Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The privacy nightmare of browser fingerprinting

kevinboone.me

Post reply on HN
Print view View original

61–70 of 456 posts

Re: The privacy nightmare of browser fingerprinting

#61

Post by aidenn0 »

Terretta wrote: post #41
prymitive wrote: post #15

Earlier quoted context omitted.

> I'm not going to pay $5/month for every blog that I occasionally read Would you pay per view? Most people (me included) would probably hesitate to say yes, because we’re used to not paying for that. But what if it meant that ad based model is gone and everything you buy is cheaper because the price does not include the cost of running ads?

> what if ... everything you buy is cheaper because the price does not include the cost of running ads? Except in practice we see the opposite. There's something interesting going on with companies when they want to get paid directly versus by ads: they demand 3x - 4x or more for subscriptions or pay per view versus what they make from ads. Easiest place to see this is ad supported non-linear TV in the years you coul…

This is price discrimination. Everybody would love to charge more money to rich people and less money to poor people, since that increases the total profit.

The only companies that we directly allow to do this are schools, but having a premium version lets you approximate this.

Re: The privacy nightmare of browser fingerprinting

#62

Post by udev4096 »

JavaScript disabling helps a lot, regardless of what author says. It disables most of the tracking attempts, improves security and most of all pages load faster and hardly break if you're just browsing anyway.

The whole article never mentions the gold standard of anti-fingerprinting, Tor Browser. It just shows how shallow the article is when it mentions Mullvad Browser, a fork of TBB, instead of TBB itself! There's also no mention of using an upto-date DNS block list to thwart fingerprinting attempts even more

Re: The privacy nightmare of browser fingerprinting

#63

Post by alcide »

drnick1 wrote: post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

Orion Browser (Kagi Product) prevents fingerprinters from running by default.

https://help.kagi.com/orion/privacy-and-security/preventing-...

Re: The privacy nightmare of browser fingerprinting

#64

Post by binaryturtle »

ekjhgkejhgk wrote: post #36

The core of the problem is that we've made this behavior of "run javascript that pulls more javascript and then run that too" the default. Stallman was right, as always.

A browser basically is like a really dumb trojan, pulling a whole herd of wooden horses into the city.

Re: The privacy nightmare of browser fingerprinting

#65

Post by codedokode »

drnick1 wrote: post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

Does it hide GPU name that is exposed via WebGL/WebGPU? Does it hide internal IP address, available via WebRTC?

> block all third party content

It's not going to work, because the fingerprinting script can be (and is often served) from first-party domain.

Also imagine if browser didn't provide drawing API for canvas (if you would have to ship your own wasm rendering library). Canvas would become useless for fingerprinting and its usage would drop manyfold. And the browser would have less code and smaller attack surface.

Re: The privacy nightmare of browser fingerprinting

#66

Post by drnick1 »

codedokode wrote: post #65
drnick1 wrote: post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

Does it hide GPU name that is exposed via WebGL/WebGPU? Does it hide internal IP address, available via WebRTC? > block all third party content It's not going to work, because the fingerprinting script can be (and is often served) from first-party domain. Also imagine if browser didn't provide drawing API for canvas (if you would have to ship your own wasm rendering library). Canvas would become useless for fingerpri…

> Does it hide GPU name that is exposed via WebGL/WebGPU? Does it hide internal IP address, available via WebRTC?

My GPU is reported as simply "Mozilla" by https://abrahamjuliot.github.io/creepjs/.

The number of cores is also set to 4 for everyone using this config and/or Tor.

> It's not going to work, because the fingerprinting script can be (and is often served) from first-party domain.

This may be true, but allowed third party content makes it trivially easy for Google and others to follow people around the Internet through fonts delivery systems among others.

Re: The privacy nightmare of browser fingerprinting

#67

Post by codedokode »

zie wrote: post #58
mathgradthrow wrote: post #45

Earlier quoted context omitted.

>An answer usually contains more information than just that one bit. Isn't the point to ask yes or no questions?

Yes, but you can make assumptions based on what you know about humans generally. Like their example that if you ask if you have long hair. If you answer yes the likelihood is you are probably female. You can think of all sorts of questions and answers like this, and when you combine with the assumptions and answers from previous answers you can make even more assumptions. They won't always be correct, but you don't h…

> Target got sooo good at identifying pregnant women

That's why I pay with cash and do not have a loyalty card (other customers often offer theirs at cash register anyway). And of course I don't even go to Target.

Re: The privacy nightmare of browser fingerprinting

#68

Post by homebrewer »

aidenn0 wrote: post #61
Terretta wrote: post #41

Earlier quoted context omitted.

> what if ... everything you buy is cheaper because the price does not include the cost of running ads? Except in practice we see the opposite. There's something interesting going on with companies when they want to get paid directly versus by ads: they demand 3x - 4x or more for subscriptions or pay per view versus what they make from ads. Easiest place to see this is ad supported non-linear TV in the years you coul…

This is price discrimination. Everybody would love to charge more money to rich people and less money to poor people, since that increases the total profit. The only companies that we directly allow to do this are schools, but having a premium version lets you approximate this.

Steam also does this. Most games are significantly cheaper in low-income countries like mine because otherwise they wouldn't make a dime here.

Re: The privacy nightmare of browser fingerprinting

#69

Post by blfr »

btilly wrote: post #51

I don't mind advertisers knowing more about me. If they can display ads that are relevant to me, this is a better experience on both sides. Unfortunately there is no way to tell advertisers, "No, I'm not interested in your product. I never will be. Don't waste your money." The top offender is Hims. No, I don't have hair loss. I don't want hair loss supplements. I also don't have ED, and I object strongly to ads for t…

If you don't mind them knowing but resent the ads, you can just block the ads. You can do dns ad blocking[1], in-browser plugins/extensions[2], finally, patch the apps[3]. Or deploy all of them.

[1] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#...

[2] https://ublockorigin.com/

[3] https://revanced.app/patches?pkg=com.google.android.youtube

Re: The privacy nightmare of browser fingerprinting

#70

Post by imiric »

prymitive wrote: post #15
doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

> I'm not going to pay $5/month for every blog that I occasionally read Would you pay per view? Most people (me included) would probably hesitate to say yes, because we’re used to not paying for that. But what if it meant that ad based model is gone and everything you buy is cheaper because the price does not include the cost of running ads?

Brave Inc. gets a lot of flack, some warranted, but their Basic Attention Token allows for exactly this. Users can add credit to their wallet by either consuming privacy-friendly ads or topping it up manually, which then gets distributed to the sites they visit in the proportion they choose, transparently in the background while they browse.

It is a shame that this feature gets lumped together with claims of crypto scams, and similar nonsense. Yet this is precisely the right model that could work at scale to eliminate the advertising middleman, and make the web a safer and more enjoyable experience for everyone.

Post reply on HN