Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

161–170 of 524 posts

Re: Web fingerprinting is worse than I thought

#161

Post by Semaphor »

miggol wrote: post #149
Semaphor wrote: post #109

For anyone who this is news to: This is why I always call the "I don't care about cookies" extension an adtech submarine, because it deceives you into thinking it’s all about cookies, when the permission you give automatically in many cases are about tracking, so using that extension will often have you consent that fingerprinting you and creating a profile based on that is perfectly fine.

To me, the thing is that I can't count on the consent modals to actually do anything. Am I really going to invest time into checking their word? How would I even do that? That's on top of all the time wasted moving sliders or hiting "reject all". For me, the cookie consent modals are the submarines. Why would I outsource the responsibility not to track me to the people with the incentive to track me? IDCAC, Cookie Au…

Obviously this only is relevant for people who think companies care a bit about trying not to flaunt the law, I thought that was a given.

There are also proper consent blockers [0], but they are not as big because everyone tells people to use that please track me shit.

[0]: https://github.com/cavi-au/Consent-O-Matic

Re: Web fingerprinting is worse than I thought

#162

Post by steve1977 »

bigfudge wrote: post #128
justinclift wrote: post #121

Earlier quoted context omitted.

That work was probably done once, years ago. Might need a few string tweaks every few years, which could be automated.

No, because any “RMS” set of headers would only be shared by the small number of nerds who care, fingerprinting us more accurately again.

Just setup a honey pot and use headers from there ;)

Re: Web fingerprinting is worse than I thought

#164

Post by throwaway202302 »

throwaway2056 wrote: post #37

It is interesting that the site can fingerprint individual profiles/dir easily: For example chromium-browser --user-data-dir=/tmp/profile_A chromium-browser --user-data-dir=/tmp/profile_A --incognito chromium-browser --user-data-dir=/tmp/profile_B chromium-browser --user-data-dir=/tmp/profile_B --incognito For each command + its incognito it can detect them as separate profiles. For ultimate privacy one needs to ever…

Did you check amiunique.org as well with these?

Re: Web fingerprinting is worse than I thought

#165

Post by charcircuit »

alkonaut wrote: post #144

What is the use case for these fingerprints when adhering to the GDPR? You can't store them in a DB and use them to target your returning anonymous visitor with products relevant to their last visit. You can't send them to a third party ad service to get more relevant ads. Isn't the whole point of the fingerprint to maintain an pseudonym for your users over some time window? But that requires storing them which would…

To prevent spam. If someone is spamming your site how do you tell if a request is coming from a legitimate user or if it is coming from the spammer. Fingerprints are how you can tell the two apart.

Re: Web fingerprinting is worse than I thought

#166

Post by noduerme »

manuelmoreale wrote: post #122
noduerme wrote: post #98

Earlier quoted context omitted.

right. but using a VPN plus a fresh VM running Ubuntu can mostly do the trick. In a pinch, just keep a few different versions of various browsers around when you plan to surf a site that you don't want associated with you. Or change your screen resolution or turn off your fonts. My point was that fingerprinting is much more practical and useful as a positive form of identity verification than it is as a tracking devi…

Your point might even be that "fingerprinting is much more practical and useful as a positive form of identity verification" but we all know how fingerprinting tech is and will be used: to track users even more and try sell even more crap to them because that's what almost the entire internet is all about. And as for this > using a VPN plus a fresh VM running Ubuntu can mostly do the trick. In a pinch, just keep a fe…

mobile devices present a problem when using fingerprinting for 3FA, and require frequent human intervention. This is a good thing.

Fingerprinting is inherently opaque. That's why it's such a good third level security measure. It's a lot harder to spoof and, if someone tries, a lot easier to isolate the attempt.

Re: Web fingerprinting is worse than I thought

#168

Post by redbell »

Another method for web fingerprinting is called GPU-Fingerprinting [0], codenamed 'DrawnApart', it relies on WebGL to count the number and speed of the execution units in the GPU, measure the time needed to complete vertex renders, handle stall functions, and more stuff..

_______________________

0. https://www.bleepingcomputer.com/news/security/researchers-u...

Re: Web fingerprinting is worse than I thought

#169

Post by throwaway2056 »

throwaway202302 wrote: post #137
throwaway2056 wrote: post #37

It is interesting that the site can fingerprint individual profiles/dir easily: For example chromium-browser --user-data-dir=/tmp/profile_A chromium-browser --user-data-dir=/tmp/profile_A --incognito chromium-browser --user-data-dir=/tmp/profile_B chromium-browser --user-data-dir=/tmp/profile_B --incognito For each command + its incognito it can detect them as separate profiles. For ultimate privacy one needs to ever…

Do these profiles clear their cookies after request? I assume if the service finds a matching cookie, it will prefer it, or at least use as an extra identifier.

Technically one can create this and launch a new profile everytime. It can still detect the device (there are some failures - if I change the screen resolution/dpi). May be after 3 or 4 times, the server may also detect that a certain ip address is trying the same thing.

TEMP_DIR=$(mktemp -d /tmp/chromium.XXXXXXX) ; /usr/bin/chromium-browser --user-data-dir=$TEMP_DIR

At the end as other say they use hardware information + IP + other stuff. It is a lost battle.

Re: Web fingerprinting is worse than I thought

#170

Post by comboy »

hilbert42 wrote: post #69

Ha! I followed the instructions and went to fingerprint.com and it all 'crashed' because I had JavaScript turned off—that's my normal default setting. I have five different browsers on my smartphone and three on the PC all sans JS and none of them are Chrome. Also, normal operation is to automatically delete all cookies at session's end. My smartphone and PCs are de-googleized and firewalled and I never see ads in my…

The more you customize the more unique your session becomes.
Post reply on HN