Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought (2023)

bitestring.com

Post reply on HN
Print view View original

181–190 of 219 posts

Re: Web fingerprinting is worse than I thought (2023)

#181

Post by pavel_lishin »

dietr1ch wrote: post #128
gherkinnn wrote: post #39

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=44169115 They found sneaky ways on Android. There is no way they aren't trying to do so on iOS. One must always assume malice with anything Meta.

It always freaked me out that WhatsApp found the SMS code sent to verify the phone number without requiring any action from me. Also, WhatsApp refuses to be usable without giving it Contacts access. I had to use the app, login to the web client, and then I was finally able to type a phone number to start a new chat. I ended up uninstalling it, but there's plenty of people AND business that nowadays mainly or even onl…

I share your woes regarding WhatsApp; my family overseas uses it, so I have to use it when visiting them, and I also had to do the weird workaround of creating a Whatsapp URL with the destination phone number, and then opening it in the browser, and then having it redirect me to the app.

Re: Web fingerprinting is worse than I thought (2023)

#182

Post by ornornor »

dietr1ch wrote: post #128
gherkinnn wrote: post #39

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=44169115 They found sneaky ways on Android. There is no way they aren't trying to do so on iOS. One must always assume malice with anything Meta.

It always freaked me out that WhatsApp found the SMS code sent to verify the phone number without requiring any action from me. Also, WhatsApp refuses to be usable without giving it Contacts access. I had to use the app, login to the web client, and then I was finally able to type a phone number to start a new chat. I ended up uninstalling it, but there's plenty of people AND business that nowadays mainly or even onl…

On iOS this is an OS facility and works for all apps (also for email codes if using apple mail on the iPhone)

For WhatsApp, WhatsApp business lets you easily start conversations just by entering any phone number. But yeah it’s still WhatsApp and meta, I personally avoid it as much as I can.

Re: Web fingerprinting is worse than I thought (2023)

#183

Post by rsync »

patrickmay wrote: post #34
Sanzig wrote: post #9

Browser fingerprinting is one of those things that should be outright illegal - it is far more of a threat than tracking cookies ever were. But it hasn't permeated the public consciousness like cookies have, so regulators seem to ignore it.

This is a technical problem, not a legal one. The solution is for browsers to provide users with the ability to limit the information being sent. There's no need for the vast majority of websites to know my OS, number of CPUs, screen or window size, or most of the other fingerprinting metrics.

… which is why it is so frustrating (and damning) that Firefox does not make it simple to block all of these measurements.

To whatever degree this is, indeed, a technical problem. There’s a simple choke point that is being intentionally unutilized.

Re: Web fingerprinting is worse than I thought (2023)

#184

Post by ryandrake »

Szpadel wrote: post #100
bee_rider wrote: post #63

Earlier quoted context omitted.

It should be illegal, but we also need technical prevention of it, because the internet is global and goes through too many jurisdictions to really regulate. Plus, fingerprinting tech would get developed for criminal organizations or intelligence agencies anyway.

there are some more or less legit causes for fingerprinting. like bot protection or to identifying scammers that just create another account when previous is banned. whether this is justified is of course subjective

Somewhat off topic, but I think calling something "more or less legit" is a form of justifying it.

Re: Web fingerprinting is worse than I thought (2023)

#186

Post by ezfe »

adzm wrote: post #104
laborcontract wrote: post #69

Earlier quoted context omitted.

Safari will assign you a random ip address on a per tab basis if private relay is on. With chrome there is zero plausible deniability as to who you are. You are who you are today, yesterday, and a year before, in every tab, window, incognito or not.

ip addresses are not used in browser fingerprints though

That's not true...they're a major signal

Re: Web fingerprinting is worse than I thought (2023)

#187

Post by Beijinger »

gruez wrote: post #172
Beijinger wrote: post #134

Earlier quoted context omitted.

You could try these: Browser Plugs Fingerprint Privacy Randomizer Clear URLs [I don't care about cockies] Privacy Badger Random User-Agent Switcher Temporary Containers uBlock Origin Canvas Blocker NoScript Font Fingerprint Defender Not all sites will work with it. For banking and plan ticket booking, I always recommend a separate, but major (e.g. Chrome) browser without any plug-ins.

>Random User-Agent Switcher Don't bother. User agent spoofing is easily detectable and it's trivial to figure out your real user-agent based on js implementation differences or TLS fingerprinting. All this does is get you banned/flagged by security vendors, on top of sticking out like a sore thumb. >Canvas Blocker >Font Fingerprint Defender Also easy to easy to detect because randomized values will put you in the buc…

Maybe.

>>Random User-Agent Switcher >Don't bother. User agent spoofing is easily detectable and it's trivial to figure out your real user-agent based on js implementation differences or TLS fingerprinting.

JS is blocked by default on my browser.

>Canvas Blocker >Font Fingerprint Defender

> Also easy to easy to detect because randomized values will put you in the bucket of "uses privacy extension"

Hm. How are they going to detect it is randomized? They would have to identify me first again as the same user and then conclude I randomize these values.

Re: Web fingerprinting is worse than I thought (2023)

#188

Post by rsync »

mystraline wrote: post #101

Bigger question: why isn't Firefox and Tor Browser modifying the JavaScript reporting calls to lie? All machines would have 16 cores and 32GB ram, running windows 10, and 1 point-touch or mouse. And the resolution would also be fixed as reporting, and only on client would change. The user-agent should be acting on our behalf. So, why isn't it (Firefox, TBB) utterly lying and acting in our interest? We know why Chrome…

Going further: why does Firefox allow site operators to dictate common user interface restrictions?

Infantile developer behaviors like disabling paste in the password field? Or bona fide on page text that cannot be selected in the browser window?

There is no reason for Firefox to enable or honor these requests.

Re: Web fingerprinting is worse than I thought (2023)

#189

Post by fsflover »

jordanb wrote: post #44

I'm considering it a good thing at this point that I'm getting captcha-walled with increasing frequency. It means that my setup and behavior looks more like the billions of anonymous bots flooding the web rather than a lucrative mark.

Did you have a look at this test? https://www.eff.org/pages/cover-your-tracks

Re: Web fingerprinting is worse than I thought (2023)

#190

Post by fsflover »

quantas wrote: post #180
thrance wrote: post #166

Earlier quoted context omitted.

Why can't it be made illegal? And from the article, a very succinct explanation as to why browsers will never be fingerprint-resilient: > Chromium (Chrome) is built by Google, an advertisement company which tracks its users for showing relevant ads. So naturally it doesn’t have any inbuilt protection against fingerprinting.

Even if they make it illegal, it won't stop bad actors especially from foreign countries to abuse stuff like this. It's better to build better systems that fix this issue instead of relying on government laws. You could compare it to the concept of security by obscurity which is obviously bad.

It's already illegal in Europe: https://news.ycombinator.com/item?id=44670345
Post reply on HN