511–520 of 524 posts
Earlier quoted context omitted.
Not if you disable JS, cause the website then can't see any of these customizations.
Having JS off probably puts you in the then you are not safe by just turning off JS.
And of course its not enough, but the situation is even more hopeless with JS on.
Earlier quoted context omitted.
It's not that easy to "present a fingerprint" without compromising the user experience. Sure, you could remove all those PWA and pretend-OS APIs and hardly anyone would notice, but what about things like viewport size and font rendering? You can't exactly hide them from a website.
For viewport, you can limit the size presented to the page to a few sizes with different aspect ratios. Browsers can simply rescale the page to the actual window size for display on the screen. That also works for font rendering. If users decide they want pixel-perfect display, they can either resize the window to one of the allowed sizes or disable this feature for a specific page.
Earlier quoted context omitted.
> It's not that easy to "present a fingerprint" without compromising the user experience. And that's exactly what I'm talking about. > what about things like viewport size and font rendering? Not much can be done about viewport size, but a browser could easily ship with 2 fonts (one serif and one sans serif) and only allow access to those.
“Font rendering” is a different thing than “what fonts you have.” Font rendering is about how fonts are drawn to the screen. The trick is to draw some words to a and then pixel-peep the result. Different OSes and browsers use different font renderers and font hinting logic; fonts will even render differently on a different-DPI screen.
Earlier quoted context omitted.
We need 2 classes of web. One for document based that doesn't require JS to run (secure). Insecure, all the SPA and anything that require JS to see the full content.
> We need 2 classes of web. One for document based that doesn't require JS to run (secure). I've wondered for a long time if a sort of posh gopher based on markdown with extensions would be able to make a comeback. Especially if it allowed for CSS.
Earlier quoted context omitted.
> We need 2 classes of web. One for document based that doesn't require JS to run (secure). I've wondered for a long time if a sort of posh gopher based on markdown with extensions would be able to make a comeback. Especially if it allowed for CSS.
You're sort of describing Gemini. https://en.wikipedia.org/wiki/Gemini_(protocol)
It's important to know that the mentioned "resistFingerprinting" breaks a lot of the web. Examples include the back button, uploading photos on some websites uploads random data instead of the photo, etc.
Earlier quoted context omitted.
"Some site operators can make a believable argument that they use it in ways that are good for society." Example please
My bank phoned me last summer. I'd authenticated with my usual two factors but a new browser fingerprint, then transferred a large sum to a new recipient. The bank blocked the transfers I did thay day, then phoned me to check whether I'd been phished, suffered a keylogger attack or something.
Earlier quoted context omitted.
That is literally what GDPR is. Somehow it got reduced to cookie banners in HN psyche, but the whole idea of GDPR is to make sure that the data can be collected and used for well defined purposes that are either necessary to provide a service (preventing CC fraud would qualify), or are explicitly consented to.
I think the misunderstandings about the GDPR (even many smart people don't get it) prove that designing and writing such a law is difficult and the result has to be complex. IMO the GDPR is good. But… it is poorly understood by many affected people . IMO if a law is poorly understood by the people it affects, then one should assume the law to be at fault, not the people. IMO it's good but I'm not happy. 4×IMO! Wow.
You are assuming that it has to be either of them who is at fault. In reality there are third-parties who have been spewing FUD in order to confuse people about the law.
Why is this being fought with technical measures (which are ineffective and cripple the web as a platform) instead of legal consumer law where you can easily fine and punish companies that do the fingerprinting? EDIT: Note that you can do BOTH - but one without the other is just a game of whack-a-mole.
Laws only apply in some countries. The internet is global. Technical measures are faster, more effective, and can be applied in all places.
Earlier quoted context omitted.
In fact, the disablement of JavaScript itself is a very identifying characteristic.
Its one added bit versus countless bits that can no longer be probed. Yeah disabling JS alone is not enough but it is not useless either.