Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The privacy nightmare of browser fingerprinting

kevinboone.me

Post reply on HN
Print view View original

41–50 of 456 posts

Re: The privacy nightmare of browser fingerprinting

#41

Post by Terretta »

prymitive wrote: post #15
doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

> I'm not going to pay $5/month for every blog that I occasionally read Would you pay per view? Most people (me included) would probably hesitate to say yes, because we’re used to not paying for that. But what if it meant that ad based model is gone and everything you buy is cheaper because the price does not include the cost of running ads?

> what if ... everything you buy is cheaper because the price does not include the cost of running ads?

Except in practice we see the opposite.

There's something interesting going on with companies when they want to get paid directly versus by ads: they demand 3x - 4x or more for subscriptions or pay per view versus what they make from ads.

Easiest place to see this is ad supported non-linear TV in the years you could get without ads, or with ads. You pay significantly more to not see the ads, than they make from the ads.

Perhaps this is justified because ad-free subscriptions reduce the audience size for ad buys, but when you look at the numbers watching with ads versus paying, it wouldn't seem like the "no ads" buyers make a dent in whatever pricing tier.

In the 90s when we were young and naive, we imagined a library card model, with a library fee and then you have fractions of a cent cost to read a post, and using (hand waving) technology to uncouple viewing history from payables to content creators. That, or the British TV license model, an Internet license of some kind.

It's curious to me the ad networks haven't gotten together to preemptively offer this. Arguably Brave tried, but from an adversarial (to the ad companies) stance. It would work better from the inside with a simple regulation: if you serve ads for ad-supported content, you have to participate in the library card system at CPM rates no greater than you receive for ads to skip the ads for card holders.

Re: The privacy nightmare of browser fingerprinting

#42

Post by Terretta »

morkalork wrote: post #21
prymitive wrote: post #15

Earlier quoted context omitted.

> I'm not going to pay $5/month for every blog that I occasionally read Would you pay per view? Most people (me included) would probably hesitate to say yes, because we’re used to not paying for that. But what if it meant that ad based model is gone and everything you buy is cheaper because the price does not include the cost of running ads?

Hard to say, there's no shortage of enticing looking medium articles that are superficial and worthless. I would not pay per view that trash even though there are good ones buried in the pile.

"If you thought click-bait was bad before..."

Re: The privacy nightmare of browser fingerprinting

#43

Post by yegle »

doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

https://en.wikipedia.org/wiki/Google_Contributor was the ideal solution IMHO.

Re: The privacy nightmare of browser fingerprinting

#44

Post by notatoad »

prymitive wrote: post #15
doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

> I'm not going to pay $5/month for every blog that I occasionally read Would you pay per view? Most people (me included) would probably hesitate to say yes, because we’re used to not paying for that. But what if it meant that ad based model is gone and everything you buy is cheaper because the price does not include the cost of running ads?

The PPV model has been tried a bunch of times, and it always turns out that the rate people are willing to pay per view is not a rate that is high enough to be a viable revenue source for the content owners.

it takes a lot of $0.10-$0.25 views to make up for the loss of a $5/month recurring revenue stream that might last for years.

Re: The privacy nightmare of browser fingerprinting

#45

Post by mathgradthrow »

tetha wrote: post #40

It reminds me of a game we played with students of data classification algorithms like ID3: How many yes/no questions do we need to uniquely identify everyone in this room? With like 12 students, that's 4 bits, and it often ends up with 2-3 questions. It starts off with the obvious ones - man/woman/diverse, but then a realization comes in: An answer usually contains more information than just that one bit. If you hav…

>An answer usually contains more information than just that one bit.

Isn't the point to ask yes or no questions?

Re: The privacy nightmare of browser fingerprinting

#46

Post by Retr0id »

johnisgood wrote: post #18
peetistaken wrote: post #9

Earlier quoted context omitted.

I built a nice tool to visualize that: https://tls.peet.ws . Its not that secret anymore though, more and more libraries are starting to allow spoofing for browser tls configs. There isnt really a cat/mouse game here - once you match the latest chrome, there is nothing to fingerprint

I do not think I understand that website. I see that JA3 always gets changed after refresh, but not sure what JA3 is. Why is it always different, and is it good or bad?

Modern browsers randomise parts of the handshake, which results in an unstable ja3. ja4 and others normalize the relevant details to make the fingerprint constant again.

Re: The privacy nightmare of browser fingerprinting

#47

Post by gedy »

kasabali wrote: post #27
doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

> I'm not quite sure what the answer is. It's very simple, it's what they've been doing in print media for centuries: contextual advertising.

Yes seriously - I'm old enough to have enjoy reading magazines that had ads throughout them. They were fine.

I'd venture to say contextual advertising would be more effective than whatever we've been trying to squeeze out of fingerprinting etc. All this supposed "data" they are gathering feels like a scam perpetuated by ad companies about how important it is to the people who buy ads. It's not.

Even Facebook and Instagram, which pretty much should know you to a tee is completely ineffectual at advertising to me - like at all.

Re: The privacy nightmare of browser fingerprinting

#48

Post by mike_d »

ArcHound wrote: post #2

You missed one of our best guarded secrets: ja3 hashes and their successors. Basically, we can identify browsers based on the supported ciphers in TLS handshake (order matters too AFAIK). Then when your declared identity is not matching the ja3 hash, you're automatically suspicious, if not blocked right away. I think that's the reason for so many Capchas.

JA3/JA4 are useless now.

At best they identify the family of browser, and spoofing it is table stakes for bad actors. https://github.com/lwthiker/curl-impersonate

Re: The privacy nightmare of browser fingerprinting

#49

Post by lanfeust6 »

prymitive wrote: post #15
doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

> I'm not going to pay $5/month for every blog that I occasionally read Would you pay per view? Most people (me included) would probably hesitate to say yes, because we’re used to not paying for that. But what if it meant that ad based model is gone and everything you buy is cheaper because the price does not include the cost of running ads?

This is exactly what I want. I don't really care to subscribe to most written media (I do in some cases) but once in awhile an article grabs my attention and I would shell out to read it.

Re: The privacy nightmare of browser fingerprinting

#50

Post by IshKebab »

ekjhgkejhgk wrote: post #36

The core of the problem is that we've made this behavior of "run javascript that pulls more javascript and then run that too" the default. Stallman was right, as always.

Does he have a strong stance of JS in the browser? In any case, I don't think many people would agree that the dubious extra privacy you gain from blocking that is really worth breaking half the web. Fingerprinting is not too hard even without JS.
Post reply on HN