Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

71–80 of 524 posts

Re: Web fingerprinting is worse than I thought

#71

Post by magicalhippo »

codetrotter wrote: post #8
db48x wrote: post #6

Earlier quoted context omitted.

If it breaks uploading a photo, it’s because the page unnecessarily copies the image into a and then tries to upload the data from the instead of the original image.

> the page unnecessarily copies the image into a and then tries to upload the data from the instead of the original image. Surely there could be valid reasons for doing so? I imagine for example that: 1. It ensures the selected file is a valid image before uploading it 2. It strips meta data like GPS position from the image before uploading it 3. It could reduce the size of the image, by either scaling it down, or co…

These are valid use-cases I agree. However I don't see why should be leaky to support those use-cases.

Browsers should ensure all operations produce identical results across platforms and hardware, and anything in the spec that prevents this should be removed from the spec.

Now, I recognize some of that functionality is handy for certain apps. In that case do like Android and put it behind an opt-in API, so the user can deny.

Basically I think browsers need a "web app" mode and a "surf mode". Just using visiting my local news outlet shouldn't require all the fingerprinting stuff.

Re: Web fingerprinting is worse than I thought

#72

Post by TylerE »

codetrotter wrote: post #8
db48x wrote: post #6

Earlier quoted context omitted.

If it breaks uploading a photo, it’s because the page unnecessarily copies the image into a and then tries to upload the data from the instead of the original image.

> the page unnecessarily copies the image into a and then tries to upload the data from the instead of the original image. Surely there could be valid reasons for doing so? I imagine for example that: 1. It ensures the selected file is a valid image before uploading it 2. It strips meta data like GPS position from the image before uploading it 3. It could reduce the size of the image, by either scaling it down, or co…

3 sounds incredibly undesirable to me, assuming we’re dealing with a jpeg. Go through 3 or 4 rounds of that and compression starts to get pretty visible.

Re: Web fingerprinting is worse than I thought

#73

Post by izacus »

aaomidi wrote: post #46
donatj wrote: post #15

Earlier quoted context omitted.

It’s a double edged sword you need to walk the edge of. Almost everything they use to fingerprint you has a fully legitimate use case which is why it was added. The more you do to prevent fingerprinting the more you hobble the web as a platform. A lot of restrictions that got placed on the canvas tag to help prevent fingerprinting for instance really limited its functionality. In my opinion a workable solution would…

Most of those APIs should be default closed. Incognito should definitely be default closed.

Which then pushes a lot of web use-cases into mobile apps locked to a few corporate platforms that make tracking much much easier. Yes, even iOS.

Re: Web fingerprinting is worse than I thought

#74

Post by JD557 »

1vuio0pswjnm7 wrote: post #24

"That's how web works." Nah. I make an HTTP request and I get a response. That's how the web works. Perhaps people can have different opinions on "how the web works". Web fingerprinting relies on a heap of assumptions. For example, that someone uses a web browser to make HTTP requests, that the web browser sends certain HTTP headers in a certain order, that the web browser runs Javascript, that it processes cookies,…

I think you can still be fingerprinted without cookies or Javascript (e.g. with HSTS supercookies). It's obviously not as effective.

Re: Web fingerprinting is worse than I thought

#75

Post by izacus »

Why is this being fought with technical measures (which are ineffective and cripple the web as a platform) instead of legal consumer law where you can easily fine and punish companies that do the fingerprinting?

EDIT: Note that you can do BOTH - but one without the other is just a game of whack-a-mole.

Re: Web fingerprinting is worse than I thought

#76

Post by noduerme »

rat9988 wrote: post #57
noduerme wrote: post #47

Look, forget about threat models. It's relatively trivial these days to avoid fingerprinting attacks if you want to (as a private, web browsing individual). I use fingerprinting actively in enterprise apps as a form of silent 3FA. It's a useful backstop. If I have a user who forgot their password but retrieves it via email, I'll usually let them pass if their fingerprint matches one of their priors; otherwise my soft…

"It's relatively trivial these days to avoid fingerprinting attacks". Why should it be on me to avoid them? And more importantly, it's NOT trivial.

really? it takes a minute to set up a VPN and do your web browsing through a virtual machine. I guess it's not "trivial" for the average American, but it definitely is for the average terrorist or child pornographer, so it's easy compared to surmounting most other threat models faced by people intending to evade detection. Therefore, "trivial".

[edit] also, the less trivial it is, the better for corporate security.

Re: Web fingerprinting is worse than I thought

#77

Post by luckystarr »

I use the usual adblocker UBlock and:

* https://addons.mozilla.org/de/firefox/addon/canvasblocker/

which prevents fingerprinting via Canvas elements, additionally warns you if a site does it. There are more sites out there than you would assume. Some stupid blogs even.

* https://addons.mozilla.org/en-US/firefox/addon/multi-account...

This splits your tabs into different categories, each with their own cookie storage.

The fingerprinting website in the article didn't manage to correlate me visiting the website concurrently from two distinct container tabs.

Re: Web fingerprinting is worse than I thought

#78

Post by TylerE »

geysersam wrote: post #39
illiarian wrote: post #29

Earlier quoted context omitted.

It's enough to narrow you down to a specific bucket. E.g. "affluent white young male in his 30s in a specific neighbourhood" and serve you ads and news. Collate with a few other sites (even airline checkouts and boarding pages have tracking), and you have a close enough match. The worst part of this? Trying to hide from fingerprinting makes your fingerprint more unique

> Trying to hide from fingerprinting makes your fingerprint more unique Didn't seem so in the experiment in the article. Sure they'll be able to place you in the bucket "tor user", but is that really more narrow than what you'd get without Tor?

Probably. Tor is not something most people use unless they have something to hide.

No, I don’t care about the one time you downloaded a gentoo iso over tor.

Re: Web fingerprinting is worse than I thought

#80

Post by stefncb »

kapsteur wrote: post #31

You can try https://www.amiunique.org/fp to get a view of all params can used to track you

It's interesting that they can narrow me down to less than 0.1% with just my language list (en-US,en,fr,ro). My user agent is practically unique as well, since I'm running an unusual configuration. I've never thought of that as a disadvantage when it comes to tracking, hah.
Post reply on HN