> Remember the big fuss about third-party cookies? It was so big that the EU had already rolled out one of its greatest inventions - consent banners.
It was never about cookies. Thats what the industry made you think. You don't need to show consent banners for cookies (like auth sessions). You need consent for tracking. This includes profiling. And it doesn't matter what you use, fingerprinting or tracking cookies, the consenst banner is required either way.
Consent is required. The banner is just one mechanism, but not required. A website could hold off on all tracking until a suitable point in the usage of the site (like creating a profile, for example) and ask at that point.
The banner is an artefact of the hostile way most sites choose to try and hoodwink the user into being monetised and ultimately to piss users off so much that they complain about the legislation rather than the lack of online privacy.
I feel it's worth distinguishing between the Hacker News Audience that is highly tech-educated and security-conscious and the general public that just wants to use the web and seems more than happy to give all their data to Meta, Google & Co.
If you ask my 70-year-old mom to decide whether she'd like to allow the WebGL API, she'll go bonkers. If anything, the constant cookie banners have just trained her to consent to stuff out of muscle memory. You could probably design a "Are you ok to sign over the deed to your house" question in the rough shape of a cookie banner and get 90%+ agreement.
I still don't understand why the highest entropy APIs aren't gated behind browser consent.
A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
Broad geographical targeting shouldn't be an issue. In fact, it's so easy that I think we should invent an ad-targeting API people can opt in to. If I could tell advertisers my geographic location, gender, age cohort, languages, and 3 interests, I'd not feel that's an invasion of privacy when they use that to deliver ads. I'd just get lawnmower ads instead of shampoo ads and that's fine.
The problem is, they don't want to use that kind of targeting.
They want to target me with ads for a travel destination that my coworker mentioned in a Messenger message to another coworker five minutes ago. But we should just not accept that.
> "I still don't understand why the highest entropy APIs aren't gated behind browser consent"
Because it's known that interrupting the user-intent with a unrelated consent-popup doesn't help.
Older people may remember that this was the approach of Java J2ME, where you couldn't provide a fluent user-experience as the user first had to answer huge popups about individual API-permissions with "Always Allow", "Allow now" etc.
> A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
We should go further. A web-site with mostly static content should not use user-side scripting (Javascript) at all, it's unnecessary for it. It should be required only in rare cases where a site is basically an application and require manually turning it on each time such application is opened.
I think that ship sailed and I'm pragmatic enough to accept it. The web is an application platform, not a web of hypertext content. That's not going to change, and I've given up on the idea to even try to "go back" there. If it worked, you'd just have half of websites be "sites" that work without JS, and half would be "apps" which would require switching on JS? The whole reaosn the web took off as it has is because we removed the distinction between "web app" and "web site". There's no putting that genie back in the bottle.
That might sound good, but people already moan and groan about cookie notices. Imagine if each website that legitimately needs it would start asking for permission to each fingerprintable API. Although I do think we should have that option, just not as a default.
Well yeah, but there's also the part where I'm not okay loading ads from a third party because they eat my battery, add latency, and can potentially be used to spread malware. So there's the conflicting preferences regarding targeting that you mention but also conflicting preferences regarding how they are served.
That could also be a preference. Do you allow third party ads to begin with? But then I'd understand if people would just block visitors that don't agree to them. I think paying via showing ads is fine. Paying with my integrity isn't.
That would be nice. However, It’s easy to see why it’s way more than simply what they want, they don’t really have a preference but it boils down to money. You’ll only replace your lawnmower every couple years and the rest of the time they’re guessing what you may buy next. By spying on your daily conversations and browsing, they have an idea of what you are likely to buy this week, next week, and the week after. This is so much more valuable to an advertiser.
Exactly. And here's where regulators come in. What we need to do as a society is basically say "Unless you can make your ad-funded business work with this tiny bit of information, your ad-funded business should fail and shut down".
The solution has to come from law. I propose we handle privacy invasion the same as rape. Body and mind aren't up for grabs. That the average internet user is unconscious isn't a valid excuse.
It would be great if a wave of lawmaking started in the USA, because most tech behemots operate from there. I would expect EU to take the lead though IF such a wave would start. The EU has still a fair share of christian/conservative MP's that keeps doing the bidding for companies by pushing chat control, but on the other hand also has some progressive and knowledgeable representatives doing great work, so there might be a glimmer of hope. We need media campaigns and public education though. Political leaders are selected for their political abilities and as such rarely have leadership qualities. If the electorate moves, the leaders will follow it. So we have to start at the bottom.
I like your idea, but as a pessimist, I believe the ship has sailed, all government are craving on monitoring their citizens' move. If there are way for the government to fingerprint their citizen digitally, they will want to do it instead of protect us.
> The request already reveals information about you; what browser you use, the language it’s in, the OS that runs it and your IP address, which the server needs to send you the response. That often reveals your location.
If we control the servers the clients are connecting to, I don't see how there could be much hope of hiding. We can spoof things like latency toward an upper bound, but we can never ever defeat the lower bound. Physics is still quite insistent about that one.
If we control multiple servers, we know where they are, and we can periodically compel our clients to rotate between them (see: DNS), we can engage in latency-based multilateration to put them on a real-world map. Depending on the number of servers and samples over time, this can be remarkably accurate. Determining someone's actual postal code just from network timing information is feasible.
VPNs obviously confound this in first order terms, but if we aren't careful they can make it even easier to identify our activity in other ways. We are trading concealment in the woods for concealment in a crowd. Both have their advantages and disadvantages. The VPN might also have a side channel that we aren't aware of.
The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis.
I can't help but keep thinking that client-side scripting was a mistake. Sure, the web would be a lot more primitive without it, but I'm not convinced that wouldn't be for the best.
The scope and amount of information that browsers hand over without the slightest shred of consent from the user or indication it’s happening is crazy.
It's a UX trade off. For non-adversarial websites it's very convenient for users because things just work without having to go through loads of permissions pop ups for every website, but of course this then makes this info a juicy target if you're trying to fingerprint someone.
But it is a design trade-off. The opposite case can be seem in the many websites asking to send you notifications, and the many flavours of cookie notices. When you have to ask the user permission to do anything and everything, the user gets annoyed and desensitized. They start allowing everything (my always collects dozens of notification-enabled websites if given the chance), and the point of asking for permission is lost.
And also without logging it. Even if I don’t want popups to give consent for every document.getEyeColor() call, it would be nice go back and see who’s doing which queries and/or have Firefox collect aggregate statistics. Naming and shaming the crooks won’t stop them but it might have an impact on curbing any bad behavior from big commercial retailers.
Google's business model has been ads from the beginning. Search, gmail, drive, office, chrome, everything they do is just to drive ad revenue further.
They don't care about the user. Never have, and never will.
And the outcome we are seeing is what happens when a defunct state isn't able to protect citizens from conglomerates. That's what the Kartellamt or the FTC is supposed to be for.
> Nope. At least until 2008 I cared and Larry and Sergey cared quite a bit.
Not sure if I can't see this comment as anything else than hypocritical. It's always easier on the money receiving side, isn't it? How do you think the term malvertisement came to be?
AdMob is kind of the definition of inevitable Surveillance Capitalism and the prime example for necessary regulation through government.
I've seen anti-fingerprinting plugins and browser configs, etc, but they all seem to make you more interesting for not being fingerprintable, or for turning off a lot of features used in fingerprinting.
Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
Random is often going to be indirectly fingerprintable too, since some values are always the same (or the same given each browser version). Some values can't be set to be random or otherwise non-fingerprintable data without affecting the user, like viewport size.
Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.
> Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard
It doesn't matter if it looks wrong as long as it looks differently wrong over time. Don't bother trying to blend in with the crowd because you can't ever expect to catch everything that can be used to fingerprint you. New techniques come out all the time. You can block a lot of information from even being collected. Limit what data you send at all, randomize what's left, change IP frequently (VPN) and you should be fine.
That's the thing, no web page, except for games, should ever need to know about your viewport size. So spoofing would be just fine, imho, with an override option/permission for individual sites.
You can forcefully disable hardware acceleration, that removes a few bits - though javascript can still guesstimate your CPU and memory.
For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.
First, see our blog post. Consult also other blog posts and other questions in this FAQ.
If you want to have the same fingerprint as many users, We suggest going for Tor Browser (do not install JShelter in Tor Browser).
If you want to make cross-site fingerprinting linkage hard, go for the Recommended JShelter level. If you want better protection for the real data at the cost of having the same fingerprint on different sites, go for the Strict JShelter level.
Keep NBS active.
If you want to detect and prevent fingerprinting attempts, use FPD.
Thanks. I tried this on Firefox for Android and each time I close the browser and load the page my fingerprint ID is different. So it seems to work. Have you had any sites break with this extension installed?
> Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
That's basically the ideal. It's become obvious that it's impossible to try to be identical. Web browsers are too leaky, and something will out you. You really don't want to try to blend in the "typical" users because none of them use ad blockers.
Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes.
90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months).
What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.
18 months ago Google publicly stated they were going to start using browser fingerprint data to track users, a reversal of their 2019 policy on it because it was considered too invasive.
There's a fingerprint demo on github called JSCreep (https://abrahamjuliot.github.io/creepjs/) that used to keep your fingerprint profile for 90 days and show you how many times you visited. Worked extremely well, and is still around, but no longer uses the API to retain fingerprint data, so you have to track your hash yourself. It would easily track most browsers across changes in IP address. Only Mullvad, Brave, or Tor would not leave an easily tracked fingerprint.
The demo presented in the royfish.dev link is easily foiled by browser extensions that scramble fingerprint data, the presence of which would itself be detected by more sophisticated profilers and used to define the fingerprint. I can refresh the page and get a new hash and adjective-animal name with the same IP. JSCreep sticks firm to the same hash for me, even with a new IP address and some spoofed browser data.
The problem with this is the biggest, most important, and sketchiest data brokering services (credit monitoring) are all but entrenched in law at this point.
Well, there are multiple approaches, but here's one that worked well for me: when I purchased a home in the country where I now live, and the mortgage lender asked for a credit report from the (high-privacy) country where I lived the longest, what they got was a letter from that country's central bank listing the penalties for requesting that information. Up to and including jail time.
Suddenly the credit report was no longer a prerequisite to the mortgage.
Wouldn't this make credit riskier for lenders, reducing access to credit in general and thus making housing less accessible especially to working people?
Not asking polemically, I just have never studied economics and wonder if my intuition here is flawed
I think the actual trade-off is between average acceptable risk at society level.
Some societies prefer huge risks for huge benefits, in those one (might) need a more detailed credit reports because everything is faster, people accept huge risks and the situation can suddenly change.
