Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The privacy nightmare of browser fingerprinting

kevinboone.me

Post reply on HN
Print view View original

171–180 of 456 posts

Re: The privacy nightmare of browser fingerprinting

#171

Post by aragonite »

Some time ago I noticed that in Chrome, every time you click "Never translate $language", $language quietly gets added to the Accept-Language header that Chrome sends to every website!

My header ended up looking like a permuted version of this:

  en-US,en;q=0.9,zh-CN;q=0.8,de;q=0.7,ja;q=0.6
I never manually configured any of those extra languages in the browser settings. All I had done was tell Chrome not to translate a few pages on some foreign news sites. Chrome then turned those one-off choices into persistent signals attached to every request.

I'd be surprised if anyone in my vicinity share my exact combination of languages in that exact order, so this seems like a pretty strong fingerprinting vector.

There was even a proposal to reduce this surface area, but it wasn't adopted:

https://github.com/explainers-by-googlers/reduce-accept-lang...

Re: The privacy nightmare of browser fingerprinting

#172

Post by NoahZuniga »

skaul wrote: post #149

Self-plug but if anyone is interested in learning more about how browser fingerprinting works and the different protections browser makers deploy against it, I wrote a longer post about this a few months ago: https://pitg.network/news/techdive/2025/08/15/browser-finger...

its consistent cross site, so you get all the same privacy problems as with 3rd party cookies

Re: The privacy nightmare of browser fingerprinting

#173

Post by hoofedear »

aragonite wrote: post #171

Some time ago I noticed that in Chrome, every time you click "Never translate $language", $language quietly gets added to the Accept-Language header that Chrome sends to every website! My header ended up looking like a permuted version of this: en-US,en;q=0.9,zh-CN;q=0.8,de;q=0.7,ja;q=0.6 I never manually configured any of those extra languages in the browser settings. All I had done was tell Chrome not to translate…

Is Chrome trying to assume that, since you don’t want it to translate those pages/languages, that you can read them/want them in your header? Interesting

Re: The privacy nightmare of browser fingerprinting

#176

Post by tempest_ »

drnick1 wrote: post #66
codedokode wrote: post #65

Earlier quoted context omitted.

Does it hide GPU name that is exposed via WebGL/WebGPU? Does it hide internal IP address, available via WebRTC? > block all third party content It's not going to work, because the fingerprinting script can be (and is often served) from first-party domain. Also imagine if browser didn't provide drawing API for canvas (if you would have to ship your own wasm rendering library). Canvas would become useless for fingerpri…

> Does it hide GPU name that is exposed via WebGL/WebGPU? Does it hide internal IP address, available via WebRTC? My GPU is reported as simply "Mozilla" by https://abrahamjuliot.github.io/creepjs/ . The number of cores is also set to 4 for everyone using this config and/or Tor. > It's not going to work, because the fingerprinting script can be (and is often served) from first-party domain. This may be true, but allow…

I had forgotten I was running Ublock origin / Privacy Badger / Ghostry so I was a bit confused with the results from that site.

I think it is Ghostry that is faking the responses but I still have a pretty unique fingerprint according to https://coveryourtracks.eff.org/kcarter?aat=1

Re: The privacy nightmare of browser fingerprinting

#177

Post by fsflover »

aragonite wrote: post #171

Some time ago I noticed that in Chrome, every time you click "Never translate $language", $language quietly gets added to the Accept-Language header that Chrome sends to every website! My header ended up looking like a permuted version of this: en-US,en;q=0.9,zh-CN;q=0.8,de;q=0.7,ja;q=0.6 I never manually configured any of those extra languages in the browser settings. All I had done was tell Chrome not to translate…

Using Chrome and caring about privacy? I thought, after Google killed uBlock Origin, it had become beyond clear these two things were incompatible, https://news.ycombinator.com/item?id=41905368

Re: The privacy nightmare of browser fingerprinting

#179

Post by o11c »

FireBeyond wrote: post #162
chiefalchemist wrote: post #146

Earlier quoted context omitted.

Allow me a second to play Devil’s Advocate. What if it could? Or should (be able to produce FTE or close income)? In that world, the amount of pointless shite - questing to “go viral” - would be reduced to near zero. That is, if the incentive were more quality, and less quantity, we’d be better off, yes?

So there's an element of truth to that. And there are those who can contribute enough value, have enough audience, etc., that they can "coast" on those 2 blog posts a month and make significant income... ... but that's also not, nor should it be the median. I'm not sure how the economy functions if, say 8h/mo effort generates a median living wage.

Tbf in a post-scarcity society, that should be expected, if historical inertia doesn't prevent it.

Re: The privacy nightmare of browser fingerprinting

#180

Post by pphysch »

baq wrote: post #175

The real problem: if you can’t be identified, the system assumes you’re a bot, untrustworthy, or both and instead of reading content you get to select squares with buses and traffic lights ad infinitum.

Yes, and the conspicuous lack of signal is itself a signal.

"Get me all the individuals in this geo area that have atypical communication patterns..."

Post reply on HN