Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

261–270 of 524 posts

Re: Web fingerprinting is worse than I thought

#261

Post by zelphirkalt »

charcircuit wrote: post #175
zelphirkalt wrote: post #70

Earlier quoted context omitted.

(1) Users should not receive passwords via e-mail. (2) How very enterprisey of you to even be able to send passwords, which one also should not be able to do. (3) Users can change or modify their browser, either to another browser entirely or through installation of addons. The fingerprint is not guaranteed at all to stay the same or similar.

(1) There is nothing wrong with sending a password via email. Even if you send a reset link instead an email provider could steal that too. (2) The server gets sent your password every time you log in. You shouldn't rely on a server operator not knowing your password. (3) You can tune how sensative the system is in response to changes in the fingerprint. Even if their in a failure to match that just means authenticat…

(1) Best that would be a one usage link though, so that a user can detect, whether the link was stolen from their inbox. I think you also did not get my point: The service should not know the password at all. Usually not even initial passwords for any account. It is simply a bad practice to ever have knowledge about user passwords, except for a salted hash. So I say you are wrong.

(2) The server gets send the password via the default communication channel, the browser, TLS hopefully, not via e-mail, possibly into an inbox, that is third-party controlled (say some google mail inbox for example).

(3) That does not make it right. Did they even ask the users for their consent? Did they learn anything from GDPR or in general discussions about consent? Or are they just a higher being, allowed to decide for their users, what data about them they track?

Many things can be done using technology. The question is always: Should we do them? That is a question about ethics, not technological possibility. We already have far too many businesses not caring about ethics at all, we do not need any additional ones.

Re: Web fingerprinting is worse than I thought

#262

Post by chrismorgan »

withinboredom wrote: post #226
kuschku wrote: post #189

Earlier quoted context omitted.

Not if you disable JS, cause the website then can't see any of these customizations.

It’s fun to put Easter eggs for people like you. https://once.getswytch.com

I have no idea what you’re talking about. That URL only tries to load one piece of JavaScript, htmx, and all it does is unbreak the mobile navigation.

(Aside: this mobile navigation is, incidentally, the worst implementation I have ever encountered: instead of twiddling some classes or such, which would happen instantly, it makes an HTTP request that responds with the new navbar. For me, this means at least half a second’s latency on clicking the button, more if time has passed so that the HTTP connection is no longer open (1.5–2 seconds). It also fails the no-JS test, as the unintercepted form-submit just serves the page with the closed mobile navbar again, not switching out the navbar as I expected it might, and which would have been enough to avoid an unconditional “worst implementation” award. Sorry if you made this and it hurts your feelings, but… ugh, this is just a baffling misapplication of hx-post and naive Tailwind use, and just unconditionally a bad approach.)

Edit: better link which shows what I suppose you probably meant: https://once.getswytch.com/app

Re: Web fingerprinting is worse than I thought

#263

Post by bauruine »

aflag wrote: post #248
ThePhysicist wrote: post #67

Using the IP address & user agent alone already gives you nearly 100 % accuracy, so the fact that they can re-identify you when these things stay identical isn't surprising at all. I tested that website as well and if you take care to rotate your IP address their re-identification rate becomes abysmal, especially if you're using a privacy-focused browser and extensions like Privacy Badger / uBlock.

And if we ever migrate to ipv6, the IP alone may be all anyone needs to fingerprint you.

Every device implements privacy extensions which changes the address every 24 hours. It's no longer based on the MAC and hasn't been for a long time.

Re: Web fingerprinting is worse than I thought

#265

Post by illiarian »

jefftk wrote: post #257
illiarian wrote: post #255

Earlier quoted context omitted.

At the time of the tweet not in Chrome: https://twitter.com/denschub/status/1582730988118867968?s=20

And the tweet is correct, unfortunately: https://www.jefftk.com/test/webmidi Looks like Chrome is trying to change this, and is slow as usual: https://groups.google.com/a/chromium.org/g/blink-api-owners-...

> is slow as usual:

It's funny because for anything Chrome deems beneficial to Google they are anything but slow, including shipping APIs that no other browser agreed on.

Re: Web fingerprinting is worse than I thought

#266

Post by dgroshev »

than3 wrote: post #254
dgroshev wrote: post #231

Earlier quoted context omitted.