Some societies prefer more stability. Lower risks, lower surprises. Less opportunities, everything is slower, people can't even take that many risks, simpler histories will do th trick.
From what I notice though, housing seems to be a problem in both types of societies, irrespective on how credits are given, because there are other things involved (regulation, NIMBY, housing used as value, airbnb, geography, etc).
It feels onerous as an idea because bank statements, monthly bills, payslips, will bequests, stock vests and trades, bank robberies*, and investment income each have different ways of being tracked. At least most of these records of individual financial activity come with a PDF these days. It wasn’t that long ago that applying for a loan meant scanning in papers for your lender to review.
Computers are smarter now. Not only can they read documents (or at least match the shapes against shapes they’ve been told are real) but they can also understand the contents too (or at least match the words against ideas they’ve been told are real.)
There may well yet be a future Data Valhalla where individuals hold their life.zip themselves, and upload whatever bits of it are needed to get that Nordstrom store card / car financing / cheeseburger loan without having an intermediate credit agency.
*I feel there’s a kernel of a joke there about a bank robber asking for a receipt with the loot in anticipation of declaring it on their tax return.
I don't see how this works in reality - The issue is that users wouldn't upload negative information (e.g. county court judgements or the bank robbery from your example).
Credit isn't like insurance where these things can be checked later during a claim (which can then be denied) - you need to know the person is a bad-payer before you send them the ten thousand dollar loan as that affects the terms, not afterwards when they default and you can't get your money back.
For CCJs and bank robberies, you'd upload a clean sheet from the government that gives a list of all CCJs and criminal convictions (in the UK we have a system called DBS for criminal records).
Potentially, with loans or other things, some kind of technical solution could work. You could have a personal document that you control, and you give permission for companies to write to the document.
With a loan, for example, if I give you a loan, I can also append to your document that I've loaned you the money; for every payment you make, I write to the log to say you've made a payment. If you stop making payments, I stop writing to the log. This would be cryptographically signed by me, so it can't be forged.
When you want to take out another loan, you can proactively share your document, the bank can see everything written on the log, and make a decision based on that.
Naively, credit is if you can pay, and if you will pay.
For the latter it’s whether you’ve had a judgment against you, which is a matter of public record.
For the former it’s based on how much money you have and what you spend, including on servicing existing debt. Lying about this would be fraud. In that sense, my proposal does indeed open up a new avenue for fraud but I don’t think that’s the same as it being unworkable!
It typically required more direct sources of trust. If you were a grocery store, you might let customers you personally knew to be good for it, run up a 'tab' and settle on payday. If you were a bank, you might only lend to rich high-class people. You can find this all around the world today; the US is a standout for credit scoring and for access to credit. When a British person wants to sell their house, it has to happen on the same day that the buyer sells their old house, and the house they're moving into to be sold, and so on in a big same-day daisy-chain, until you hit someone who has enough cash for initial outlay. In Japan, up until very recently, you could expect your boss to need to co-sign your apartment lease (and your landlord to immediately escalate any disagreements to your boss).
> It typically required more direct sources of trust. If you were a grocery store, you might let customers you personally knew to be good for it, run up a 'tab' and settle on payday. If you were a bank, you might only lend to rich high-class people.
You hit the nail on the head with the first statement. It required humans in the loop. It scaled linearly. Local branch managers had relationships with the people in their community, and knew who could and couldn't be trusted.
It was an imperfect system, where a human could be prejudiced against another human, and deny them access to credit.
Sometimes that would get discovered, and the human was held accountable for their actions, or had their actions upheld by a (org-chart-superior) human.
Similar to the imperfect system today, where the models a computer uses could be prejudiced against a human, and deny them access to credit. Dissimilar in that the model or the computer is rarely, if ever, held to account. "Computer says no" is a meme for a reason.
I can't tell if this is sarcasm, or do you honestly consider credit for fast food a good thing. I hesitate because I know that in America people buy everything with credit (or at least a lot), so it's possible some people think like that. But obviously not buying fast food with credit is a good thing?
Poor people couldn't borrow and middle-class people paid really high interest rates. Credit ratings are pretty much what enabled the expansion of availability to everyone.
Yes, and then in the interim we invented having a hundred trillion dollars in GDP. I prefer having access to credit and so does everyone who owns a credit card. If you own a house, you didn't have its cash value when you bought it; neither your car, nor (most likely) your education. In the days of no borrowing, we solved the problem with ramshackle one-room buildings with dirt floors, handcarts, and the one book whose distributors desperately wanted everyone to have it for free.
> If you own a house, you didn't have its cash value when you bought it; neither your car, nor (most likely) your education
When I grew up I was told to not make debts if not needed. So many older people did indeed save up until they could afford a car or a house. Education was always mostly free where I lived.
Nowadays it seems like ordinary people would need to pay off a house their whole life and thus also need to keep income high enough to keep paying installments. This takes away so much freedom from people as they are trapped in their high paying jobs...
> I prefer having access to credit and so does everyone who owns a credit card.
A good number of European countries have only half the poverty rates - the dirt floors and carts you're talking about - of the US yet barely use credit cards.
> If you own a house, you didn't have its cash value when you bought it;
> we solved the problem with ramshackle one-room buildings with dirt floors,
there is a fallacy here. People with access to debt bid up the price of an asset, like a house, against other peoples’ similar access to debt. Sans debt access, the solution was not necessarily a small ramshackle house. The fallacy is the belief that the same asset price - whether opulent or ramshackle house, wouldn’t adjust to the reduced level from the bidding environment. The differential cost of construction for a nicer house can be countenanced in the access-to-debt case, but that is second order.
Illustrative straw-man example: Suppose, once one had a parcel of land, that it was trivial to construct one’s ‘starter home’ the ramshackle house if you like. Get one’s family and friends to help build in exchange for future return favors. As one advances in life, rebuild to have something more opulent. The rub is in the parcel itself. Unlike the would-be house, it had no cost built-in, just whatever price the previous owner was willing to accept to release their parcel. That parcel’s (and those around it) price reflects the market’s access to debt, or lack of access to debt. In the market without access to debt, parcel pricing reflects which buyers have accrued more savings vs other buyers. In the market with access to debt, parcel pricing reflects who can access more debt (through the various means we know of today - down payment ability yes, which parallels the non-debt’s savings case, someone co-signing, long term expected future earning potential vs someone retired, the parcel itself put up as collateral, perhaps other non-immobile assets put up as collateral, like the family oxcart).
The point is that there isn’t necessarily a 1:1 coupling between market’s debt vs non-debt access and whether the construction is opulent vs ramshackle.
You send them digitally signed statements from other lenders (who are legally required to give them for free with accurate info) or independent rating agencies, they evaluate them and make a decision. They can have their own model or license one from FICO.
That does mean banks can't know if you lie by omission and hide some unpaid bills, but they can raise the evidence requirements to compensate and I think everyone deserves a second chance.
Overall correct, but you're kind of missing some of the cat-and-mouse details for fingerprinting centered around infosec and anti-fraud purposes rather than generic ad-related tracking. That stuff can get way more intense, and is constantly changing based on new techniques developed, countermeasures from cybercriminals, and mitigations from browser developers.
Is there any way to link this data over longer periods of time?
A lot of data can change over days, weeks, but if you can maintain an accurate fingerprint with tinier changes, and granted you have consistent visits from the user, could you just keep up?
Especially if one service is tapped into several websites, and can continually keep up with smaller data changes and distribute that info. Is this possible? In practice anywhere?
I'm thinking that you just need one website where you can associate a given fingerprint to a specific user and then tracking its activity around the web becomes easy.
Let's say I'm logged in a famous search engine, they associate my fingerprint X to my account A. If they then encounter fingerprint X anywhere else, there is a good chance it was me, A, doing it.
If the next day I get fingerprint Y, it gets attached to A as well and the tracking information follows it.
I was thinking about the literal fingerprint sensor a device has. Imagine a "prove youre not a bot" challenge and the finger scanner pulls up. What a nightmare, reminds me when a website asked me if I want to login with windows hello (facescan)
That is different though. That site is just creating a passkey and storing in your keychain (or windows equivalent). Windows hello unlocks the keychain. It can be your face, fingerprint, usb key, 4 digit pin anything. Chrome already uses this. You’re not sending your face to that website nor to microsoft, I hope.
on what basis do you believe this about fonts? my guess would be that the average user doesn’t install or remove fonts often if ever, but it’s only a guess
I don't actually know how much this happens - software versioning is the biggest one. Chrome updates every two weeks, Microsoft updates once a month, your GPU drivers get updated semi regularly, etc. Any one of those would break the fingerprint.
Your IP changes way less often so that combined with everything else would be more than enough to track you through browser version changes. Even a new IP with the exact same everything else would be pretty easy to correlate too. It just depends on how much they're willing to track and companies are often willing to track a lot already, including things like how fast you type, what kind of movements your mouse makes, etc.
Depending on the browser new fonts can be downloaded and installed automatically. I'd bet most people have a lot more than just the default fonts that came with their OS installed.
One intereting part about installed fonts is that many enterprise companies buy specific fonts. Then they are rolled out to all their devices, and sometimes at least one of them will have the company name as part of it's name.
On the other hand, browsers don't need to share all this data at all. Sure, IP address can't be hidden, but from your example, installed fonts and volume settings? Why should that be shared at all? Sure, for example for a teams meeting, but you'd have to allow the use of microphones or that, youtube for example doesn't need to know how loud you're listening to a video.
> Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Sorry, but that's simply not true. It's actually the default way of how people eg track people across installs in app stores ever since they started removing that feature.
The problem isn't advertising, it's data harvesting and sale. Ads used to rent space on websites - totally reasonable. The whole industry around the purchase and sale of user data is what needs to be banned.
Consequences are deeper than the immediate cause. Advertising is at the heart that gives a lot of value to data harvesting and similar scams.
Data harvesting gains most of its value because they sell some or all data to businesses which wish to leverage that data in advertising. If they cant advertise they wont need most of the data, which should at the least reduce the problem significantly...
Advertising and paid promotion in any form has never been ok. It has always been a cancer on society. That is what happens when you ignore a mild symptom until it metastasizes into something horrible. We need to ban it completely.
Much as i hate being advertised to, i do like the existence of trade, and of new products. In the old days, you would take your products to market once a week on a cart, and the market would pass by your stall. That isn't how it works any more.
Generally, how can society discover new products and services?
I would be open to having some kind of directory that i could browse at my own convenience, but that's ultimately going to devolve to paid placement.
