Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

321–330 of 524 posts

Re: Web fingerprinting is worse than I thought

#321
post #180

You can try https://www.amiunique.org/fp to get a view of all params can used to track you

so in order to stay anonymous, one can clear these parameters, alternatively one can generate different parameters for every HTTP call.

No, any session based protocol (HTTPS) would expect certain characteristics to stay the same between the same session.

If it changed with every call they'd just block you as a bot.

Re: Web fingerprinting is worse than I thought

#323
post #4

It's important to know that the mentioned "resistFingerprinting" breaks a lot of the web. Examples include the back button, uploading photos on some websites uploads random data instead of the photo, etc.

This is FUD. As others have said, been using RFP for years and barely noticed.

Re: Web fingerprinting is worse than I thought

#324
post #6

Earlier quoted context omitted.

If it breaks uploading a photo, it’s because the page unnecessarily copies the image into a and then tries to upload the data from the instead of the original image.

> the page unnecessarily copies the image into a and then tries to upload the data from the instead of the original image. Surely there could be valid reasons for doing so? I imagine for example that: 1. It ensures the selected file is a valid image before uploading it 2. It strips meta data like GPS position from the image before uploading it 3. It could reduce the size of the image, by either scaling it down, or co…

[deleted]

Re: Web fingerprinting is worse than I thought

#325
post #6
post #4

It's important to know that the mentioned "resistFingerprinting" breaks a lot of the web. Examples include the back button, uploading photos on some websites uploads random data instead of the photo, etc.

If it breaks uploading a photo, it’s because the page unnecessarily copies the image into a and then tries to upload the data from the instead of the original image.

> unnecessarily

No, this is how most pre-upload image editors work. Why upload a 5MB avatar photo that's you're going to have the user crop and scale on the client-side to a few hundred KB first?

Using canvas for this is much more friendly to their bandwidth, no nefarious intent needed.

Re: Web fingerprinting is worse than I thought

#326

I don't understand the test on this page. It says we should be worried because a fingerprinting website generates the same hash even after you clear your cache and site-data, and even if you go into a private tab. But I'm not overly concerned by this, provided I share that hash with other people. The worry would be that the hash is unique to me (i.e. a fingerprint), but I don't see the evidence that it is.

Here is evidence that the hash can be unique, or narrow down a small group of people https://coveryourtracks.eff.org/

This is a nice website.

Re: Web fingerprinting is worse than I thought

#327
post #125
post #55

Earlier quoted context omitted.

Well, we could fingerprint the fingerprint detection code ...

uBlock Origin in default deny of 3p scripts basically achieves this already.

UBlock (and even AdGuard) is not preventing this website from accurately fingerprinting me.

Re: Web fingerprinting is worse than I thought

#328
post #269

Target and the model that found the pregnant girl (bad counter argument here: https://medium.com/@colin.fraser/target-didnt-figure-out-a-t... There are three options: 1. Prevent/Stop it: This ship sailed long ago. Not to be grim about it but pandoras box got opened. 2. Fight it: Tool up, change your print, your behavior, your place. Build focused VM's that you use per topic. Simply do a WHOLE lot less. In the grand s…

I thought about the noise route, but doesn't that make you more unique? Maybe if many users share the noise, but then that makes it easier to identify what's noise and what's not.

Any thing that doesn't impact the signal, or can be separated from the signal does not qualify as noise.

You want to quickly throw targeting systems off your scent (or get them distracted) see how sticky high value sales are for the ad's you see on line. Start looking for a new car, use the word wedding too much (god help you if your a woman) or say vacation 3 times near search engine and watch how quickly your ad experience changes.

This won't work "long term"

As an example: You get an ID as a 24 year old male, who likes his local sports ball team, drinks canned domestic beer... that's a profile that is perfect to sell you a BBQ grill and a subscription to the meat of the month club. Spend an hour or two a week pursuing sewing, the engine is going to get confused! Maybe you share a device with your wife, or she got on it...

This is the sort of noise you create, its not random its "more" and you do it by going off type for a while. Have a friend who is into something you aren't (music, art, and so on) ask them some questions and go spend a week getting more informed on their hobby and have a chat with them. Suddenly the systems will see you as MORE...

Re: Web fingerprinting is worse than I thought

#329
post #4

It's important to know that the mentioned "resistFingerprinting" breaks a lot of the web. Examples include the back button, uploading photos on some websites uploads random data instead of the photo, etc.

I just tried putting it on with the idea of trying it out for one workday to see if it breaks something. It immediataly broke favicons on my GitLab tabs (turning them into random vertical stripes of pixels), which is both odd and a pretty bad start. I really like the idea behind this feature, but it seems the Web API might have become too complex to counteract bad actors like this. It's particularly scary that it can…

RFP randomizes Canvas data extraction by default, which might have something to do with it. Gitlab favicon seems normal to me when I navigate there(RFP on).

Re: Web fingerprinting is worse than I thought

#330
post #194

Fingerprinting is doing terrible things for big-tech data collection, and at the same time it's excruciatingly hard to protect against bots, spammers, fraudaters etc without it. Few people seem to try to reconcile this, since neither side cares about the other. I personally think that discussion about fingerprinting as raw tech, without mentioning the size of the company collecting the date or the purpose is meaningl…

You don't need to precisely identify users across sessions without their consent to detect bots, advanced anti-bots make heavy use of biometrics to detect bots and don't rely too heavily on fingerprinting, mostly because they're easy to spoof in general, but generating human-like mouse data is a bigger challange.

https://github.com/Xetera/ghost-cursor
Post reply on HN