I look forward to the day the EU makes fingerprinting illegal.
Me too. But more likely they will do the opposite. Apple’s anti-fingerprinting is anticompetitive to the market for European data trackers or some such bullshit.
Bypassing Safari 17's advanced audio fingerprinting protection
191–200 of 266 posts
Re: Bypassing Safari 17's advanced audio fingerprinting protection
#192Earlier quoted context omitted.
That’s how location services and notifications work today, and all it means is that websites just constantly nag me to enable them. Things like this make for a more annoying web all around, because now it’s just one more tool sites can use to track me and increase engagement. (Edit: sibling poster chuckles said it way better than I can.) If I had my way, JavaScript on the web would be limited to XMLHttpRequest and ba…
I’m kinda surprised that no fork of Firefox has added both global and domain-scoped toggles for web feature support. I know there’s flags in about:config but that only covers some things and isn’t very user friendly. That’d let users turn support for all the fancy bits off by default and enable them in the tiny handful of cases that they’re actually desired. This way as far as sites are concerned your browser simply…
It’s not as extensive as you’re asking for, but check out the Firefox extension uMatrix.
Re: Bypassing Safari 17's advanced audio fingerprinting protection
#193Earlier quoted context omitted.
browsers should come with a default software renderer, and behave like the mic and camera where the site will require user permission to release the hardware GPU render path.
but nobody wants to use software rendering, that's the whole reason WebGL and WebGPU exist.
Alternatively: vanishingly few pages use WebGL and WebGPU so software rendering would work well as a default.
Safari still has show stopping perf bugs in WebGL 2 (a 2017 finalized spec): https://forums.developer.apple.com/forums/thread/696821 https://forum.unity.com/threads/unity-webgl-poor-rendering-p... so Mac/iOS users wouldn't notice a difference probably.
Re: Bypassing Safari 17's advanced audio fingerprinting protection
#194Earlier quoted context omitted.
Do you have something more recent than a leak from over 2 years ago that has long been fixed? I'm curious why iCloud Private Relay is theatre at the moment.
[flagged]
> It was advertised as being private, but it wasn't
Signal had a bug once. Herego, it’s a scam?
Re: Bypassing Safari 17's advanced audio fingerprinting protection
#195Earlier quoted context omitted.
Do you have something more recent than a leak from over 2 years ago that has long been fixed? I'm curious why iCloud Private Relay is theatre at the moment.
[flagged]
And a VPN leaks a lot of information about your network activity to the operator, so by your standard it is privacy theater. Do you see why you’re coming across as having inconsistent standards and thereby perhaps an axe to grind?
iCloud Private Relay is used for all network activity from Safari which does not seem like a “limited amount of activity.”
Re: Bypassing Safari 17's advanced audio fingerprinting protection
#196Earlier quoted context omitted.
IIRC it turned out that way in large part because realtime audio is very sensitive to performance hitches, and idiomatic JS is hitchy by nature due to relying on garbage collection, so they wanted to hoist as much as possible up into native code provided by the browser. If WASM had existed at the time it would have been easier to make the case for just exposing a simple raw audio interface instead.
Well... Mozilla had ASM.js at the time. In part to showcase their superior performance with certain portions of JS compared to V8 - at the time I remember the things like console emulators preferring Mozilla's JS engine due to it offering more reliable performance than V8 on the tight loops and large switches. Mozilla was also demonstrating how their engine could offer comparable performance to Google NaCl in an imag…
(That is, I'm pretty sure ASM.js uses same trick WASM does given it was the predecessor - just preallocate a ton of memory in an array, and work with primitive types, and no GC to worry about most of the time)
Re: Bypassing Safari 17's advanced audio fingerprinting protection
#197Earlier quoted context omitted.
Is iCloud Private Relay theatre? 3rd party cookie blocking? What specific features do you allege exist just to mislead the general public?