>Generally, how can society discover new products and services?
I'm surprised you can't imagine a society where the consumer would be the one recommending products and not the producer. Any entrepreneur can find one first consumer to test their new product. And that first consumer have access to a great communication network to recommend that products to their social network — it's called "the Internet". Social networks are a great platform for people to share interesting things to their friends, family, colleagues and also to people they don't actually know ("the Internet" can connect you to strangers). Such networks cost little to operate when the content is created by users, instead of producers and their intermediaries (people favors short, insightful written text instead of catchy commercial once detoxed).
Being born in the 1990s, I did experience that "Internet", when advertising networks didn't exist and when people intentionally interacted to make connections and actively look for information. They were happy to tell about things they discovered, with little to expect in return ("influencer", aka mercenary, wasn't a job yet).
You can never get rid of advertising entirely. Ultimately people want to learn about new products and services and new companies that couldn't ever advertise anywhere would die off. It makes sense to support limitations on how and where ads are used though. Banning surveillance capitalism would solve a lot of the problems we have and would mean that a website about cars can still show ads about things people who go to car websites would typically be interested in and that's pretty much the only level of targeting we need.
> Ultimately people want to learn about new products and services and new companies that couldn't ever advertise anywhere would die off.
I want to learn about products that are useful to me, but not through ads. As it turns out, it is incredibly difficult to learn about new products that are useful, as those do not tend to show up in ads at all and even seeking them out is very difficult.
It's weird how no one has come together to make a website specifically designed around users finding product categories that will make their life better. For example, I didn't learn about height adjustable desks from an ad. Nor did I learn about balance boards from an ad. Or trackballs. Or essentially every other product that made my life better once I realized that product category exists.
> Ultimately people want to learn about new products and services
Yes, and those people are free to visit equivalent of mail order catalog or go to the store or subscribe to consumer goods quality testing journal or to any of the enthusiast magazines about electronics or gardening or whatever where they perform independent testing and benchmarking or look up a video comparing ceiling fans across a century when they feel hot in the summer.
So yes, we should absolutely ban third party advertisements. People will still be able to discover good products.
> Ultimately people want to learn about new products and services
Maybe I'm just not a typical person, but I have never woken up in the morning and said to myself, "You know, I would just love for a corporation to help me learn about their new products and services today." Never. Not even once. When I want to learn about something, I will actively seek information out about it, and I'm not going to look to advertisements for impartial information. The purpose of advertising is never to inform. It's to bombard and saturate.
That's one perspective. Other are in different perspectives, like "anything that present something else than the very topic looked for is pure propaganda."
The spectre of possible interpretations is wide.
Some see only problems everywhere whatever the benefits might be, some see only new opportunities no matter the tragic outcomes, some see various blend of this and that.
How do you tell the difference between a regular human trying to not have a weird creepy perma-dossier collected on them... versus a bot set up to always look like a new visitor?
The only winning move is not to play--er, to somehow not to have this kind of game in the first place.
You don't, you simply make both spend a few billion cpu cycles for it. The human will tolerate the one-time cost. The bot's owner won't because it's not scalable.
I worked in fraud prevention for years and device fingerprinting didn't stop fraud, but it reduced it by upping the up the cost. It is not hard to circumvent fingerprinting, but it still takes a non-zero amount of effort on behalf of the fraudster. Device fingerprints helped us identify and block or prevent a lot of low effort fraud and abuse on various platforms.
How would you enforce that? Who can be trusted with the ability to classify things as advertising and in so doing silence their critics?
The solution is explicit trust. Not fingerprints for users, but digital signatures for content. If it's not signed by somebody the user trusts, don't render it.
The user is the only one who can be approach that task without a conflict of interest. If somebody wants the user to run code that phones home about user behavior, make them gain the user's trust.
This site gave me the name “Greedy Bison”, but it didn’t say how many other “Greedy Bison” are out there. I’m guessing everyone using the very common device I’m using and using the very common browser that I’m using would get the same name as me
At least when tracking was unregulated, at least you knew who was by the cookie left in your browser, now I just assume everyone and everything is tracking me
With the cookie, at least you could just whitelist some sites and have everything else be deleted once you leave the related website. Though, admittedly cookie-auto-delete often stops doing what it is supposed to.
The fingerprints don't need to be long-time-stable to be harmful. Some companies have your stable datapoints (e.g., email) and your fingerprint. Other companies only have your fingerprint on the same day/week. Some companies have locations of edge devices and the fingerprints. And there are companies out there that will take all of those data streams, both from above board and not-so-above-board players and mix them for commercial benefit.
Fingerprint.com charges around $0.004 per investigation, and really encourages you to set up a first party proxy - so iOS doesn't nuke storage after 7 days. And even there, unless its a cookie match; your ID usually carries a confidence number.
That should give some hint about how difficult it is to do in real life, at scale.
Fingerprinting is really bad for privacy and the defenses against it are not there. See https://fingerprint.com. Tor Browser defeats it but I don't think there's a highly usable browser like Brave you can use and prevent being tracked by it.
I've been obfuscating my fingerprint with Brave for years, which I selected specifically because it was the browser I was able to do this with, based on my testing of 5 popular browsers, using https://coveryourtracks.eff.org/ as my benchmark.
It does mean that sites that uses 2FA (so every site nowadays) flag me as a coming from a new device each visit, and I have to have my phone nearby every time I want to use my computer, which is quite annoying. If you use GrapheneOS, you can obfuscate your phone too on WiFi networks (and sites, but GrapheneOS not needed for that, just Brave). You can't obfuscate yourself on cellular networks though, unless you have a ton of sim cards you rotate through.
For years, I've been practicing good privacy-hygiene in public. At my doctor's office, I always wear a Groucho Marx moustache to keep them guessing. Before I walk into my bank for a withdrawal, I team up with two of my friends, set them on my shoulders, and throw a trenchcoat over us! I made a fake ID with my birthday on July 4th and my weight as 98 pounds, but my pharmacy is now refusing to fill my prescriptions!
So what sort of benefits are you reaping from your anti-fingerprinting measures?
> So what sort of benefits are you reaping from your anti-fingerprinting measures?
A better question would be how are you being screwed over if you never bother to try to stop companies from collecting as much data as they possibly can about your private life? It can cost you a job offer, or cause you to pay more than your neighbor for the same products/services. It can get your data leaked, or sold to scammers. Companies use the data they collect on you for things as trivial as deciding how long to you leave you on hold. The more data they have on you, the easier it becomes for them to use it against you.
Feel free to give companies every bit of personal data they want from you. They'll be thrilled to use that information at any time and in any way they think it will benefit them. Until we have laws against surveillance capitalism the only person looking out for your interests is you, but only if you can be bothered. It'll sure help companies take advantage of you if you decide it's not worth trying.
Yeah, you know what? Life is far too short to live in fear and paranoia of the scenarios you suggest.
Anywhere I go in meatspace, people could be collecting data about me and my behavior. That has always been true since the beginning of time. An old lady can sit on her porch and take notes about my outfit, my comings and goings, and every driver who comes to my door. Today, they're saying that Target can definitely hear our WiFi/BT MACs as soon as we get into their store, and they see/track everything on camera everywhere inside. My Groucho Marx isn't going to hinder or change that!
All I can do, honestly, is be judicious about what sites I visit, and be forthright in my interactions. I should cultivate good relationships with trustworthy, reputable companies, and stay away from the rest. I cannot ultimately prevent the buying and selling behind the scenes. We cannot realistically prevent collection of everything possible.
I don't shop at Temu or Alibaba, and I don't search on Yandex. I checked my "About Me" on Amazon yesterday and it's shockingly bland and shallow. However I interact with Google, YouTube, Microsoft, and Cloudflare, it's a foregone conclusion that they know everything. My extensive 19-year history on Wikimedia projects is a shockingly rich treasure trove, if anything just my waking hours of every day since 2007! Your own karma score 22,495 in 14 years is probably a fantastic track record of when you were awake and using a computer. If you're so paranoid about Internet privacy, then you wouldn't be so willingly revealing that stuff in public.
I'm using adblocking DNS again, but awhile ago I sort of dropped the pretense of paranoia, because I understood its futility, and again, life's too short. If evil corpos want to do evil to me based on what they think they know, they can do their worst. I am a Christian man accustomed to suffering and infirmity. I got nothing to lose in this life, except integrity.
It’s really kind of pointless. They fingerprint you to target ads and that’s it. The valuable data that’s collected and sold can’t be hidden through fingerprint avoidance: anything you actually pay for. Sure there’s privacy cards, but the second you purchase a physical product you have to give up a delivery address and now they’ll just correlate all your disposable emails and privacy cards and whatever else.
Your only option is to never buy anything online and only pay cash.
> Your only option is to never buy anything online and only pay cash.
I probably wouldn't go as far as never buying anything online, but paying cash IRL should be something done by everyone to protect their privacy. There are a few other easy things that can massively improve your privacy with minor or no inconvenience: Linux on every PC/laptop, GrapheneOS on phone(s), uBlock on every browser (or a DNS-level sanitizer), car without cellular modem (pull the fuse), non-Google and non-Apple email (ideally your own server or a small provider in a friendly jurisdiction). Also, don't use social media and text over Signal instead. Of course, TVs and other home appliances should be kept off the Internet. Overall, those are some very minor sacrifices for anyone with a little bit of maturity. It's very far from living off the grid or anything like that.
> It’s really kind of pointless. They fingerprint you to target ads and that’s it.
That's a very early 2000s view of the issue. Ads are not what all the surveillance is for, it's just the publicly acceptable excuse for tracking you that companies love to use because nobody cares which ad they get shown. Being able to build a profile of which websites you visit can provide a ton of information about you and that data is increasingly being used offline. It stopped being about ads ages ago and now what you do online can impact your next job offer, what prices you pay, which policies companies apply to you, etc.
You can never limit all data collection. Going to the store and paying in cash will still have you tracked by Flock cameras. The point is just to limit what you can, where you can. Every scrap of data collected about you is going to eventually be used against you later by somebody. No point in giving them anymore ammo than you have to.
Wow, that is a seriously impressive demo. I wonder how it’s able to distinguish people using identical hardware and software versions (e.g., iPhones on the same iOS version). It was able to correlate my sessions across multiple independent ISPs, with a VPN, and with Apple’s extra tracking resistance in private mode.
I wonder if a browser extension could be made that inspects your fingerprint and informs you if you're too unique, then one-click to 'correct' those unique items (or at least list them), so you can conveniently go back to being ~anonymous if preferred.
