Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

401–410 of 524 posts

Re: Web fingerprinting is worse than I thought

#401

Post by SV_BubbleTime »

mdorazio wrote: post #315
aktuel wrote: post #305

If I have a certain phone model with updates applied. Is there something that distinguishes me from other people with the same phone and browser version other than the IP address?

I, too, would like to know this and find it odd it wasn't mentioned at all. Most web traffic these days is from mobile devices, not desktops/laptops. And Apple at least seems to try doing a decent job of obfuscating trackable info by default on top of massive numbers of people having the same device (probably not true for Android).

I have been trying Apple devices for an hour now. Nothing I can do gets them to pass the eff or linked tracker sites.

Firefox, VPN, privacy extensions, nothing works.

Apple has work to do.

Re: Web fingerprinting is worse than I thought

#402

Post by pr0zac »

kapsteur wrote: post #31

You can try https://www.amiunique.org/fp to get a view of all params can used to track you

I like this site for the info on how tracking is done it provides but the data set it generates uniqueness from is really tiny and differs a lot from real world browser makeup.

For instance it claims iOS is 4.63% of users and Safari is 3,42% when all other more complete statistical sources put those numbers at closer to 20%-30%.

Re: Web fingerprinting is worse than I thought

#403

Post by omginternets »

jonhohle wrote: post #357

Until everyday people realize they’re being stalked, I don’t know what will change. I am seriously thinking about trying to go through the proposition process in my state to forbid selling of data (this should already run afoul of wiretapping laws, imho). I thought having an ad campaign that targeted subgroups very specifically and boldly might be enough drum up public interest. Something like: “Hello $name from $cit…

I would consider donating to such an effort. I'm sure there are others like me.

Re: Web fingerprinting is worse than I thought

#404

Post by Arnt »

dgroshev wrote: post #235
bigfudge wrote: post #114

Earlier quoted context omitted.

Even if this were the case - which I don’t actually believe, but… - it would be straightforward for that law to also constrain these purposes and prevent data sharing with non-worthy operations. At present it’s basically a free for all.

That is literally what GDPR is. Somehow it got reduced to cookie banners in HN psyche, but the whole idea of GDPR is to make sure that the data can be collected and used for well defined purposes that are either necessary to provide a service (preventing CC fraud would qualify), or are explicitly consented to.

I think the misunderstandings about the GDPR (even many smart people don't get it) prove that designing and writing such a law is difficult and the result has to be complex.

IMO the GDPR is good. But… it is poorly understood by many affected people . IMO if a law is poorly understood by the people it affects, then one should assume the law to be at fault, not the people. IMO it's good but I'm not happy.

4×IMO! Wow.

Re: Web fingerprinting is worse than I thought

#405

Post by SV_BubbleTime »

reportgunner wrote: post #142

Seems like a disguised ad for that fingerprinting service. Resist fingerprinting was already set to true in my Firefox. "Worse than I thought" apparently means "I thought there was no fingerprinting but I found out there is fingerprinting."

Try to get a non-unique on iPhone. I’ll admit it’s worse than I thought.

Re: Web fingerprinting is worse than I thought

#406

Post by SV_BubbleTime »

switch007 wrote: post #238

On iOS I visited fingerprint.com on safari twice and then opened used Brave with its “Block fingerprinting” setting enabled and it registered it as my third visit! They should label it as “resist” as it’s a lot more honest And https://www.amiunique.org/ says I’m unique in Brave compared to “nearly” in Safari haha

Same. I did iPhone with VON change, cleared cache, firefox or IOS, blocking extensions, and… it gets me every time.

Re: Web fingerprinting is worse than I thought

#407

Post by SV_BubbleTime »

sltkr wrote: post #243
pbhjpbhj wrote: post #58

Earlier quoted context omitted.

Thanks, can you answer a couple of questions: So carriers (ISPs) still would need to do NAT, the RFC didn't seem (I skimmed) explicit? Isn't the removal of processing traffic a large part of the sell for IPv6. Also, surely the ISP can sell IP-to-user correlation lists as I assume they do now? They can presumably do it anonymously bit with some other party seeking the other part of the data that allows deobfuscation o…

The way it works is that the ISP assigns the home user's router a prefix (e.g. 64 bits). Devices on the home network pick a random address within that prefix, and regenerate it periodically, keeping the old address alive for a while too. Only the router needs an IPv6-to-MAC-address map (it always needed that, this was no different with IPv4). The ISP just has a static route that sends all traffic matching the prefix…

Hmm, I feel like I should have known this! Nice clear explanation.

Re: Web fingerprinting is worse than I thought

#408

Post by bdhcuidbebe »

ambicapter wrote: post #373
alexriddle wrote: post #247

Earlier quoted context omitted.

I've had to implement this - we have a web app used by engineers in the field where signal is often not great. We got lots of complaints about image uploads as for a typical job there would be potentially 100+ images that needed to be uploaded (multiple assets with 2 before and 2 after photos per asset). iPhone defaults to uploading a large image which can take ages to upload. We implemented a canvas based solution w…

I was under the impression that base64 encoding doesn't reduce file size of an image at all, rather it sometimes increases it. That wasn't the point of using base64 string, right?

> a base64 string representing a compressed image

Parent explained that the base64 encoding held compressed data.

Re: Web fingerprinting is worse than I thought

#409

Post by matheusmoreira »

grishka wrote: post #308
nordsieck wrote: post #285

Earlier quoted context omitted.

> I think unless we lock down new APIs that aide in fingerprinting to only be accessible to WebAssembly and let people block or enable WASM theres not too much else we can do. IMO, it should be enough if incognito mode presents an identical fingerprint on everyone's browser.

It's not that easy to "present a fingerprint" without compromising the user experience. Sure, you could remove all those PWA and pretend-OS APIs and hardly anyone would notice, but what about things like viewport size and font rendering? You can't exactly hide them from a website.

> what about things like viewport size and font rendering? You can't exactly hide them from a website.

Of course you can. Viewport? Just return fake viewport data containing the most statistically common display properties. Website renders incorrectly? They only have themselves to blame, shouldn't have abused that data for hostile purposes. Data is a privilege, we can and should take it away. Fonts? Just force everything to use Noto Sans or Noto Mono. Everything will render correctly. Maybe the designer's vision won't be fully realized but that's not a problem.

Re: Web fingerprinting is worse than I thought

#410

Post by cryptoboid »

jonhohle wrote: post #357

Until everyday people realize they’re being stalked, I don’t know what will change. I am seriously thinking about trying to go through the proposition process in my state to forbid selling of data (this should already run afoul of wiretapping laws, imho). I thought having an ad campaign that targeted subgroups very specifically and boldly might be enough drum up public interest. Something like: “Hello $name from $cit…

Pretty much what Signal did a few years ago [1], but on a bigger scale. Sadly Facebook banned their Ads account and couldn't do it further, would be interesting if someone tries the same.

[1] https://signal.org/blog/the-instagram-ads-you-will-never-see...

Post reply on HN