Web fingerprinting is worse than I thought (2023) • Hacker News Board

Re: Web fingerprinting is worse than I thought (2023)

#61

Post by lucraft » Thu, Jul 24, 2025, 1:42 PM UTC

I tried the demo, fingerprint.com, in:

  - Safari
  - Safari private mode
  - Chrome private mode

and it was not able to identify me across those.

I then tried

  - Chrome (normal, non-private mode)

and it did identify that as a repeat Chrome visit.

Does Safari have better privacy than Chrome?

Re: Web fingerprinting is worse than I thought (2023)

#62

Post by afiori » Thu, Jul 24, 2025, 1:42 PM UTC

apples_oranges wrote: post #8

bryanrasmussen wrote: post #6

Earlier quoted context omitted.

sure, if they ask you can we track you and you say no they should not fingerprint.

EU (or whoever) could mandate a switch in the browser, when turned on, all identifying apis are disabled. But the IP is still the same, so..

This falls into the same problem as the DNT header, while being a good technology it will be used by so few people that is might very well increase fingerprinting capabilities in some ways.

Re: Web fingerprinting is worse than I thought (2023)

#63

Post by bee_rider » Thu, Jul 24, 2025, 1:42 PM UTC

Sanzig wrote: post #9

Browser fingerprinting is one of those things that should be outright illegal - it is far more of a threat than tracking cookies ever were. But it hasn't permeated the public consciousness like cookies have, so regulators seem to ignore it.

It should be illegal, but we also need technical prevention of it, because the internet is global and goes through too many jurisdictions to really regulate.

Plus, fingerprinting tech would get developed for criminal organizations or intelligence agencies anyway.

Re: Web fingerprinting is worse than I thought (2023)

#64

Post by rogerkirkness » Thu, Jul 24, 2025, 1:43 PM UTC

lucraft wrote: post #61

I tried the demo, fingerprint.com, in: - Safari - Safari private mode - Chrome private mode and it was not able to identify me across those. I then tried - Chrome (normal, non-private mode) and it did identify that as a repeat Chrome visit. Does Safari have better privacy than Chrome?

Yes by a lot.

Re: Web fingerprinting is worse than I thought (2023)

#65

Post by prasadjoglekar » Thu, Jul 24, 2025, 1:44 PM UTC

matthewdgreen wrote: post #22

This isn't exactly browser fingerprinting (though it may involve browser fingerprinting.) But the biggest open question I have right now is: what is Meta doing to get around Apple's iOS privacy protections? A couple of years ago, Apple launched App Tracking Transparency as a way to reduce tracking across their iOS app ecosystem. People predicted that this would be devastating for companies like Meta and Snap, and it…

IP addresses are quite static. Most phones and laptops come "home" once a day and get attached to the home IP. Do it for long enough and you can household all the other IP v6s, MACs etc. that are untethered.

Re: Web fingerprinting is worse than I thought (2023)

#66

Post by jeroenhd » Thu, Jul 24, 2025, 1:44 PM UTC

mysterypie wrote: post #38

> go to about:config and setting privacy.resistFingerprinting = true in your Firefox browser Two questions jump to mind: Why isn't this the default in Firefox? What is the downside? I.e., what can break by enabling this parameter?

> What is the downside

Just of the top of my head:

- Timezone is set to UTC which means any web calendar input becomes confusing at best

- Canvases turn into random stripes, which leaves artefacts all over many websites

- Some websites outright block you as bots (twitch does this)

- Some web APIs break, which can be a pain if you're web apps that rely on them

You can add websites to a whitelist to avoid the downsides on some sites (privacy.resistFingerprinting.exemptedDomains) but it's a pain to do that for every website.

Re: Web fingerprinting is worse than I thought (2023)

#67

Post by troupo » Thu, Jul 24, 2025, 1:46 PM UTC

aniviacat wrote: post #56

troupo wrote: post #20

Earlier quoted context omitted.

Or... You could read GDPR and realize that "cookie dialogs" were never about cookies: https://news.ycombinator.com/item?id=44670345

So does that mean that fingerprint.com, which records your fingerprint without asking for your consent, is operating illegally?

Good question :)

I think if it's all client-side, not logged or retained, and is not transmitted to third parties, it should be fine.

IANAL

Re: Web fingerprinting is worse than I thought (2023)

#68

Post by jeroenhd » Thu, Jul 24, 2025, 1:46 PM UTC

micromacrofoot wrote: post #51

mysterypie wrote: post #38

> go to about:config and setting privacy.resistFingerprinting = true in your Firefox browser Two questions jump to mind: Why isn't this the default in Firefox? What is the downside? I.e., what can break by enabling this parameter?

It's actually part of the privacy preferences in the normal settings, and they supply this warning > This setting may cause some websites to not display content or work correctly. If a site seems broken, you may want to turn off tracking protection for that site to load all content. Some sites use light fingerprinting to provide features

resistFingerprinting is stricter (and has worse side effects) than the standard "strict" privacy protection.

Re: Web fingerprinting is worse than I thought (2023)

#69

Post by laborcontract » Thu, Jul 24, 2025, 1:46 PM UTC

lucraft wrote: post #61

I tried the demo, fingerprint.com, in: - Safari - Safari private mode - Chrome private mode and it was not able to identify me across those. I then tried - Chrome (normal, non-private mode) and it did identify that as a repeat Chrome visit. Does Safari have better privacy than Chrome?

Safari will assign you a random ip address on a per tab basis if private relay is on. With chrome there is zero plausible deniability as to who you are. You are who you are today, yesterday, and a year before, in every tab, window, incognito or not.

Re: Web fingerprinting is worse than I thought (2023)

#70

Post by piker » Thu, Jul 24, 2025, 1:47 PM UTC

rogerkirkness wrote: post #64

lucraft wrote: post #61

I tried the demo, fingerprint.com, in: - Safari - Safari private mode - Chrome private mode and it was not able to identify me across those. I then tried - Chrome (normal, non-private mode) and it did identify that as a repeat Chrome visit. Does Safari have better privacy than Chrome?

Yes by a lot.

This comes with some downside because to protect privacy Safari blocks some useful APIs. For example, you can't tell if the user is running Apple silicon or Intel. That means you have to ask them whether they want the Intel or Apple silicon version of a download. This is a non-trivial question for a lot of Mac users. And, sure, you can always publish through the App store but that comes with its own drawbacks.