Huh, it is different for me on every page refresh. No VPN, etc... just Firefox on Windows with uBlock, CanvasBlocker, and a PiHole. No persistent fingerprint for me!
Cookies, in and of themselves, are not bad. Like any tool that can be misused, they're just being abused by a ton of really shitty people in an effort to try to enrich themselves at the expense of others. Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"
> Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Don't you people remember how it was done back when web browsers didn't have cookies, or could be configured to reject or ask for each cookie? The server software automatically added a PHPSESSID parameter to every link, containing the session identifier.
RFC 2109 predates anything that vaguely resembles PHP, and Netscape (thus, defacto, basically everyone using the internet), had cookies 3 years before the RFC. PHPSESSID wasn't added until PHP 4 in 2000.
If you're going to be a bitchy pedant, you'd damn well better be CORRECT.
I have heard from some power users that Brave is one of the best browsers with regard to ad-blocking and privacy.
But I think I have read elsewhere that it receives money from ad companies to display only certain ads, which does not make me trust it.
Does anyone have facts or know where to find them?
As a general role, always be suspicious of very loud and vocal opinions about product and services. Specially for closed source products and paid services, they often invest in what is called Native Advertisement/Marketing which is basically paying people to lie and pretend it is organic content/opinion.
Second, despite the dumpsterfire that Mozilla’s leadership has been in a decade or so, it is very robust with privacy and anti fingerprint features out of the box, the containers has also stabilised and works great.
I see so many misconceptions on HN about that coveryourtracks site. Neither of those results are ideal.
"randomized fingerprint" -> that's a bad result, it means the site can detect you're spoofing info
"unique fingerprint" -> this is good, ONLY IF you refresh and it still says "unique fingerprint", because it means the site sees you as a brand new visitor each visit, and doesn't detect any (what advertisers would call) nefarious behavior. however, if you visit again and the second time it says "nearly-unique fingerprint", that's a fail because your two visits were linked
The ideal result you should aim for is "non-unique fingerprint". That means your device is indistinguishable from countless others. Blending in to the crowd is what you want.
These tests aren't reliable - Brave does randomise values but it ultimately doesn't do much to prevent fingerprinting, as many values remain static. For example, Brave still exposes your GPU model and driver version.
See Fingerprint.com, despite Brave's protections you'll likely find it works reliably.
Yet I am constantly flagged by various pages because Cloudflare decided I had some bot running at some point on my network. And my IP is fixed. Whatever EU is doing, it doesn't work.
You might have a residential proxy running somewhere on the network. The latest in botnets is bundling a proxy in with some TV torrent streaming app or whatever else that can run in the background and proxy malicious traffic from your residential IP. Services like cloudflare and crowdsec will keep a constantly updating list of the IP addresses that are actively sending bot traffic and blacklist them. If you can work out where the traffic is coming from and shut it down you should have this issue go away.
I have a similar issue. I see cloudflare checkboxes all the time. Google makes me fill out captchas all the time. Sometimes it decides I can’t search, sometimes cloudflare doesnt let me past the checkbox.
I’ve checked my network. I’ve monitored egress traffic. There is no residential proxy. I’m not on a VPN. If anything, services should be able to track me entirely by my home IP that doesn’t change that often.
My best guess is that I’ve committed the crime of not allowing third party cookies? Or maybe the crime of not being logged into a Google account 24/7. It’s not browser or device specific. My iPhone is just as likely to fail the cloudflare checkbox as my desktop with Firefox + uBlock.
I've committed the extreme crime of running no JS and clean cache of cookies.
Plus, something as simple as containerizing work/play/research reading, into different browsers, has provoked the Eye of Google to be cast on me
I haven't seen a YT ad in years while in lurk-only mode (no login), which is nice, but I also see cloudflare everywhere , which is not great.
One of the nicer things about LLMs, is that they arrived just in time to erase my dependency in search.
I have experienced the same with Google and with PayPal, whenever I used Tor. When I afterwards visited those sites using my normal browser I got Captchas. They are actively fighting attempts to avoid fingerprinting. Also, I am pretty sure that no browser protects against getting fingerprinted. Test with https://fingerprint.com/.
> they have always been about the tracking itself!
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
Yep, and somehow there's always someone who thinks that the "Ah, but this is not a cookie!" is a loophole. It is not, he is just undereducated.
The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)
Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).
Point is that tracking isn't the only thing that's not "strictly necessary". And additionally that "strictly necessary" is tied to something specific: internet society service. That includes a very specific requirement: "Normally provided for remuneration". That's why e.g. public authorities should not (usually) be allowed to rely on it, public services are not often provided for remuneration in EU-law sense.
It also limits the exception in relation to e.g. employment.
> Let’s give it up for Google - the biggest ad company on Earth
I think Google needs to be forbidden from causing more damage to the
EU market. And there need to be replacements too, once we forbid this
Evil entity from sabotaging EU citizens any further.
We also need real open browsers not controlled by greedy Ad companies.
I am also aware of the irony of using thorium here right now (based on
the adChrome code base). If I use Firefox, I can not listen to audio
since mozilla claims only systemd-pulseaudio using people can listen to
audio. Well, chrome plays audio on youtube (which is also owned by
Google, do people begin to see how big of a problem Google has become)
just fine, so I have no idea what Mozilla devs are smoking. I could
recompile firefox, to just use ALSA, but who in his right mind wants
to compile a 1% usage base legacy browser that uses ancient technology
to compile its outdated code base please?
Mozilla gave up decades ago on fighting adGoogle. And it can be seen via
small things too.
Ladybird may be a competitor at one point in time but they ban people from
their github repository, which also sends the message "do not contribute
to us because we don't care about you if you have dissenting opinions". Well,
so much for real competition, when projects get all emo early on. You can't
beat the evil adGoogle empire with wishful projections about "conduct of
people". That's not going to work. I don't subscribe to any random ruleset
made by random people I don't know and don't want to know when they resort
to censorship. But hopefully more and more people realise that something has
to be done about Google one way or another.
I'm skeptical of this magic trick, maybe add a counter with the amount of times I logged in to the website. Or let me save some data to read it from another session. Otherwise lots of people can be identified by that hash, there's no proof that it is unique
> See, the thing is, it’s not about you at all. It’s not really about the ads anymore either. Nobody cares about you. And if the police or your government happen to care, I’ll gladly take their money too.
> I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.
> And to the highest bidder it goes!
> What does that make you then? A gear? An ox? A volunteer?
This does absolutely nothing for me. If this resonates with you, can you explain?
I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.
Is the implication that the machine knows me so deeply that it doesn't matter if it connect my device ID to my name? That it knows me deeply as a person regardless of what identifiers are used?
If that's what meant, I have to say:
1. That's an absurd overestimation of the current capabilities of adtech
2. Even if it were true, I'm not sure I'd be that bothered by it? What I'm bothered by is what could be done with that intimate knowledge. And if the answer is just "show me the absolute most optimal ads", this doesn't really bother me.
It’s a question of entropy. If your device is unusual in detectable ways, then the fingerprint has high entropy. But on my iPhone I suspect most of the things being fingerprinted are the same. How many other people get “smug koala”?
Couple different results than that across three refreshes on iOS w/iCloud Private Relay. Apple does work to do some randomization.
But at least the moment we start using websites the largest players will know it’s us. Nobody else swipes and types exactly like me on my screen size of iOS over the relay.
fingerprints pick up on all sorts of things that make you different enough combined with another signal, 33 bits can be enough to single you out from anyone else on the planet... iOS can be 10-15, and given a residential IP that's plenty - always mobile is more anonymous on the web but guess what's much worse? apps.
a native app with 0 permission prompts gets you more bits than web
No. Almost everybody using an iPhone is on the latest release, plus or minus one while updates are rolling out. For a given iOS release and hardware type almost all of those probes are highly correlated. No way there’s 30 bits of entropy in that. I doubt there’s even 10.
Now on a desktop PC sure I believe these fingerprints are highly descriptive. And in android land they probably work okay because of the diversity of products and configurations. But iPhones resist fingerprinting just because they all give the same answers.
Some of these guys sound like they erase their fingerprints off the plates when they visit a restaurant, and ask people to forget about them when done talking.
Like it or not, as web gets more complex, it will recognize you more. If you don't want that, just don't use the web - perhaps buy a farm and life off-grid.
I just don't get what's the appeal to this endless damn cat and mouse game.
So you're basically saying the old "I have nothing to hide" argument which has been debunked over a million times...
In particular because "I have nothing to hide" means "I have nothing to hide until now, and because of the corporations and states that have access to my data are lead right now by people I trust not to misuse that data"
But if tomorrow the government change, and suddenly your searches for "gay bars near my location" becomes illegal, you'd rather this info not be in everyone's hands...
Lack of privacy harms journalism and activism, making the government too powerful and not accountable. If only activists and journalists will try to have the privacy, it will be much easier to target them. Everyone should have privacy to protect them. It’s sort of like freedom of speech is necessary not just for journalists, but for everyone, even if you have nothing to say.
> Remember the big fuss about third-party cookies? It was so big that the EU had already rolled out one of its greatest inventions - consent banners.
It was never about cookies. Thats what the industry made you think. You don't need to show consent banners for cookies (like auth sessions). You need consent for tracking. This includes profiling. And it doesn't matter what you use, fingerprinting or tracking cookies, the consenst banner is required either way.
> the consenst banner is required either way.
Consent is required. The banner is just one mechanism, but not required. A website could hold off on all tracking until a suitable point in the usage of the site (like creating a profile, for example) and ask at that point.
The banner is an artefact of the hostile way most sites choose to try and hoodwink the user into being monetised and ultimately to piss users off so much that they complain about the legislation rather than the lack of online privacy.
I feel it's worth distinguishing between the Hacker News Audience that is highly tech-educated and security-conscious and the general public that just wants to use the web and seems more than happy to give all their data to Meta, Google & Co.
If you ask my 70-year-old mom to decide whether she'd like to allow the WebGL API, she'll go bonkers. If anything, the constant cookie banners have just trained her to consent to stuff out of muscle memory. You could probably design a "Are you ok to sign over the deed to your house" question in the rough shape of a cookie banner and get 90%+ agreement.
Yeah it’s absolutely how effective the industry psyop against that was
Or alternatively how weak the EU messaging was I guess
A 'cookie banner' I've came across recently (https://www.courthousenews.com/scotus-calls-for-redo-on-wash...) feels so bizarre yet arguably should be the standard.
> Global Privacy Control detected. Advertising cookies are turned OFF.
> Global Privacy Control detected. Advertising cookies are turned OFF.
