Live data from Hacker News

The privacy nightmare of browser fingerprinting

kevinboone.me

431–440 of 456 posts

Re: The privacy nightmare of browser fingerprinting

#431
post #401

Earlier quoted context omitted.

Those are some rose tinted glasses. Not having to drive a check to the city utility office to pay the power bill is quite the improvement.

You can mail checks you know.

I will happily let the internet fingerprint my browser to not have to go back to mailing checks. I am guessing this is true of most non-HN people.

Re: The privacy nightmare of browser fingerprinting

#432
post #320

Isn't it forbidden on the EU anyways - thanks to GDPR?

Somewhat. Opt-in is required for marketing purposes. Fingerprinting counts as PII due to its potential to personally identify an individual. Other legitimate uses, such as fraud detection, do not require opt-in.

Re: The privacy nightmare of browser fingerprinting

#433
post #174

Has anyone ever thought that RSS doesn't have a fingerprint? Because the sites that still offer feeds, at least those for which a feed makes sense, well, you can read them comfortably via RSS.

No JS fingerprint - your browser version and IP are still visible.

Re: The privacy nightmare of browser fingerprinting

#434

On the pros of fingerprinting: it's practically the only consistent tool to prevent malicious use in certain usecases, such as app hosting and similar bot protection. Email validation doesn't work. Ip blocking doesn't work. Captcha? Kind of. Fingerprinting? Very efficient.

Its efficient until you get bots that rotate fingerprints with every request. Then you need to move to behavioural metrics to see if they look different to regular users of the site.

Re: The privacy nightmare of browser fingerprinting

#435
post #7
post #5

Earlier quoted context omitted.

Here you go: https://developers.cloudflare.com/bots/additional-configurat... It's a better explanation that I can provide.

Oh! Now I wonder, if crowdsec could issue bans based on that

I'm not sure about JA3, but JA4 is basically fixed for all recent Chrome versions across many platforms so you definitely would not want to ban that. JA3/4s are basically just good at detecting people using python who are pretenting to be Chrome. And even that's patchable with packages like curl_cffi

Re: The privacy nightmare of browser fingerprinting

#436
post #347

Earlier quoted context omitted.

Do you have a repo for this?

Just use any Firefox browser (I prefer Floorp) with the Temporary Container Plus extension ( https://addons.mozilla.org/en-US/firefox/addon/temporary-con... ) and set automatic mode on.

Awesome, thx.

Re: The privacy nightmare of browser fingerprinting

#437
post #303

Earlier quoted context omitted.

> Randal had a long career of good takes, until around 2016 when they stopped being objectively good. Specifically it was at this point in 2016: https://xkcd.com/1756/ > I’m not kidding at all, that my guess is he was doing drugs and stopped. I don’t know if he stopped or started, but something changed.

Coming our against a candidate that literally said the words "grab them by the pussy" is a bad thing?

No, but not understanding your audience, not being able to not divide your fanbase for absolutely no reason, and doing all that for Hillary Clinton who history will not at all be kind to…

His traffic and hot takes dropped and his influence declined to almost nothing… maybe those things aren’t unrelated?

Re: The privacy nightmare of browser fingerprinting

#438

Earlier quoted context omitted.

Note that one very simple mitigation for browser fingerprinting is to simply run different browsers for "the business Internet" and "the fun Internet". You may need to do this anyway, because so many business sites only work on Chrome, with Javascript enabled, no VPN, no adblocker, and pop-ups enabled. But then you might use Chrome (which tracks everything you do anyway) for all your banking, SaaS, government tasks,…

I don't think separate browsers is a very effective mitigation. If both browsers are running on the same machine, from the same ip address, using the same email address for logins, the same phone number for 2FA, it will be pretty clear that both browsers represent the same person. Even cross-device identity tracking is a real thing.

In general you shouldn't be logging in to any of the "fun" sites. If you do, you should create a burner email address and separate logins (and obviously separate passwords) for each site. A lot of the "fun" Internet doesn't require 2FA, but for sites that do (which is an increasing number of social media providers), I'd highly recommend getting a Google Voice number and using that. That shifts the trust boundary to Google, who is going to have all your info anyway, rather than dozens of fly-by-night websites.

IP address is covered by VPN or Tor.

Re: The privacy nightmare of browser fingerprinting

#439

We really need a browser (or several) that aren't effectively controlled by private interests (such as corporations). Basically they are used as spy-tools. Many anti-features are pushed into them - a simple example is the disable-right-click functionality. I do understand that some of this have a useful functionality (for instance during an exam on-campus-site, to restrict what the students may do), but I always hate…

> a simple example is the disable-right-click functionality This is a part of a W3C browser spec and every web browser has to implement it. But you're right that people writing the spec work for companies selling web browsers.

Every browser has to implement it but there's nothing saying they can't let the user disable that functionality, either.

Re: The privacy nightmare of browser fingerprinting

#440
post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

You could just use `privacy.resistFingerprinting` in Firefox, tweak a few other settings, install uBlock Origin/uMatrix and you get the same thing, unless I'm missing something?
Post reply on HN