211–220 of 524 posts
Surely if your website collects data using browser fingerprinting this is covered by GDPR and you have to tell your visitors/ask for permission? https://www.eff.org/deeplinks/2018/06/gdpr-and-browser-finge...
GDPR doesn't really apply outside of Europe, despite what the EU might claim.
As the years pass, I keep thinking back and realize that Richard Stallman was right all along: > For personal reasons, I do not browse the web from my computer. (I also have not net connection much of the time.) To look at page I send mail to a demon which runs wget and mails the page back to me. It is very efficient use of my time, but it is slow in real time.
I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built…
Earlier quoted context omitted.
GDPR doesn't really apply outside of Europe, despite what the EU might claim.
The EU does not claim that it applies outside of Europe, just that the law applies to all your customers/visitors that are within the EU.
Earlier quoted context omitted.
The more you customize the more unique your session becomes.
Not if you disable JS, cause the website then can't see any of these customizations.
Target and the model that found the pregnant girl (bad counter argument here: https://medium.com/@colin.fraser/target-didnt-figure-out-a-t... There are three options: 1. Prevent/Stop it: This ship sailed long ago. Not to be grim about it but pandoras box got opened. 2. Fight it: Tool up, change your print, your behavior, your place. Build focused VM's that you use per topic. Simply do a WHOLE lot less. In the grand s…
Earlier quoted context omitted.
Randomization works if you opt in everyone without their consent. If your addon or minority browser randomizes data you're adding a signal.
Yes, but that's a poor signal. If only two users add "enough" noise to their signal, fingerprinting will only be able to proof a user added noise, but not which user did so. For a single site doing the fingerprinting. Compare that to tracking users across multiple sites for proper signal without randomization.
Regardless it's still adding an extra bit of information leaked, so you may as well forge a common value rather than make something new up.
Note also: As the number of APIs increases, so does the fingerprinting. E.g. MIDI device enumeration (no prompt in Chrome, prompt in FF, not implemented in Safari): https://twitter.com/denschub/status/1582730985778556931?s=20
We need 2 classes of web. One for document based that doesn't require JS to run (secure). Insecure, all the SPA and anything that require JS to see the full content.
One of the nicest things about Flash was that you could set your browser to only load and run Flash content after you click it.
Earlier quoted context omitted.
These are valid use-cases I agree. However I don't see why should be leaky to support those use-cases. Browsers should ensure all operations produce identical results across platforms and hardware, and anything in the spec that prevents this should be removed from the spec. Now, I recognize some of that functionality is handy for certain apps. In that case do like Android and put it behind an opt-in API, so the user…
> I think browsers need a "web app" mode and a "surf mode" Agree. It will be hard to define a standard for "surf mode", but in addition to privacy benefits there would be security benefits for the browser container as well.
Earlier quoted context omitted.
Not if you disable JS, cause the website then can't see any of these customizations.
Except that disabling JavaScript is an anomaly all on its own. The dozens of users running without JavaScript might not be individually fingerprint able but it's still a small enough cohort that I don't know how much I'd lean on that. Figure in the user agent string and it's probably unique enough a subgroup to sell ads to.
But if you never see ads how do you sell ads to them and how do you meaningfully discover enough about the person to feed them valuable ads?
Earlier quoted context omitted.
I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built…
I actually did exactly that a while ago. Where I worked, we didn't have internet access but we had email access, so as a workaround, I made an email server on my home machine that fetched web pages for me. A coworker took it even further and made a proxy server that automated the process so you could actually browse the web, although very slowly. Just to say that Stallman is not the only one with this idea. It was in…