Web fingerprinting is worse than I thought • Hacker News Board

Re: Web fingerprinting is worse than I thought

#141

Post by no_time » Tue, Mar 21, 2023, 9:21 AM UTC

BeefWellington wrote: post #106

Technotroll wrote: post #100

Earlier quoted context omitted.

I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built…

WGET can be pretty trivially told to send custom headers.

Try to do that to a site with CF bot protection cranked up... Not happening without a custom build/custom ssl proxy that mimics the SSL fingerprint of Chrome.

Re: Web fingerprinting is worse than I thought

#142

Post by reportgunner » Tue, Mar 21, 2023, 9:22 AM UTC

Seems like a disguised ad for that fingerprinting service. Resist fingerprinting was already set to true in my Firefox. "Worse than I thought" apparently means "I thought there was no fingerprinting but I found out there is fingerprinting."

Re: Web fingerprinting is worse than I thought

#143

Post by throwaway202302 » Tue, Mar 21, 2023, 9:22 AM UTC

stefncb wrote: post #80

kapsteur wrote: post #31

You can try https://www.amiunique.org/fp to get a view of all params can used to track you

It's interesting that they can narrow me down to less than 0.1% with just my language list (en-US,en,fr,ro). My user agent is practically unique as well, since I'm running an unusual configuration. I've never thought of that as a disadvantage when it comes to tracking, hah.

I observed this too, but I cannot really believe it. For me it finds just german on the iphone. I get 0.88% for it. But if all Apples do it the same, I can hardly believe this provides already such selectivity. The problem with such test sites seems to me that only nerds visit them, and therefore the database is small and biased.

Re: Web fingerprinting is worse than I thought

#144

Post by alkonaut » Tue, Mar 21, 2023, 9:23 AM UTC

What is the use case for these fingerprints when adhering to the GDPR? You can't store them in a DB and use them to target your returning anonymous visitor with products relevant to their last visit. You can't send them to a third party ad service to get more relevant ads. Isn't the whole point of the fingerprint to maintain an pseudonym for your users over some time window? But that requires storing them which would be against the GDPR?

Re: Web fingerprinting is worse than I thought

#145

Post by kalleboo » Tue, Mar 21, 2023, 9:24 AM UTC

twelve40 wrote: post #52

PrimeMcFly wrote: post #43

Earlier quoted context omitted.

GDPR doesn't really apply outside of Europe, despite what the EU might claim.

also, one could just roll it up into a wall of fine print or something, no? who reads these things anyway?

GDPR requires an opt out available, that is just as easy to opt out of as it is to opt in. Fine print disclaimers are illegal.

Re: Web fingerprinting is worse than I thought

#146

Post by TeMPOraL » Tue, Mar 21, 2023, 9:24 AM UTC

meghan_rain wrote: post #130

Semaphor wrote: post #109

For anyone who this is news to: This is why I always call the "I don't care about cookies" extension an adtech submarine, because it deceives you into thinking it’s all about cookies, when the permission you give automatically in many cases are about tracking, so using that extension will often have you consent that fingerprinting you and creating a profile based on that is perfectly fine.

Implying they actually stop tracking when you press "Reject"

They may not, but if you're in/from the EU and press "Reject" and they still track you, they're breaking the law.

Re: Web fingerprinting is worse than I thought

#147

Post by noduerme » Tue, Mar 21, 2023, 9:26 AM UTC

bigfudge wrote: post #120

noduerme wrote: post #98

Earlier quoted context omitted.

right. but using a VPN plus a fresh VM running Ubuntu can mostly do the trick. In a pinch, just keep a few different versions of various browsers around when you plan to surf a site that you don't want associated with you. Or change your screen resolution or turn off your fonts. My point was that fingerprinting is much more practical and useful as a positive form of identity verification than it is as a tracking devi…

one point is that I may not have any specific sites I care about disassociating myself with. I just don’t want an aggregate picture to be built and sold freely. Cliche example/ I want to be able to buy a pregnancy test online but don’t want that information shared and re marketed to me. There is plenty of stuff like this. The impact of privacy violation is small and often boring but on aggregate corrosive to public d…

Look... to this and other (sib) posts I have total sympathy, but much better tracking can be done with cookies and other forms of client side storage. Which the 90% of people do not notice, clear, or care about.

Fingerprinting is by definition a lot more imprecise and vague. It's always going to be an issue if surveillance networks use it to pick out individual users. Whining about that is useless. It's also a valuable security tool and part of the landscape. Do with it what you can.

Re: Web fingerprinting is worse than I thought

#148

Post by Arnt » Tue, Mar 21, 2023, 9:26 AM UTC

hutzlibu wrote: post #102

Arnt wrote: post #96

Earlier quoted context omitted.

A law needs a justification and needs to apply equally to everyone. Writing that about fingerprinting would not be trivial. Some site operators can make a believable argument that they use it in ways that are good for society.

"Some site operators can make a believable argument that they use it in ways that are good for society." Example please

My bank phoned me last summer. I'd authenticated with my usual two factors but a new browser fingerprint, then transferred a large sum to a new recipient. The bank blocked the transfers I did thay day, then phoned me to check whether I'd been phished, suffered a keylogger attack or something.

Re: Web fingerprinting is worse than I thought

#149

Post by miggol » Tue, Mar 21, 2023, 9:26 AM UTC

Semaphor wrote: post #109

For anyone who this is news to: This is why I always call the "I don't care about cookies" extension an adtech submarine, because it deceives you into thinking it’s all about cookies, when the permission you give automatically in many cases are about tracking, so using that extension will often have you consent that fingerprinting you and creating a profile based on that is perfectly fine.

To me, the thing is that I can't count on the consent modals to actually do anything. Am I really going to invest time into checking their word? How would I even do that? That's on top of all the time wasted moving sliders or hiting "reject all".

For me, the cookie consent modals are the submarines. Why would I outsource the responsibility not to track me to the people with the incentive to track me? IDCAC, Cookie Autodelete, and strict tracking protection feels like the better alternative for me.

(From today onwards, I'll add resistFingerprinting=true to that list as well.)

Re: Web fingerprinting is worse than I thought

#150

Post by db48x » Tue, Mar 21, 2023, 9:27 AM UTC

magicalhippo wrote: post #119

db48x wrote: post #104

Earlier quoted context omitted.

The real snag comes from putting text into a canvas. Nobody can agree on what fonts they have installed, and of course there are all kinds of subtle variations from one version of the “same” font to the next, and then everyone has different ideas about hinting, kerning, stem widths, etc, etc, etc. You can fingerprint basically everyone just from that information alone.

Sure fonts and text is hard. But none of that is needed for basic surfing of the web.

In that case you should use Firefox, and turn on “resistFingerprinting”. It’s not perfect, but it’s approaching real privacy.