Live data from Hacker News

Browser Fingerprinting Without JavaScript

fingerprintjs.com

1–10 of 124 posts

Re: Browser Fingerprinting Without JavaScript

#3
> your fingerprint stays the same even if your browser is in incognito mode.

OK, I tried the demo with Firefox Focus, and it worked. But it doesn't tell you how unique your fingerprint is. If multiple users have the same fingerprint, then its effectiveness will be limited.

Re: Browser Fingerprinting Without JavaScript

#5
post #3

> your fingerprint stays the same even if your browser is in incognito mode. OK, I tried the demo with Firefox Focus, and it worked. But it doesn't tell you how unique your fingerprint is. If multiple users have the same fingerprint, then its effectiveness will be limited.

Right. What is the entropy?

Re: Browser Fingerprinting Without JavaScript

#6
Would it be possible to mitigate the CSS based fingerprinting using URLs, by having the client forcibly cache the fonts / urls? I think then on return to the site, there would be client cache hits, and no request to the server on return visits.

I imagine this would be a pain for browsing in general, but could help browsers in a privacy mode

Re: Browser Fingerprinting Without JavaScript

#7
I seem to be able to change the fingerprint through triggering a fetch in the JS console on every `/signal/...` url found in the stylesheet while it is "gathering data". I'm guessing that adding some randomness on the fetches in an extension could probably fool CSS-based fingerprinting, granted you're handling all `url()`s found in all CSS... which is pretty overkill.

But then again, AdNauseam exists https://adnauseam.io/

Re: Browser Fingerprinting Without JavaScript

#8
post #6

Would it be possible to mitigate the CSS based fingerprinting using URLs, by having the client forcibly cache the fonts / urls? I think then on return to the site, there would be client cache hits, and no request to the server on return visits. I imagine this would be a pain for browsing in general, but could help browsers in a privacy mode

In addition to making browsing slower you’d also consume more of your data, if you’re on a capped plan.

These days I have a 70 GB plan with data rollover, which leaves me with plenty of data to spare. But for the longest time I used to be on a plan with only a couple of GB of data per month, and it was a real pain in general. In that situation, downloading all resources instead of only the ones I need would have made a noticeable impact I am sure.

Even though I now have data to spare, the additional slowness that you mentioned would be annoying enough that I would not want my device to do that. Additionally, transferring more data would also consume more battery.

Re: Browser Fingerprinting Without JavaScript

#9

I used to think that privacy was a technical problem, then I thought it was a legal problem, now I think it is a reaction problem. We are not disgusted enough. I do wonder if that will change.

No, it's a legal problem. There are countries where groping women is not a big deal for example. Even in the most "ideal" EU countries, casual racism is an afterthought. Reaction is a problem because there is no adverse consequence to the perpetrator.

I don't need a browser extension, I need CEOs in prison. Then reactions will catch up.

Re: Browser Fingerprinting Without JavaScript

#10

I used to think that privacy was a technical problem, then I thought it was a legal problem, now I think it is a reaction problem. We are not disgusted enough. I do wonder if that will change.

I thought Smarter Every Day's analogy to carbon emissions was great for this exact reason. It's hard to feel like it is a problem because it is difficult to see the pollutant and small amounts don't cause major problems. But when that pollutant reaches a critical mass then it becomes a very large problem for everyone, not just a particular individual.
Post reply on HN