Yes, I love this. My browser is already sending "do not track" requests.
I’m sure the Meta’s and Google’s on this planet will all faithfully honor our “do not track” requests.
The banners were for those other cookies, often for affiliate marketing and needed permission or at least the appearance of state order
I still don't understand why the highest entropy APIs aren't gated behind browser consent.
A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
Broad geographical targeting shouldn't be an issue. In fact, it's so easy that I think we should invent an ad-targeting API people can opt in to. If I could tell advertisers my geographic location, gender, age cohort, languages, and 3 interests, I'd not feel that's an invasion of privacy when they use that to deliver ads. I'd just get lawnmower ads instead of shampoo ads and that's fine.
The problem is, they don't want to use that kind of targeting. They want to target me with ads for a travel destination that my coworker mentioned in a Messenger message to another coworker five minutes ago. But we should just not accept that.
> "I still don't understand why the highest entropy APIs aren't gated behind browser consent"
Because it's known that interrupting the user-intent with a unrelated consent-popup doesn't help.
Older people may remember that this was the approach of Java J2ME, where you couldn't provide a fluent user-experience as the user first had to answer huge popups about individual API-permissions with "Always Allow", "Allow now" etc.
> A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
We should go further. A web-site with mostly static content should not use user-side scripting (Javascript) at all, it's unnecessary for it. It should be required only in rare cases where a site is basically an application and require manually turning it on each time such application is opened.
I think that ship sailed and I'm pragmatic enough to accept it. The web is an application platform, not a web of hypertext content. That's not going to change, and I've given up on the idea to even try to "go back" there. If it worked, you'd just have half of websites be "sites" that work without JS, and half would be "apps" which would require switching on JS? The whole reaosn the web took off as it has is because we removed the distinction between "web app" and "web site". There's no putting that genie back in the bottle.
That might sound good, but people already moan and groan about cookie notices. Imagine if each website that legitimately needs it would start asking for permission to each fingerprintable API. Although I do think we should have that option, just not as a default.
You could accept things once per API and site. It doesn't feel that terrible. We do it for camera and clipboard already.
Well yeah, but there's also the part where I'm not okay loading ads from a third party because they eat my battery, add latency, and can potentially be used to spread malware. So there's the conflicting preferences regarding targeting that you mention but also conflicting preferences regarding how they are served.
That could also be a preference. Do you allow third party ads to begin with? But then I'd understand if people would just block visitors that don't agree to them. I think paying via showing ads is fine. Paying with my integrity isn't.
That would be nice. However, It’s easy to see why it’s way more than simply what they want, they don’t really have a preference but it boils down to money. You’ll only replace your lawnmower every couple years and the rest of the time they’re guessing what you may buy next. By spying on your daily conversations and browsing, they have an idea of what you are likely to buy this week, next week, and the week after. This is so much more valuable to an advertiser.
Exactly. And here's where regulators come in. What we need to do as a society is basically say "Unless you can make your ad-funded business work with this tiny bit of information, your ad-funded business should fail and shut down".
Same reasons why browsers allow javascript on every site.
The solution has to come from law. I propose we handle privacy invasion the same as rape. Body and mind aren't up for grabs. That the average internet user is unconscious isn't a valid excuse.
It would be great if a wave of lawmaking started in the USA, because most tech behemots operate from there. I would expect EU to take the lead though IF such a wave would start. The EU has still a fair share of christian/conservative MP's that keeps doing the bidding for companies by pushing chat control, but on the other hand also has some progressive and knowledgeable representatives doing great work, so there might be a glimmer of hope. We need media campaigns and public education though. Political leaders are selected for their political abilities and as such rarely have leadership qualities. If the electorate moves, the leaders will follow it. So we have to start at the bottom.
I like your idea, but as a pessimist, I believe the ship has sailed, all government are craving on monitoring their citizens' move. If there are way for the government to fingerprint their citizen digitally, they will want to do it instead of protect us.
> The request already reveals information about you; what browser you use, the language it’s in, the OS that runs it and your IP address, which the server needs to send you the response. That often reveals your location.
If we control the servers the clients are connecting to, I don't see how there could be much hope of hiding. We can spoof things like latency toward an upper bound, but we can never ever defeat the lower bound. Physics is still quite insistent about that one.
If we control multiple servers, we know where they are, and we can periodically compel our clients to rotate between them (see: DNS), we can engage in latency-based multilateration to put them on a real-world map. Depending on the number of servers and samples over time, this can be remarkably accurate. Determining someone's actual postal code just from network timing information is feasible.
VPNs obviously confound this in first order terms, but if we aren't careful they can make it even easier to identify our activity in other ways. We are trading concealment in the woods for concealment in a crowd. Both have their advantages and disadvantages. The VPN might also have a side channel that we aren't aware of.
https://www.usenix.org/legacy/event/nsdi07/tech/full_papers/...
I think that's how ipinfo works: https://ipinfo.io/trace
The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis.
I can't help but keep thinking that client-side scripting was a mistake. Sure, the web would be a lot more primitive without it, but I'm not convinced that wouldn't be for the best.
The alternative is to install a binary that has full access to the computer.
The scope and amount of information that browsers hand over without the slightest shred of consent from the user or indication it’s happening is crazy.
It's a UX trade off. For non-adversarial websites it's very convenient for users because things just work without having to go through loads of permissions pop ups for every website, but of course this then makes this info a juicy target if you're trying to fingerprint someone.
It's not a tradeoff, it's poor design.
But it is a design trade-off. The opposite case can be seem in the many websites asking to send you notifications, and the many flavours of cookie notices. When you have to ask the user permission to do anything and everything, the user gets annoyed and desensitized. They start allowing everything (my always collects dozens of notification-enabled websites if given the chance), and the point of asking for permission is lost.
And also without logging it. Even if I don’t want popups to give consent for every document.getEyeColor() call, it would be nice go back and see who’s doing which queries and/or have Firefox collect aggregate statistics. Naming and shaming the crooks won’t stop them but it might have an impact on curbing any bad behavior from big commercial retailers.
I like this idea a lot. It’s similar in principal to how macOS shames battery hog apps in its battery menu extra.
That's not a browser thing. Fingerprinting native apps is much easier.
Is it though?
Google's business model has been ads from the beginning. Search, gmail, drive, office, chrome, everything they do is just to drive ad revenue further.
They don't care about the user. Never have, and never will.
And the outcome we are seeing is what happens when a defunct state isn't able to protect citizens from conglomerates. That's what the Kartellamt or the FTC is supposed to be for.
Nope. At least until 2008 I cared and Larry and Sergey cared quite a bit.
Yes, I believe they initially really meant it when making their “don’t be evil” statement.
The company as a whole also really stopped caring at some point and are now following the “do be evil” paradigm
> Nope. At least until 2008 I cared and Larry and Sergey cared quite a bit.
Not sure if I can't see this comment as anything else than hypocritical. It's always easier on the money receiving side, isn't it? How do you think the term malvertisement came to be?
AdMob is kind of the definition of inevitable Surveillance Capitalism and the prime example for necessary regulation through government.
You can do plenty (like view port size) via just CSS.
If everyone else you know has JavaScript turned on, congrats, you're still fingerprinted.
If anyone else has JavaScript turned off you're fine (as long as you can account for all the other stuff like IP address).
Even without JS, there is timing, HTTP headers, conditional CSS, etc.
> identifying hardware,
> language
I dont think js is needed for either of those things.
I've seen anti-fingerprinting plugins and browser configs, etc, but they all seem to make you more interesting for not being fingerprintable, or for turning off a lot of features used in fingerprinting.
Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
Random is often going to be indirectly fingerprintable too, since some values are always the same (or the same given each browser version). Some values can't be set to be random or otherwise non-fingerprintable data without affecting the user, like viewport size.
Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.
> Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard
It doesn't matter if it looks wrong as long as it looks differently wrong over time. Don't bother trying to blend in with the crowd because you can't ever expect to catch everything that can be used to fingerprint you. New techniques come out all the time. You can block a lot of information from even being collected. Limit what data you send at all, randomize what's left, change IP frequently (VPN) and you should be fine.
There are projects that do this already e.g. https://github.com/lwthiker/curl-impersonate
That's the thing, no web page, except for games, should ever need to know about your viewport size. So spoofing would be just fine, imho, with an override option/permission for individual sites.
Any idea how iOS’ private browsing impacts fingerprinting?
It doesn’t. Same there
[dead]
You can forcefully disable hardware acceleration, that removes a few bits - though javascript can still guesstimate your CPU and memory.
For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.
IIRC that is what https://jshelter.org/ does.
> "What JShelter configuration should I pick?
https://jshelter.org/faq/#what-jshelter-configuration-should... :
First, see our blog post. Consult also other blog posts and other questions in this FAQ.
If you want to have the same fingerprint as many users, We suggest going for Tor Browser (do not install JShelter in Tor Browser). If you want to make cross-site fingerprinting linkage hard, go for the Recommended JShelter level. If you want better protection for the real data at the cost of having the same fingerprint on different sites, go for the Strict JShelter level. Keep NBS active. If you want to detect and prevent fingerprinting attempts, use FPD.
Thanks. I tried this on Firefox for Android and each time I close the browser and load the page my fingerprint ID is different. So it seems to work. Have you had any sites break with this extension installed?
> Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
That's basically the ideal. It's become obvious that it's impossible to try to be identical. Web browsers are too leaky, and something will out you. You really don't want to try to blend in the "typical" users because none of them use ad blockers.
This very often will trigger cloudflare protection.
I think this is what canvas blocker does.
Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes.
90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months).
What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.
18 months ago Google publicly stated they were going to start using browser fingerprint data to track users, a reversal of their 2019 policy on it because it was considered too invasive.
https://www.malwarebytes.com/blog/news/2025/02/google-now-al...
There's a fingerprint demo on github called JSCreep (https://abrahamjuliot.github.io/creepjs/) that used to keep your fingerprint profile for 90 days and show you how many times you visited. Worked extremely well, and is still around, but no longer uses the API to retain fingerprint data, so you have to track your hash yourself. It would easily track most browsers across changes in IP address. Only Mullvad, Brave, or Tor would not leave an easily tracked fingerprint.
The demo presented in the royfish.dev link is easily foiled by browser extensions that scramble fingerprint data, the presence of which would itself be detected by more sophisticated profilers and used to define the fingerprint. I can refresh the page and get a new hash and adjective-animal name with the same IP. JSCreep sticks firm to the same hash for me, even with a new IP address and some spoofed browser data.
IMO, data brokering is what should be illegal, not the cookie .
