Web fingerprinting is worse than I thought • Hacker News Board

Re: Web fingerprinting is worse than I thought

#441

Post by Zurrrrr » Tue, Mar 21, 2023, 5:13 PM UTC

msm_ wrote: post #439

Zurrrrr wrote: post #430

Earlier quoted context omitted.

> If your product or service is accessible to EU citizens, in the EU market, then you need to abide by the laws of the EU It's not that simple though. If I offer a website in the US, I can collect the info of anyone that visit it as long as I am not breaking US law. If the EU doesn't like that, then they can block my site. They claim though that I am subject to their law if I harness the data of Europeans.

Yes, this is what they claim. As long as your company has no physical offices in the EU you probably don't have to worry about it. If your company grows bigger, you probably should.

That was my only point, that they claim something which simply is not true.

Re: Web fingerprinting is worse than I thought

#442

Post by noduerme » Tue, Mar 21, 2023, 5:15 PM UTC

xkcd1963 wrote: post #349

noduerme wrote: post #47

Look, forget about threat models. It's relatively trivial these days to avoid fingerprinting attacks if you want to (as a private, web browsing individual). I use fingerprinting actively in enterprise apps as a form of silent 3FA. It's a useful backstop. If I have a user who forgot their password but retrieves it via email, I'll usually let them pass if their fingerprint matches one of their priors; otherwise my soft…

You seem to have a conflict of interest here. How can you accept this for employee/employer but at the same time say it's not ok for a person to submit fingerprinting? Employees are also persons.

Because the software is only allowed to be used on company computers and a few personal devices which have to be approved by upper management. It isn't fingerprinting the person or the public. It's checking that the software is running on a known/approved machine.

Re: Web fingerprinting is worse than I thought

#443

Post by A4ET8a8uTh0 » Tue, Mar 21, 2023, 5:15 PM UTC

user- wrote: post #426

nebula8804 wrote: post #421

Earlier quoted context omitted.

Stallman shot himself in the foot by having a text only blog that was easily searchable when it came time for the wolves to cancel him. A crappy proprietary blog or thousands of hours of ranting via Youtube videos ironically would have slowed down the haters and maybe even cause them to miss things with which to cancel him with. Its hilarious in an ironic way. Bonus points if the cancelers were running GNU software.…

You make it sound like he said something mildly insensentive. He was "cancelled" for making pro-cp comments, and for literal decades of being a creep. https://twitter.com/_sagesharp_/status/1173637138413318144

And how does that invalidate his technical expertise?

More importantly, was he charged and convicted with anything?

I am getting really tired of this public opinion tribunal, where mere accusation is enough to get a person out of their position. This is not how this is supposed to work at all.

Re: Web fingerprinting is worse than I thought

#444

Post by hooverd » Tue, Mar 21, 2023, 5:16 PM UTC

jonhohle wrote: post #357

Until everyday people realize they’re being stalked, I don’t know what will change. I am seriously thinking about trying to go through the proposition process in my state to forbid selling of data (this should already run afoul of wiretapping laws, imho). I thought having an ad campaign that targeted subgroups very specifically and boldly might be enough drum up public interest. Something like: “Hello $name from $cit…

Ad platforms aren't that stupid.

Re: Web fingerprinting is worse than I thought

#445

Post by bauruine » Tue, Mar 21, 2023, 5:31 PM UTC

pbhjpbhj wrote: post #440

bauruine wrote: post #267

Earlier quoted context omitted.

