Live data from Hacker News

The privacy nightmare of browser fingerprinting

kevinboone.me

211–220 of 456 posts

Re: The privacy nightmare of browser fingerprinting

#211
post #179

Earlier quoted context omitted.

So there's an element of truth to that. And there are those who can contribute enough value, have enough audience, etc., that they can "coast" on those 2 blog posts a month and make significant income... ... but that's also not, nor should it be the median. I'm not sure how the economy functions if, say 8h/mo effort generates a median living wage.

Tbf in a post-scarcity society, that should be expected, if historical inertia doesn't prevent it.

[deleted]

Re: The privacy nightmare of browser fingerprinting

#212

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

Do you see how the discourse has been shifted here? Some of us have nothing against ads per-se. We care about tracking. How does tracking me and invading my privacy make ads perform better? In my case it does not. As the tracked ads are usually worse as they will keep advertising me things I don't need anymore. Context based ads worked fine in the past and I don't really see why they cannot. Also why does every web s…

> How does tracking me and invading my privacy make ads perform better?

If you don’t want to be tracked, you shouldn’t be, but how could it not? At a very simple level, an ad targeted towards a 50 year old woman isn’t going to be the same ad to show a 14 year old boy. Different people like different things and ads targeting you as an advertising profile are going to be better than ones that aren’t. You may not like the targeting and think it's invasive, because it is, but let's not pretend the tracking doesn't do something.

Re: The privacy nightmare of browser fingerprinting

#213
post #3

> Worst of all, perhaps, it can extract a canvas fingerprint. Canvas fingerprinting works by having the browser run code that draws text (perhaps invisibly), and then retrieving the individual pixel data that it drew. This pixel data will differ subtly from one system to another, even drawing the same text, because of subtle differences in the graphics hardware and the operating system. I am concerned about the detai…

I have heard of such things. The signal is not persistent over time, since it's dependent on eg heat and concurrent operations. But it's there, to some degree, and can be correlated over time somewhat.

We've made our world a scary place.

Re: The privacy nightmare of browser fingerprinting

#214
When an individual stalks a person without their consent, it is considered unlawful. Why is it ok for websites to do this?

Perhaps what is missing is a criminal law that forbids deliberate non-consensual tracking of a person's activity. Even in public.

Recording someone as you happen to be recording something in public (including CCTV) is not deliberate or targeted towards an individual. But even in public, if someone followed you around tracking what you're doing (even without recording you), that shouldn't be lawful. Public figures and law enforcement activity based on probable cause being the exceptions.

Can anyone think of any reasonable counter-arguments to this?

Re: The privacy nightmare of browser fingerprinting

#215

Earlier quoted context omitted.

All javascript based anti-fingerprinting is detectable and is also a major source of uniqueness!

Sure but if you are always unique for every website then you can’t be tracked overtime.

They meant a signal of uniqueness for your setup that could still assist with tracking, not being unique for every site.

Re: The privacy nightmare of browser fingerprinting

#216
post #175

The real problem: if you can’t be identified, the system assumes you’re a bot, untrustworthy, or both and instead of reading content you get to select squares with buses and traffic lights ad infinitum.

Yes, and the conspicuous lack of signal is itself a signal. "Get me all the individuals in this geo area that have atypical communication patterns..."

https://xkcd.com/1105/

Re: The privacy nightmare of browser fingerprinting

#217
post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

There's no point unless a critical mass of people use these tools. You will be the only one on your IP address using this configuration of masked fingerprinting, which is itself a fingerprint.

That's also why it's indeed useful when using Tor, because you're not identified by your base IP.

Unless we make this part of the culture, you have basically 0 recourse to browser fingerprinting except using Tor. Which can itself still be a useful fingerprint depending on the context.

EDIT: I'll add that using these tools outside of normal browsing use can be useful for obfuscating who's doing specific browsing, but it should be emphasized that using fingerprinting masking in isolation all the time is nearly as useful as not using them at all.

Re: The privacy nightmare of browser fingerprinting

#218
post #121

Earlier quoted context omitted.

Not trying to be sarcastic; I may be unaware of some relevant legal framework for the US, could you please elaborate which one is a right and how is it enshrined and enforced?

Not American here, but I'm aware of both privacy in mixed forms (privacy act 1974, HIPAA, COPPA, and CCPA in California); as well as anonimity in First Amendment et al since there's case law (IANAL) demonstrating the requirement of anonimity to avoid persecution of free speech. All of these have limitations and exceptions in a complex legal system. But to issue a blanket statement like the comment above is no really…

Also not a lawyer but anonymity case law is a mixed bag to best, and more practically speaking very narrowly targeted compared to privacy.

Re: The privacy nightmare of browser fingerprinting

#219

Earlier quoted context omitted.

Does he have a strong stance of JS in the browser? In any case, I don't think many people would agree that the dubious extra privacy you gain from blocking that is really worth breaking half the web. Fingerprinting is not too hard even without JS.

> Does he have a strong stance of JS in the browser? Lets see what he says on the subject. https://www.gnu.org/philosophy/javascript-trap.html

Ok so his issue is even more obtuse - he doesn't care about fingerprinting; he cares that not all JS code is GPL.

Re: The privacy nightmare of browser fingerprinting

#220
post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

There is also server side fingerprinting like JA4+ and others. Also, if you somehow evade fingeprinting, you have to prepare yourself to solve some very slow Google and Cloudflare captchas.
Post reply on HN