Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

271–280 of 524 posts

Re: Web fingerprinting is worse than I thought

#271

Post by mnw21cam »

dgroshev wrote: post #240
giancarlostoro wrote: post #236

Earlier quoted context omitted.

They should enforce that Do Not Track is honored. Its the easiest way, and websites dont need silly cookie consent dialogs if set.

DNT is ~useless because it's opt-out, whereas "auxiliary", non-essential tracking is opt-in under GDPR. Websites don't need cookie consent dialogs if they only use cookies to do things that don't need to be consented to, like providing the service they are offering. Look at Apple's website, they don't have any.

DNT may be opt-out. But it should certainly be treated as "Don't even bother asking for consent to track, because I already told you the answer is no, and you'll be harrassing me by asking."

Re: Web fingerprinting is worse than I thought

#273

Post by nerdponx »

Throwaway62884 wrote: post #242
zamnos wrote: post #214

Earlier quoted context omitted.

Except that disabling JavaScript is an anomaly all on its own. The dozens of users running without JavaScript might not be individually fingerprint able but it's still a small enough cohort that I don't know how much I'd lean on that. Figure in the user agent string and it's probably unique enough a subgroup to sell ads to.

More common than you think https://amiunique.org/fpnojs

Probably not a representative sample though.

Re: Web fingerprinting is worse than I thought

#275

Post by alkonaut »

charcircuit wrote: post #165
alkonaut wrote: post #144

What is the use case for these fingerprints when adhering to the GDPR? You can't store them in a DB and use them to target your returning anonymous visitor with products relevant to their last visit. You can't send them to a third party ad service to get more relevant ads. Isn't the whole point of the fingerprint to maintain an pseudonym for your users over some time window? But that requires storing them which would…

To prevent spam. If someone is spamming your site how do you tell if a request is coming from a legitimate user or if it is coming from the spammer. Fingerprints are how you can tell the two apart.

I thouht that was most commonly dealth with with a first party cookie. I.e. show the captcha to anyone who doesn't have the cookie. At least that's how it feels when you browse incognito.

Re: Web fingerprinting is worse than I thought

#277

Post by magicalhippo »

DoctorOW wrote: post #139
magicalhippo wrote: post #119

Earlier quoted context omitted.

Sure fonts and text is hard. But none of that is needed for basic surfing of the web.

Either there is a complete and total consensus on every aspect of rendering or there are differences in how is rendered.

Ciphers and hashes publish test data so you can ensure conformance. Don't see why, in principle, one couldn't do something similar with a stripped down .

Re: Web fingerprinting is worse than I thought

#278

Post by jefftk »

illiarian wrote: post #265
jefftk wrote: post #257

Earlier quoted context omitted.

And the tweet is correct, unfortunately: https://www.jefftk.com/test/webmidi Looks like Chrome is trying to change this, and is slow as usual: https://groups.google.com/a/chromium.org/g/blink-api-owners-...

> is slow as usual: It's funny because for anything Chrome deems beneficial to Google they are anything but slow, including shipping APIs that no other browser agreed on.

Having been someone at Google working on new browser APIs, that's slow too. But maybe it doesn't look as slow from the outside?

Re: Web fingerprinting is worse than I thought

#280

Post by darefalcon »

charcircuit wrote: post #165
alkonaut wrote: post #144

What is the use case for these fingerprints when adhering to the GDPR? You can't store them in a DB and use them to target your returning anonymous visitor with products relevant to their last visit. You can't send them to a third party ad service to get more relevant ads. Isn't the whole point of the fingerprint to maintain an pseudonym for your users over some time window? But that requires storing them which would…

To prevent spam. If someone is spamming your site how do you tell if a request is coming from a legitimate user or if it is coming from the spammer. Fingerprints are how you can tell the two apart.

Agree - cross site tracking of devices without consent is going the way of the dodos. With respect to fraud prevention, being able to analyse device signatures along with identity and behavior on a per-site basis is the only reason we are enable to enjoy what’s left of the ‘open web’
Post reply on HN