Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

301–310 of 524 posts

Re: Web fingerprinting is worse than I thought

#301

Post by akie »

Zurrrrr wrote: post #213
akie wrote: post #211

Earlier quoted context omitted.

The EU does not claim that it applies outside of Europe, just that the law applies to all your customers/visitors that are within the EU.

IIRC they do try to claim it applies outside of Europe; they say their laws apply to any entity processing data of EU citizens, regardless of where the data or website actually lie.

I think it's well within the rights of the EU to legislate in which way the data of its citizens is processed. If your product or service is accessible to EU citizens, in the EU market, then you need to abide by the laws of the EU. It's no different for physical or virtual products.

Re: Web fingerprinting is worse than I thought

#302

Post by grishka »

giancarlostoro wrote: post #228
grishka wrote: post #217

Earlier quoted context omitted.

Back in the day, we had a nice boundary between the document and the "app". Then for some reason we decided that Flash doesn't need to be a thing any more and erased that boundary by building the app functionality into browsers themselves, making the app and the document inseparable. We should have invested that effort into building an open source Flash player instead. One of the nicest things about Flash was that yo…

Java Applets were worse though, every time I got a virus of any sort from merely browsing generic sites, it always happened due to Java in the browser. I finally stopped installing Java for the web and my security problems went away. Flash had some security nightmares all the time too if I remember correctly but I dont think it ever screwed me over like Java did. I think unless we lock down new APIs that aide in fing…

> Flash had some security nightmares all the time too if I remember correctly but I dont think it ever screwed me over like Java did.

Those incessant RCEs were only due to the sloppy way the Adobe Flash player was written. There is nothing bad security-wise inherent to the SWF format itself.

Ruffle is an open source Flash player in Rust, currently under active development. I'm sure it won't have such problems because 1) it's open-source and 2) it's in Rust, and I was told that anything written in Rust can't possibly have any memory-related vulnerabilities; we'll wait and see if this would still hold true if/when they implement JIT compilation for AS3.

Re: Web fingerprinting is worse than I thought

#303

Post by throwaway202302 »

throwaway202302 wrote: post #203
throwaway202302 wrote: post #192

Earlier quoted context omitted.

Then, could not we a get a trace of the properties it uploads to the server by analyzing what is executed in the javascript? Sure it has some sort of submit endpoint where it throws the individual values to.

POST https://fpa.fingerprint.com/?ci=js/3.8.10&ii=fingerprintjs-p... It looks like it is using heavy obfuscation.

Scrolling a bit through the mess it seems, it is for exampling, trying to detect the used ad-blockers.

.... adGuardGerman:[u("LmJhbm5lcml0ZW13ZXJidW5nX2hlYWRfMQ==") ....

I see things hat look like font fingerprinting, CSS, Apple pay detection, ... , msPointerEnabled, ..., webkitResolveLocalFileSystemURL, ... cookie settings... ... used mathematical library (sinus, cosinus, ...) serviceworkers, ...RTCPeerConnection, hardwareConcurrency,

Maybe we could dissect it and analyze the full list?

At some other place, they documented e.g. you can get the light/dark theme information out of the CSS. Doesn't even need JS to do it.

Re: Web fingerprinting is worse than I thought

#304

Post by boopmaster »

Technotroll wrote: post #100
zamubafoo wrote: post #63

As the years pass, I keep thinking back and realize that Richard Stallman was right all along: > For personal reasons, I do not browse the web from my computer. (I also have not net connection much of the time.) To look at page I send mail to a demon which runs wget and mails the page back to me. It is very efficient use of my time, but it is slow in real time.

I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built…

Are we losing the point, here? “Does not browse” When interacting with webmail- also does not browse directly, preferring CLI scripts to act as intermediary. Does wget execute .js or .css or execute anything it reads beyond a URL redirect? Is wget a huge attack surface like a browser?

