Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought (2023)

bitestring.com

Post reply on HN
Print view View original

111–120 of 219 posts

Re: Web fingerprinting is worse than I thought (2023)

#111

Post by eagleal »

aniviacat wrote: post #56
troupo wrote: post #20

Earlier quoted context omitted.

Or... You could read GDPR and realize that "cookie dialogs" were never about cookies: https://news.ycombinator.com/item?id=44670345

So does that mean that fingerprint.com, which records your fingerprint without asking for your consent, is operating illegally?

Without permission yes, if it stores it (but that would probably just be client-side).

If it stores it and uses it for matters different than what explicitely advertised when you consented to it, than yes it's even worse.

edit: just saw that's a service they resell. So yeah it is against GDPR

Re: Web fingerprinting is worse than I thought (2023)

#113

Post by Beijinger »

matthewdgreen wrote: post #22

This isn't exactly browser fingerprinting (though it may involve browser fingerprinting.) But the biggest open question I have right now is: what is Meta doing to get around Apple's iOS privacy protections? A couple of years ago, Apple launched App Tracking Transparency as a way to reduce tracking across their iOS app ecosystem. People predicted that this would be devastating for companies like Meta and Snap, and it…

"But companies found another way to uniquely identify you across different sessions and websites without using cookies or other persistent storage. It’s called web fingerprinting. Fingerprinting is a more sophisticated approach to identify a user among millions of others. It works by studying your web browser and hardware configuration. Many websites use a fingerprinting library to generate a unique ID. This library collects data from multiple JavaScript APIs offered by your web browser. For example, websites can see web browser version, number of CPUs on your device, screen size, number of touchpoints, video/audio codecs, operating system and many other details that you would not want a typical news website to see."

My "rugged" browser for regular browsing has plug-ins that randomize all this data.

Re: Web fingerprinting is worse than I thought (2023)

#114

Post by Vinnl »

rinz wrote: post #57
Vinnl wrote: post #27

So, one thing I don't quite get about fingerprinting: > For example, websites can see web browser version, number of CPUs on your device, screen size, number of touchpoints, video/audio codecs, operating system and many other details If, for example, I upgrade my web browser in two weeks (i.e. I get a new version number), doesn't that mean that the site has lost me? Sites like https://coveryourtracks.eff.org seem to…

That is why they probably don't put features that can be easily changed into the final fingerprint hash.

But how many features then remain? For example, I've seen people discuss font size, version numbers, viewport size, etc. Do the remaining features still make a unique identifier?

Re: Web fingerprinting is worse than I thought (2023)

#115

Post by grishka »

Sanzig wrote: post #9

Browser fingerprinting is one of those things that should be outright illegal - it is far more of a threat than tracking cookies ever were. But it hasn't permeated the public consciousness like cookies have, so regulators seem to ignore it.

It can't be made entirely illegal so IMO a better way would be to remove or restrict the APIs that fingerprinting scripts abuse. Make browsers hypertext viewers again!

Re: Web fingerprinting is worse than I thought (2023)

#116

Post by Workaccount2 »

Szpadel wrote: post #95
jeroenhd wrote: post #66

Earlier quoted context omitted.

> What is the downside Just of the top of my head: - Timezone is set to UTC which means any web calendar input becomes confusing at best - Canvases turn into random stripes, which leaves artefacts all over many websites - Some websites outright block you as bots (twitch does this) - Some web APIs break, which can be a pain if you're web apps that rely on them You can add websites to a whitelist to avoid the downsides…

other downsides, cloudflare, PayPal and all kinds of finance related sites will assign high threat level for you and you will make your life miserable for causes ranging from captcha through rejecting your purchases to even blocking you access. and the worst part is that this didn't changed the fingerprint generated by mentioned here site just increases suspect level to 9

The solution I use is to have two browsers, one bolted down and the other mostly untethered.

After a while you develop and intuition for which browser to use depending on what you will be doing.

Re: Web fingerprinting is worse than I thought (2023)

#117

Post by jancsika »

Lord-Jobo wrote: post #58
amelius wrote: post #19

Earlier quoted context omitted.

We need regulators with more balls. And more brains. This privacy theater is becoming very painful to watch.

The core issue is that politically you gain nearly no votes and definitely no money by running with regulation as a pillar of your campaign. In fact, doing so will often times end up bringing donations from relevant industries directly to your opponent. Now, this system of perverse incentive and legal bribery should be fixed at the constitutional level but thats a gigantic can of worms. In the current system there ar…

> The core issue is that politically you gain nearly no votes and definitely no money by running with regulation as a pillar of your campaign.

Proof of Domain Expertise: Name the famous presidential campaign which focused directly on combating "this system of perverse incentive and legal bribery" as its core campaign message.

Edit: Hint: primary, lots of votes, lots of money

MD5 of answer: 1c02462874398d776ff28aeed2d056b1

Re: Web fingerprinting is worse than I thought (2023)

#118

Post by rimbo789 »

OhioMan2943 wrote: post #59
amelius wrote: post #19

Earlier quoted context omitted.

We need regulators with more balls. And more brains. This privacy theater is becoming very painful to watch.

People with ideas are a dying breed. The west doesn't have a fraction of the idealism of the 80s and 90s

Good: that naive idealism led us down some very stupid paths

Re: Web fingerprinting is worse than I thought (2023)

#119

Post by corford »

Vinnl wrote: post #114
rinz wrote: post #57

Earlier quoted context omitted.

That is why they probably don't put features that can be easily changed into the final fingerprint hash.

But how many features then remain? For example, I've seen people discuss font size, version numbers, viewport size, etc. Do the remaining features still make a unique identifier?

In most cases yes. If you upgrade your browser, the only thing that changes is the user agent data. The underlying device remains the same and it is this that leaks a lot of fingerprinting attributes (screen, gfx card, fonts, timezone, language, operating system, battery status, audio setup, bluetooth, installed video codecs, TCP data, IP address if static etc.).

To get a feeling for this, try: https://abrahamjuliot.github.io/creepjs/ ; https://bot.incolumitas.com/ and https://amiunique.org/fingerprint

Combined with super cookies (https://blog.mozilla.org/en/internet-culture/mozilla-explain...), that's a lot of data points to stitch together a high confidence fingerprint.

Although not perfect, FF is much better out of the box at limiting the leaks than chrome.

Re: Web fingerprinting is worse than I thought (2023)

#120

Post by RiverCrochet »

Beijinger wrote: post #113
matthewdgreen wrote: post #22

This isn't exactly browser fingerprinting (though it may involve browser fingerprinting.) But the biggest open question I have right now is: what is Meta doing to get around Apple's iOS privacy protections? A couple of years ago, Apple launched App Tracking Transparency as a way to reduce tracking across their iOS app ecosystem. People predicted that this would be devastating for companies like Meta and Snap, and it…

"But companies found another way to uniquely identify you across different sessions and websites without using cookies or other persistent storage. It’s called web fingerprinting. Fingerprinting is a more sophisticated approach to identify a user among millions of others. It works by studying your web browser and hardware configuration. Many websites use a fingerprinting library to generate a unique ID. This library…

what plugins do you use/recommend?
Post reply on HN