The privacy nightmare of browser fingerprinting • Hacker News Board

Re: The privacy nightmare of browser fingerprinting

#111

Post by txrx0000 » Sat, Nov 22, 2025, 7:15 PM UTC

doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

We could normalize paying content creators directly. So instead of paywalls or ads, we get "donate" buttons.

Re: The privacy nightmare of browser fingerprinting

#112

Post by charlie-83 » Sat, Nov 22, 2025, 7:15 PM UTC

btilly wrote: post #51

I don't mind advertisers knowing more about me. If they can display ads that are relevant to me, this is a better experience on both sides. Unfortunately there is no way to tell advertisers, "No, I'm not interested in your product. I never will be. Don't waste your money." The top offender is Hims. No, I don't have hair loss. I don't want hair loss supplements. I also don't have ED, and I object strongly to ads for t…

Relevant/personalised ads doesn't mean ads that benefit you. It's means ads that are better able to extract money from you.

It means that, when you need a new dishwasher, you will never see the actual best dishwasher for you, only dishwashers that are a bit more expensive than you actually need but you will end up buying one of them anyways.

It means that you are more likely to see products you would impulse buy just after you get your paycheck. Or slightly inflated prices on things you usually buy.

It means ads designed to take advantage of addictions to sugar, alcohol, gambling etc

Finding stuff you actually want to buy has never been easier, you can find hundreds of reviews and comparisons instantly. People who opt into personalised ads don't end up being more savvy online shoppers, they just end up buying more junk.

Re: The privacy nightmare of browser fingerprinting

#113

Post by fragmede » Sat, Nov 22, 2025, 7:15 PM UTC

imiric wrote: post #70

prymitive wrote: post #15

Earlier quoted context omitted.

> I'm not going to pay $5/month for every blog that I occasionally read Would you pay per view? Most people (me included) would probably hesitate to say yes, because we’re used to not paying for that. But what if it meant that ad based model is gone and everything you buy is cheaper because the price does not include the cost of running ads?

Brave Inc. gets a lot of flack, some warranted, but their Basic Attention Token allows for exactly this. Users can add credit to their wallet by either consuming privacy-friendly ads or topping it up manually, which then gets distributed to the sites they visit in the proportion they choose, transparently in the background while they browse. It is a shame that this feature gets lumped together with claims of crypto s…

It's frustrating that humans are stoichastic parrots and the minute you mention crypto they go into conniptions because the rails are basically there. It's not user friendly, but it's possible to build a system where you transfer $0.05 cents of crypto to someone as you scroll down a web page using a special browser.

Re: The privacy nightmare of browser fingerprinting

#114

Post by maks198 » Sat, Nov 22, 2025, 7:16 PM UTC

drnick1 wrote: post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

>Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy.

No. It's LARP. You either don't care or go with Tor Browser and/or commercial antidetect browsers.

But you shouldn't care, this issue of fingerprinting is overblown. (really reminds me of AI)

Re: The privacy nightmare of browser fingerprinting

#115

Post by gruez » Sat, Nov 22, 2025, 7:16 PM UTC

stego-tech wrote: post #102

Sandboxing in containers and manually exempting specific security tokens is arguably one of the better steps we can take in the immediate term, as are random agent strings and returning fake data for common prompts. Of course that only works in the immediate, because this, like advertising in general, is an arms race at the moment. This feels like a regulatory question, not a technical one. We've repeatedly proven th…

>We've repeatedly proven that with math and code alone, we can fingerprint and identify almost every unique person on the planet, given enough data points.

I'm very skeptical of this claim, especially in practice. Contrary to what many fingerprinting sites claim ("you're unique of everyone we fingerprinted!!"), browser fingerprinting can't possibly uniquely identify someone. Smartphones are pretty locked down and there's very few customization options that allow for fingerprinting. In the US Apple has around 50% market share in the US, and there are 30 iPhones models that are still in support. That means if you're an iPhone user in a city of 1 million, there are, on average, approximately 16.6k (500k / 30) other people with the same exact model of iPhone (and therefore fingerprint) as you. As long as you don't do anything to stick out (eg. living in the US but setting Denmark as your locale), you'll be reasonably anonymous.