The problem with this is the biggest, most important, and sketchiest data brokering services (credit monitoring) are all but entrenched in law at this point.
How should credit reports work?
Well, there are multiple approaches, but here's one that worked well for me: when I purchased a home in the country where I now live, and the mortgage lender asked for a credit report from the (high-privacy) country where I lived the longest, what they got was a letter from that country's central bank listing the penalties for requesting that information. Up to and including jail time.
Suddenly the credit report was no longer a prerequisite to the mortgage.
Wouldn't this make credit riskier for lenders, reducing access to credit in general and thus making housing less accessible especially to working people?
Not asking polemically, I just have never studied economics and wonder if my intuition here is flawed
I think the actual trade-off is between average acceptable risk at society level.
Some societies prefer huge risks for huge benefits, in those one (might) need a more detailed credit reports because everything is faster, people accept huge risks and the situation can suddenly change.
Some societies prefer more stability. Lower risks, lower surprises. Less opportunities, everything is slower, people can't even take that many risks, simpler histories will do th trick.
From what I notice though, housing seems to be a problem in both types of societies, irrespective on how credits are given, because there are other things involved (regulation, NIMBY, housing used as value, airbnb, geography, etc).
You bring your own data to each credit check.
It feels onerous as an idea because bank statements, monthly bills, payslips, will bequests, stock vests and trades, bank robberies*, and investment income each have different ways of being tracked. At least most of these records of individual financial activity come with a PDF these days. It wasn’t that long ago that applying for a loan meant scanning in papers for your lender to review.
Computers are smarter now. Not only can they read documents (or at least match the shapes against shapes they’ve been told are real) but they can also understand the contents too (or at least match the words against ideas they’ve been told are real.)
There may well yet be a future Data Valhalla where individuals hold their life.zip themselves, and upload whatever bits of it are needed to get that Nordstrom store card / car financing / cheeseburger loan without having an intermediate credit agency.
*I feel there’s a kernel of a joke there about a bank robber asking for a receipt with the loot in anticipation of declaring it on their tax return.
I don't see how this works in reality - The issue is that users wouldn't upload negative information (e.g. county court judgements or the bank robbery from your example).
Credit isn't like insurance where these things can be checked later during a claim (which can then be denied) - you need to know the person is a bad-payer before you send them the ten thousand dollar loan as that affects the terms, not afterwards when they default and you can't get your money back.
For CCJs and bank robberies, you'd upload a clean sheet from the government that gives a list of all CCJs and criminal convictions (in the UK we have a system called DBS for criminal records).
Potentially, with loans or other things, some kind of technical solution could work. You could have a personal document that you control, and you give permission for companies to write to the document.
With a loan, for example, if I give you a loan, I can also append to your document that I've loaned you the money; for every payment you make, I write to the log to say you've made a payment. If you stop making payments, I stop writing to the log. This would be cryptographically signed by me, so it can't be forged.
When you want to take out another loan, you can proactively share your document, the bank can see everything written on the log, and make a decision based on that.
Naively, credit is if you can pay, and if you will pay.
For the latter it’s whether you’ve had a judgment against you, which is a matter of public record.
For the former it’s based on how much money you have and what you spend, including on servicing existing debt. Lying about this would be fraud. In that sense, my proposal does indeed open up a new avenue for fraud but I don’t think that’s the same as it being unworkable!
The point of the credit agency is to work for the lender?
[flagged]
…is the title of my sex tape!
How did lending work before nationwide mass surveillance of consumers and reporting on their activities?
It typically required more direct sources of trust. If you were a grocery store, you might let customers you personally knew to be good for it, run up a 'tab' and settle on payday. If you were a bank, you might only lend to rich high-class people. You can find this all around the world today; the US is a standout for credit scoring and for access to credit. When a British person wants to sell their house, it has to happen on the same day that the buyer sells their old house, and the house they're moving into to be sold, and so on in a big same-day daisy-chain, until you hit someone who has enough cash for initial outlay. In Japan, up until very recently, you could expect your boss to need to co-sign your apartment lease (and your landlord to immediately escalate any disagreements to your boss).
> It typically required more direct sources of trust. If you were a grocery store, you might let customers you personally knew to be good for it, run up a 'tab' and settle on payday. If you were a bank, you might only lend to rich high-class people.
You hit the nail on the head with the first statement. It required humans in the loop. It scaled linearly. Local branch managers had relationships with the people in their community, and knew who could and couldn't be trusted.
It was an imperfect system, where a human could be prejudiced against another human, and deny them access to credit.
Sometimes that would get discovered, and the human was held accountable for their actions, or had their actions upheld by a (org-chart-superior) human.
Similar to the imperfect system today, where the models a computer uses could be prejudiced against a human, and deny them access to credit. Dissimilar in that the model or the computer is rarely, if ever, held to account. "Computer says no" is a meme for a reason.
Sounds like a mess! How in that system will people get access to credit for things like buying fast food or books?
they shouldn't
Wow credit for fast food! What about toilet paper? The companies producing toilet paper can't just run a "tab" for their good customers
I can't tell if this is sarcasm, or do you honestly consider credit for fast food a good thing. I hesitate because I know that in America people buy everything with credit (or at least a lot), so it's possible some people think like that. But obviously not buying fast food with credit is a good thing?
Poor people couldn't borrow and middle-class people paid really high interest rates. Credit ratings are pretty much what enabled the expansion of availability to everyone.
Why should they work. We used to think that money lenders were evil.
Yes, and then in the interim we invented having a hundred trillion dollars in GDP. I prefer having access to credit and so does everyone who owns a credit card. If you own a house, you didn't have its cash value when you bought it; neither your car, nor (most likely) your education. In the days of no borrowing, we solved the problem with ramshackle one-room buildings with dirt floors, handcarts, and the one book whose distributors desperately wanted everyone to have it for free.
> If you own a house, you didn't have its cash value when you bought it; neither your car, nor (most likely) your education
When I grew up I was told to not make debts if not needed. So many older people did indeed save up until they could afford a car or a house. Education was always mostly free where I lived.
Nowadays it seems like ordinary people would need to pay off a house their whole life and thus also need to keep income high enough to keep paying installments. This takes away so much freedom from people as they are trapped in their high paying jobs...
> I prefer having access to credit and so does everyone who owns a credit card.
A good number of European countries have only half the poverty rates - the dirt floors and carts you're talking about - of the US yet barely use credit cards.
> If you own a house, you didn't have its cash value when you bought it;
> we solved the problem with ramshackle one-room buildings with dirt floors,
there is a fallacy here. People with access to debt bid up the price of an asset, like a house, against other peoples’ similar access to debt. Sans debt access, the solution was not necessarily a small ramshackle house. The fallacy is the belief that the same asset price - whether opulent or ramshackle house, wouldn’t adjust to the reduced level from the bidding environment. The differential cost of construction for a nicer house can be countenanced in the access-to-debt case, but that is second order.
Illustrative straw-man example: Suppose, once one had a parcel of land, that it was trivial to construct one’s ‘starter home’ the ramshackle house if you like. Get one’s family and friends to help build in exchange for future return favors. As one advances in life, rebuild to have something more opulent. The rub is in the parcel itself. Unlike the would-be house, it had no cost built-in, just whatever price the previous owner was willing to accept to release their parcel. That parcel’s (and those around it) price reflects the market’s access to debt, or lack of access to debt. In the market without access to debt, parcel pricing reflects which buyers have accrued more savings vs other buyers. In the market with access to debt, parcel pricing reflects who can access more debt (through the various means we know of today - down payment ability yes, which parallels the non-debt’s savings case, someone co-signing, long term expected future earning potential vs someone retired, the parcel itself put up as collateral, perhaps other non-immobile assets put up as collateral, like the family oxcart).
The point is that there isn’t necessarily a 1:1 coupling between market’s debt vs non-debt access and whether the construction is opulent vs ramshackle.
You send them digitally signed statements from other lenders (who are legally required to give them for free with accurate info) or independent rating agencies, they evaluate them and make a decision. They can have their own model or license one from FICO.
That does mean banks can't know if you lie by omission and hide some unpaid bills, but they can raise the evidence requirements to compensate and I think everyone deserves a second chance.
It is illegal, if it's PII without explicit consent.
Overall correct, but you're kind of missing some of the cat-and-mouse details for fingerprinting centered around infosec and anti-fraud purposes rather than generic ad-related tracking. That stuff can get way more intense, and is constantly changing based on new techniques developed, countermeasures from cybercriminals, and mitigations from browser developers.
I think the idea here is that the details shouldn't be publicly known. (Or that if they were they would have to invent their details!)
Is there any way to link this data over longer periods of time?
A lot of data can change over days, weeks, but if you can maintain an accurate fingerprint with tinier changes, and granted you have consistent visits from the user, could you just keep up?
Especially if one service is tapped into several websites, and can continually keep up with smaller data changes and distribute that info. Is this possible? In practice anywhere?
I'm thinking that you just need one website where you can associate a given fingerprint to a specific user and then tracking its activity around the web becomes easy.
Let's say I'm logged in a famous search engine, they associate my fingerprint X to my account A. If they then encounter fingerprint X anywhere else, there is a good chance it was me, A, doing it. If the next day I get fingerprint Y, it gets attached to A as well and the tracking information follows it.
Does this make sense?
You mean, like a really popular web service or app that someone would log into every day/week/month...?
Even easier if, additionally, many of the smaller websites were syndicated into a tracking network?
I was thinking about the literal fingerprint sensor a device has. Imagine a "prove youre not a bot" challenge and the finger scanner pulls up. What a nightmare, reminds me when a website asked me if I want to login with windows hello (facescan)
That is different though. That site is just creating a passkey and storing in your keychain (or windows equivalent). Windows hello unlocks the keychain. It can be your face, fingerprint, usb key, 4 digit pin anything. Chrome already uses this. You’re not sending your face to that website nor to microsoft, I hope.
Yes, very much. I just fear we may end up there at some point...
on what basis do you believe this about fonts? my guess would be that the average user doesn’t install or remove fonts often if ever, but it’s only a guess
I don't actually know how much this happens - software versioning is the biggest one. Chrome updates every two weeks, Microsoft updates once a month, your GPU drivers get updated semi regularly, etc. Any one of those would break the fingerprint.
Your IP changes way less often so that combined with everything else would be more than enough to track you through browser version changes. Even a new IP with the exact same everything else would be pretty easy to correlate too. It just depends on how much they're willing to track and companies are often willing to track a lot already, including things like how fast you type, what kind of movements your mouse makes, etc.
