Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The privacy nightmare of browser fingerprinting

kevinboone.me

Post reply on HN
Print view View original

191–200 of 456 posts

Re: The privacy nightmare of browser fingerprinting

#191

Post by charlie-83 »

btilly wrote: post #159
charlie-83 wrote: post #112

Earlier quoted context omitted.

Relevant/personalised ads doesn't mean ads that benefit you. It's means ads that are better able to extract money from you. It means that, when you need a new dishwasher, you will never see the actual best dishwasher for you, only dishwashers that are a bit more expensive than you actually need but you will end up buying one of them anyways. It means that you are more likely to see products you would impulse buy just…

My preferences are based on my understanding of myself. I do not have those problem addictions. Of course I am going to comparison shop for any large purchases. I am good enough about controlling spending that excess junk isn't one of my problems. But what I do have a problem with is coming up with creative ideas for people in my life. So, for example, I would have never thought to look for https://www.zazzle.com/cup…

There are always situations where an advert is useful and we remember those. However, when an advert causes you to spend more than you would, you have no idea it has happened.

Maybe you truly are above the influence of advertising. However, almost no one believes that they are affected by advertising yet clearly almost all of those people are wrong.

I find it safer to assume I am part of the vast majority of people who would be influenced by personalised advertising. Given that online advertising is basically the biggest business in the world, I assume that it would find a way to get money from me.

Re: The privacy nightmare of browser fingerprinting

#192

Post by beeflet »

AndrewStephens wrote: post #160
beeflet wrote: post #148

Earlier quoted context omitted.

The Ad model is exactly the problem. If you had anonymous, cheap micropayments where you pay 1 cent per pageview it would not just solve the surveillance problem but it would solve the DDoS problem too (you set up a web server where the price increases with load and clients bid for bandwidth).

Sadly, I think you are wrong. Micropayments seem attractive but the idea falls apart quickly - there are just too many intractable non-technical problems. It has been tried more than once and each effort has failed. I wrote a longer post on this[0] but to save you the click I will state the biggest problem from a privacy point of view - if you think privacy is bad now with ads imagine how much worse it would be with…

I think it is a technical problem. If you could integrate payment channels on top of private cryptocurrencies that would be enough. Even without the lightning network and just direct 1-to-1 payment channels, it would work.

The article you lists assumes a "conventional" credit card system with chargebacks, massive fees, etc. which makes micropayments ecosystem impractical in the first place. Proposals for micro-payment systems usually describe a way top enable low-fee payments.

The author doesn't take into account modern cryptocurrency tech like payment channels. I really doubt that payments have a natural fixed floor of 10s of cents - Payment providers charge these fees simply because they are in a natural monopoly position, thanks to lock-in and regulation. The need to control fraud is caused by regulatory requirements, which are in turn caused by monopolization.

Despite being technologically less efficient, even traditional cryptocurrency payments are cheaper than bank transfer fees due to competition and low regulation.

Secondly, you assume that no one wants to do micropayments. The infrastructure doesn't exist for it yet. If you don't build it, they will not come.

As for browser fingerprinting, it can be solved on the client side with enough effort. Look at tor browser. Just have a system where cookies, WebGL, etc. are opt in on a browser level in the same way that WebUSB is. Artificially limit the performance of javascript to prevent bench-marking. I think it is possible to solve this architecturally.

Check it out!

https://en.bitcoin.it/wiki/Payment_channels

https://lightning.network/lightning-network-paper.pdf

Also, there are GNU Taler/Chaumian cash type systems that inherit the efficiency of centralized systems with an added privacy benefit.

Re: The privacy nightmare of browser fingerprinting

#193

Post by hilbert42 »

drnick1 wrote: post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

"This will break a lot of websites, but automatically rules out most forms of tracking…"

Whether one breaks a lot of websites or not depends on the type of user one is. People who regularly use the Google ecosystem, Amazon and Social Media etc. cannot afford to break sites for obvious reasons, they too are those that websites are most interested in tracking and fingerprinting.

Those who use the web in the way advertisers and Big Tech intend users to use it are the most vulnerable, they're the ones who most need protection.

I break websites regularly but it doesn't worry me, I browse with the premise that there are more websites on the internet than I'll ever be able to visit and if I break sites or are blocked by paywalls then there are usually alternatives and workarounds.

But then I'm not a typical user, I block ads, I usually browse with JS off, kill cookies, use block lists, use multiple browsers (there are six on this deGoogled, rooted phone), browse from multiple machines—Windows, Linux and use multiple ISPs. Also, I've no Social media or Google accounts and rarely ever purchase stuff online. Internet access is via dynamic IP addresses and routers are rebooted often. There's more but you get the picture.

