Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

On Google’s Policy Change Towards Fingerprinting

blog.lukaszolejnik.com

Post reply on HN
Print view View original

41–50 of 64 posts

Re: On Google’s Policy Change Towards Fingerprinting

#41

Post by Hizonner »

fidotron wrote: post #34
Hizonner wrote: post #28

What is with everybody suggesting this or that browser? They're all going to be fingerprintable. Using a less common browser just makes that easier... not that it will ever be hard. You might get some relief from some tracking, including via fingerprinting, by using comprehensive ad and tracking blockers. Or you might not, since CDNs are still probably going to track you.

It is because Google want a situation where they have a monopoly over being able to track web users, and Chrome is a major part of that. Because that is so blatantly anti competitive the adtech industry manipulates it into a sort of war of opaque identifiers (“user resettable device identifiers”) , attached to things like Roku, smart TV and phones, which then can be passed along with bid requests for ads and later us…

You're not going to even improve the problem without completely shutting down the entire "personalized" advertising industry. Which I'm totally on board for, mind you.

Re: On Google’s Policy Change Towards Fingerprinting

#42

Post by Hizonner »

fsflover wrote: post #35
NemoNobody wrote: post #32

Earlier quoted context omitted.

Exactly. There is not anon browsing bc of a browser - you have to do a lot more than a browser to be anon online these days.

How about the Tor Browser?

Very hard to link with your name or other elements of your "real identity" (unless you ever give them out over Tor).

Probably only slightly hard to link all the things you do using a given installation of the browser to each other. They do at least try, but it's still basically Firefox, and it's not clear that it's even possible to make an unfingerprintable browser.

Re: On Google’s Policy Change Towards Fingerprinting

#43

Post by fidotron »

Hizonner wrote: post #41
fidotron wrote: post #34

Earlier quoted context omitted.

It is because Google want a situation where they have a monopoly over being able to track web users, and Chrome is a major part of that. Because that is so blatantly anti competitive the adtech industry manipulates it into a sort of war of opaque identifiers (“user resettable device identifiers”) , attached to things like Roku, smart TV and phones, which then can be passed along with bid requests for ads and later us…

You're not going to even improve the problem without completely shutting down the entire "personalized" advertising industry. Which I'm totally on board for, mind you.

That is true, and part of that would have to be enabling people to make money from web type content without shoving ads in it (or it being an ad for something else).

My personal, controversial, conception of the future is to return to the notion of the Internet as a network of other networks, and then enable devs and content creators to sell apps and experiences which operate privately within those networks.

Re: On Google’s Policy Change Towards Fingerprinting

#44

Post by hilbert42 »

Hizonner wrote: post #11
nine_zeros wrote: post #7

Use Firefox. Consumers need to wean away from spam companies.

No browser is immune to fingerprinting, or even a little bit hard to fingerprint.

Perhaps so, but with JS disabled, Chrome uninstalled and all Google apps disabled and or removed together with a myriad of other tweaks including phone rooting, regular rebooting of routers to change IP address as well as using multiple different IP providers seems to minimize the problem.

Can't remember when I last saw an ad (except for some static one within the page), and the last time I actually clicked on an ad was about 20 years ago.

Oh and BTW, I use a dumb/feature phone for telephone, my smartphones have no SIMs and they connect to the net via a WiFi router (usually a pocket type), and no email is sent from smartphones. Nor do I use any social media (perhaps one if by some stretch HN could be classified as one).

And Gibson Research's ShieldsUP can't find anything of note.

Finally, without JS the web runs like a grayhound. Sites that break without it are not worth visiting anyway (and they're usually the worst privacy offenders).

I've no need of them, as they say, there are pleanty more fish in the sea.

All this nonsense is only a problem if you expect something for nothing and or like the trinkets and pretty baubles Google pretends to offer for free.

PS: and I don't send or receive email from those who've gmail addresses. Boycotting those with gmail addresses sends a message that one is actually serious about privacy.

Re: On Google’s Policy Change Towards Fingerprinting

#45

Post by Hizonner »

fidotron wrote: post #43
Hizonner wrote: post #41

Earlier quoted context omitted.

You're not going to even improve the problem without completely shutting down the entire "personalized" advertising industry. Which I'm totally on board for, mind you.

That is true, and part of that would have to be enabling people to make money from web type content without shoving ads in it (or it being an ad for something else). My personal, controversial, conception of the future is to return to the notion of the Internet as a network of other networks, and then enable devs and content creators to sell apps and experiences which operate privately within those networks.

> That is true, and part of that would have to be enabling people to make money from web type content without shoving ads in it (or it being an ad for something else).

While I think that would be good, I did say personalized advertising, not all advertising. If every visitor to site.com sees the same rotation of ads, there's no need to track anybody. Still obnoxious and a vector for malware, of course. But not really the same problem.

