Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No-JavaScript Fingerprinting

noscriptfingerprint.com

Post reply on HN
Print view View original

1–10 of 107 posts

Re: No-JavaScript Fingerprinting

#3

Post by alkonaut »

This doesn’t worry me too much, the value seems like it should be the exact same hash for any iOS Safari visitor with the same screen resolution and browser language? I’d be fingerprinted as part of a group of (probably) several hundred thousand.

8d666b05c42878d6d6d364c410a4eef2

It’s a shame that browsers leak things like font presence, but of course when sites can read back canvas contents without querying the user is when it all goes out the window.

Re: No-JavaScript Fingerprinting

#4

Post by cmeacham98 »

I have Firefox RFP enabled, and as far as I know all these values will be the same across RFP users except the size of the browser window (which seems like a poor fingerprinting metric given the fact I can and do resize my browser during usage) - and maybe pixel density? (can't tell if this one is standardized or not).

If there are any other RFP users out there compare to mine and see if you get anything different other than browser window size: https://noscriptfingerprint.com/result/yiRFTom5qPpKPxOl

Re: No-JavaScript Fingerprinting

#5

Post by nieve »

cmeacham98 wrote: post #4

I have Firefox RFP enabled, and as far as I know all these values will be the same across RFP users except the size of the browser window (which seems like a poor fingerprinting metric given the fact I can and do resize my browser during usage) - and maybe pixel density? (can't tell if this one is standardized or not). If there are any other RFP users out there compare to mine and see if you get anything different ot…

Even without RFP it seems to be very fragile, just resizing my window completely changes the result.

Re: No-JavaScript Fingerprinting

#6

Post by zelphirkalt »

cmeacham98 wrote: post #4

I have Firefox RFP enabled, and as far as I know all these values will be the same across RFP users except the size of the browser window (which seems like a poor fingerprinting metric given the fact I can and do resize my browser during usage) - and maybe pixel density? (can't tell if this one is standardized or not). If there are any other RFP users out there compare to mine and see if you get anything different ot…

It says:

"4. Click the toggle button until “true” changes to “false”"

But for me there is no toggle button. It seems to not be able to do anything, with my blocker settings.

When I allow the site, I see, that it did change the screen resolution result compared to yours.

Re: No-JavaScript Fingerprinting

#7

Post by jefftk »

nieve wrote: post #5
cmeacham98 wrote: post #4

I have Firefox RFP enabled, and as far as I know all these values will be the same across RFP users except the size of the browser window (which seems like a poor fingerprinting metric given the fact I can and do resize my browser during usage) - and maybe pixel density? (can't tell if this one is standardized or not). If there are any other RFP users out there compare to mine and see if you get anything different ot…

Even without RFP it seems to be very fragile, just resizing my window completely changes the result.

That's because it is including the dimensions of your window as part of your fingerprint. If your goal is to track users as they move across sites, matching browser size makes sense.

Re: No-JavaScript Fingerprinting

#8

Post by Urd- »

cmeacham98 wrote: post #4

I have Firefox RFP enabled, and as far as I know all these values will be the same across RFP users except the size of the browser window (which seems like a poor fingerprinting metric given the fact I can and do resize my browser during usage) - and maybe pixel density? (can't tell if this one is standardized or not). If there are any other RFP users out there compare to mine and see if you get anything different ot…

Yes, my signals only differ by screen size.

Re: No-JavaScript Fingerprinting

#10

Post by tyingq »

I thought it was going to use ETAG based fingerprinting/tracking, which I always thought was pretty clever. The etag header is supposed to be used to control caching, so it's typically a server-side generated hash of the requested resource's content. But, there's no requirement for it to be, so you can generate a unique one, and the client will send it back to you next time it asks for that uri. Sort of like a cookie.

The fingerprint sources are here: https://github.com/fingerprintjs/blog-nojs-fingerprint-demo/... Basically some css that uniquely identifies some browsers, then headers like user-agent, language, etc.

Post reply on HN