Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The privacy nightmare of browser fingerprinting

kevinboone.me

Post reply on HN
Print view View original

281–290 of 456 posts

Re: The privacy nightmare of browser fingerprinting

#281

Post by thaumasiotes »

jm4 wrote: post #263
thaumasiotes wrote: post #221

Earlier quoted context omitted.

> There was even a proposal to reduce this surface area, but it wasn't adopted: >> Instead of sending a full list of the users' preferred languages from browsers and letting sites figure out which language to use, we propose a language negotiation process in the browser, which means in addition to the Content-Language header, the site also needs to respond with a header indicating all languages it supports Who though…

What language do you put that list in? Would you still want to show it to every visitor when you know most of them speak a particular language? I use to do some work in this area. The first question is difficult and the second is no. We had the best results when we used various methods to detect the preferred language and then put up a language selector with a welcome message in that language. After they made a selec…

> What language do you put that list in? Would you still want to show it to every visitor when you know most of them speak a particular language?

Judging by... a large number of websites, you make the list available in a topbar, and each language is named in itself. You don't apply one language to the entire list.

Here's the first page that popped into my head as one that would probably offer multiple languages (and it does!):

https://www.dyson.com/en

They've got the list in a page footer instead of a header, but otherwise it's an absolutely standard language selector. It does technically identify countries rather than languages. The options range from Azərbaycan to Україна. They are -- of course -- displayed to every visitor.

Why would you want to force someone to consume your website in the wrong language?

And why would the list be in a single language, again?

Re: The privacy nightmare of browser fingerprinting

#282

Post by mmooss »

drnick1 wrote: post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

> Basically, it makes Firefox expose the same information as the Tor browser.

Is it based on the Tor browser?

Some solutions, like Tor browser or GrapheneOS, are engineered for the purpose.

Some free online tools are an aggregation of ideas from social media and someone's personal understanding. These solutions can have limited benefits or be worse than the problem. Many settings don't work as expected, there are unintended consequences (such as making the browser more unique and easier to fingerprint), unusual combinations of settings can have unintended consequences or break things (Mozilla can't test every combination of about:config settings).

Re: The privacy nightmare of browser fingerprinting

#283

Post by mmooss »

alcide wrote: post #63
drnick1 wrote: post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

Orion Browser (Kagi Product) prevents fingerprinters from running by default. https://help.kagi.com/orion/privacy-and-security/preventing-...

To ask the obvious question: Doesn't blocking fingerprinters itself fingerprint the browser.

(Also, what is a 'fingerprinter'? Isn't it something that runs server-side, out of reach of the browser, based on data collected?)

Re: The privacy nightmare of browser fingerprinting

#284

Post by [deleted] »

aragonite wrote: post #171

Some time ago I noticed that in Chrome, every time you click "Never translate $language", $language quietly gets added to the Accept-Language header that Chrome sends to every website! My header ended up looking like a permuted version of this: en-US,en;q=0.9,zh-CN;q=0.8,de;q=0.7,ja;q=0.6 I never manually configured any of those extra languages in the browser settings. All I had done was tell Chrome not to translate…

[deleted]

Re: The privacy nightmare of browser fingerprinting

#285

Post by dartharva »

xp84 wrote: post #248

On articles like this always I see a lot of people bragging about how they’ve pimped out their browser(s) to make themselves “untrackable” (or proposals to make new ways of tracking impossible) but nobody ever brags about how lack of “tracking” has positively impacted their lives. I do block ads on the web with UBlock Origin because there’s no pay option to opt-out of it and ads ruin the experience. But I don’t give…

I have one! Because of my anti-tracking measures, all social media platforms still don't seem to have a profile on me for content preferences, and so fail to show me the hyper-curated slop they do to everyone else. What I see instead is a classic feed of the best content generally trending across the world, pre-2010 style. That's one way it has impacted my life.

Another way is the security and peace of mind it gives me while living in a country that has a behemoth population of bad actors online. Everyone I know has fallen to at least one targeted cyber-scam or the other. I haven't.

Re: The privacy nightmare of browser fingerprinting

#286

Post by mmooss »

xp84 wrote: post #269
nativeit wrote: post #267

Earlier quoted context omitted.

Is this before or after ICE became a $150B secret paramilitary beholden to a corrupt authoritarian with a large cohort of sycophantic tech billionaires?

I’m not an illegal immigrant so I’m not worried about it

That is short-sighted for many reasons that I don't need to mention.

Re: The privacy nightmare of browser fingerprinting

#287

Post by SV_BubbleTime »

8fingerlouie wrote: post #228
SV_BubbleTime wrote: post #185

Earlier quoted context omitted.

Definitely a good STEP1, but it’s not like Firefox and Safari are finger printing secure.

Modern Safari is pretty damned good at randomizing fingerprints with Intelligent Tracking Prevention. With IOS 26 and MacOS 26, it's enabled in both private and non private browser windows (used to be only in private mode). All "fingerprint" tests I've run have returned good results.

I haven’t tried 26, but I remember it didn’t used to be so great.

Re: The privacy nightmare of browser fingerprinting

#288

Post by stego-tech »

dwg wrote: post #236
stego-tech wrote: post #102

Sandboxing in containers and manually exempting specific security tokens is arguably one of the better steps we can take in the immediate term, as are random agent strings and returning fake data for common prompts. Of course that only works in the immediate, because this, like advertising in general, is an arms race at the moment. This feels like a regulatory question, not a technical one. We've repeatedly proven th…

> ...severe consequences for data breaches... Often had the same thought, if not shared same opinion. On the other hand, stiffer penalties have the trade off of incentivizing cover-ups, i.e. disincentivize honest disclosure.

And that’s where I’d need other SMEs in the room to help craft policy. Enough of us agree that the status quo is untenable, but we lack a clear vision to change it still. I know where I stand, but I don’t know what I don’t know.

Re: The privacy nightmare of browser fingerprinting

#290

Post by faidit »

scrollop wrote: post #182
aragonite wrote: post #171

Some time ago I noticed that in Chrome, every time you click "Never translate $language", $language quietly gets added to the Accept-Language header that Chrome sends to every website! My header ended up looking like a permuted version of this: en-US,en;q=0.9,zh-CN;q=0.8,de;q=0.7,ja;q=0.6 I never manually configured any of those extra languages in the browser settings. All I had done was tell Chrome not to translate…

PSA Don't use chrome.

Translating pages is literally the only thing I use Chrome for. The built-in translation works way better than other browsers, even though they also use Google Translate.
Post reply on HN