Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

361–370 of 524 posts

Re: Web fingerprinting is worse than I thought

#361
Fingerprinting is one of those things where there's really been a slippery slope we've just slid further and further down it over the last decade; back when I worked at an ad-tech startup (almost 15 years ago) I ran an experiment myself with our data to see if a simple hash of IP, browser agent, and maybe a couple other signals we had in our logs (don't recall) would co-relate with the cookies we already had through cookie matching from other sources. And the answer was: yes, about 95% of the time. Enough to be reliable enough to do basic retargeting without worrying about excessive false matches.

But at the time, it was considered to be a big do not touch -- just don't do this. Not so much for ethical reasons, but for optics in the industry. (I wasn't proposing doing it, was just curious)

In the meantime, though, this seems to have just become standard practice, but way more sophisticated with way higher accuracy, as this article touches on.

What was not acceptable a decade ago is now "ok." Not just by sketchy ad startups, but by major players.

But this whole mess ties back to one of the things that worries me the most about the propagation of LLM type ML out into the general industry. It's only a matter of time before ad targeting takes on an extra dimension of creepiness through this (and I'm sure it's already happening in some aspects, inside Google & Meta.)

In the past, in ad tech & search, etc. people could say things like: "Yes, it's highly targeted. Yes we've co-related an absolutely huge quantity of data to fingerprint you exactly, and retarget you. But it's anonymized. No humans saw your personal data. It's just statistics.". Not saying whether or not this argument has merit or not, just repeating it.

But now, here we are, where "just statistics" is a far more intricate learning model. One which is capable not just of corelating your purchases and browsing activity, but of "understanding" you, and which -- while not an AGI -- is pretty damn smart.

At what point does "a computer scanned your browsing for patterns and recommend this TV set" become ethically the same as "a human read your logs, and would like to talk to you about television sets..."?

Having worked in ad-tech before (and having worked at Google, in ads and other things as well), I do not trust the people in that industry to make the right decisions here.

Re: Web fingerprinting is worse than I thought

#362

Anyone know if there's been any forks of Chrome that enforce more privacy features? I know Chromium is a thing, but I doubt the builds for Chromium (except when tweaked by some Linux distros) do much like Firefox does. I only use Chrome to test some things, or to create a completely isolated browser session disconnected from my use of Firefox.

Brave, Iridium, Bromite comes to mind

Iridium sounds like it might be what I want, thanks!

Re: Web fingerprinting is worse than I thought

#363
I have a sort of love hate relationhip with this stuff. On the one hand, yes tracking me is bad if I am not aware, but on the other hand I work for a company that uses it's expert knowledge to help consumers purchase the right tools for them. Ideally we would like the end product to reward us for putting them in touch with the right customer that we've used our name to help land. Much like a hairdresser would recommend a certain brand of hairspray, or a mechanic who carries their preferred oil - there is always a need for a middleman 'tell Bob I sent ya!'. Obviously this an exception to a large majority of what tracking is currently in place for, but until we drop the whole 'tracking is bad we should just shut it all down', and start to think of a fair and reasonable way for users to say 'I am ok with company B knowing that I have a relationship with company A' then these increasingly nerfarious tracking efforts will happen.

Re: Web fingerprinting is worse than I thought

#364

Until everyday people realize they’re being stalked, I don’t know what will change. I am seriously thinking about trying to go through the proposition process in my state to forbid selling of data (this should already run afoul of wiretapping laws, imho). I thought having an ad campaign that targeted subgroups very specifically and boldly might be enough drum up public interest. Something like: “Hello $name from $cit…

I will admit that it always made me confused as to why browser has access to detailed hardware information. I can understand OS. I can understand resolution. I can rationalize GPU. I don't understand though why it should be able to access .. well, everything about the machine.

edit: It is still impressive. Even with the firefox settings on, the website was able to identify me. I am not entirely certain how I want to approach this.

Re: Web fingerprinting is worse than I thought

#365
Asking the wider audience here, I have uBlock origin installed on my Chrome browser, while I surf mostly on the incognito mode. I know this is no where close to an optimum setup, hence asking. What setup do you folks use to prevent the best you could from being tracked?

