Live data from Hacker News

The privacy nightmare of browser fingerprinting

kevinboone.me

331–340 of 456 posts

Re: The privacy nightmare of browser fingerprinting

#331
I've recently started going full send and using Ad-Nauseaum instead of simply using an ad-blocker. I've even started seriously boning up on Javascript to see if I can come up with some horribly hacky :click:hover:focus smokescreen sideload.

I'm sick to death of companies thinking they have any right to keep tabs on me because they think it'll make them a buck.

Re: The privacy nightmare of browser fingerprinting

#332

Earlier quoted context omitted.

> There was even a proposal to reduce this surface area, but it wasn't adopted: >> Instead of sending a full list of the users' preferred languages from browsers and letting sites figure out which language to use, we propose a language negotiation process in the browser, which means in addition to the Content-Language header, the site also needs to respond with a header indicating all languages it supports Who though…

More and more international audiences websites literally do this themselves, putting a language (sometimes even currency) select box option on top when they detect your settings don’t match best at first the page you are on. Why not have this negotiation implemented at the browser level?

Because that prevents all of your users from selecting the language they want. It's a terrible idea with no upside and not-high-but-still-not-no downside.

Re: The privacy nightmare of browser fingerprinting

#333

Earlier quoted context omitted.

>Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. No. It's LARP. You either don't care or go with Tor Browser and/or commercial antidetect browsers. But you shouldn't care, this issue of fingerprinting is overblown. (really reminds me of AI)

Unfortunately, recently more and more sites fail to work with Tor Browser. Notably, I am informed by people who are not me, Anna's archive and libgen.

The sites block Tor, not fail to work with Tor browser itself. I know this is a meaningless distinction for end user.

In theory you could use Tor browser with Tor stripped (I heard this is what mullvad browser is?) or go tor-then-proxy (this is what I often do, because I sometimes use whonix at work). I don't know about libgen or Anna's archive, I don't use them.

Re: The privacy nightmare of browser fingerprinting

#335
post #290

Earlier quoted context omitted.

PSA Don't use chrome.

Translating pages is literally the only thing I use Chrome for. The built-in translation works way better than other browsers, even though they also use Google Translate.

There is an extension called twp or something like that for firefox. IME it is pretty good

Re: The privacy nightmare of browser fingerprinting

#336

Earlier quoted context omitted.

PSA Don't use chrome.

PSA only use Mullvad or Tails which are set up to be as bland and uniform as possible

As uniform as possible is exactly the wrong way to go. It only takes one data point overlooked or newly discovered to make every person trying to look identical distinct. New fingerprinting techniques are being implemented all the time, so what's the point in taking chances when it's far easier to randomly change a browsers fingerprint for each site/connection making it much harder to track any one browser over time.

Re: The privacy nightmare of browser fingerprinting

#337

Earlier quoted context omitted.

Definitely a good STEP1, but it’s not like Firefox and Safari are finger printing secure.

Firefox does pretty damn well though, especially with privacy.resistFingerprinting set to true

Every time I manually touched the "fingerprinting" about:config settings, my entropy went up. I used the EFF site to test: https://coveryourtracks.eff.org/

AFAIK some of these options are there to be used by the Tor browser, which comes with strict configuration assumptions, and it doesn't translate well to normal Firefox usage. Especially if you change the window size on a non-standardized device. Mind you, the goal is not to block fingerprinting, but to not stand out. Safari on a macbook is probably harder to fingerprint than Firefox on your soldering iron.

However, judging by the fact that every data hungry website seemingly has a huge problem with VPN usage, I'd presume they are pretty effective and fingerprinting is not.

Re: The privacy nightmare of browser fingerprinting

#338

Some time ago I noticed that in Chrome, every time you click "Never translate $language", $language quietly gets added to the Accept-Language header that Chrome sends to every website! My header ended up looking like a permuted version of this: en-US,en;q=0.9,zh-CN;q=0.8,de;q=0.7,ja;q=0.6 I never manually configured any of those extra languages in the browser settings. All I had done was tell Chrome not to translate…

Using Chrome and caring about privacy? I thought, after Google killed uBlock Origin, it had become beyond clear these two things were incompatible, https://news.ycombinator.com/item?id=41905368

Most people using chrome are also using Google's DNS servers too which hands them a list of every single domain you visit.

Re: The privacy nightmare of browser fingerprinting

#339
post #304

Earlier quoted context omitted.

If I was a fingerprinting company, I'd be cross-referencing signals between browsers for sure. If the browser header says windows but the fonts available says linux, that's a very distinctive signal. And if the UA says Chrome but some other signal says not-chrome, that's very distinctive as well.

Surely this is true, but if you’re a fingerprinting company aren’t you making so much money violating the privacy of the masses that it’s not worth your time going after the tiny set of Freedom Nerds trying to evade you?

Yeah, and my passwords are so obvious and stupid, nobody's gonna guess them!

I think, you are falling for a technical fallacy. It's not costing them any more time.

Re: The privacy nightmare of browser fingerprinting

#340
post #305

Some time ago I noticed that in Chrome, every time you click "Never translate $language", $language quietly gets added to the Accept-Language header that Chrome sends to every website! My header ended up looking like a permuted version of this: en-US,en;q=0.9,zh-CN;q=0.8,de;q=0.7,ja;q=0.6 I never manually configured any of those extra languages in the browser settings. All I had done was tell Chrome not to translate…

How does it determine the order? Clearly it thinks you prefer Chinese to German. Was that correlated with the frequency of your requests on Google Translate? With your browsing history? With your shopping history?

$lang_header = $lang_header + $the_lang_choice_that_was_just_made
Post reply on HN