Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The privacy nightmare of browser fingerprinting

kevinboone.me

Post reply on HN
Print view View original

81–90 of 456 posts

Re: The privacy nightmare of browser fingerprinting

#81

Post by dminuoso »

codedokode wrote: post #65
drnick1 wrote: post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

Does it hide GPU name that is exposed via WebGL/WebGPU? Does it hide internal IP address, available via WebRTC? > block all third party content It's not going to work, because the fingerprinting script can be (and is often served) from first-party domain. Also imagine if browser didn't provide drawing API for canvas (if you would have to ship your own wasm rendering library). Canvas would become useless for fingerpri…

If I infiltrate someone else’s computer, secretly run code in order to to exfiltrate data I risk prison time because objectively it seems to satisfy criminal laws over where I live.

How do prosecutors in any modern country/state not charge this behavior when done by a website owner?

Re: The privacy nightmare of browser fingerprinting

#82

Post by imiric »

notatoad wrote: post #44
prymitive wrote: post #15

Earlier quoted context omitted.

> I'm not going to pay $5/month for every blog that I occasionally read Would you pay per view? Most people (me included) would probably hesitate to say yes, because we’re used to not paying for that. But what if it meant that ad based model is gone and everything you buy is cheaper because the price does not include the cost of running ads?

The PPV model has been tried a bunch of times, and it always turns out that the rate people are willing to pay per view is not a rate that is high enough to be a viable revenue source for the content owners. it takes a lot of $0.10-$0.25 views to make up for the loss of a $5/month recurring revenue stream that might last for years.

The fact that advertising is more profitable doesn't mean that the PPV model is not viable. It could certainly be so. Every site could set their own price, or specific tiers, which users can agree to, just like they do with subscription-based content today.

The problem is skewed incentives, of course. Advertising is acceptable to most users and easy to integrate, so why should website authors go out of their way to please a minority of their users who object to it?

Re: The privacy nightmare of browser fingerprinting

#83

Post by codedokode »

ekjhgkejhgk wrote: post #36

The core of the problem is that we've made this behavior of "run javascript that pulls more javascript and then run that too" the default. Stallman was right, as always.

The problem is not JS, the problem is useless techonolgies like WebRTC or WebGL that can run without permission and that, I think, are used in 99% cases for figerprinting. And people who designed them and did nothing to prevent fingerprinting.

Re: The privacy nightmare of browser fingerprinting

#84

Post by btilly »

blfr wrote: post #69
btilly wrote: post #51

I don't mind advertisers knowing more about me. If they can display ads that are relevant to me, this is a better experience on both sides. Unfortunately there is no way to tell advertisers, "No, I'm not interested in your product. I never will be. Don't waste your money." The top offender is Hims. No, I don't have hair loss. I don't want hair loss supplements. I also don't have ED, and I object strongly to ads for t…

If you don't mind them knowing but resent the ads, you can just block the ads. You can do dns ad blocking[1], in-browser plugins/extensions[2], finally, patch the apps[3]. Or deploy all of them. [1] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#... [2] https://ublockorigin.com/ [3] https://revanced.app/patches?pkg=com.google.android.youtube

Perhaps you missed that I am willing to deal with ads in general? I am perfectly willing to put up with the annoyance, and like knowing that I am bringing money to the channel that I'm watching. I only want specific advertisers turned off.

A general "show me no ads" solution is not my preference.

Re: The privacy nightmare of browser fingerprinting

#86

Post by imiric »

echelon_musk wrote: post #25
prymitive wrote: post #15

Earlier quoted context omitted.

> I'm not going to pay $5/month for every blog that I occasionally read Would you pay per view? Most people (me included) would probably hesitate to say yes, because we’re used to not paying for that. But what if it meant that ad based model is gone and everything you buy is cheaper because the price does not include the cost of running ads?

How do you track the views?

How do you track ad impressions?

Re: The privacy nightmare of browser fingerprinting

#87

Post by Vinnl »

kasabali wrote: post #27
doug_durham wrote: post #8

I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compe…

> I'm not quite sure what the answer is. It's very simple, it's what they've been doing in print media for centuries: contextual advertising.

Print media did also include e.g. coupons with discount codes with which advertisers could learn which lead led through a sale.

Re: The privacy nightmare of browser fingerprinting

#88

Post by lipbetfox »

I still haven't found a method that can fingerprint simple Firefox containers. I use automatic temporary containers as a rule, and rules for specific sites where I want to keep persistent sessions.

I don't understand how temporary containers are still not a built-in Firefox feature, it seems like such a no-brainer solution for privacy.

Re: The privacy nightmare of browser fingerprinting

#89

Post by gruez »

codedokode wrote: post #75
alcide wrote: post #63

Earlier quoted context omitted.

Orion Browser (Kagi Product) prevents fingerprinters from running by default. https://help.kagi.com/orion/privacy-and-security/preventing-...

How do they reliably detect fingerprinting? Did they solve the Halting Problem? Sounds fishy.

>The only efficient protection against fingerprinting is what Orion is doing — preventing any fingerprinter from running in the first place. Orion is the only browser on the market that comes with full first-party and third-party ad and tracking script blocking, built-in by default, making sure invasive fingerprinters never run on the page.

sounds like they block "known" fingerprinting scripts and call it a day.

Re: The privacy nightmare of browser fingerprinting

#90

Post by kachapopopow »

drnick1 wrote: post #52

Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's…

All javascript based anti-fingerprinting is detectable and is also a major source of uniqueness!
Post reply on HN