Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

481–490 of 524 posts

Re: Web fingerprinting is worse than I thought

#481

Post by seqizz »

perihelions wrote: post #202
chaosite wrote: post #4

It's important to know that the mentioned "resistFingerprinting" breaks a lot of the web. Examples include the back button, uploading photos on some websites uploads random data instead of the photo, etc.

It also breaks page zoom. The user's preferred zoom level for a domain isn't preserved between new-tab page loads, but resets itself every time. (I'm guessing it was too much implementation work to separate out this feature: to preserve normal, expected UI behavior client-side, while presenting a fake pagezoom value to scripts. That would degrade only a handful of (poorly-designed, script-layout) websites, rather tha…

Yeah I enabled the option yesterday after learning, today I disabled it back since NOPE without site-specific zoom settings retained the web is too inconsistent for me.

Re: Web fingerprinting is worse than I thought

#482

Post by zelphirkalt »

charcircuit wrote: post #428
zelphirkalt wrote: post #261

Earlier quoted context omitted.

(1) Best that would be a one usage link though, so that a user can detect, whether the link was stolen from their inbox. I think you also did not get my point: The service should not know the password at all. Usually not even initial passwords for any account. It is simply a bad practice to ever have knowledge about user passwords, except for a salted hash. So I say you are wrong. (2) The server gets send the passwor…

(1) How can the user detect it? The service can request a password reset at any time. Most alerts go through emails which the provider can hide. It's only a bad practice since password reuse exists and people trust services not to exploit that fact. (2) That is how it usually works. (3) You can collect the information for security purposes just fine under the GDPR. Providing a better user experience while maintaining…

(1) A tool like for example https://github.com/pglombardo/PasswordPusher self-hosted offers a way for the user to detect, whether their password has been seen before.

(2) Are you missing the point? "That is how it usually works." -- So why then send a password to an e-mail inbox, like I said a location often controlled by third party and often one with no good record of respecting privacy, if you can completely avoid that?

(3) OK, seems like we did not learn about consent. Why don't you ask your users, whether they are OK with it first, instead of assuming and basing on what is legally possible? Is ethics something too far out of reach?

Lastly a word about what you call security: Your so called security is observed often enough to result in inaccessible accounts. "Extra strict" usually means something along the lines of "oh, now I am going to require your phone number, to send you a message on a second channel to make sure" or "solve these captchas for this untrustworthy third party provider and I will trust their word about you having solved it correctly" (again being tracked of course ...) or similar things. Again circumventing consent, because now it becomes an extortion, extracting more personal data, so that the user can access their account. Your so called security makes for a real shitty user experience and punishes the user for ever switchting their browser.

So what does your "extra strict" mode entail? How are you going to be "extra strict", without any extortion? Are you implementing your own captachas by any chance? Or something similar?

Re: Web fingerprinting is worse than I thought

#483

Post by joveian »

mhio wrote: post #466
joveian wrote: post #218

Earlier quoted context omitted.

I don't think it would be that hard, start with "no javascript". Add a better compataiblity method. Ideally add ways to get the browser to do common stuff like resize images, although even saving that for "app mode" would be a big improvement on the current situation. Making the standard is easy, it is getting anyone to follow it that is difficult. Sites could already work great without javascript if they wanted to b…

"No javascript" is a non starter in my opinion. That's a very simple on/off switch that is already available but has very little buy in. As you noted, "JS off" mode requires a shift in what HTML/CSS are capable of on their own. > Making the standard is easy, it is getting anyone to follow it that is difficult That's my point, those two parts aren't disconnected. The standard isn't useful (or a standard really) until…

There are some improvements that could be made to HTML/CSS but it is already possible to do a bunch of fancy stuff with no javascript. I don't think it is possible to avoid tracking while allowing javascript, unless only the most trivial javascript, and for that there is likely to already be HTML/CSS alternatives. The stuff you are talking about is already available if you dig into the settings, although of course picking and choosing your own collection of settings like I do is itself a unique identifier. But there need to be a bunch more restrictions to actually prevent fingerprinting.

I think the lack of buy in is because the people who would need to buy in are the ones pushing the tracking. Rather than a new standard something like a directory of sites that work well without javascript (and search engine just searching those sites) with enough people using it for it to be an advantage to be listed seems to me to be more likely to be effective.

Re: Web fingerprinting is worse than I thought

#484

Post by DoItToMe81 »

user- wrote: post #426
nebula8804 wrote: post #421

Earlier quoted context omitted.

Stallman shot himself in the foot by having a text only blog that was easily searchable when it came time for the wolves to cancel him. A crappy proprietary blog or thousands of hours of ranting via Youtube videos ironically would have slowed down the haters and maybe even cause them to miss things with which to cancel him with. Its hilarious in an ironic way. Bonus points if the cancelers were running GNU software.…

You make it sound like he said something mildly insensentive. He was "cancelled" for making pro-cp comments, and for literal decades of being a creep. https://twitter.com/_sagesharp_/status/1173637138413318144

Actually, he was "cancelled" by people lying about him supporting Epstein and saying child rape is good, neither of which were even close to being uttered.