No ISPs don't need to do NAT but you can if you like. You also don't have to do NAT with IPv4 if you only have one device or get a subnet from your ISP. It's just done because we don't have enough v4 addresses. They can do subnet to customer correlation. The IPv6 is randomly generated by your device if you use SLAAC. But if your ISP is an adversary you have pretty much lost anyway. If they provide you with a router t…

I'm sorry, you've misconstrued the question. The context is the privacy extension to IPv6 under RFC 4941. So, my question was would ISPs need to do NAT in order to provide that extension -- I only skimmed the RFC but there was no other obvious way to me for it to be provided that wouldn't fall to an adversarial ISP because it appears they must do NAT to make that work? AIUI ISPs provide a fixed prefix to customers. S…

They they don't need NAT that is simply called routing. The ISP sends every packet that is in your assigned /64 to your routers IP address. It's called prefix delegation [0]

Yes they get a /32 by default (at least in RIPE) larger allocations need justification. But there are 2^32 /64 subnets in a /32 so every ISP gets a complete IPv4 internet of /64 they can assign to their customers at will. Your devices assigns itself a random IP address from that /64 network your ISP gave you via prefix delegation.

[0] https://en.wikipedia.org/wiki/Prefix_delegation

Re: Web fingerprinting is worse than I thought

#446

Post by TheRealDunkirk » Tue, Mar 21, 2023, 5:43 PM UTC

jonhohle wrote: post #357

Until everyday people realize they’re being stalked, I don’t know what will change. I am seriously thinking about trying to go through the proposition process in my state to forbid selling of data (this should already run afoul of wiretapping laws, imho). I thought having an ad campaign that targeted subgroups very specifically and boldly might be enough drum up public interest. Something like: “Hello $name from $cit…

> Until everyday people realize they’re being stalked, I don’t know what will change.

FTFY: People already know; nothing will change.

Many of the things that are happening (at least in the US) are deeply, deeply unpopular, but are not changing, and show no signs that they are even susceptible to change. Fortune-sized companies, the 1%, and the deep state are calling the shots, despite how much can be seen in real time, through things like Twitter and TikTok. I've actually had to pull back from Twitter because of all the things that are obviously beyond the pale, yet will never change. (Snowden, Assange, et. al.)

Re: Web fingerprinting is worse than I thought

#447

Post by TheRealDunkirk » Tue, Mar 21, 2023, 5:49 PM UTC

mihaic wrote: post #194

Fingerprinting is doing terrible things for big-tech data collection, and at the same time it's excruciatingly hard to protect against bots, spammers, fraudaters etc without it. Few people seem to try to reconcile this, since neither side cares about the other. I personally think that discussion about fingerprinting as raw tech, without mentioning the size of the company collecting the date or the purpose is meaningl…

> I can't really see a good solution without a coordination of regulation...

Totally agree that this is perfectly within the government's purview, and they should be doing something about it. But, as with anything else in the US, until a Fortune 100, some few 1%-ers, or the deep state MIC wants it, we're not going to be getting it.

Re: Web fingerprinting is worse than I thought

#448

Post by lwhi » Tue, Mar 21, 2023, 5:57 PM UTC

_siis wrote: post #179

lwhi wrote: post #135

Earlier quoted context omitted.

I think it absolutely does work. We need better regulation to temper capitalism.

That's very naive, and you need to educate yourself about what capitalism actually is because it certainly isn't what you are saying. You've misused that term.

No. You're incorrect.

We need limits to prevent capitalism from doing its worst.

It's only fair that we all live and work with the same limits.

This is the type of regulation that is necessary.

Re: Web fingerprinting is worse than I thought

#449

Post by AtNightWeCode » Tue, Mar 21, 2023, 6:00 PM UTC

"Given there are companies selling fingerprinting as a service, if you want to really protect yourself from fingerprinting, you should use Tor Browser or Firefox with resistFingerprinting=true."

Fingerprinting services tries to figure out browsing settings. Since very few people have this feature enabled. You might be easier to fingerprint by enabling it. A metric that historically been used for fingerprinting is the "do not track" feature which is a bit of irony.

Re: Web fingerprinting is worse than I thought

#450

Post by NoZebra120vClip » Tue, Mar 21, 2023, 6:00 PM UTC

zamubafoo wrote: post #63

As the years pass, I keep thinking back and realize that Richard Stallman was right all along: > For personal reasons, I do not browse the web from my computer. (I also have not net connection much of the time.) To look at page I send mail to a demon which runs wget and mails the page back to me. It is very efficient use of my time, but it is slow in real time.

& . . . . @

"Mail for you, sir!"