I assume browsing sans JS makes me a first-class target for fingerprinting and that websites know about me but it doesn't matter. Whatever I'm doing seems to work, over the years I've had very little trouble doing everything on the web that I want to do. Clearly I'm of little interest to advertisers and I never see ads let alone targeted ones. I used to use uBlock Origin but I don't bother now as browsing sans JS is just so effective at blocking ads.

I'm lucky in the fact that I use no service that would benefit from fingerprinting me. Whilst my web browsing is atypical of most users I reckon many could benefit by being more proactive—using multiple machines, browsers, ISPs etc.—to disrupt the outflow of personal data. For example, this is being written on a rooted Android using Privacy Browser from F-Droid sans JS and with block lists. If I really need to go to a site where JS is required, I can simply hit a toggle and turn on JS or alternatively use another browser.

Re: The privacy nightmare of browser fingerprinting

#194

Post by Neikius »

doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

Do you see how the discourse has been shifted here? Some of us have nothing against ads per-se. We care about tracking.

How does tracking me and invading my privacy make ads perform better? In my case it does not. As the tracked ads are usually worse as they will keep advertising me things I don't need anymore. Context based ads worked fine in the past and I don't really see why they cannot.

Also why does every web store need to show me ads? Don't they make money out of selling things? If they really have to, do they have to invade privacy? This is like walking into a physical store and them doing facial recognition, then showing you tailored ads/inventory. That feels creepy to me.

Re: The privacy nightmare of browser fingerprinting

#195

Post by capitainenemo »

SV_BubbleTime wrote: post #185
scrollop wrote: post #182

Earlier quoted context omitted.

PSA Don't use chrome.

Definitely a good STEP1, but it’s not like Firefox and Safari are finger printing secure.

Firefox does pretty damn well though, especially with privacy.resistFingerprinting set to true

Re: The privacy nightmare of browser fingerprinting

#196

Post by 8bitsrule »

gedy wrote: post #47
kasabali wrote: post #27

Earlier quoted context omitted.

> I'm not quite sure what the answer is. It's very simple, it's what they've been doing in print media for centuries: contextual advertising.

Yes seriously - I'm old enough to have enjoy reading magazines that had ads throughout them. They were fine. I'd venture to say contextual advertising would be more effective than whatever we've been trying to squeeze out of fingerprinting etc. All this supposed "data" they are gathering feels like a scam perpetuated by ad companies about how important it is to the people who buy ads. It's not. Even Facebook and Inst…

Same here. By the time I was old enough to have an income, reading comics had already made it possible for me to -not even see any- advertising. That carried over to newspapers, magazines... all those advertisers were wasting their money.

Later on in life I got pissed at cable-TV advertisers shoved into my favorite movies every 5-10 minutes ... ruining any ambience or artistic merit in them ... so I got rid of cable TV. By the time analog TV went away, I'd got rid of my television set. No return address on an envelope? junk mail, into the garbage unopened.

Now the pollution's ruined the 'net ... it's YouTube (re-routed) and some websites (blocked). So long, boing-boing and wired and your 'native ads'. Sites demand subscription? blocked. How much longer before advertisers realize how much they're getting ripped off?

Re: The privacy nightmare of browser fingerprinting

#198

Post by capitainenemo »

drnick1 wrote: post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

unfamiliar with the Arkenfox user.js but are any of these things that are beyond what firefox enables out of the box if you turn on privacy.resistFingerprinting ? Because what you describe seems to be all stuff it does just by flipping flag.

Re: The privacy nightmare of browser fingerprinting

#199

Post by nobody42 »

thetyster wrote: post #188
nobody42 wrote: post #184

You could test with this: https://github.com/abrahamjuliot/creepjs Does it store the data? Unknown. The best browser for protection is https://mullvad.net/en/browser because it makes the connection uniform, to better blend in.

> best I guess that really depends on how you classify "best" Tor is pretty good for protection. Then there's always i2P as well… Saying one browser can protect the best is pretty hard to prove.

Best among existing. Anti-fingerprinting field is still in it's early stages.

I wouldn't say Tor Browser is the best because it requires custom configuration to be usable conveniently, which will make the connection non-uniform (and the user will stand out).

>Tor is pretty good for protection. Then there's always i2P as well…

Tor and i2P does nothing for (anti)fingerprinting - the program which render the web pages does.

>Saying one browser can protect the best is pretty hard to prove.

Not a proof but things to consider: https://privacytests.org/

Re: The privacy nightmare of browser fingerprinting

#200

Post by fsflover »

esseph wrote: post #187
fsflover wrote: post #177

Earlier quoted context omitted.

Using Chrome and caring about privacy? I thought, after Google killed uBlock Origin, it had become beyond clear these two things were incompatible, https://news.ycombinator.com/item?id=41905368

uBlock origin just got replaced with uBlock lite for most people

Which, by design, doesn't protect you from actual spying, https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-as...
Post reply on HN