Here's a bunch of consumer laws that work: - living in the UK, I barely ever receive spam calls or messages. I can be reasonably sure that companies don't sell my contacts to third parties, I can withdraw my consent to marketing communications and spam will stop, I did it multiple times. My American friends seem to have way more problems with that, to the extent of buying burner phones to buy insurance. Considering t…

I'll keep in mind points 1 and 3. As for cars, how do we know that's true. There was Dieselgate, but from what I've heard they only got them because of whistleblowers. Many VOCs which these laws are designed to reduce are odorless. The ones are visible are larger particle size and generally less of an issue from an environmental perspective from most accounts.

You can literally smell it in the air, older cars don't have cats to burn everything uncombusted down to CO2+H2O. You can smell it with a modern car for the first few minutes while cat is heating up. You can see it in car shapes, there's a reason why every modern car looks the same — aerodynamics and pedestrian safety make car shapes converge. You can see it in ubiquitous cans of AdBlue on petrol stations, which was not a thing just two decades ago (and still aren't in many developing countries).

Finally, you can see it numbers: https://www.asm-autos.co.uk/workspace/images/yearly-co2-emis...

There is no fundamental reason why all those changes had to happen, it wasn't the market driving them. It was the regulation.

Re: Web fingerprinting is worse than I thought

#267

Post by bauruine »

pbhjpbhj wrote: post #58
perlgeek wrote: post #23

Earlier quoted context omitted.

There's "Privacy Extension" for that, from https://labs.ripe.net/author/johanna_ullrich/ipv6-addresses-... > The IPv6 Privacy Extension is defined in RFC 4941. It is a format defining temporary addresses that change in regular time intervals; successive addresses appear unrelated to each other for outsiders and are a means of protection against address correlation. Their regular change is independent from the network…

Thanks, can you answer a couple of questions: So carriers (ISPs) still would need to do NAT, the RFC didn't seem (I skimmed) explicit? Isn't the removal of processing traffic a large part of the sell for IPv6. Also, surely the ISP can sell IP-to-user correlation lists as I assume they do now? They can presumably do it anonymously bit with some other party seeking the other part of the data that allows deobfuscation o…

No ISPs don't need to do NAT but you can if you like. You also don't have to do NAT with IPv4 if you only have one device or get a subnet from your ISP. It's just done because we don't have enough v4 addresses.

They can do subnet to customer correlation. The IPv6 is randomly generated by your device if you use SLAAC. But if your ISP is an adversary you have pretty much lost anyway. If they provide you with a router they can see all devices in your network (MAC and hostname) and they could also map certain devices to certain port ranges and sell that too.

Re: Web fingerprinting is worse than I thought

#268

Post by paleotrope »

enjoytheview wrote: post #259
mihaic wrote: post #194

Fingerprinting is doing terrible things for big-tech data collection, and at the same time it's excruciatingly hard to protect against bots, spammers, fraudaters etc without it. Few people seem to try to reconcile this, since neither side cares about the other. I personally think that discussion about fingerprinting as raw tech, without mentioning the size of the company collecting the date or the purpose is meaningl…

You don't need to precisely identify users across sessions without their consent to detect bots, advanced anti-bots make heavy use of biometrics to detect bots and don't rely too heavily on fingerprinting, mostly because they're easy to spoof in general, but generating human-like mouse data is a bigger challange.

I wonder if you could use a chicken like in the old chicken tic-tac-toe machines to mimic real user behavior.

Re: Web fingerprinting is worse than I thought

#269

Post by avnigo »

zer00eyz wrote: post #207

Target and the model that found the pregnant girl (bad counter argument here: https://medium.com/@colin.fraser/target-didnt-figure-out-a-t... There are three options: 1. Prevent/Stop it: This ship sailed long ago. Not to be grim about it but pandoras box got opened. 2. Fight it: Tool up, change your print, your behavior, your place. Build focused VM's that you use per topic. Simply do a WHOLE lot less. In the grand s…

I thought about the noise route, but doesn't that make you more unique? Maybe if many users share the noise, but then that makes it easier to identify what's noise and what's not.

Re: Web fingerprinting is worse than I thought

#270

Post by mananaysiempre »

no_time wrote: post #141
BeefWellington wrote: post #106

Earlier quoted context omitted.

WGET can be pretty trivially told to send custom headers.

Try to do that to a site with CF bot protection cranked up... Not happening without a custom build/custom ssl proxy that mimics the SSL fingerprint of Chrome.

I haven’t seen a custom build of Wget, but for Curl there is curl-impersonate[1].

[1] https://github.com/lwthiker/curl-impersonate

Post reply on HN