Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

501–510 of 524 posts

Re: Web fingerprinting is worse than I thought

#501

Post by DavideNL »

SV_BubbleTime wrote: post #379
A4ET8a8uTh0 wrote: post #364

Earlier quoted context omitted.

I will admit that it always made me confused as to why browser has access to detailed hardware information. I can understand OS. I can understand resolution. I can rationalize GPU. I don't understand though why it should be able to access .. well, everything about the machine. edit: It is still impressive. Even with the firefox settings on, the website was able to identify me. I am not entirely certain how I want to…

I got me on iPhone through VPN change, clear cache, private window, and reboot. I know what to think about this… I fucking hate it.

Note that there's also:

  Settings > Safari > Advanced > Experimental Features
where you can disable OpenGL and such (i haven't tested yet.)

Re: Web fingerprinting is worse than I thought

#502

Post by neop1x »

sophiabits wrote: post #25
matheusmoreira wrote: post #3

I wish browsers did more to combat this. There should be ways to randomize or normalize every bit of information they try to gather.

If Javascript is enabled there’s ultimately very little that can be done to prevent fingerprinting. If you don’t want to be fingerprinted then only allowing JS to run on allowlisted websites is the only way to truly be safe

As someone said already, 'resistFingerprinting' option should be configurable per-domain. Then we could have it enabled (randomized) for most of the web and disable it (allow fingerprinting) for payment processors and similar 'trusted' websites.

Re: Web fingerprinting is worse than I thought

#503

Post by neop1x »

neop1x wrote: post #502
sophiabits wrote: post #25

Earlier quoted context omitted.

If Javascript is enabled there’s ultimately very little that can be done to prevent fingerprinting. If you don’t want to be fingerprinted then only allowing JS to run on allowlisted websites is the only way to truly be safe

As someone said already, 'resistFingerprinting' option should be configurable per-domain. Then we could have it enabled (randomized) for most of the web and disable it (allow fingerprinting) for payment processors and similar 'trusted' websites.

EDIT: there actually appears to be a hidden per-domain whitelist privacy.resistFingerprinting.exemptedDomains

Re: Web fingerprinting is worse than I thought

#505

Post by [deleted] »

lwhi wrote: post #448
_siis wrote: post #179

Earlier quoted context omitted.

That's very naive, and you need to educate yourself about what capitalism actually is because it certainly isn't what you are saying. You've misused that term.

No. You're incorrect. We need limits to prevent capitalism from doing its worst. It's only fair that we all live and work with the same limits. This is the type of regulation that is necessary.

[deleted]

Re: Web fingerprinting is worse than I thought

#506

Post by account42 »

super256 wrote: post #291
GuB-42 wrote: post #186

Earlier quoted context omitted.

I actually did exactly that a while ago. Where I worked, we didn't have internet access but we had email access, so as a workaround, I made an email server on my home machine that fetched web pages for me. A coworker took it even further and made a proxy server that automated the process so you could actually browse the web, although very slowly. Just to say that Stallman is not the only one with this idea. It was in…

In Germany there is a "WhatsApp" SIM [1], where you have to pay for normal internet use, but WhatsApp texts are free of charge. With a technique which you described, you could probably abuse a phone with this SIM as a "free" hot spot with infinite data. [1] https://www.whatsappsim.de/

> Guthabenaufladung mind. 5 € alle 6 Monate zur Verlängerung des Aktivitätszeitfensters.

So it costs at least 83 cents per month. Still might be worth it compared to the insane mobile data charges here if you can get a usable bandwidth. I suspect in practice they will just ban you if you abuse it like that.

Re: Web fingerprinting is worse than I thought

#507

Post by account42 »

cobbzilla wrote: post #252
szundi wrote: post #224

Earlier quoted context omitted.

Hard to watch netflix or YouTube whis way. Considering I have just learned electronics design from YouTube, this is inconvenient.

For Youtube, try invidious or yt-dlp

Also mpv calls yt-dlp automatically. Add a browser extension to launch mpv for links/the current page and the experience is so much better than in-browser video: native controls, video window can be placed anywhere, full power of ffmpeg.

I am continously baffled by how most people just accept media companies controlling the video player you are allowed to use and thereby the UX. Don't let them.

Re: Web fingerprinting is worse than I thought

#508

Post by account42 »

fnordpiglet wrote: post #420
shanebellone wrote: post #368

Earlier quoted context omitted.

Disabling JavaScript does not stop fingerprinting either. HTTP headers are sufficient to construct unique user identifiers. Passing that data via API to a FaaS provider would enable cross site tracking that's invisible to the visitor. Edit: The required FaaS implementation is trivial too. I could launch an endpoint that performs exactly this function in 30-60 minutes.

In fact, the disablement of JavaScript itself is a very identifying characteristic.

Its one added bit versus countless bits that can no longer be probed. Yeah disabling JS alone is not enough but it is not useless either.

Re: Web fingerprinting is worse than I thought

#509

Post by account42 »

A4ET8a8uTh0 wrote: post #364
jonhohle wrote: post #357

Until everyday people realize they’re being stalked, I don’t know what will change. I am seriously thinking about trying to go through the proposition process in my state to forbid selling of data (this should already run afoul of wiretapping laws, imho). I thought having an ad campaign that targeted subgroups very specifically and boldly might be enough drum up public interest. Something like: “Hello $name from $cit…

I will admit that it always made me confused as to why browser has access to detailed hardware information. I can understand OS. I can understand resolution. I can rationalize GPU. I don't understand though why it should be able to access .. well, everything about the machine. edit: It is still impressive. Even with the firefox settings on, the website was able to identify me. I am not entirely certain how I want to…

> I can understand OS. I can understand resolution. I can rationalize GPU.

None of these should be available to websites by default. The first two come from simpler times when people were not as concerned with privacy implications. The third has been and continues to be pushed by advertising companies (Google, Apple, Microsoft).

Re: Web fingerprinting is worse than I thought

#510

Post by account42 »

tenebrisalietum wrote: post #418
A4ET8a8uTh0 wrote: post #364

Earlier quoted context omitted.

I will admit that it always made me confused as to why browser has access to detailed hardware information. I can understand OS. I can understand resolution. I can rationalize GPU. I don't understand though why it should be able to access .. well, everything about the machine. edit: It is still impressive. Even with the firefox settings on, the website was able to identify me. I am not entirely certain how I want to…

Because the browser has become a vendor neutral, architecture neutral app engine and people want to do things like play MIDI instruments, use serial ports, use proprietary USB check scanners for accounting/ERP apps that work on the web and don't need SCCM to manage, etc.

> people want to

Some people want to do those things and for very specific websites. Most people don't even know what MIDI or serial ports are.

Post reply on HN