic warfare, that same add-on could issue GET requests at randomly selected intervals. If those intervals were reasonably far apart (say one hour apart for any one gif) then it would not obviously be an attack on the analytics server.

What it would do is to make it completely useless to correlate your visits to different domains.

Follow this up with certification by a main industry body and legal foundation for how companies in the sector should operate with data and we can finally make progress. This is no different than how finance companies or health companies go through audits and such with both process and data handling.

While digital advertising doesn't need to be as onerous and involved as that, the same workflow would help along with clear rules for collecting, analyzing, acting on, purging and securing data as part of consumer wishes and best practices. The next step would be to make sure transacting with a non-certified company carries risks and perhaps fines so that media buyers actually work with good vendors based on merit instead of inside deals.

There should also be technical certifications so that companies can actually prove they know what they're doing and dont just cram megabytes of crap on a page to serve a single ad. It's just too easy to whip up some crappy ad server software these days which ends up bloating sites and ruining trust and user experience.

Unfortunately there are issues with regional laws applying to a global business and the large amount of shady networks headquartered internationally but it's a good first step.

We will never be able to solve fingerprinting without upheaving the entire web platform as we know it. So many web APIs are simply not possible without exposing some UA capability and configuration variance. For example, it is impossible to support WebGL without exposing additional UA variance for fingerprinting.

Computers will always have varying capabilities and configurations, and developers will always need to consider some of them. A world without fingerprinting is a world without the modern web.

It only takes ~30 bits of entropy to uniquely fingerprint all ~3 billion internet users. We already expose this much variance entropy, and it is only going to increase as the web gets new features.

I implore you all to simply give up on fighting fingerprinting. Try to stop worrying about it, as there's almost nothing we can do short of the nuclear option of removing every API that exposes UA variance (which will make the web less useful).

We have already lost, and every new feature makes the hole a little deeper. The hole is already too steep to escape, so accept that you will be tracked by colluding websites whenever you browse the web.

---

The W3C page comes to roughly the same conclusion, but recommends a very drastic and dangerous solution: legislation. I fear that legislating this issue will legitimize only select pre-approved uses of UA variance entropy, and will hinder developer innovation in the long run. I'd rather be fingerprinted than be held back by legislation as to what browser data I'm allowed to read, and in what manner I can act on that data.

Please do not lobby for legislation in order to fix this problem. W3C's proposed solution will most likely only cause more harm than good. I would be deeply upset if "intent to fingerprint" became an actual crime.

One example of something useful that such legislation may make illegal is my navigator.hardwareConcurrency polyfill[1] that runs a timing attack on your CPU (not unlike "The Spy in the Sandbox" linked to in the W3C page) to figure out how many cores you have. This information is actually useful for optimizing heavy multi-threaded webapps, but it is also directly useful for fingerprinting. Future legislation could make it so that using my polyfill, even for benign purposes, counts as "intent to fingerprint".

People do not deserve jail time or fines based on if a tech illiterate jury judges you to harbor "intent to fingerprint". The future will be a very scary place for developers if you actually have to worry about this.

[1]: http://wg.oftn.org/projects/core-estimator/demo/