Most people probably have completely default fonts, right? Doesn't seem like much of an identifier anyway
Depending on the browser new fonts can be downloaded and installed automatically. I'd bet most people have a lot more than just the default fonts that came with their OS installed.
Automatically installed fonts don't give much of a signal if they are automatically installed on everyone's machines.
Hmm. I used to have to do that a lot, but I haven't in a few years now.
Perhaps, but that would also mean the cardinality is lower.
One intereting part about installed fonts is that many enterprise companies buy specific fonts. Then they are rolled out to all their devices, and sometimes at least one of them will have the company name as part of it's name.
On the other hand, browsers don't need to share all this data at all. Sure, IP address can't be hidden, but from your example, installed fonts and volume settings? Why should that be shared at all? Sure, for example for a teams meeting, but you'd have to allow the use of microphones or that, youtube for example doesn't need to know how loud you're listening to a video.
> Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Sorry, but that's simply not true. It's actually the default way of how people eg track people across installs in app stores ever since they started removing that feature.
Theres only one solution, ban third party advertising. Everything else is a compromise that doesnt work anyway.
The problem isn't advertising, it's data harvesting and sale. Ads used to rent space on websites - totally reasonable. The whole industry around the purchase and sale of user data is what needs to be banned.
Consequences are deeper than the immediate cause. Advertising is at the heart that gives a lot of value to data harvesting and similar scams.
Data harvesting gains most of its value because they sell some or all data to businesses which wish to leverage that data in advertising. If they cant advertise they wont need most of the data, which should at the least reduce the problem significantly...
Advertising and paid promotion in any form has never been ok. It has always been a cancer on society. That is what happens when you ignore a mild symptom until it metastasizes into something horrible. We need to ban it completely.
Much as i hate being advertised to, i do like the existence of trade, and of new products. In the old days, you would take your products to market once a week on a cart, and the market would pass by your stall. That isn't how it works any more.
Generally, how can society discover new products and services?
I would be open to having some kind of directory that i could browse at my own convenience, but that's ultimately going to devolve to paid placement.
>Generally, how can society discover new products and services?
I'm surprised you can't imagine a society where the consumer would be the one recommending products and not the producer. Any entrepreneur can find one first consumer to test their new product. And that first consumer have access to a great communication network to recommend that products to their social network — it's called "the Internet". Social networks are a great platform for people to share interesting things to their friends, family, colleagues and also to people they don't actually know ("the Internet" can connect you to strangers). Such networks cost little to operate when the content is created by users, instead of producers and their intermediaries (people favors short, insightful written text instead of catchy commercial once detoxed).
Being born in the 1990s, I did experience that "Internet", when advertising networks didn't exist and when people intentionally interacted to make connections and actively look for information. They were happy to tell about things they discovered, with little to expect in return ("influencer", aka mercenary, wasn't a job yet).
You can never get rid of advertising entirely. Ultimately people want to learn about new products and services and new companies that couldn't ever advertise anywhere would die off. It makes sense to support limitations on how and where ads are used though. Banning surveillance capitalism would solve a lot of the problems we have and would mean that a website about cars can still show ads about things people who go to car websites would typically be interested in and that's pretty much the only level of targeting we need.
> Ultimately people want to learn about new products and services and new companies that couldn't ever advertise anywhere would die off.
I want to learn about products that are useful to me, but not through ads. As it turns out, it is incredibly difficult to learn about new products that are useful, as those do not tend to show up in ads at all and even seeking them out is very difficult.
It's weird how no one has come together to make a website specifically designed around users finding product categories that will make their life better. For example, I didn't learn about height adjustable desks from an ad. Nor did I learn about balance boards from an ad. Or trackballs. Or essentially every other product that made my life better once I realized that product category exists.
> Ultimately people want to learn about new products and services
Yes, and those people are free to visit equivalent of mail order catalog or go to the store or subscribe to consumer goods quality testing journal or to any of the enthusiast magazines about electronics or gardening or whatever where they perform independent testing and benchmarking or look up a video comparing ceiling fans across a century when they feel hot in the summer.
So yes, we should absolutely ban third party advertisements. People will still be able to discover good products.
> Ultimately people want to learn about new products and services
Maybe I'm just not a typical person, but I have never woken up in the morning and said to myself, "You know, I would just love for a corporation to help me learn about their new products and services today." Never. Not even once. When I want to learn about something, I will actively seek information out about it, and I'm not going to look to advertisements for impartial information. The purpose of advertising is never to inform. It's to bombard and saturate.
Nobody claims one can get rid of it entirely. Nothing in this world is black and white, there are always shades of gray.
We also cant get rid of cancer, it doesnt mean we shoudl close down all hospitals.
That's one perspective. Other are in different perspectives, like "anything that present something else than the very topic looked for is pure propaganda."
The spectre of possible interpretations is wide.
Some see only problems everywhere whatever the benefits might be, some see only new opportunities no matter the tragic outcomes, some see various blend of this and that.
Theres only one problem most what people call opportunities are not actually positive life experiences.
Or ban all advertising, https://news.ycombinator.com/item?id=43595269
Fingerprinting is still needing for preventing fraud and platform abuse like spam.
How do you tell the difference between a regular human trying to not have a weird creepy perma-dossier collected on them... versus a bot set up to always look like a new visitor?
The only winning move is not to play--er, to somehow not to have this kind of game in the first place.
You don't, you simply make both spend a few billion cpu cycles for it. The human will tolerate the one-time cost. The bot's owner won't because it's not scalable.
It doesn't actually work for that
I worked in fraud prevention for years and device fingerprinting didn't stop fraud, but it reduced it by upping the up the cost. It is not hard to circumvent fingerprinting, but it still takes a non-zero amount of effort on behalf of the fraudster. Device fingerprints helped us identify and block or prevent a lot of low effort fraud and abuse on various platforms.
If it didn't, why do you think every captcha solution uses it? It doesn't have to be 100% effective to be useful.
How would you enforce that? Who can be trusted with the ability to classify things as advertising and in so doing silence their critics?
The solution is explicit trust. Not fingerprints for users, but digital signatures for content. If it's not signed by somebody the user trusts, don't render it.
The user is the only one who can be approach that task without a conflict of interest. If somebody wants the user to run code that phones home about user behavior, make them gain the user's trust.
Many countries ban cigarette advertising. Not saying its perfect but has helped reduce smoking.
This site gave me the name “Greedy Bison”, but it didn’t say how many other “Greedy Bison” are out there. I’m guessing everyone using the very common device I’m using and using the very common browser that I’m using would get the same name as me
At least when tracking was unregulated, at least you knew who was by the cookie left in your browser, now I just assume everyone and everything is tracking me
With the cookie, at least you could just whitelist some sites and have everything else be deleted once you leave the related website. Though, admittedly cookie-auto-delete often stops doing what it is supposed to.
The fingerprints don't need to be long-time-stable to be harmful. Some companies have your stable datapoints (e.g., email) and your fingerprint. Other companies only have your fingerprint on the same day/week. Some companies have locations of edge devices and the fingerprints. And there are companies out there that will take all of those data streams, both from above board and not-so-above-board players and mix them for commercial benefit.
Fingerprint.com charges around $0.004 per investigation, and really encourages you to set up a first party proxy - so iOS doesn't nuke storage after 7 days. And even there, unless its a cookie match; your ID usually carries a confidence number.
That should give some hint about how difficult it is to do in real life, at scale.
Fingerprinting is really bad for privacy and the defenses against it are not there. See https://fingerprint.com. Tor Browser defeats it but I don't think there's a highly usable browser like Brave you can use and prevent being tracked by it.
I've been obfuscating my fingerprint with Brave for years, which I selected specifically because it was the browser I was able to do this with, based on my testing of 5 popular browsers, using https://coveryourtracks.eff.org/ as my benchmark.
It does mean that sites that uses 2FA (so every site nowadays) flag me as a coming from a new device each visit, and I have to have my phone nearby every time I want to use my computer, which is quite annoying. If you use GrapheneOS, you can obfuscate your phone too on WiFi networks (and sites, but GrapheneOS not needed for that, just Brave). You can't obfuscate yourself on cellular networks though, unless you have a ton of sim cards you rotate through.
> unless you have a ton of sim cards you rotate through
And phones!
For years, I've been practicing good privacy-hygiene in public. At my doctor's office, I always wear a Groucho Marx moustache to keep them guessing. Before I walk into my bank for a withdrawal, I team up with two of my friends, set them on my shoulders, and throw a trenchcoat over us! I made a fake ID with my birthday on July 4th and my weight as 98 pounds, but my pharmacy is now refusing to fill my prescriptions!
So what sort of benefits are you reaping from your anti-fingerprinting measures?
> So what sort of benefits are you reaping from your anti-fingerprinting measures?
A better question would be how are you being screwed over if you never bother to try to stop companies from collecting as much data as they possibly can about your private life? It can cost you a job offer, or cause you to pay more than your neighbor for the same products/services. It can get your data leaked, or sold to scammers. Companies use the data they collect on you for things as trivial as deciding how long to you leave you on hold. The more data they have on you, the easier it becomes for them to use it against you.
Feel free to give companies every bit of personal data they want from you. They'll be thrilled to use that information at any time and in any way they think it will benefit them. Until we have laws against surveillance capitalism the only person looking out for your interests is you, but only if you can be bothered. It'll sure help companies take advantage of you if you decide it's not worth trying.
Yeah, you know what? Life is far too short to live in fear and paranoia of the scenarios you suggest.
Anywhere I go in meatspace, people could be collecting data about me and my behavior. That has always been true since the beginning of time. An old lady can sit on her porch and take notes about my outfit, my comings and goings, and every driver who comes to my door. Today, they're saying that Target can definitely hear our WiFi/BT MACs as soon as we get into their store, and they see/track everything on camera everywhere inside. My Groucho Marx isn't going to hinder or change that!
All I can do, honestly, is be judicious about what sites I visit, and be forthright in my interactions. I should cultivate good relationships with trustworthy, reputable companies, and stay away from the rest. I cannot ultimately prevent the buying and selling behind the scenes. We cannot realistically prevent collection of everything possible.
I don't shop at Temu or Alibaba, and I don't search on Yandex. I checked my "About Me" on Amazon yesterday and it's shockingly bland and shallow. However I interact with Google, YouTube, Microsoft, and Cloudflare, it's a foregone conclusion that they know everything. My extensive 19-year history on Wikimedia projects is a shockingly rich treasure trove, if anything just my waking hours of every day since 2007! Your own karma score 22,495 in 14 years is probably a fantastic track record of when you were awake and using a computer. If you're so paranoid about Internet privacy, then you wouldn't be so willingly revealing that stuff in public.