> Is iCloud Private Relay theatre? https://fingerprint.com/blog/ios15-icloud-private-relay-vuln... > 3rd party cookie blocking? It's very funny that you should ask this question in response to an article about fingerprinting without cookies. But yes, there are various workaround to use 1st party cookies or other storage to take the place of 3rd party cookies. Perhaps the worst is the Safari "Privacy Report", which ha…
Built in tracker blocking and the various ways Safari makes it hard to share user sessions with 3rd parties absolutely has real effect. It also has real costs: part of Safari’s poor compatibility reputation comes from websites that are broken by its tracking prevention features. This is why Google claims they haven’t rolled out the same. If Apple only cared about the problem at a superficial level, why wouldn’t they do the same as Chrome and talk a big game about the problem but continuously delay changes?
I’d say the privacy report is the only real false security feature, but Apple was a laggard in that market. For all we know, they could have been trying to match features with Ghostery or Brave that teach consumers this is a feature you should expect from your browser. Users may also have been needed education about that behavior in order to justify the compatibility regressions cookie blocking incurs. It’s impossible to know from the outside, but your body of evidence to support a really strong accusation is quite weak.
Re: Bypassing Safari 17's advanced audio fingerprinting protection
#198Earlier quoted context omitted.
I haven't seen marketing related to audio fingerprinting protection. Maybe Hanlon's applies here. As for your point about the pattern of vulnerabilities: I'd attribute this to being closed source. They keep shipping security features with limited auditing, and only discover flaws in production.
> I haven't seen marketing related to audio fingerprinting protection. Apple announces powerful new privacy and security features: https://www.apple.com/newsroom/2023/06/apple-announces-power... WebKit Features in Safari 17.0: https://webkit.org/blog/14445/webkit-features-in-safari-17-0... In general, Apple is trying to market itself as the privacy company. "What happens on iPhone stays on iPhone", yadda yadda. > May…
Bad engineering yet state of the art. What are Chromium’s protections against web audio fingerprinting?
In the game of tracking, minor hurdles are great at stymying many actors.
And finally, your citation in response to someone saying they haven’t seen Apple market web audio fingerprinting protections has no references to said feature. Are you saying all the privacy features in that press release are a smokescreen? It’s quite unclear.
Re: Bypassing Safari 17's advanced audio fingerprinting protection
#199Earlier quoted context omitted.
That's an wild accusation to make without citations. It doesn't even apply in this instance, since Apple's work on fingerprint resistance still results in real privacy improvements even when later shown to be imperfect. It means Apple has to improve what they've already done, not that what they've done so far is mere "marketing" or "theatre".
> That's an wild accusation to make without citations. Shall I cite my list of CVE? Or perhaps it would be more interesting to cite my list of unfixed 0days. > It doesn't even apply in this instance, since Apple's work on fingerprint resistance still results in real privacy improvements even when later shown to be imperfect. It means Apple has to improve what they've already done, not that what they've done so far is…
“Apple’s quantity and resolution rate of security bugs undermine its privacy marketing” and “Apple’s privacy marketing is a lie” are two very different claims, and it seems like you meant to make the first. Even that claim though is unsupported since Safari users are definitely harder to track across the web in practice than Chrome users.
> Shall I cite my list of CVE? Or perhaps it would be more interesting to cite my list of unfixed 0days.
The list of vulnerabilities is not very informative for the same reason a trackers blocked statistic is not. It doesn’t give any baseline for comparison and may just be a reflection of how important and interesting to security researchers the target is.
Re: Bypassing Safari 17's advanced audio fingerprinting protection
#200Earlier quoted context omitted.
[flagged]
> It was advertised as being private, but it wasn't Signal had a bug once. Herego, it’s a scam?
> Signal had a bug once.
Are you referring to this?
https://www.forbes.com/sites/daveywinder/2019/10/05/signal-m...
It was a bad bug in the Android client, to be sure, but it didn't bypass Signal encryption.