Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

331–340 of 524 posts

Re: Web fingerprinting is worse than I thought

#331

Post by worg »

psacawa wrote: post #294
hilbert42 wrote: post #69

Ha! I followed the instructions and went to fingerprint.com and it all 'crashed' because I had JavaScript turned off—that's my normal default setting. I have five different browsers on my smartphone and three on the PC all sans JS and none of them are Chrome. Also, normal operation is to automatically delete all cookies at session's end. My smartphone and PCs are de-googleized and firewalled and I never see ads in my…

Before you get all jubilant, note that they have fingerprinting techniques which don't use JS[0]. It was able to identity me. Contrary to popular opinion, disabling JS doesn't protect you from fingerprinting. They describe their approach[1]. They use HTTP headers and conditional request triggered by CSS conditional media queries to gather data. Something like @media(...) {background: url(/tracking/$clientid)}. But in…

FF mobile gives be different IDs each time I run a new private session on both the JS an non-js demos (I run w/o JS usually AND have enabled the resistFingerprint setting)

Re: Web fingerprinting is worse than I thought

#332

Post by [deleted] »

zamubafoo wrote: post #63

As the years pass, I keep thinking back and realize that Richard Stallman was right all along: > For personal reasons, I do not browse the web from my computer. (I also have not net connection much of the time.) To look at page I send mail to a demon which runs wget and mails the page back to me. It is very efficient use of my time, but it is slow in real time.

[deleted]

Re: Web fingerprinting is worse than I thought

#333

Post by chaosite »

d-z-m wrote: post #323
chaosite wrote: post #4

It's important to know that the mentioned "resistFingerprinting" breaks a lot of the web. Examples include the back button, uploading photos on some websites uploads random data instead of the photo, etc.

This is FUD. As others have said, been using RFP for years and barely noticed.

I'm not saying don't use it, I also have it turned on. I'm saying that it has consequences, and you might not immediately realize it's related to RFP.

Re: Web fingerprinting is worse than I thought

#334

Post by dinkleberg »

chrisMyzel wrote: post #322

I find it scary coming back to the fingerprint.js site after years and still being correctly identified and see the exact dates I visited

Interesting, despite me not using a VPN, it has me “identified” in the totally wrong location (in fact, multiple wrong locations within minutes).

Re: Web fingerprinting is worse than I thought

#335

Post by jefc1111 »

Is anyone trying to tie users to multiple devices, and consequently identify both fingerprints as being from one user? I.e. Let's say I visit HN on both my laptop and on my mobile phone, each will have a very different fingerprint, but not only do I visit the same site on both devices but I am unlikely to do so simultaneously across the two devices, and there are likely to be other factors such as not visiting on either device during sleeping hours, not visiting on either device before some date (i.e. when I got into HN).

Perhaps you could call this something like 'cross-device fingerprint unification', idk.

Re: Web fingerprinting is worse than I thought

#336

Post by favaq »

smirgel wrote: post #251
hilbert42 wrote: post #69

Ha! I followed the instructions and went to fingerprint.com and it all 'crashed' because I had JavaScript turned off—that's my normal default setting. I have five different browsers on my smartphone and three on the PC all sans JS and none of them are Chrome. Also, normal operation is to automatically delete all cookies at session's end. My smartphone and PCs are de-googleized and firewalled and I never see ads in my…

To me this seems extremely elitist. Non-technical people deserve to have their personal data stolen because they don't know about javascript for example?

Yeah? If they don't know how to operate a computer then they shouldn't be operating one. The same I would feel if someone without a licence crashed their car.

Re: Web fingerprinting is worse than I thought

#337

Post by Spivak »

factormeta wrote: post #197
illiarian wrote: post #20

Note also: As the number of APIs increases, so does the fingerprinting. E.g. MIDI device enumeration (no prompt in Chrome, prompt in FF, not implemented in Safari): https://twitter.com/denschub/status/1582730985778556931?s=20

We need 2 classes of web. One for document based that doesn't require JS to run (secure). Insecure, all the SPA and anything that require JS to see the full content.

Which class you're in will be in control of the developer and they'll always choose SPA even for the presentation of static text.

And to be fair it makes a lot of sense because writing HTML templates feels super jank once you've experienced not doing it. Even for a site with static content I would still prefer to deliver it as a static JS bundle and a data payload.

I really like https://docsify.js.org. Gotta be one of the lowest touch libs out there. The whole site from git repo to page one single completely static asset.

Re: Web fingerprinting is worse than I thought

#338

Post by d-z-m »

ergonaught wrote: post #223

Even after discovering it is worse than they thought, it remains far worse than the author thinks. Public knowledge is far behind the actual capabilities in practice.

This is easy to say, but not always true. Can you elaborate about concrete details of the "capabilities in practice"?

Re: Web fingerprinting is worse than I thought

#339

Post by coldpie »

nordsieck wrote: post #284
factormeta wrote: post #197

Earlier quoted context omitted.

We need 2 classes of web. One for document based that doesn't require JS to run (secure). Insecure, all the SPA and anything that require JS to see the full content.

> We need 2 classes of web. One for document based that doesn't require JS to run (secure). I've wondered for a long time if a sort of posh gopher based on markdown with extensions would be able to make a comeback. Especially if it allowed for CSS.

As with most things, this isn't really a technical challenge, it's a social one. The protocols you're describing already exist, more or less. No one uses them.

Re: Web fingerprinting is worse than I thought

#340

Post by domh »

jefc1111 wrote: post #335

Is anyone trying to tie users to multiple devices, and consequently identify both fingerprints as being from one user? I.e. Let's say I visit HN on both my laptop and on my mobile phone, each will have a very different fingerprint, but not only do I visit the same site on both devices but I am unlikely to do so simultaneously across the two devices, and there are likely to be other factors such as not visiting on eit…

I think it would have to have some code that tied those two fingerprints together... something like `fingerprint.identifyUser("jefc1111")` which would then store both of those fingerprints against your user id.
Post reply on HN