Earlier quoted context omitted.
Yes. Apple is a huge corporation and I feel confident that such an entity would happily harm any person or group of persons in the pursuit of profit.
Are there any examples?
Web fingerprinting is worse than I thought (2023)
161–170 of 219 posts
Re: Web fingerprinting is worse than I thought (2023)
#162There's a company, currently called Tie (meettie.com), formerly known as Revenue Roll, who promises to "de-anonymize your highest value web traffic", which in practice means that they give you an email address for retargeting, for a user who visited your site without ever explicitly providing any identifying info. The old site had a blog post [0] where they explicitly said they were using fingerprinting, and even cal…
I notice they have an Opt-Out form here: https://app.termly.io/dsar/ee5088c4-5eb2-475c-a9ea-9376f1b70...
It's pretty hilarious legalese and tells you nothing about what it even achieves. Maybe makes you a Very Important Marketing Target.
One thing that struck me was the 'Under penalty of perjury, I declare all the above information to be true and accurate'. Shame they seem to require validating request by email. It'd be fun to take a PII breach and throw all the emails you find at 'em.
Re: Web fingerprinting is worse than I thought (2023)
#163Earlier quoted context omitted.
You should share details on your setup.
(Different commenter, same experience) Firefox, VPN, UBlock Origin, Privacy Badger, and UMatrix plugin to block cookies and javascript by default. (You can easily whitelist first and/or third-party cookies and/or JS on sites of your choice.) Actually, usually librewolf instead of firefox, but not a big difference I suspect.
When I test with Librewolf (anti-fingerprinting enabled) and uBlock Origin as only addon installed, it manages to retain my fingerprint across sessions. Perhaps it's my static IP.
Re: Web fingerprinting is worse than I thought (2023)
#164Earlier quoted context omitted.
Yeah, you get the exact same results in two separate incognito sessions in stock Chrome. They don't immediately add your fingerprint to their database. (And that site isn't using the state of the art in fingerprinting - check https://fingerprint.com/ for a slightly better indicator.)
https://fingerprint.com/demo/ Yes, fingerprint.com realizes that I am the same visitor. But ONLY IF I access it from the same IP address. This is impressive, but in the end not so much. They claim VPN does not matter for them. It does. Probably one of the last things that makes my browser identifiable.
Haha, that failed spectacularly.
On stock Mac OS Safari (no plugins, no hardened config), I did what they asked and visited their site in incognito mode via a VPN. It gave me a different id, with a message gleefully announcing that "your ID is the same when you're in incognito mode!" It even showed me some supposed visit from a minute ago.
Jesus what a scam.
Re: Web fingerprinting is worse than I thought (2023)
#165There's a company, currently called Tie (meettie.com), formerly known as Revenue Roll, who promises to "de-anonymize your highest value web traffic", which in practice means that they give you an email address for retargeting, for a user who visited your site without ever explicitly providing any identifying info. The old site had a blog post [0] where they explicitly said they were using fingerprinting, and even cal…
Why aren't privacy orgs trying these services.
Re: Web fingerprinting is worse than I thought (2023)
#166Browser fingerprinting is one of those things that should be outright illegal - it is far more of a threat than tracking cookies ever were. But it hasn't permeated the public consciousness like cookies have, so regulators seem to ignore it.
It can't be made entirely illegal so IMO a better way would be to remove or restrict the APIs that fingerprinting scripts abuse. Make browsers hypertext viewers again!
Why can't it be made illegal? And from the article, a very succinct explanation as to why browsers will never be fingerprint-resilient:
> Chromium (Chrome) is built by Google, an advertisement company which tracks its users for showing relevant ads. So naturally it doesn’t have any inbuilt protection against fingerprinting.
Re: Web fingerprinting is worse than I thought (2023)
#167Earlier quoted context omitted.
sure, if they ask you can we track you and you say no they should not fingerprint.
How would you ever find out/enforce this though? With cookies, you can examine the local cookie storage but with fingerprinting everything happens server-side (as I understand).
>How would you ever find out/enforce this though?
programmers really have a hard time understanding the law, how does any violation of the law ever get found out, or any law enforced? Generally someone says hey this company is doing X, and then the government gets a warrant to say let us look through your stuff to find out if you are doing X.
As a normal rule most companies work something like:
"excuse me, we have reports you are doing X"
"Not exactly, this is what we are doing - we call it X1, which is why we are totally ok under the rules governing X. Our legal dept. can totally explain"
Court case instantiates.
If the company is doing something that they will actually say "no we are doing nothing of the sort!" then it is likely someone in the company will at some time say "hey they are really doing X" and then the warrant thing I discussed first happens.
At any rate finding out enforcing things can happen without perfect technical access to everything, that's how justice systems have managed to work for centuries.
Re: Web fingerprinting is worse than I thought (2023)
#168Earlier quoted context omitted.
How would you ever find out/enforce this though? With cookies, you can examine the local cookie storage but with fingerprinting everything happens server-side (as I understand).
> with fingerprinting everything happens server-side (as I understand). It happens client-side. Browser headers sent through for requests aren't enough for fingerprinting.
sure but anyway the data collection is not that important, it is actually the data storage and data deletion parts that are going to make or break a GDPR case.
on edit: better clarify, I mean if you are fingerprinting, but not storing in such a way that you can actually identify someone (although not sure why you would use fingerprinting then) then I don't think there is a case.
Re: Web fingerprinting is worse than I thought (2023)
#169This isn't exactly browser fingerprinting (though it may involve browser fingerprinting.) But the biggest open question I have right now is: what is Meta doing to get around Apple's iOS privacy protections? A couple of years ago, Apple launched App Tracking Transparency as a way to reduce tracking across their iOS app ecosystem. People predicted that this would be devastating for companies like Meta and Snap, and it…
> what is Meta doing to get around Apple's iOS privacy protections? Money always finds a way. Everyone thought the changes made a few years ago would hurt Meta but they make $70 billion net profit. At a minimum, they only need a good relationship with advertisers, and a (sort of measurable) increase from a campaign. Also ads are different now. One address may see the same five seconds of an ad hundreds of times. That…
Let’s pretend that the Apple restriction is 100% effective- how much impact would you expect to Meta’s bottom line? Sure, Meta would love to know every spicy detail of your life, but just following in app activity probably reveals more than enough to sway advertisers.
Meta hoovers up every detail because they can. Knowing that user #7227724 spends 23 minutes a day in Spotify might make the ad targeting 0.4% more accurate, but does not seem like the lynchpin for the entire business.
Re: Web fingerprinting is worse than I thought (2023)
#170This isn't exactly browser fingerprinting (though it may involve browser fingerprinting.) But the biggest open question I have right now is: what is Meta doing to get around Apple's iOS privacy protections? A couple of years ago, Apple launched App Tracking Transparency as a way to reduce tracking across their iOS app ecosystem. People predicted that this would be devastating for companies like Meta and Snap, and it…
IP addresses are quite static. Most phones and laptops come "home" once a day and get attached to the home IP. Do it for long enough and you can household all the other IP v6s, MACs etc. that are untethered.
>MACs etc. that are untethered.
MAC addresses don't leave the local network, so it's not relevant to web tracking. Moreover it's randomized by default on ios/android so the tracking potential is limited.