Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The privacy nightmare of browser fingerprinting

kevinboone.me

Post reply on HN
Print view View original

91–100 of 456 posts

Re: The privacy nightmare of browser fingerprinting

#91

Post by binoct »

codedokode wrote: post #83
ekjhgkejhgk wrote: post #36

The core of the problem is that we've made this behavior of "run javascript that pulls more javascript and then run that too" the default. Stallman was right, as always.

The problem is not JS, the problem is useless techonolgies like WebRTC or WebGL that can run without permission and that, I think, are used in 99% cases for figerprinting. And people who designed them and did nothing to prevent fingerprinting.

Neither WebRTC or WebGL are remotely ‘useless’. Very fair though to say that you would prefer to have them disabled and/or whitelisted for certain sites.

Re: The privacy nightmare of browser fingerprinting

#92

Post by rob_c »

lipbetfox wrote: post #88

I still haven't found a method that can fingerprint simple Firefox containers. I use automatic temporary containers as a rule, and rules for specific sites where I want to keep persistent sessions. I don't understand how temporary containers are still not a built-in Firefox feature, it seems like such a no-brainer solution for privacy.

How to scream I'm behaving badly online...

Re: The privacy nightmare of browser fingerprinting

#94

Post by georgefrowny »

codedokode wrote: post #67
zie wrote: post #58

Earlier quoted context omitted.

Yes, but you can make assumptions based on what you know about humans generally. Like their example that if you ask if you have long hair. If you answer yes the likelihood is you are probably female. You can think of all sorts of questions and answers like this, and when you combine with the assumptions and answers from previous answers you can make even more assumptions. They won't always be correct, but you don't h…

> Target got sooo good at identifying pregnant women That's why I pay with cash and do not have a loyalty card (other customers often offer theirs at cash register anyway). And of course I don't even go to Target.

I don't know if Target specifically use all of these, but I would bet they have data based on at least some of facial/gait/demographic recognition, wi-fi/Bluetooth beaconing, vehicle registrations, time and location tracking, statistical analysis of your purchases and clustering of people you have made purchases next to (e.g. you bought something at same time and till as your mother more then once). I'm sure they have other methods too. They can also combine datasets from brokers that do have a face:name link (say you used a card at another store that captured it and sold the data) and resolve you within their own data that way.

Re: The privacy nightmare of browser fingerprinting

#95

Post by baalimago »

On the pros of fingerprinting: it's practically the only consistent tool to prevent malicious use in certain usecases, such as app hosting and similar bot protection.

Email validation doesn't work. Ip blocking doesn't work. Captcha? Kind of. Fingerprinting? Very efficient.

Re: The privacy nightmare of browser fingerprinting

#96

Post by gruez »

dminuoso wrote: post #81
codedokode wrote: post #65

Earlier quoted context omitted.

Does it hide GPU name that is exposed via WebGL/WebGPU? Does it hide internal IP address, available via WebRTC? > block all third party content It's not going to work, because the fingerprinting script can be (and is often served) from first-party domain. Also imagine if browser didn't provide drawing API for canvas (if you would have to ship your own wasm rendering library). Canvas would become useless for fingerpri…

If I infiltrate someone else’s computer, secretly run code in order to to exfiltrate data I risk prison time because objectively it seems to satisfy criminal laws over where I live. How do prosecutors in any modern country/state not charge this behavior when done by a website owner?

The difference is that there's implied consent to run arbitrary (albeit sandboxed) code when you visit a website. Moreover it's not the website causing the code to be executed, it's your browser. Otherwise if the bar is "code is being run but the user doesn't know about it", it would lead to either any type of web pages with javascript being illegal (or maybe without javascript, given that CSS turing complete), or a cookie banner type situation where site asks for consent and everyone just blindly accepts.

Re: The privacy nightmare of browser fingerprinting

#97

Post by internetter »

gweinberg wrote: post #85

For a fingerprint to be useful it must not only be unique but also persistent. If I have a process that randomly installs and deletes wacky fonts, I'm unique at any given time, but the me of today can't be linked to the me of tomorrow, right?

Point still taken, however you can only really check if a given font is installed, not obtain a list of all fonts. Thus, installing a wacky font is pointless as the fingerprinter won’t bother to check that particular font. There is queryLocalFonts on chrome but this requires a permission popup.

Re: The privacy nightmare of browser fingerprinting

#98

Post by zzo38computer »

myaccountonhn wrote: post #33
ekjhgkejhgk wrote: post #23

I mean... I don't give a fuck about fonts, I don't give a fuck about drawing shit to some canvas. Can I not just opt out? Yes, I know that's ski-mask bla bla bla, but I still don't want my browser to be doing this nonsense.

There's the gemini protocol and gopher. When I think of all the tracking that goes on, these are becoming more lucrative.

Gemini and Gopher are better than the existing WWW, (although there are others as well, such as Spartan (uses the same file format as Gemini, but it is a different protocol without TLS), Scorpion (my own format, intended to be between Gemini and "WWW as it should be if it was designed better"), and others).

However, you might also want to access HTTP and HTML, and to do so without needing to load fonts, pictures, etc; you might use a web browser that omits many of these features. However, it also can result in some problems; there are a few ways to work around some of these, such as adding your own scripts to handle some services, adding proxy services for handling some services (although some of these can use other protocols such as Gemini), and/or using the HTML/CSS commands in other ways (e.g. using ARIA to decide the formatting rather than using CSS). However, there are other issues, e.g. if the web page you download includes more junk than the actual main text.

Re: The privacy nightmare of browser fingerprinting

#99

Post by gruez »

ekjhgkejhgk wrote: post #36

The core of the problem is that we've made this behavior of "run javascript that pulls more javascript and then run that too" the default. Stallman was right, as always.

>The core of the problem is that we've made this behavior of "run javascript that pulls more javascript and then run that too" the default. Stallman was right, as always.

It really isn't, because there's plenty of fingerprinting scripts that run on the same domain, especially fingerprinters from security providers like cloudflare or akamai.

Re: The privacy nightmare of browser fingerprinting

#100

Post by levocardia »

imiric wrote: post #82
notatoad wrote: post #44

Earlier quoted context omitted.

The PPV model has been tried a bunch of times, and it always turns out that the rate people are willing to pay per view is not a rate that is high enough to be a viable revenue source for the content owners. it takes a lot of $0.10-$0.25 views to make up for the loss of a $5/month recurring revenue stream that might last for years.

The fact that advertising is more profitable doesn't mean that the PPV model is not viable. It could certainly be so. Every site could set their own price, or specific tiers, which users can agree to, just like they do with subscription-based content today. The problem is skewed incentives, of course. Advertising is acceptable to most users and easy to integrate, so why should website authors go out of their way to p…

Do you think the fact that NO major content websites (NYT, substack, WSJ, ...) have settled on a PPV model is simply because they haven't thought of it? Or is it more likely that the numbers absolutely do not work?
Post reply on HN