Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

421–430 of 524 posts

Re: Web fingerprinting is worse than I thought

#421

Post by nebula8804 »

Technotroll wrote: post #100
zamubafoo wrote: post #63

As the years pass, I keep thinking back and realize that Richard Stallman was right all along: > For personal reasons, I do not browse the web from my computer. (I also have not net connection much of the time.) To look at page I send mail to a demon which runs wget and mails the page back to me. It is very efficient use of my time, but it is slow in real time.

I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built…

Stallman shot himself in the foot by having a text only blog that was easily searchable when it came time for the wolves to cancel him. A crappy proprietary blog or thousands of hours of ranting via Youtube videos ironically would have slowed down the haters and maybe even cause them to miss things with which to cancel him with. Its hilarious in an ironic way. Bonus points if the cancelers were running GNU software. :D

Re: Web fingerprinting is worse than I thought

#423

Post by shantnutiwari »

jonhohle wrote: post #357

Until everyday people realize they’re being stalked, I don’t know what will change. I am seriously thinking about trying to go through the proposition process in my state to forbid selling of data (this should already run afoul of wiretapping laws, imho). I thought having an ad campaign that targeted subgroups very specifically and boldly might be enough drum up public interest. Something like: “Hello $name from $cit…

>> I thought having an ad campaign that targeted subgroups very specifically a

This has been tried by a guy who placed Facebook ads like these. FB blocked his account in a few hours.

So good in theory, wont work in practice

Re: Web fingerprinting is worse than I thought

#424

Post by fnordpiglet »

matheusmoreira wrote: post #399
smirgel wrote: post #251

Earlier quoted context omitted.

To me this seems extremely elitist. Non-technical people deserve to have their personal data stolen because they don't know about javascript for example?

Have you ever tried to talk to "non-technical" people about this subject? They treat you like you're one of those tinfoil hat crazies. At this point I'm 100% OK with us being the only ones able to protect ourselves. We warned them and they didn't care. Allow them to remain uncaring. We don't have to help everyone. People must want to be helped.

What they want is things to be easy and require a low to non existent cognitive load. You start confusing them with details of what could happen etc and all the gyrations they have to do to avoid it, they tune out and look at you like a tinfoil hat crazy (are you sure they aren’t right?)

As the techno elite, it’s actually our job to create the underlying reality everyone else participates in when using technology. So, it is our responsibility to care, if you care. It’s not theirs - they’re just here for the party. But that doesn’t mean they’re sheep for slaughter, because there are plenty of folks ready to slaughter them for money.

It’s our ability to understand the issues and to actually improve them that uniquely makes it important for us to care. But we can’t expect people to turn off the cat video for long enough to listen to us nerd at them, and we really can’t expect them to do something complex to avoid something they don’t understand or care about. What our challenge is is - how do we improve internet technologies sufficiently that everyone enjoys what we know is important but we don’t require them to care? That’s how you build a better emergent reality.

I’m glad to have had a hand in the Netscape and Mozilla’s launch and have watched Firefox for years with pride. They are the closest to a mainstream any man product that even remotely cares. WebKit safari is a close second. I hope we all find ways to develop the tech platforms that protect as well.

Re: Web fingerprinting is worse than I thought

#425

Post by GoblinSlayer »

zamnos wrote: post #214
kuschku wrote: post #189

Earlier quoted context omitted.

Not if you disable JS, cause the website then can't see any of these customizations.

Except that disabling JavaScript is an anomaly all on its own. The dozens of users running without JavaScript might not be individually fingerprint able but it's still a small enough cohort that I don't know how much I'd lean on that. Figure in the user agent string and it's probably unique enough a subgroup to sell ads to.

But ads don't work without javascript.

Re: Web fingerprinting is worse than I thought

#426

Post by user- »

nebula8804 wrote: post #421
Technotroll wrote: post #100

Earlier quoted context omitted.

I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built…

Stallman shot himself in the foot by having a text only blog that was easily searchable when it came time for the wolves to cancel him. A crappy proprietary blog or thousands of hours of ranting via Youtube videos ironically would have slowed down the haters and maybe even cause them to miss things with which to cancel him with. Its hilarious in an ironic way. Bonus points if the cancelers were running GNU software.…

You make it sound like he said something mildly insensentive. He was "cancelled" for making pro-cp comments, and for literal decades of being a creep. https://twitter.com/_sagesharp_/status/1173637138413318144

Re: Web fingerprinting is worse than I thought

#427

Post by msm_ »

dinkleberg wrote: post #334
chrisMyzel wrote: post #322

I find it scary coming back to the fingerprint.js site after years and still being correctly identified and see the exact dates I visited

Interesting, despite me not using a VPN, it has me “identified” in the totally wrong location (in fact, multiple wrong locations within minutes).

Maybe your fingerprint is just common? Location probably comes from geoip.

Re: Web fingerprinting is worse than I thought

#428

Post by charcircuit »

zelphirkalt wrote: post #261
charcircuit wrote: post #175

Earlier quoted context omitted.

(1) There is nothing wrong with sending a password via email. Even if you send a reset link instead an email provider could steal that too. (2) The server gets sent your password every time you log in. You shouldn't rely on a server operator not knowing your password. (3) You can tune how sensative the system is in response to changes in the fingerprint. Even if their in a failure to match that just means authenticat…

(1) Best that would be a one usage link though, so that a user can detect, whether the link was stolen from their inbox. I think you also did not get my point: The service should not know the password at all. Usually not even initial passwords for any account. It is simply a bad practice to ever have knowledge about user passwords, except for a salted hash. So I say you are wrong. (2) The server gets send the passwor…

(1) How can the user detect it? The service can request a password reset at any time. Most alerts go through emails which the provider can hide. It's only a bad practice since password reuse exists and people trust services not to exploit that fact.

(2) That is how it usually works.

(3) You can collect the information for security purposes just fine under the GDPR.

Providing a better user experience while maintaining a similar amount of security is a net positive

Re: Web fingerprinting is worse than I thought

#429

Post by charcircuit »

alkonaut wrote: post #275
charcircuit wrote: post #165

Earlier quoted context omitted.

To prevent spam. If someone is spamming your site how do you tell if a request is coming from a legitimate user or if it is coming from the spammer. Fingerprints are how you can tell the two apart.

I thouht that was most commonly dealth with with a first party cookie. I.e. show the captcha to anyone who doesn't have the cookie. At least that's how it feels when you browse incognito.

What happens if they solve the captcha? If a captcha service costs $0.02 per 1000 captchas that means they can post. That means it costs $10 to post a spam message every minute for an entire year if they get banned after every post. If you want to annoy some site owner that would be an easy way to do so.

Re: Web fingerprinting is worse than I thought

#430

Post by Zurrrrr »

akie wrote: post #301
Zurrrrr wrote: post #213

Earlier quoted context omitted.

IIRC they do try to claim it applies outside of Europe; they say their laws apply to any entity processing data of EU citizens, regardless of where the data or website actually lie.

I think it's well within the rights of the EU to legislate in which way the data of its citizens is processed. If your product or service is accessible to EU citizens, in the EU market, then you need to abide by the laws of the EU. It's no different for physical or virtual products.

> If your product or service is accessible to EU citizens, in the EU market, then you need to abide by the laws of the EU

It's not that simple though.

If I offer a website in the US, I can collect the info of anyone that visit it as long as I am not breaking US law.

If the EU doesn't like that, then they can block my site.

They claim though that I am subject to their law if I harness the data of Europeans.

Post reply on HN