Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

221–230 of 524 posts

Re: Web fingerprinting is worse than I thought

#221

Post by dgroshev »

mcherm wrote: post #82
izacus wrote: post #75

Why is this being fought with technical measures (which are ineffective and cripple the web as a platform) instead of legal consumer law where you can easily fine and punish companies that do the fingerprinting? EDIT: Note that you can do BOTH - but one without the other is just a game of whack-a-mole.

Because some browser-makers (Firefox at least) believe that the identity of those browsing the web should be protected. Legislators do not believe that. (At least, a majority of legislators do not.)

Would you consider the entire European Union a minority of the legislators? Because that's what GDPR is designed to do, make identifying customers well controlled and expensive whatever the method.

Granted, the enforcement should be stepped up.

Re: Web fingerprinting is worse than I thought

#222

Post by sltkr »

croes wrote: post #212
Technotroll wrote: post #100

Earlier quoted context omitted.

I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built…

Maybe he's setting a false trail and using curl

Maybe the script does:

    wget --user-agent="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" ...
Nobody will suspect a thing!

Re: Web fingerprinting is worse than I thought

#224

Post by szundi »

zamubafoo wrote: post #63

As the years pass, I keep thinking back and realize that Richard Stallman was right all along: > For personal reasons, I do not browse the web from my computer. (I also have not net connection much of the time.) To look at page I send mail to a demon which runs wget and mails the page back to me. It is very efficient use of my time, but it is slow in real time.

Hard to watch netflix or YouTube whis way. Considering I have just learned electronics design from YouTube, this is inconvenient.

Re: Web fingerprinting is worse than I thought

#225

Post by zagrebian »

zamnos wrote: post #214
kuschku wrote: post #189

Earlier quoted context omitted.

Not if you disable JS, cause the website then can't see any of these customizations.

Except that disabling JavaScript is an anomaly all on its own. The dozens of users running without JavaScript might not be individually fingerprint able but it's still a small enough cohort that I don't know how much I'd lean on that. Figure in the user agent string and it's probably unique enough a subgroup to sell ads to.

> it's probably unique enough a subgroup to sell ads to

I have been browsing with JavaScript disabled by default for the past 6 months. Based on my experience, no-JavaScript ads are rarer than four-leaf clover.

Re: Web fingerprinting is worse than I thought

#226

Post by withinboredom »

kuschku wrote: post #189
comboy wrote: post #170

Earlier quoted context omitted.

The more you customize the more unique your session becomes.

Not if you disable JS, cause the website then can't see any of these customizations.

It’s fun to put Easter eggs for people like you. https://once.getswytch.com

Re: Web fingerprinting is worse than I thought

#228

Post by giancarlostoro »

grishka wrote: post #217
factormeta wrote: post #197

Earlier quoted context omitted.

We need 2 classes of web. One for document based that doesn't require JS to run (secure). Insecure, all the SPA and anything that require JS to see the full content.

Back in the day, we had a nice boundary between the document and the "app". Then for some reason we decided that Flash doesn't need to be a thing any more and erased that boundary by building the app functionality into browsers themselves, making the app and the document inseparable. We should have invested that effort into building an open source Flash player instead. One of the nicest things about Flash was that yo…

Java Applets were worse though, every time I got a virus of any sort from merely browsing generic sites, it always happened due to Java in the browser. I finally stopped installing Java for the web and my security problems went away.

Flash had some security nightmares all the time too if I remember correctly but I dont think it ever screwed me over like Java did.

I think unless we lock down new APIs that aide in fingerprinting to only be accessible to WebAssembly and let people block or enable WASM theres not too much else we can do. It would be nice to be able to block web APIs selectively to limit what a JS script can do.

Re: Web fingerprinting is worse than I thought

#229

Post by kevincox »

TylerE wrote: post #72
codetrotter wrote: post #8

Earlier quoted context omitted.

> the page unnecessarily copies the image into a and then tries to upload the data from the instead of the original image. Surely there could be valid reasons for doing so? I imagine for example that: 1. It ensures the selected file is a valid image before uploading it 2. It strips meta data like GPS position from the image before uploading it 3. It could reduce the size of the image, by either scaling it down, or co…

3 sounds incredibly undesirable to me, assuming we’re dealing with a jpeg. Go through 3 or 4 rounds of that and compression starts to get pretty visible.

Most websites will recompress user images. Although you probably don't want to do it client side.

The biggest reason is if course cost saving. Store and transfer smaller images. This could be done client side with a server side check on max size.

Another big reason is metadata stripping. Both to protect the user (can be done client side) and to avoid unintentional data channels being provided.

Another reason is to avoid triggering exploits. If a major browser has a JPEG rendering exploit Facebook doesn't want you to be able to pwn everyone who sees your post. By using a trusted encoded it is very likely that the produced image is more or less following the standards and not likely to trigger any exploits (as exploits usually require invalid files).

Re: Web fingerprinting is worse than I thought

#230

Post by giancarlostoro »

db48x wrote: post #104
magicalhippo wrote: post #71

Earlier quoted context omitted.

These are valid use-cases I agree. However I don't see why should be leaky to support those use-cases. Browsers should ensure all operations produce identical results across platforms and hardware, and anything in the spec that prevents this should be removed from the spec. Now, I recognize some of that functionality is handy for certain apps. In that case do like Android and put it behind an opt-in API, so the user…

The real snag comes from putting text into a canvas. Nobody can agree on what fonts they have installed, and of course there are all kinds of subtle variations from one version of the “same” font to the next, and then everyone has different ideas about hinting, kerning, stem widths, etc, etc, etc. You can fingerprint basically everyone just from that information alone.

Every browser can agree on a specific font if they truly cared about end-user privacy.
Post reply on HN