Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought (2023)

bitestring.com

Post reply on HN
Print view View original

131–140 of 219 posts

Re: Web fingerprinting is worse than I thought (2023)

#131

Post by graemep »

rafram wrote: post #122
Beijinger wrote: post #113

Earlier quoted context omitted.

"But companies found another way to uniquely identify you across different sessions and websites without using cookies or other persistent storage. It’s called web fingerprinting. Fingerprinting is a more sophisticated approach to identify a user among millions of others. It works by studying your web browser and hardware configuration. Many websites use a fingerprinting library to generate a unique ID. This library…

This most likely makes you more identifiable, not less, until a critical mass of people are using a browser with the exact same randomness properties.

I can see this as an argument for avoiding unusual properties, but how can they identify you using random properties? Even if it is just one user doing this how can they match the fingerprints?

Also, its unusual enough that its unlikely they will bother trying.

Re: Web fingerprinting is worse than I thought (2023)

#132

Post by Beijinger »

rafram wrote: post #122
Beijinger wrote: post #113

Earlier quoted context omitted.

"But companies found another way to uniquely identify you across different sessions and websites without using cookies or other persistent storage. It’s called web fingerprinting. Fingerprinting is a more sophisticated approach to identify a user among millions of others. It works by studying your web browser and hardware configuration. Many websites use a fingerprinting library to generate a unique ID. This library…

This most likely makes you more identifiable, not less, until a critical mass of people are using a browser with the exact same randomness properties.

Yes. It makes me unique. Every visit. If I visit the site 10 times, you have 10 unique IDs.

Re: Web fingerprinting is worse than I thought (2023)

#133

Post by AdamN »

metalliqaz wrote: post #85
gherkinnn wrote: post #39

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=44169115 They found sneaky ways on Android. There is no way they aren't trying to do so on iOS. One must always assume malice with anything Meta.

I find it is useful to do so for all corporations.

Not really. Meta is kind of the most corrupt towards users of the big tech companies imho. All companies want to make a profit but Meta has very few scruples.

Re: Web fingerprinting is worse than I thought (2023)

#134

Post by Beijinger »

RiverCrochet wrote: post #120
Beijinger wrote: post #113

Earlier quoted context omitted.

"But companies found another way to uniquely identify you across different sessions and websites without using cookies or other persistent storage. It’s called web fingerprinting. Fingerprinting is a more sophisticated approach to identify a user among millions of others. It works by studying your web browser and hardware configuration. Many websites use a fingerprinting library to generate a unique ID. This library…

what plugins do you use/recommend?

You could try these:

Browser Plugs Fingerprint Privacy Randomizer

Clear URLs

[I don't care about cockies]

Privacy Badger

Random User-Agent Switcher

Temporary Containers

uBlock Origin

Canvas Blocker

NoScript

Font Fingerprint Defender

Not all sites will work with it. For banking and plan ticket booking, I always recommend a separate, but major (e.g. Chrome) browser without any plug-ins.

Re: Web fingerprinting is worse than I thought (2023)

#135

Post by rafram »

Beijinger wrote: post #132
rafram wrote: post #122

Earlier quoted context omitted.

This most likely makes you more identifiable, not less, until a critical mass of people are using a browser with the exact same randomness properties.

Yes. It makes me unique. Every visit. If I visit the site 10 times, you have 10 unique IDs.

And if the site loads 100 iframes, it can figure out the distribution of values that your browser returns, which doesn’t change, and is likely to be close to unique until many people are using the same setup as you.

(Or it can just use properties of the extension like monkey-patched function toString() outputs to identify its users, which, again, narrows it down to a very small group.)

Re: Web fingerprinting is worse than I thought (2023)

#136

Post by homebrewer »

dietr1ch wrote: post #128
gherkinnn wrote: post #39

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=44169115 They found sneaky ways on Android. There is no way they aren't trying to do so on iOS. One must always assume malice with anything Meta.

It always freaked me out that WhatsApp found the SMS code sent to verify the phone number without requiring any action from me. Also, WhatsApp refuses to be usable without giving it Contacts access. I had to use the app, login to the web client, and then I was finally able to type a phone number to start a new chat. I ended up uninstalling it, but there's plenty of people AND business that nowadays mainly or even onl…

If you're on Android, it's an Android API feature, it has nothing to do with WhatsApp and is used by lots of other applications.

https://developers.google.com/identity/sms-retriever/overvie...

Re: Web fingerprinting is worse than I thought (2023)

#137

Post by rafram »

graemep wrote: post #131
rafram wrote: post #122

Earlier quoted context omitted.

This most likely makes you more identifiable, not less, until a critical mass of people are using a browser with the exact same randomness properties.

I can see this as an argument for avoiding unusual properties, but how can they identify you using random properties? Even if it is just one user doing this how can they match the fingerprints? Also, its unusual enough that its unlikely they will bother trying.

The fact that the properties are randomized (and which properties are randomized) identifies the extension that you’re using, and if that extension has like 10 users, that uniquely identifies you across sites.

All of this is overkill anyway unless you actually think you’re up against a determined actor targeting you personally. If you are, they will bother trying.

Re: Web fingerprinting is worse than I thought (2023)

#138

Post by Aurornis »

kennywinker wrote: post #46
patrickmay wrote: post #34

Earlier quoted context omitted.

This is a technical problem, not a legal one. The solution is for browsers to provide users with the ability to limit the information being sent. There's no need for the vast majority of websites to know my OS, number of CPUs, screen or window size, or most of the other fingerprinting metrics.

Making it a technical problem means it’s an arms race forever. Making it a regulation problem, if done right, can simply end the arms race. Not to mention the big players on the users’ team in the technical arms race (google, ms, apple) are also advertising companies. By all means let’s solve it from the technical side - but also lets regulate privacy so everyone gets it not just people paranoid/technical enough to u…

> Making it a technical problem means it’s an arms race forever. Making it a regulation problem, if done right, can simply end the arms race.

“If done right” is doing a lot of work in that sentence.

The way hypothetical regulation is spoken of in abstract terms where it’s perfect, solves everything, and everyone complies perfectly is at odds with how regulation works in the real world.

Re: Web fingerprinting is worse than I thought (2023)

#139

Post by Beijinger »

rafram wrote: post #135
Beijinger wrote: post #132

Earlier quoted context omitted.

Yes. It makes me unique. Every visit. If I visit the site 10 times, you have 10 unique IDs.

And if the site loads 100 iframes, it can figure out the distribution of values that your browser returns, which doesn’t change, and is likely to be close to unique until many people are using the same setup as you. (Or it can just use properties of the extension like monkey-patched function toString() outputs to identify its users, which, again, narrows it down to a very small group.)

Yes! You are unique among the 4162412 fingerprints in our entire dataset.

Yes! You are unique among the 4162649 fingerprints in our entire dataset.

Two visits...

https://amiunique.org/

Re: Web fingerprinting is worse than I thought (2023)

#140

Post by homebrewer »

SpaghettiCthulu wrote: post #125
kytazo wrote: post #93

Earlier quoted context omitted.

My impression would be the opposite. IPv6s get constantly rotated by most ISPs. MACs are always randomized, even when connecting to the same network. At least as far as modern devices go. Am I wrong?

Last I heard, the default on Android was to randomize MAC address across networks but keep them static for each network.

It's actually well documented. What you're describing is the default (mostly), but it's more complicated than that.

Proper randomization can be enabled through the developer settings.

https://source.android.com/docs/core/connect/wifi-mac-random...

Post reply on HN