[flagged]
What makes you think that this is a worthwhile addition to the world?
We're focused on serving ethical use cases such as combating fraud, account takeover, scams and more.
Web fingerprinting is worse than I thought
41–50 of 524 posts
Re: Web fingerprinting is worse than I thought
#42I don't understand the test on this page. It says we should be worried because a fingerprinting website generates the same hash even after you clear your cache and site-data, and even if you go into a private tab. But I'm not overly concerned by this, provided I share that hash with other people. The worry would be that the hash is unique to me (i.e. a fingerprint), but I don't see the evidence that it is.
The likelihood that you have the same hash as other people is exceedingly small. So if I fingerprint you on a site which is using my commercial fingerprint service, then I can sell your hash to other places and tell them all about your browsing habits. The more places run my fingerprinting service, the more data I can collect on you.
I understand the principle. I'm saying that the test on this page isn't demonstrating uniqueness, and so isn't demonstrating fingerprinting.
The first time I heard about fingerprinting was with EFF's panoptoclick, which stated how many hashes had been generated from visitors, and how many you shared with them.
Re: Web fingerprinting is worse than I thought
#43Surely if your website collects data using browser fingerprinting this is covered by GDPR and you have to tell your visitors/ask for permission? https://www.eff.org/deeplinks/2018/06/gdpr-and-browser-finge...
GDPR doesn't really apply outside of Europe, despite what the EU might claim.
Re: Web fingerprinting is worse than I thought
#44I don't understand the test on this page. It says we should be worried because a fingerprinting website generates the same hash even after you clear your cache and site-data, and even if you go into a private tab. But I'm not overly concerned by this, provided I share that hash with other people. The worry would be that the hash is unique to me (i.e. a fingerprint), but I don't see the evidence that it is.
Unfortunately the many, many browser capabilities have given adtech enough entropy to actually create globally unique fingerprints. You can lookup yours with an estimation of uniqueness here: https://amiunique.org/fp
Re: Web fingerprinting is worse than I thought
#45GDPR should have been approached at browser level. But there would not have been money to make for those that provide "compliant" banners. I guess the economy needed the stimulus.
GDPR isn't about cookies, browsers or the web.
> But there would not have been money to make for those that provide "compliant" banners.
Are you serious? Do you think WordPress addon makers lobbied GDPR through the European parlament?
Re: Web fingerprinting is worse than I thought
#46I wish browsers did more to combat this. There should be ways to randomize or normalize every bit of information they try to gather.
It’s a double edged sword you need to walk the edge of. Almost everything they use to fingerprint you has a fully legitimate use case which is why it was added. The more you do to prevent fingerprinting the more you hobble the web as a platform. A lot of restrictions that got placed on the canvas tag to help prevent fingerprinting for instance really limited its functionality. In my opinion a workable solution would…
Most of those APIs should be default closed. Incognito should definitely be default closed.
Re: Web fingerprinting is worse than I thought
#47Look, forget about threat models. It's relatively trivial these days to avoid fingerprinting attacks if you want to (as a private, web browsing individual).
I use fingerprinting actively in enterprise apps as a form of silent 3FA. It's a useful backstop. If I have a user who forgot their password but retrieves it via email, I'll usually let them pass if their fingerprint matches one of their priors; otherwise my software shoots off an email to their immediate superior to make that manager validate that the machine the employee is using is one they can vouch for.
I've always viewed browser fingerprinting as something that can be leveraged as a security feature. It's far more useful for that than for some sort of distributed tracking. I'd never want to live in a world (ahem ... China) where submitting to such fingerprinting actively was mandatory, or politically punishable if you didn't. No society should be run like an employer/employee organization with that sort of lack of trust. No sane free person would allow their own browser to transmit a fingerprint. But for employer/employee systems management? It's a great tool in the box.
Re: Web fingerprinting is worse than I thought
#48If you don't pay attention to it you might be surprised how non dynamic your residential internet last mile DHCP assigned IP really is. It's not uncommon to go many months or a year with having it always renew to the same address. That, combined with all the fingerprinting mentioned in the article...
Yes, the IP and the user agent string appended and CRC’d is a good enough fingerprint for basic web analytics, like for identifying returning customers.
The false positive and negative rates are reasonable, and false positives (new customer seen as returning) could be further reduced by browser feature testing.
Re: Web fingerprinting is worse than I thought
#49"That's how web works." Nah. I make an HTTP request and I get a response. That's how the web works. Perhaps people can have different opinions on "how the web works". Web fingerprinting relies on a heap of assumptions. For example, that someone uses a web browser to make HTTP requests, that the web browser sends certain HTTP headers in a certain order, that the web browser runs Javascript, that it processes cookies,…
> "bots". Not web browsers running Javascript, processing cookies, and so on
even the simplest bots nowadays can run Javascript and process cookies. What's much harder for a bot (or some other actor that has been doing shady things across many websites) to uniquely fake are things like the graphics card (WebGL Vendor & Renderer), audio and other hardware, which gets queried during fingerprinting.
Full fingerprinting is relatively expensive, so it originally was used by fintechs to combat fraudulent/automated signups, but with the third-party cookie situation it might be already economical to track regular users for ads/retargeting.
Re: Web fingerprinting is worse than I thought
#50I wish browsers did more to combat this. There should be ways to randomize or normalize every bit of information they try to gather.
If Javascript is enabled there’s ultimately very little that can be done to prevent fingerprinting. If you don’t want to be fingerprinted then only allowing JS to run on allowlisted websites is the only way to truly be safe
Well, and stuff like the resistFingerprinting=True option in Firefox. As described in the article. You can make your browser to just lie to the JS API.
There is a price, of course. Lying about screen resolution might mess up how the website looks. Lying about which fonts are installed might make the site a bit uglier.