Re: The privacy nightmare of browser fingerprinting

#116

Post by ArcHound » Sat, Nov 22, 2025, 7:18 PM UTC

mike_d wrote: post #48

ArcHound wrote: post #2

You missed one of our best guarded secrets: ja3 hashes and their successors. Basically, we can identify browsers based on the supported ciphers in TLS handshake (order matters too AFAIK). Then when your declared identity is not matching the ja3 hash, you're automatically suspicious, if not blocked right away. I think that's the reason for so many Capchas.

JA3/JA4 are useless now. At best they identify the family of browser, and spoofing it is table stakes for bad actors. https://github.com/lwthiker/curl-impersonate

Slight correction: Spoofing it is table stakes for ever so slightly capable actors.

These will still help against the masses of dumb actors flooding your stuff.

Re: The privacy nightmare of browser fingerprinting

#117

Post by NewsaHackO » Sat, Nov 22, 2025, 7:19 PM UTC

gruez wrote: post #101

gweinberg wrote: post #85

For a fingerprint to be useful it must not only be unique but also persistent. If I have a process that randomly installs and deletes wacky fonts, I'm unique at any given time, but the me of today can't be linked to the me of tomorrow, right?

>If I have a process that randomly installs and deletes wacky fonts, I'm unique at any given time, but the me of today can't be linked to the me of tomorrow, right? See: https://xkcd.com/1105/ Services with a large enough fingerprinting database can filter out implausible values and flag you as faking your fingerprint, which is itself fingerprintable.

But they still wouldn't be able to confidently connect his different fingerprints to the same individual, just that he is one of a group of individuals who fake their fingerprints.

Re: The privacy nightmare of browser fingerprinting

#118

Post by cruffle_duffle » Sat, Nov 22, 2025, 7:21 PM UTC

charlie-83 wrote: post #105

cruffle_duffle wrote: post #78

Earlier quoted context omitted.

Why would I trust any software that doesn’t pass the gatekeeper test? Even if it claims to be “open source” with links to some code repo there is no guarantee the binary blob you are running was built using only that code and nothing else. Sure even with the gatekeeper test you can’t be sure it’s built against only the claimed code but it does guarantee : 1) the binary hasn’t been modified since it was signed 2) the…

You could always just build it yourself from source if you are concerned.

Sure but most people aren’t going to do that. It automatically limits the audience willing to use the software.

This isn’t an easy problem! I’d argue signed binaries are good for everybody… They are good for the end user because it provides some assurance the thing hasn’t been tampered with and provides at least some form of audit history. It’s good for the developers too! It ensures that users are running the binaries the dev intended them to run! It’s good for the platform maker as it reduces the attack surface…

The problem is… getting the keys to sign binaries requires getting a private key! And not just any key but one that been blessed somehow by something that all parties can trust. And trust isn’t a technical problem but a meatspace human some. Apple solves it by requiring the dev to cough up 100USD and probably some other personal information. I have no idea how Ubuntu does it or Microsoft…. But something, somewhere has to bless that signing key.

Re: The privacy nightmare of browser fingerprinting

#119

Post by Retric » Sat, Nov 22, 2025, 7:22 PM UTC

Vinnl wrote: post #87

kasabali wrote: post #27

Earlier quoted context omitted.

> I'm not quite sure what the answer is. It's very simple, it's what they've been doing in print media for centuries: contextual advertising.

Print media did also include e.g. coupons with discount codes with which advertisers could learn which lead led through a sale.

Without any transactions or user tracking it’s difficult to separate ‘legitimate’ content farms from those using bot farms to boost their page views.

Print media was also trying to guarantee their audience was an actual person by charging nominal fees, the difference was how much info required to do so.

Re: The privacy nightmare of browser fingerprinting

#120

Post by hedora » Sat, Nov 22, 2025, 7:22 PM UTC

kasabali wrote: post #27

doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

> I'm not quite sure what the answer is. It's very simple, it's what they've been doing in print media for centuries: contextual advertising.

The main “problem” with contextualized advertising is that the people producing the content get a larger share of the ad spend.

Targeted ads concentrate control over the market into a few players, which can do things like acquire competitors or run them out of business with loss leaders.

With AI, the supply of ad real estate will go to infinity, so the only thing that will matter is the quality of the places the ads run.

This would be a good time to ban targeted advertising, or for the content producers to form a cartel that only purchases contextual ads.

That cartel will probably be even worse than what we have now, since it’s going to be 2-3 mega conglomerates like Disney, and they already have handed editorial control over to the White House.

Hopefully the invisible hand of capitalism will somehow fix this.