Live data from Hacker News

Web fingerprinting is worse than I thought (2023)

bitestring.com

41–50 of 219 posts

Re: Web fingerprinting is worse than I thought (2023)

#41

> go to about:config and setting privacy.resistFingerprinting = true in your Firefox browser Two questions jump to mind: Why isn't this the default in Firefox? What is the downside? I.e., what can break by enabling this parameter?

Some websites prefilled username to allow quicker re-login - this kind of features. Worst case scenario, you will get a first-time visit experience all over again

Re: Web fingerprinting is worse than I thought (2023)

#42
post #9

Browser fingerprinting is one of those things that should be outright illegal - it is far more of a threat than tracking cookies ever were. But it hasn't permeated the public consciousness like cookies have, so regulators seem to ignore it.

This is a technical problem, not a legal one. The solution is for browsers to provide users with the ability to limit the information being sent. There's no need for the vast majority of websites to know my OS, number of CPUs, screen or window size, or most of the other fingerprinting metrics.

I think it's both. It wasn't a problem when browsers were simple content display engines, but now that they are full VMs for application software, they need some of that capability just to function. FWIW, I think this was a mistake, but the genie is out of the bottle.

I suppose one technical mitigation might be a permissions dialog when a script requests access to a high-risk API like canvas or WebGL. But that's unfortunately something that won't work for most users, who will just click through the dialog.

Re: Web fingerprinting is worse than I thought (2023)

#45

> go to about:config and setting privacy.resistFingerprinting = true in your Firefox browser Two questions jump to mind: Why isn't this the default in Firefox? What is the downside? I.e., what can break by enabling this parameter?

It's isn't the default because the countermeasures cause a lot of side-effects. If it were on by default, new users would probably think the browser is broken or buggy.

Here's what the settings do and what sort of side-effects you might experience:

https://support.mozilla.org/en-US/kb/resist-fingerprinting

Re: Web fingerprinting is worse than I thought (2023)

#46
post #9

Browser fingerprinting is one of those things that should be outright illegal - it is far more of a threat than tracking cookies ever were. But it hasn't permeated the public consciousness like cookies have, so regulators seem to ignore it.

This is a technical problem, not a legal one. The solution is for browsers to provide users with the ability to limit the information being sent. There's no need for the vast majority of websites to know my OS, number of CPUs, screen or window size, or most of the other fingerprinting metrics.

Making it a technical problem means it’s an arms race forever. Making it a regulation problem, if done right, can simply end the arms race.

Not to mention the big players on the users’ team in the technical arms race (google, ms, apple) are also advertising companies.

By all means let’s solve it from the technical side - but also lets regulate privacy so everyone gets it not just people paranoid/technical enough to use the latest/best privacy respecting tools.

Re: Web fingerprinting is worse than I thought (2023)

#48

Earlier quoted context omitted.

probably just ignored them. Aren't those privacy protections basically you saying "pretty please don't track me?"

If we're exploring the space of "they're lying" isn't a simpler explanation be that they're lying about their revenue?

The consequences for lying about revenue as a public company are many orders of magnitude worse than lying about compliance with some private contract or TOS.

Re: Web fingerprinting is worse than I thought (2023)

#49
post #12
post #3

Isn't fingerprinting covered by GDPR in a similar way to how cookies are? So in theory you should be able to opt out, at least as an EU user.

Those obnoxious "cookie" dialogs? Yes, they cover fingerprinting as well. E.g. some innocent company wants to keep your precise geolocation data for 12 years: https://x.com/dmitriid/status/1817122117093056541 Cookie banners were never about cookies or privacy. The industry designed them with some very explicit goals in mind: to force users to opt-in to pervasive tracking, and to blame "how unusable web has become" on…

Cookie banners were a result of an EU ePrivacy "cookie law" from 2002, 16yrs prior to GDPR and before fingerprinting.
Post reply on HN