Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

251–260 of 524 posts

Re: Web fingerprinting is worse than I thought

#251

Post by smirgel »

hilbert42 wrote: post #69

Ha! I followed the instructions and went to fingerprint.com and it all 'crashed' because I had JavaScript turned off—that's my normal default setting. I have five different browsers on my smartphone and three on the PC all sans JS and none of them are Chrome. Also, normal operation is to automatically delete all cookies at session's end. My smartphone and PCs are de-googleized and firewalled and I never see ads in my…

To me this seems extremely elitist. Non-technical people deserve to have their personal data stolen because they don't know about javascript for example?

Re: Web fingerprinting is worse than I thought

#252

Post by cobbzilla »

szundi wrote: post #224
zamubafoo wrote: post #63

As the years pass, I keep thinking back and realize that Richard Stallman was right all along: > For personal reasons, I do not browse the web from my computer. (I also have not net connection much of the time.) To look at page I send mail to a demon which runs wget and mails the page back to me. It is very efficient use of my time, but it is slow in real time.

Hard to watch netflix or YouTube whis way. Considering I have just learned electronics design from YouTube, this is inconvenient.

For Youtube, try invidious or yt-dlp

Re: Web fingerprinting is worse than I thought

#253

Post by jefftk »

illiarian wrote: post #20

Note also: As the number of APIs increases, so does the fingerprinting. E.g. MIDI device enumeration (no prompt in Chrome, prompt in FF, not implemented in Safari): https://twitter.com/denschub/status/1582730985778556931?s=20

MIDI device enumeration is behind a permissions prompt, though? "The user must explicitly grant permission to use the API though a user-agent specific mechanism, or have previously granted permission." https://developer.mozilla.org/en-US/docs/Web/API/Navigator/r...

EDIT: nope, not as implemented in Chrome https://www.jefftk.com/test/webmidi

Re: Web fingerprinting is worse than I thought

#254

Post by than3 »

dgroshev wrote: post #231
than3 wrote: post #159

Earlier quoted context omitted.

You don't need proof you just need some sound reasoning about the trends. If it were as effective as you claim, progression in this area would have halted full stop. Ask yourself how long have those consumer laws been in effect. Has this technology problem progressed during that time (increased or decreased). Have the fines against the large tech companies actually been collected and were they sufficient to curb that…

Here's a bunch of consumer laws that work: - living in the UK, I barely ever receive spam calls or messages. I can be reasonably sure that companies don't sell my contacts to third parties, I can withdraw my consent to marketing communications and spam will stop, I did it multiple times. My American friends seem to have way more problems with that, to the extent of buying burner phones to buy insurance. Considering t…

I'll keep in mind points 1 and 3.

As for cars, how do we know that's true. There was Dieselgate, but from what I've heard they only got them because of whistleblowers.

Many VOCs which these laws are designed to reduce are odorless. The ones are visible are larger particle size and generally less of an issue from an environmental perspective from most accounts.

Re: Web fingerprinting is worse than I thought

#255

Post by illiarian »

jefftk wrote: post #253
illiarian wrote: post #20

Note also: As the number of APIs increases, so does the fingerprinting. E.g. MIDI device enumeration (no prompt in Chrome, prompt in FF, not implemented in Safari): https://twitter.com/denschub/status/1582730985778556931?s=20

MIDI device enumeration is behind a permissions prompt, though? "The user must explicitly grant permission to use the API though a user-agent specific mechanism, or have previously granted permission." https://developer.mozilla.org/en-US/docs/Web/API/Navigator/r... EDIT: nope, not as implemented in Chrome https://www.jefftk.com/test/webmidi

At the time of the tweet not in Chrome: https://twitter.com/denschub/status/1582730988118867968?s=20

Re: Web fingerprinting is worse than I thought

#256

Post by illiarian »

olebedev wrote: post #234
factormeta wrote: post #197

Earlier quoted context omitted.

We need 2 classes of web. One for document based that doesn't require JS to run (secure). Insecure, all the SPA and anything that require JS to see the full content.

I think we will end up with something like permissions grants (including granular JS APIs available for the website, as we do for the location, camera APIs etc, at the moment) per website and convenient tools built-in browser that allow you create/re-use patterns so you don't actually interrupted by this strictness too much.

> per website and convenient tools built-in browser

Per-website, for dozens (if not hundreds) of APIs and convenient? These are contradictory :)

Re: Web fingerprinting is worse than I thought

#257

Post by jefftk »

illiarian wrote: post #255
jefftk wrote: post #253

Earlier quoted context omitted.

MIDI device enumeration is behind a permissions prompt, though? "The user must explicitly grant permission to use the API though a user-agent specific mechanism, or have previously granted permission." https://developer.mozilla.org/en-US/docs/Web/API/Navigator/r... EDIT: nope, not as implemented in Chrome https://www.jefftk.com/test/webmidi

At the time of the tweet not in Chrome: https://twitter.com/denschub/status/1582730988118867968?s=20

And the tweet is correct, unfortunately: https://www.jefftk.com/test/webmidi

Looks like Chrome is trying to change this, and is slow as usual: https://groups.google.com/a/chromium.org/g/blink-api-owners-...

Re: Web fingerprinting is worse than I thought

#258

Post by RalfWausE »

smirgel wrote: post #251
hilbert42 wrote: post #69

Ha! I followed the instructions and went to fingerprint.com and it all 'crashed' because I had JavaScript turned off—that's my normal default setting. I have five different browsers on my smartphone and three on the PC all sans JS and none of them are Chrome. Also, normal operation is to automatically delete all cookies at session's end. My smartphone and PCs are de-googleized and firewalled and I never see ads in my…

To me this seems extremely elitist. Non-technical people deserve to have their personal data stolen because they don't know about javascript for example?

I run a similar setup as the OP when browsing the modern web, but i think it is in a way our responsibility as professionals to help the less tech inclined to navigate the sea of monsters the modern web has become.

For example: I have set up the systems of family members for whom i am some sort of digital janitor with a nice collection of firefox plugins to get rid of the worst offenders.

Re: Web fingerprinting is worse than I thought

#259

Post by enjoytheview »

mihaic wrote: post #194

Fingerprinting is doing terrible things for big-tech data collection, and at the same time it's excruciatingly hard to protect against bots, spammers, fraudaters etc without it. Few people seem to try to reconcile this, since neither side cares about the other. I personally think that discussion about fingerprinting as raw tech, without mentioning the size of the company collecting the date or the purpose is meaningl…

You don't need to precisely identify users across sessions without their consent to detect bots, advanced anti-bots make heavy use of biometrics to detect bots and don't rely too heavily on fingerprinting, mostly because they're easy to spoof in general, but generating human-like mouse data is a bigger challange.

Re: Web fingerprinting is worse than I thought

#260

Post by dismalpedigree »

mcherm wrote: post #82
izacus wrote: post #75

Why is this being fought with technical measures (which are ineffective and cripple the web as a platform) instead of legal consumer law where you can easily fine and punish companies that do the fingerprinting? EDIT: Note that you can do BOTH - but one without the other is just a game of whack-a-mole.

Because some browser-makers (Firefox at least) believe that the identity of those browsing the web should be protected. Legislators do not believe that. (At least, a majority of legislators do not.)

What a legislator believes is irrelevant. Only what the lobbyist is paid to believe is relevant.
Post reply on HN