Re: Web fingerprinting is worse than I thought

#306

Post by orbisvicis »

smirgel wrote: post #251
hilbert42 wrote: post #69

Ha! I followed the instructions and went to fingerprint.com and it all 'crashed' because I had JavaScript turned off—that's my normal default setting. I have five different browsers on my smartphone and three on the PC all sans JS and none of them are Chrome. Also, normal operation is to automatically delete all cookies at session's end. My smartphone and PCs are de-googleized and firewalled and I never see ads in my…

To me this seems extremely elitist. Non-technical people deserve to have their personal data stolen because they don't know about javascript for example?

Technical defenses are never perfect. In a sense they provide security through obscurity, as evinced by the comments above regarding Stallman's use of wget. If everyone applied technical defenses equally then workarounds would quickly be found, and everyone would be equally vulnerable. So privacy is a scale, and being in the minority provides its own defense. If in aggregate each individual is equally valuable, then the value of breaching a minority's technical defenses is some inverse multiplier of the minority's size. Personally my threat model is to put in just enough work to never be the juiciest target.

Re: Web fingerprinting is worse than I thought

#307

Post by stefncb »

iudqnolq wrote: post #90
stefncb wrote: post #80

Earlier quoted context omitted.

It's interesting that they can narrow me down to less than 0.1% with just my language list (en-US,en,fr,ro). My user agent is practically unique as well, since I'm running an unusual configuration. I've never thought of that as a disadvantage when it comes to tracking, hah.

They narrowed me down to an order of magnitude less based on just my browser user agent (latest Firefox Android). I'm not sure what that actually means.

I'm guessing it means people don't use Firefox, and people _really_ don't use Firefox android.

Re: Web fingerprinting is worse than I thought

#308

Post by grishka »

nordsieck wrote: post #285
giancarlostoro wrote: post #228

Earlier quoted context omitted.

Java Applets were worse though, every time I got a virus of any sort from merely browsing generic sites, it always happened due to Java in the browser. I finally stopped installing Java for the web and my security problems went away. Flash had some security nightmares all the time too if I remember correctly but I dont think it ever screwed me over like Java did. I think unless we lock down new APIs that aide in fing…

> I think unless we lock down new APIs that aide in fingerprinting to only be accessible to WebAssembly and let people block or enable WASM theres not too much else we can do. IMO, it should be enough if incognito mode presents an identical fingerprint on everyone's browser.

It's not that easy to "present a fingerprint" without compromising the user experience. Sure, you could remove all those PWA and pretend-OS APIs and hardly anyone would notice, but what about things like viewport size and font rendering? You can't exactly hide them from a website.

Re: Web fingerprinting is worse than I thought

#309

Post by jsmith45 »

enjoytheview wrote: post #259
mihaic wrote: post #194

Fingerprinting is doing terrible things for big-tech data collection, and at the same time it's excruciatingly hard to protect against bots, spammers, fraudaters etc without it. Few people seem to try to reconcile this, since neither side cares about the other. I personally think that discussion about fingerprinting as raw tech, without mentioning the size of the company collecting the date or the purpose is meaningl…

You don't need to precisely identify users across sessions without their consent to detect bots, advanced anti-bots make heavy use of biometrics to detect bots and don't rely too heavily on fingerprinting, mostly because they're easy to spoof in general, but generating human-like mouse data is a bigger challange.

Sure, but on the other hand, a lot of anti-fingerprinting efforts strive to reduce the info available including things like mouse movement data.

Mouse movement data is a fairly potent fingerprinting vector. Bucketing the average spouse speed and acceleration rates could provide provide useful information. This may imply specific OS speed settings, or physical mouse DPI. A machine learning system would likely be able to distinguish traditional mouse, vs trackpoint, vs touchpad, vs trackball. Etc.

Also it is not just bots that have non-human like mouse movement. Many assistive technologies would have no mouse movement, or would auto snap the mouse to relevant spot. That is actually a quite powerful for fingerprinting, since assistive technology users are a pretty small subset of internet users, so only a relatively small amount of additional data is needed to uniquely fingerprint that user/machine.

Post reply on HN