71–80 of 266 posts
But all iPhones of the same model have the same processor. Every iPhone 15 Pro Max, of which Apple sells hundreds of millions, all have the same processor. Why do they have different results?
They sell ~200M iPhones per year, but I doubt most are the most expensive model.
Earlier quoted context omitted.
Yeah, it doesn't tell a website who you are. Instead, it allows them to recognize you again when you come back to visit again, even if you clear cookies. This is particularly a problem with big advertiser networks because they can track you across many sites you visit, even if you disable third-party cookies. It has positive uses too, like preventing click fraud and concert ticket arbitrage.
>Instead, it allows them to recognize you again when you come back to visit again, even if you clear cookies. I don't think that's what stockhorn said. stockhorn said it can only identify a what browser and OS and laptop model you're using. Someone else with the same browser, OS, and laptop model would have the same fingerprint. So audio fingerprinting couldn't precisely recognize you again when you come back again.
It seems like rather than adding a random amount to each sample (which lets them compute a mean by recreating the same audio and extracting out the differences), Safari could instead add randomness that is based on a key that rotates every hour. (Function of audio sample and key, so the noise would be the same in a given session, but useless for tracking an hour later).
Fixing this would require removing the information leak entirely, not just masking it under a layer of random deviations.
Earlier quoted context omitted.
That’s how location services and notifications work today, and all it means is that websites just constantly nag me to enable them. Things like this make for a more annoying web all around, because now it’s just one more tool sites can use to track me and increase engagement. (Edit: sibling poster chuckles said it way better than I can.) If I had my way, JavaScript on the web would be limited to XMLHttpRequest and ba…
> That’s how location services and notifications work today, and all it means is that websites just constantly nag me to enable them. It also means you can tell the browser to outright deny every request, thus avoiding even getting prompted. If a website detects the request was denied and still prompts you any other way, that’s an undeniable signal to close the tab and never return.
The result is that the web just keeps getting incrementally worse and worse. It’s all good intentions in creating these API’s but the result is that everything just gets more terrible.
Does disabling web audio beat this fingerprinting?
I always assume that any difficult/annoying anti-fingerprint techniques make you more identifiable instead of less, since very few people do them.
Earlier quoted context omitted.
>Instead, it allows them to recognize you again when you come back to visit again, even if you clear cookies. I don't think that's what stockhorn said. stockhorn said it can only identify a what browser and OS and laptop model you're using. Someone else with the same browser, OS, and laptop model would have the same fingerprint. So audio fingerprinting couldn't precisely recognize you again when you come back again.
Browser, OS, laptop joined with IP looks like a pretty good ID
Does disabling web audio beat this fingerprinting?
So, if you visit Google, your hash would be something like "h38kflak". If you're visiting twitter, the API would generate something different, so you won't be tracked across websites.
That way, even if you clean your cookies, you can still be identified as the same user.
The use case? Fraud detection and that kinda stuff. For example, you may create a web game where you allow users to play instantly without "creating" an account. So, an anonymous account would be created in the background, in order to log in. Any bad actor can just clear their cookies/storage to bypass a ban. IP banning isn't reliable, as multiple users may share an adress.
It's a shame that we have to rely on web api hacks in order to fingerprint users for legitimate reasons, and that ends up in an eternal cat and mouse game, because anything you try today may be broken tomorrow.