Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web fingerprinting is worse than I thought

bitestring.com

Post reply on HN
Print view View original

81–90 of 524 posts

Re: Web fingerprinting is worse than I thought

#81

Post by throwaway2056 »

vesinisa wrote: post #64
throwaway2056 wrote: post #37

It is interesting that the site can fingerprint individual profiles/dir easily: For example chromium-browser --user-data-dir=/tmp/profile_A chromium-browser --user-data-dir=/tmp/profile_A --incognito chromium-browser --user-data-dir=/tmp/profile_B chromium-browser --user-data-dir=/tmp/profile_B --incognito For each command + its incognito it can detect them as separate profiles. For ultimate privacy one needs to ever…

... on a new computer, each time ordered from a different brand and reseller, paid with a unique type of cryptocurrency and delivered each time to a new dead drop in a different country.

I tried live boot of ubuntu. Every time it can detect accurately. Looks like the whole privacy thing is OVER. Unless lawmakers do something - (i.e) not going to happen!

Atleast they can use this to prevent reCaptcha - and make passwords disappear!

Re: Web fingerprinting is worse than I thought

#82

Post by mcherm »

izacus wrote: post #75

Why is this being fought with technical measures (which are ineffective and cripple the web as a platform) instead of legal consumer law where you can easily fine and punish companies that do the fingerprinting? EDIT: Note that you can do BOTH - but one without the other is just a game of whack-a-mole.

Because some browser-makers (Firefox at least) believe that the identity of those browsing the web should be protected. Legislators do not believe that. (At least, a majority of legislators do not.)

Re: Web fingerprinting is worse than I thought

#84

Post by siquick »

izacus wrote: post #75

Why is this being fought with technical measures (which are ineffective and cripple the web as a platform) instead of legal consumer law where you can easily fine and punish companies that do the fingerprinting? EDIT: Note that you can do BOTH - but one without the other is just a game of whack-a-mole.

Because like the climate crisis, it’s easier to make the individual clean up the mess and make the changes than hold large organisations accountable.

Re: Web fingerprinting is worse than I thought

#85

Post by ashildr »

noduerme wrote: post #47

Look, forget about threat models. It's relatively trivial these days to avoid fingerprinting attacks if you want to (as a private, web browsing individual). I use fingerprinting actively in enterprise apps as a form of silent 3FA. It's a useful backstop. If I have a user who forgot their password but retrieves it via email, I'll usually let them pass if their fingerprint matches one of their priors; otherwise my soft…

Dunning and Kruger agree.

Re: Web fingerprinting is worse than I thought

#86

Post by iudqnolq »

pipo234 wrote: post #65
aaomidi wrote: post #46

Earlier quoted context omitted.

Most of those APIs should be default closed. Incognito should definitely be default closed.

But it's not just a matter of "open"/"close". It's more like signal/noise. Much of the signal is legit: source IP is needed to deliver response, screen resolution, audio/video codec support, transfer protocol, cache headers are all needed to render the page correctly and as quick as possible. Unfortunately, much of that signal persists across sessions as well as websites and can therefore be aggregated into a hash th…

Randomization works if you opt in everyone without their consent. If your addon or minority browser randomizes data you're adding a signal.

Re: Web fingerprinting is worse than I thought

#87

Post by masklinn »

siquick wrote: post #84
izacus wrote: post #75

Why is this being fought with technical measures (which are ineffective and cripple the web as a platform) instead of legal consumer law where you can easily fine and punish companies that do the fingerprinting? EDIT: Note that you can do BOTH - but one without the other is just a game of whack-a-mole.

Because like the climate crisis, it’s easier to make the individual clean up the mess and make the changes than hold large organisations accountable.

> Because like the climate crisis, it’s easier to blame the individual than clean up the mess and make the changes.

FTFY?

Re: Web fingerprinting is worse than I thought

#88

Post by bearmode »

1vuio0pswjnm7 wrote: post #24

"That's how web works." Nah. I make an HTTP request and I get a response. That's how the web works. Perhaps people can have different opinions on "how the web works". Web fingerprinting relies on a heap of assumptions. For example, that someone uses a web browser to make HTTP requests, that the web browser sends certain HTTP headers in a certain order, that the web browser runs Javascript, that it processes cookies,…

>Do advertisers care about computer users who do not use graphical browsers much. As such a user, IME, the answer is no.

Almost nobody does this, so obviously not. You're probably in a group that makes up less than 0.0001% of web users. And that might even be generous.

Re: Web fingerprinting is worse than I thought

#89

Post by defrost »

noduerme wrote: post #76
rat9988 wrote: post #57

Earlier quoted context omitted.

"It's relatively trivial these days to avoid fingerprinting attacks". Why should it be on me to avoid them? And more importantly, it's NOT trivial.

really? it takes a minute to set up a VPN and do your web browsing through a virtual machine. I guess it's not "trivial" for the average American, but it definitely is for the average terrorist or child pornographer, so it's easy compared to surmounting most other threat models faced by people intending to evade detection. Therefore, "trivial". [edit] also, the less trivial it is, the better for corporate security.

The article describes "Fingerprinting as a Service. Some choice quotes:

     It doesn’t matter if you are using a VPN or Private Browsing mode, they can accurately identify you.


    Also note that VPNs does not help with fingerprinting. They only masks IP address.

Re: Web fingerprinting is worse than I thought

#90

Post by iudqnolq »

stefncb wrote: post #80
kapsteur wrote: post #31

You can try https://www.amiunique.org/fp to get a view of all params can used to track you

It's interesting that they can narrow me down to less than 0.1% with just my language list (en-US,en,fr,ro). My user agent is practically unique as well, since I'm running an unusual configuration. I've never thought of that as a disadvantage when it comes to tracking, hah.

They narrowed me down to an order of magnitude less based on just my browser user agent (latest Firefox Android). I'm not sure what that actually means.
Post reply on HN