Re: Web fingerprinting is worse than I thought

#366

Note also: As the number of APIs increases, so does the fingerprinting. E.g. MIDI device enumeration (no prompt in Chrome, prompt in FF, not implemented in Safari): https://twitter.com/denschub/status/1582730985778556931?s=20

We need 2 classes of web. One for document based that doesn't require JS to run (secure). Insecure, all the SPA and anything that require JS to see the full content.

The dark web is the document-based web. Sites built for Tor Browser have to assume JavaScript is disabled. So they have to rely on server-side rendering, old-school HTML forms, HTML meta refresh, etc.

Surprisingly, one thing that seems to work just fine in this environment is (even modern versions of) phpBB. Lot of phpBB dark web forums.

Also surprisingly, this doesn’t preclude polish or some level of app-like stateful interactivity, because CSS still works. You just have to think differently about how you use it.

Re: Web fingerprinting is worse than I thought

#367

Earlier quoted context omitted.

Exactly. IP address identification is the elephant in the room that the article just briefly mentions. Nearly all websites that want to target adds to you use that. It's just so simple to use, you can't switch it off like you can with cookies, except of course by using a VPN but almost nobody does that.

I often see the narrative on here that consumer VPN providers are almost useless for privacy due to other fingerprinting methods, which I've never really bought.

I just tested at fingerprint.com using mullvad.

Brave browser, no VPN, they recorded one visit, one IP.

Brave browser, no VPN, incognito, they recorded two visits, one IP.

Brave browser, with VPN, incognito, recorded three visits, two IPs.

I'm pretty impressed / surprised. A fresh incognito session, through a VPN, still matched the same fingerprint. Especially surprising since TFA indicates Brave randomizes the fingerprint. I even changed my fingerprint block setting to "strict, may break sites" and it's still recording the same visitor ID from Brave, even with incognito.

Re: Web fingerprinting is worse than I thought

#368
post #194

Fingerprinting is doing terrible things for big-tech data collection, and at the same time it's excruciatingly hard to protect against bots, spammers, fraudaters etc without it. Few people seem to try to reconcile this, since neither side cares about the other. I personally think that discussion about fingerprinting as raw tech, without mentioning the size of the company collecting the date or the purpose is meaningl…

Disabling JavaScript does not stop fingerprinting either. HTTP headers are sufficient to construct unique user identifiers. Passing that data via API to a FaaS provider would enable cross site tracking that's invisible to the visitor.

Edit: The required FaaS implementation is trivial too. I could launch an endpoint that performs exactly this function in 30-60 minutes.

Re: Web fingerprinting is worse than I thought

#369
post #359

Earlier quoted context omitted.

I'm not saying don't use it, I also have it turned on. I'm saying that it has consequences, and you might not immediately realize it's related to RFP.

There certainly are consequences. However, you said it "breaks a lot of the web" including "the back button". Maybe this is the case with some very complicated SPA type sites, but personally, I've never seen this.

Yes, all the problems are on very complicated SPA type sites. You know, like Google Docs/Drive, YouTube, Facebook, Instagram.

Re: Web fingerprinting is worse than I thought

#370

Earlier quoted context omitted.

It's not that easy to "present a fingerprint" without compromising the user experience. Sure, you could remove all those PWA and pretend-OS APIs and hardly anyone would notice, but what about things like viewport size and font rendering? You can't exactly hide them from a website.

> It's not that easy to "present a fingerprint" without compromising the user experience. And that's exactly what I'm talking about. > what about things like viewport size and font rendering? Not much can be done about viewport size, but a browser could easily ship with 2 fonts (one serif and one sans serif) and only allow access to those.

“Font rendering” is a different thing than “what fonts you have.” Font rendering is about how fonts are drawn to the screen. The trick is to draw some words to a and then pixel-peep the result. Different OSes and browsers use different font renderers and font hinting logic; fonts will even render differently on a different-DPI screen.
Post reply on HN