191–200 of 524 posts
Why is this being fought with technical measures (which are ineffective and cripple the web as a platform) instead of legal consumer law where you can easily fine and punish companies that do the fingerprinting? EDIT: Note that you can do BOTH - but one without the other is just a game of whack-a-mole.
Earlier quoted context omitted.
Is this _only_ figerprinting then? If the profiles are different, do they manage to extract some UID from the profile (which I would assume is a bug in the browser), or do they store data client-side using persistent storage APIs?
Chrome does give access to localStorage/sessionStorage in Incognito and this can be used to communicate between tabs on the same domain, but just like cookies and cache this data is wiped if you close the Incognito instance. It's certainly a mystery, because you'd expect any capability fingerprinting (some combo of UA, extensions, CPU/GPU specs, IP etc) to give an identical result between profiles, so it does seem th…
Earlier quoted context omitted.
But it's not just a matter of "open"/"close". It's more like signal/noise. Much of the signal is legit: source IP is needed to deliver response, screen resolution, audio/video codec support, transfer protocol, cache headers are all needed to render the page correctly and as quick as possible. Unfortunately, much of that signal persists across sessions as well as websites and can therefore be aggregated into a hash th…
Randomization works if you opt in everyone without their consent. If your addon or minority browser randomizes data you're adding a signal.
Compare that to tracking users across multiple sites for proper signal without randomization.
Few people seem to try to reconcile this, since neither side cares about the other.
I personally think that discussion about fingerprinting as raw tech, without mentioning the size of the company collecting the date or the purpose is meaningless, and only leads to a few tech savy users having less data collected on them.
Most people want to use Javascript, use the default setting and not be afraid of clicking on links. I can't really see a good solution without a coordination of regulation and tech standards, so I'm hopeful at least for decent solutions.
There's a flipside question as well, how many users have the same fingerprint as you?
You can experiment there: https://coveryourtracks.eff.org
Earlier quoted context omitted.
> Trying to hide from fingerprinting makes your fingerprint more unique Didn't seem so in the experiment in the article. Sure they'll be able to place you in the bucket "tor user", but is that really more narrow than what you'd get without Tor?
Using Tor might stop them to track you in a unique way, but they can for sure put you in the basket of the 0.1% of Tor users
Note also: As the number of APIs increases, so does the fingerprinting. E.g. MIDI device enumeration (no prompt in Chrome, prompt in FF, not implemented in Safari): https://twitter.com/denschub/status/1582730985778556931?s=20
"That's how web works." Nah. I make an HTTP request and I get a response. That's how the web works. Perhaps people can have different opinions on "how the web works". Web fingerprinting relies on a heap of assumptions. For example, that someone uses a web browser to make HTTP requests, that the web browser sends certain HTTP headers in a certain order, that the web browser runs Javascript, that it processes cookies,…
GPT-3 was trained on a filtered version of CommonCrawl.
IMO, this is text-only web use. No (fingerprint-friendly) graphical web browser needed. Others may have different opinions. Perhaps I am biased as I use the web this way seven days a week.
Earlier quoted context omitted.
You don't need proof you just need some sound reasoning about the trends. If it were as effective as you claim, progression in this area would have halted full stop. Ask yourself how long have those consumer laws been in effect. Has this technology problem progressed during that time (increased or decreased). Have the fines against the large tech companies actually been collected and were they sufficient to curb that…
Just so we're clear - the consumer law has mostly not been adjusted to cover data mining yet and you seem to be building your argument on the assumption that it has. Am I correct?
Granted, I didn't go directly to the regulatory site because who can sit down and analyze multiple legalese documents that have thousands of pages with crossreferencing requirements.
Can we fingerprint fingerprinting code and block it? At first glance it seems like code accessing all kinds of unrelated high entropy APIs should be something detectable. But then static analysis might be too hard in face of obfuscation so it would have to be done using dynamic analysis which kind of means you let the fingerprinting happen but are now at least aware of it. So how do you prevent the fingerprint from b…
You'd have to mask every informational API with a suitable corrupted alternative that is plausible.