Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought (2023)

bitestring.com

Post reply on HN
Print view View original

101–110 of 219 posts

Re: Web fingerprinting is worse than I thought (2023)

#101

Post by mystraline »

Bigger question: why isn't Firefox and Tor Browser modifying the JavaScript reporting calls to lie?

All machines would have 16 cores and 32GB ram, running windows 10, and 1 point-touch or mouse. And the resolution would also be fixed as reporting, and only on client would change.

The user-agent should be acting on our behalf. So, why isn't it (Firefox, TBB) utterly lying and acting in our interest? We know why Chrome wouldn't.

Tor also gave up this web fingerprinting fight without even really trying. Editing the JavaScript calls to consistently lie the same way was "too hard". https://m.youtube.com/watch?v=3wlNemFwbwE

Re: Web fingerprinting is worse than I thought (2023)

#102

Post by aorloff »

kytazo wrote: post #93
prasadjoglekar wrote: post #65

Earlier quoted context omitted.

IP addresses are quite static. Most phones and laptops come "home" once a day and get attached to the home IP. Do it for long enough and you can household all the other IP v6s, MACs etc. that are untethered.

My impression would be the opposite. IPv6s get constantly rotated by most ISPs. MACs are always randomized, even when connecting to the same network. At least as far as modern devices go. Am I wrong?

IPv6 isn't the boogeyman for tracking in general, because so much still relies on IPv4

Re: Web fingerprinting is worse than I thought (2023)

#103

Post by oldandboring »

thesuitonym wrote: post #28
anonymousDan wrote: post #10

It's a little unclear to me - does Brave prevent it or not? Edit: some interesting background on what they do here: https://github.com/brave/brave-browser/wiki/Fingerprinting-P...

Does it matter? Brave is adware, so even if they prevent fingerprinting, you're just trading one vendor for another.

I just turn off all the news, ads, crypto wallet, etc. stuff in Brave and it honestly feels just like Chrome but with really good ad-blocking. I'm just a little disappointed to see that it isn't as good at blocking fingerprinting as they claim to be.

Re: Web fingerprinting is worse than I thought (2023)

#104

Post by adzm »

laborcontract wrote: post #69
lucraft wrote: post #61

I tried the demo, fingerprint.com, in: - Safari - Safari private mode - Chrome private mode and it was not able to identify me across those. I then tried - Chrome (normal, non-private mode) and it did identify that as a repeat Chrome visit. Does Safari have better privacy than Chrome?

Safari will assign you a random ip address on a per tab basis if private relay is on. With chrome there is zero plausible deniability as to who you are. You are who you are today, yesterday, and a year before, in every tab, window, incognito or not.

ip addresses are not used in browser fingerprints though

Re: Web fingerprinting is worse than I thought (2023)

#106

Post by vel0city »

kytazo wrote: post #93
prasadjoglekar wrote: post #65

Earlier quoted context omitted.

IP addresses are quite static. Most phones and laptops come "home" once a day and get attached to the home IP. Do it for long enough and you can household all the other IP v6s, MACs etc. that are untethered.

My impression would be the opposite. IPv6s get constantly rotated by most ISPs. MACs are always randomized, even when connecting to the same network. At least as far as modern devices go. Am I wrong?

> IPv6s get constantly rotated by most ISPs

I've had the same prefix for five years now.

And yeah, sure, my device cycles through ephemeral IPv6 addresses often, but always within the same prefix.

Group IPs somewhere between /64s and /56 and you'll essentially get a household identity, at least for a few days to a few years.

Re: Web fingerprinting is worse than I thought (2023)

#107

Post by dylnuge »

Sanzig wrote: post #36
troupo wrote: post #20

Earlier quoted context omitted.

Or... You could read GDPR and realize that "cookie dialogs" were never about cookies: https://news.ycombinator.com/item?id=44670345

TIL, thanks! The usual convention of calling them "cookie dialogues" sure obfuscates that.

Which is a very intentional (and successful) marketing ploy by companies to get users to not care about them. It sounds like a boring technical thing instead of "we need your permission to let massive advertising networks track you around the internet" (consent isn't needed for site functionality; you can use cookies and never mention it if you don't use them for tracking).

Unfortunately this is a challenge with regulation; companies find a way to break the spirit of it as much as possible while following the letter. It's better that companies need consent to track us than not, but consent managers are dark patterns designed to deeply annoy us at the prospect of saying no.

Re: Web fingerprinting is worse than I thought (2023)

#108

Post by eli »

prasadjoglekar wrote: post #65
matthewdgreen wrote: post #22

This isn't exactly browser fingerprinting (though it may involve browser fingerprinting.) But the biggest open question I have right now is: what is Meta doing to get around Apple's iOS privacy protections? A couple of years ago, Apple launched App Tracking Transparency as a way to reduce tracking across their iOS app ecosystem. People predicted that this would be devastating for companies like Meta and Snap, and it…

IP addresses are quite static. Most phones and laptops come "home" once a day and get attached to the home IP. Do it for long enough and you can household all the other IP v6s, MACs etc. that are untethered.

Apple's iCloud Private Relay seems like it should solve this for iOS.

Re: Web fingerprinting is worse than I thought (2023)

#109

Post by piker »

9dev wrote: post #79
piker wrote: post #70

Earlier quoted context omitted.

This comes with some downside because to protect privacy Safari blocks some useful APIs. For example, you can't tell if the user is running Apple silicon or Intel. That means you have to ask them whether they want the Intel or Apple silicon version of a download. This is a non-trivial question for a lot of Mac users. And, sure, you can always publish through the App store but that comes with its own drawbacks.

A price I’ll gladly pay in favor of increased privacy, and I haven’t heard of too many people stumped by the question. In the worst case, you can just try it out.

Yeah for folks who are viewing this site it's obvious, but my target audience doesn't have a clue for example.

Re: Web fingerprinting is worse than I thought (2023)

#110

Post by piker »

dangus wrote: post #88
piker wrote: post #70

Earlier quoted context omitted.

This comes with some downside because to protect privacy Safari blocks some useful APIs. For example, you can't tell if the user is running Apple silicon or Intel. That means you have to ask them whether they want the Intel or Apple silicon version of a download. This is a non-trivial question for a lot of Mac users. And, sure, you can always publish through the App store but that comes with its own drawbacks.

https://developer.apple.com/documentation/apple-silicon/buil...

There are a whole lot of downsides to that approach. Most applications don't do it, although perhaps it does make sense for the general audience like mine. Fortunately, however, a lot of Macs are using Chrome or Firefox that expose this info.
Post reply on HN