311–320 of 524 posts
You can try https://www.amiunique.org/fp to get a view of all params can used to track you
It's interesting that they can narrow me down to less than 0.1% with just my language list (en-US,en,fr,ro). My user agent is practically unique as well, since I'm running an unusual configuration. I've never thought of that as a disadvantage when it comes to tracking, hah.
Earlier quoted context omitted.
We need 2 classes of web. One for document based that doesn't require JS to run (secure). Insecure, all the SPA and anything that require JS to see the full content.
> We need 2 classes of web. One for document based that doesn't require JS to run (secure). I've wondered for a long time if a sort of posh gopher based on markdown with extensions would be able to make a comeback. Especially if it allowed for CSS.
I dont think this is a proper way to test it. It matters more how unique your fingerprint is than how consistent or reproducible it is. Just testing if you get the same fingerprint back on your second visit doesn't tell you much if you don't know how many people "share" your fingerprint. As a silly example, if you gave all users the same fingerprint, it would be very consistent but also useless as a tracking method.
If I have a certain phone model with updates applied. Is there something that distinguishes me from other people with the same phone and browser version other than the IP address?
Earlier quoted context omitted.
I actually did exactly that a while ago. Where I worked, we didn't have internet access but we had email access, so as a workaround, I made an email server on my home machine that fetched web pages for me. A coworker took it even further and made a proxy server that automated the process so you could actually browse the web, although very slowly. Just to say that Stallman is not the only one with this idea. It was in…
In Germany there is a "WhatsApp" SIM [1], where you have to pay for normal internet use, but WhatsApp texts are free of charge. With a technique which you described, you could probably abuse a phone with this SIM as a "free" hot spot with infinite data. [1] https://www.whatsappsim.de/
Earlier quoted context omitted.
Having been someone at Google working on new browser APIs, that's slow too. But maybe it doesn't look as slow from the outside?
> But maybe it doesn't look as slow from the outside? Google ships 400 new APIs per year. It readily ships API within a month after it spits out a half-prepared spec and asks other browsers for input. Even benign changes like CSS headline balancing was sent to TAG three weeks ago, and will ship a month from now. From the outside this is neck-breaking speed with utter disregard for anything. But when user privacy is c…
The "text-wrap: balance" proposal is not new, though? I see it in the 2019-11-13 draft spec: https://www.w3.org/TR/2019/WD-css-text-4-20191113/#valdef-te...
As the years pass, I keep thinking back and realize that Richard Stallman was right all along: > For personal reasons, I do not browse the web from my computer. (I also have not net connection much of the time.) To look at page I send mail to a demon which runs wget and mails the page back to me. It is very efficient use of my time, but it is slow in real time.
I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built…
Earlier quoted context omitted.
Not if you disable JS, cause the website then can't see any of these customizations.
You are easily tracked without JS. It is much easier than tracking a default settings browser.
Not true. Especially if you mean a default browser with Canvas/WebRTC APIs enabled.
It is much more difficult for fingerprinting companies to get a high entropy fingerprint from a no-JS user.
Earlier quoted context omitted.
> I think unless we lock down new APIs that aide in fingerprinting to only be accessible to WebAssembly and let people block or enable WASM theres not too much else we can do. IMO, it should be enough if incognito mode presents an identical fingerprint on everyone's browser.
It's not that easy to "present a fingerprint" without compromising the user experience. Sure, you could remove all those PWA and pretend-OS APIs and hardly anyone would notice, but what about things like viewport size and font rendering? You can't exactly hide them from a website.
And that's exactly what I'm talking about.
> what about things like viewport size and font rendering?
Not much can be done about viewport size, but a browser could easily ship with 2 fonts (one serif and one sans serif) and only allow access to those.