> My personal, controversial, conception of the future is to return to the notion of the Internet as a network of other networks, and then enable devs and content creators to sell apps and experiences which operate privately within those networks.

It never really was that, you know. And I think putting everybody in walled gardens would be even worse than ad spyware.

Re: On Google’s Policy Change Towards Fingerprinting

#46

Post by tholdem »

dewey wrote: post #31
timtom123 wrote: post #24

Earlier quoted context omitted.

Yes, there was a big one for FF in Oct https://nvd.nist.gov/vuln/detail/CVE-2024-9680

And Chrome had one with severity "High" just three days ago, browsers will always have security issues that seem to be patched reasonably fast in the big three. Might as well pick one that's not part of the monoculture by a big advertising company, depending on your threat model of course. https://chromereleases.googleblog.com/2025/01/stable-channel...

Yes all software will have security issues, but Chromium is much harder target to exploit than Firefox.

Re: On Google’s Policy Change Towards Fingerprinting

#47

Post by pseudo0 »

iLoveOncall wrote: post #4
jqpabc123 wrote: post #2

The simplest, readily available solution ---use Brave or LibreWolf. These can't prevent all fingerprinting but they can make it less reliable and more difficult and costly for a fingerprint to be relayed back to the mother ship. Personalized advertising is one of the dumbest ideas of the 21st century. Studies show it is less effective than context sensitive ads and it costs more. Participants in ad auctions are essen…

Ah yes, Brave, the browser that highjacks websites to inject their own referral code, that's the right browser to use for privacy conscious people.

They were adding their own referral code to queries made in the search bar, not replacing or altering referral codes on websites. They apologized and reversed this after criticism back in 2020 (https://brave.com/blog/referral-codes-in-suggested-sites/).

Overall Brave is pretty good, they build in ad-blocking by default and their own ad service is opt-in. They also have Tor and IPFS support that does not exist in Chromium, and are maintaining Manifest V2 support.

Re: On Google’s Policy Change Towards Fingerprinting

#49

Post by tholdem »

fsflover wrote: post #36
tholdem wrote: post #12

Earlier quoted context omitted.

If security is not that important, Firefox or Safari. If you care about security, Chromium.

Using Firefox on Qubes OS. Show me any good attack vector affecting me.

QubesOS is great if you need to do work and personal stuff on the same computer. I do most of my stuff in the browser and have a separate computer for work. I am mostly interested in making initial access as expensive and difficult as possible.

You are still just as vulnerable or more vulnerable to malware stealing browser sessions, passwords, and everything you have on the AppVM the browser is running on than you are on a regular Fedora Workstation. Unless you only use disposable VMs, which you probably don't. If QubesOS had hardened templates, I would use it. When I used it, SELinux was not enforced, and I believe it still has passwordless sudo. Not sure what other mitigations are disabled in the default templates compared to regular, non-QubesOS Fedora Workstation.

Re: On Google’s Policy Change Towards Fingerprinting

#50

Post by fsflover »

tholdem wrote: post #49
fsflover wrote: post #36

Earlier quoted context omitted.

Using Firefox on Qubes OS. Show me any good attack vector affecting me.

QubesOS is great if you need to do work and personal stuff on the same computer. I do most of my stuff in the browser and have a separate computer for work. I am mostly interested in making initial access as expensive and difficult as possible. You are still just as vulnerable or more vulnerable to malware stealing browser sessions, passwords, and everything you have on the AppVM the browser is running on than you ar…

> QubesOS is great if you need to do work and personal stuff on the same computer

This is significantly underestimating the benefits of Qubes. Are you using your online banking in the same browser that you use for random web surfing? I do it in separate VMs with hardware isolation. Same compartmentalization with all other things.

> You are still just as vulnerable or more vulnerable to malware stealing browser sessions, passwords, and everything you have on the AppVM the browser is running on than you are on a regular Fedora Workstation

This is not true. I'm not using the same VM for everything but dedicated VMs for bank, email, HN, instant messaging and so on. A malware on a random website would only get the access to an empty VM, nothing more. Passwords can be securely saved in the related single-purpose browsers and in a plain text file (in an offline VM).

> If QubesOS had hardened templates, I would use it.

You misinterpret the Qubes' approach to security. If your VM is compromised, no hardening will save your data (https://xkcd.com/1200/). On Qubes, you should compartmentalize your digital live into security domains, such that you never run anything untrusted in trusted ones and never have anything valuable in untrusted ones. With such approach, hardening is irrelevant. More examples: https://www.qubes-os.org/news/2022/10/28/how-to-organize-you...

> Unless you only use disposable VMs, which you probably don't.

I don't understand why one wouldn't use them for everything not requiring saving the data. Of course I do use them and wrote this comment from one.

More benefits: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15

Post reply on HN