The disingenuous nature of this all is why he's back in his foundations again.

Re: Web fingerprinting is worse than I thought

#485

Post by eashman »

logifail wrote: post #414
cptskippy wrote: post #411

Earlier quoted context omitted.

> It also was a time where companies were paranoid into letting employees access the internet, but at the same time had abysmal security. I recall we had a crappy firewall that would collapse under the load of NAT for the 100ish employees and so executives got static IPs mapped to their machines. The late 90s and 00s were crazy.

> so executives got static IPs mapped to their machines. The late 90s and 00s were crazy In my Uni days, all our department's machines had public IPs; no NAT, no firewall(!) So much simpler to able to telnet, FTP and/or remote desktop straight from home to the office :)

Same at my University in the mid-90s. I was the CS department network admin and we had an entire /24 to use as we liked.

At least it taught me how to detect attempted hacks early because every machine had to be monitored for attacks.

I just looked and they still have a /16 (65k public addresses). This is for a school that has maybe 15k students, not all of them living on the campus. And I’m sure most of the computing takes place in the cloud now anyway.

I know there are a lot of places who were on the Net early besides the military that have excess address capacity.

Re: Web fingerprinting is worse than I thought

#486

Post by enjoytheview »

faet wrote: post #330
enjoytheview wrote: post #259

Earlier quoted context omitted.

You don't need to precisely identify users across sessions without their consent to detect bots, advanced anti-bots make heavy use of biometrics to detect bots and don't rely too heavily on fingerprinting, mostly because they're easy to spoof in general, but generating human-like mouse data is a bigger challange.

https://github.com/Xetera/ghost-cursor

Bezier curves are easily detected by machine learning models as non-human, that software wont work on akamai or any decent anti-bot

Re: Web fingerprinting is worse than I thought

#487

Post by derefr »

GoblinSlayer wrote: post #434
derefr wrote: post #370

Earlier quoted context omitted.

“Font rendering” is a different thing than “what fonts you have.” Font rendering is about how fonts are drawn to the screen. The trick is to draw some words to a and then pixel-peep the result. Different OSes and browsers use different font renderers and font hinting logic; fonts will even render differently on a different-DPI screen.

Don't they already use freetype to parse webfonts?

Is that a standard — that all browsers are forced to use the Freetype library, or to be bug-for-bug compatible with its glyph+hint parsing semantics? I've never heard of anything like that.

But also, even if they did, AFAIK browsers still mostly lean on OS text-drawing APIs for font rendering. Text in Chrome on Windows looks different than text in Chrome on macOS, etc. The same pile of beziers, and the same pile of hints, converts into a different set of hinted pixels (and sub-pixels!) when fed to each OS text-drawing API. Especially when those APIs are configured by user settings around subpixel hinting / "font smoothing", and when those APIs are aware of the device being rendered to and so render subpixels differently for high-DPI vs low-DPI screens, RGB vs BGR displays, etc.

Re: Web fingerprinting is worse than I thought

#488

Post by SV_BubbleTime »

fnord77 wrote: post #276

the demo got my browser totally wrong. it has me showing up in various places around the country and I don't use a VPN. One of the dates I was out of the country and my laptop was at home, turned off

You are using cellular data then. Your exit point when using 3-5G can be a lot of strange places. Not unusual.

Re: Web fingerprinting is worse than I thought

#489

Post by xkcd1963 »

noduerme wrote: post #442
xkcd1963 wrote: post #349

Earlier quoted context omitted.

You seem to have a conflict of interest here. How can you accept this for employee/employer but at the same time say it's not ok for a person to submit fingerprinting? Employees are also persons.

Because the software is only allowed to be used on company computers and a few personal devices which have to be approved by upper management. It isn't fingerprinting the person or the public. It's checking that the software is running on a known/approved machine.

This technology could be used outside the company's garden one day. The current employer/employee picture could been seen as a miniature of society, e.g. The great firewall is only used for Chinese citizens and is controlled by the Government of the People's Republic of China.

But I probably interpret too far here and it seems that in some industries e.g. secret agencies need to use unconventional methods.

Re: Web fingerprinting is worse than I thought

#490

Post by enjoytheview »

jsmith45 wrote: post #309
enjoytheview wrote: post #259

Earlier quoted context omitted.

You don't need to precisely identify users across sessions without their consent to detect bots, advanced anti-bots make heavy use of biometrics to detect bots and don't rely too heavily on fingerprinting, mostly because they're easy to spoof in general, but generating human-like mouse data is a bigger challange.

Sure, but on the other hand, a lot of anti-fingerprinting efforts strive to reduce the info available including things like mouse movement data. Mouse movement data is a fairly potent fingerprinting vector. Bucketing the average spouse speed and acceleration rates could provide provide useful information. This may imply specific OS speed settings, or physical mouse DPI. A machine learning system would likely be able…

I wonder if that would be enough to precisely identify a single user between millions like regular fingerprinting can already do, but yeah it's still a big fingerprinting vector
Post reply on HN