I'm using adblocking DNS again, but awhile ago I sort of dropped the pretense of paranoia, because I understood its futility, and again, life's too short. If evil corpos want to do evil to me based on what they think they know, they can do their worst. I am a Christian man accustomed to suffering and infirmity. I got nothing to lose in this life, except integrity.
It’s really kind of pointless. They fingerprint you to target ads and that’s it. The valuable data that’s collected and sold can’t be hidden through fingerprint avoidance: anything you actually pay for. Sure there’s privacy cards, but the second you purchase a physical product you have to give up a delivery address and now they’ll just correlate all your disposable emails and privacy cards and whatever else.
Your only option is to never buy anything online and only pay cash.
Well you can buy prepaid cards with monero on xmrbazaar if you want
> Your only option is to never buy anything online and only pay cash.
I probably wouldn't go as far as never buying anything online, but paying cash IRL should be something done by everyone to protect their privacy. There are a few other easy things that can massively improve your privacy with minor or no inconvenience: Linux on every PC/laptop, GrapheneOS on phone(s), uBlock on every browser (or a DNS-level sanitizer), car without cellular modem (pull the fuse), non-Google and non-Apple email (ideally your own server or a small provider in a friendly jurisdiction). Also, don't use social media and text over Signal instead. Of course, TVs and other home appliances should be kept off the Internet. Overall, those are some very minor sacrifices for anyone with a little bit of maturity. It's very far from living off the grid or anything like that.
> It’s really kind of pointless. They fingerprint you to target ads and that’s it.
That's a very early 2000s view of the issue. Ads are not what all the surveillance is for, it's just the publicly acceptable excuse for tracking you that companies love to use because nobody cares which ad they get shown. Being able to build a profile of which websites you visit can provide a ton of information about you and that data is increasingly being used offline. It stopped being about ads ages ago and now what you do online can impact your next job offer, what prices you pay, which policies companies apply to you, etc.
You can never limit all data collection. Going to the store and paying in cash will still have you tracked by Flock cameras. The point is just to limit what you can, where you can. Every scrap of data collected about you is going to eventually be used against you later by somebody. No point in giving them anymore ammo than you have to.
Wow, that is a seriously impressive demo. I wonder how it’s able to distinguish people using identical hardware and software versions (e.g., iPhones on the same iOS version). It was able to correlate my sessions across multiple independent ISPs, with a VPN, and with Apple’s extra tracking resistance in private mode.
> Wow, that is a seriously impressive demo
https://abrahamjuliot.github.io/creepjs/
Can anyone confirm that they are also "Gentle Llama" on Mullvad browser?
I just installed it, I want to know if everyone gets the same hash (same identity for everyone).
My reaction to this is always two fold; firstly cool tech, secondly horrifying invasion of privacy.
At {{job}} we did briefly consider rolling out fingerprint.com, but settled on ja3/ja4 at the CDN layer.
I wonder if a browser extension could be made that inspects your fingerprint and informs you if you're too unique, then one-click to 'correct' those unique items (or at least list them), so you can conveniently go back to being ~anonymous if preferred.
It's creepy that we all have stalkers that want to know our intimate details.
Huh, it is different for me on every page refresh. No VPN, etc... just Firefox on Windows with uBlock, CanvasBlocker, and a PiHole. No persistent fingerprint for me!
firefox, ublock and canvasblocker seems to be enough for me. New identity every refresh
Cookies, in and of themselves, are not bad. Like any tool that can be misused, they're just being abused by a ton of really shitty people in an effort to try to enrich themselves at the expense of others. Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"
> Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Don't you people remember how it was done back when web browsers didn't have cookies, or could be configured to reject or ask for each cookie? The server software automatically added a PHPSESSID parameter to every link, containing the session identifier.
The "PHPSESSID" thing is why many message boards couldn't be archived in wayback machine.
RFC 2109 predates anything that vaguely resembles PHP, and Netscape (thus, defacto, basically everyone using the internet), had cookies 3 years before the RFC. PHPSESSID wasn't added until PHP 4 in 2000.
If you're going to be a bitchy pedant, you'd damn well better be CORRECT.
I have heard from some power users that Brave is one of the best browsers with regard to ad-blocking and privacy. But I think I have read elsewhere that it receives money from ad companies to display only certain ads, which does not make me trust it. Does anyone have facts or know where to find them?
As a general role, always be suspicious of very loud and vocal opinions about product and services. Specially for closed source products and paid services, they often invest in what is called Native Advertisement/Marketing which is basically paying people to lie and pretend it is organic content/opinion.
Second, despite the dumpsterfire that Mozilla’s leadership has been in a decade or so, it is very robust with privacy and anti fingerprint features out of the box, the containers has also stabilised and works great.
Isn't Brave open source? https://github.com/brave/brave-core
Brave outperforms Firefox on the EFF fingerprinting test at https://coveryourtracks.eff.org/
Using Brave EFF reports that I have a randomized fingerprint.
Using Firefox or Edge EFF reports I have a unique fingerprint
I see so many misconceptions on HN about that coveryourtracks site. Neither of those results are ideal.
"randomized fingerprint" -> that's a bad result, it means the site can detect you're spoofing info
"unique fingerprint" -> this is good, ONLY IF you refresh and it still says "unique fingerprint", because it means the site sees you as a brand new visitor each visit, and doesn't detect any (what advertisers would call) nefarious behavior. however, if you visit again and the second time it says "nearly-unique fingerprint", that's a fail because your two visits were linked
The ideal result you should aim for is "non-unique fingerprint". That means your device is indistinguishable from countless others. Blending in to the crowd is what you want.
These tests aren't reliable - Brave does randomise values but it ultimately doesn't do much to prevent fingerprinting, as many values remain static. For example, Brave still exposes your GPU model and driver version.
See Fingerprint.com, despite Brave's protections you'll likely find it works reliably.
> Brave still exposes your GPU model and driver version.
I love that things like this are coming too light. But, I fucking cannot understand how anyone would’ve ever thought this was OK.
So what is next in this cat and mouse game? Fake-slow browser to miss fingerprint? Declare revolution and declare all advertising illegal?
I think this app is broken. Every time it refreshes it calls me a different name.
This is already illegal in the EU. The consent banners were never about cookies, they have always been about the tracking itself!
Same thing the other way: no need to have a banner for a simple login cookie which isn't being used for privacy-invading tracking purposes.
Yet I am constantly flagged by various pages because Cloudflare decided I had some bot running at some point on my network. And my IP is fixed. Whatever EU is doing, it doesn't work.
You might have a residential proxy running somewhere on the network. The latest in botnets is bundling a proxy in with some TV torrent streaming app or whatever else that can run in the background and proxy malicious traffic from your residential IP. Services like cloudflare and crowdsec will keep a constantly updating list of the IP addresses that are actively sending bot traffic and blacklist them. If you can work out where the traffic is coming from and shut it down you should have this issue go away.
I have a similar issue. I see cloudflare checkboxes all the time. Google makes me fill out captchas all the time. Sometimes it decides I can’t search, sometimes cloudflare doesnt let me past the checkbox.
I’ve checked my network. I’ve monitored egress traffic. There is no residential proxy. I’m not on a VPN. If anything, services should be able to track me entirely by my home IP that doesn’t change that often.
My best guess is that I’ve committed the crime of not allowing third party cookies? Or maybe the crime of not being logged into a Google account 24/7. It’s not browser or device specific. My iPhone is just as likely to fail the cloudflare checkbox as my desktop with Firefox + uBlock.
I've committed the extreme crime of running no JS and clean cache of cookies. Plus, something as simple as containerizing work/play/research reading, into different browsers, has provoked the Eye of Google to be cast on me
I haven't seen a YT ad in years while in lurk-only mode (no login), which is nice, but I also see cloudflare everywhere , which is not great.
One of the nicer things about LLMs, is that they arrived just in time to erase my dependency in search.
I don't. I had a RSS software that was polling a local auctions website (Allegro) once an hour and that's it.
This should be absolutely illegal, one entity is capable of making my life extra difficult and there's no one to appeal to.
I have experienced the same with Google and with PayPal, whenever I used Tor. When I afterwards visited those sites using my normal browser I got Captchas. They are actively fighting attempts to avoid fingerprinting. Also, I am pretty sure that no browser protects against getting fingerprinted. Test with https://fingerprint.com/.
Oh. PayPal is super interesting because they outfight ban me! But I can change a browser and it works just fine.
Have you got a TV? Or a car?
if your IP is fixed, surely no further fingerprinting is necessary?
They don't know that and don't rely on that. That's why fingerprinting exists. They ban only my one browser, that's it.
Static IPs completely destroy privacy when not being shared with many users. Our university has one outgoing static IP for hundreds of users :)
> they have always been about the tracking itself!
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
Yep, and somehow there's always someone who thinks that the "Ah, but this is not a cookie!" is a loophole. It is not, he is just undereducated.
The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)
Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).
Eh reads like a “civil war was about states rights not slavery” argument.
The thing the site is doing that isn’t “strictly necessary” is always tracking.
Point is that tracking isn't the only thing that's not "strictly necessary". And additionally that "strictly necessary" is tied to something specific: internet society service. That includes a very specific requirement: "Normally provided for remuneration". That's why e.g. public authorities should not (usually) be allowed to rely on it, public services are not often provided for remuneration in EU-law sense.
It also limits the exception in relation to e.g. employment.
Well now the thing that isn’t “strictly necessary” and they’re not allowed to do is remember my no cookie preference.
It's not a preference. It literally is the default requirement.
[flagged]
Yet you can’t set a cookie to remember the preference of opting out.
It's not a preference. It literally is the default requirement.
Ok, but are they really all that new at this stage?
> Let’s give it up for Google - the biggest ad company on Earth
I think Google needs to be forbidden from causing more damage to the EU market. And there need to be replacements too, once we forbid this Evil entity from sabotaging EU citizens any further.
We also need real open browsers not controlled by greedy Ad companies.
I am also aware of the irony of using thorium here right now (based on the adChrome code base). If I use Firefox, I can not listen to audio since mozilla claims only systemd-pulseaudio using people can listen to audio. Well, chrome plays audio on youtube (which is also owned by Google, do people begin to see how big of a problem Google has become) just fine, so I have no idea what Mozilla devs are smoking. I could recompile firefox, to just use ALSA, but who in his right mind wants to compile a 1% usage base legacy browser that uses ancient technology to compile its outdated code base please?
See: https://www.linuxfromscratch.org/blfs/view/svn/xsoft/firefox...
Mozilla gave up decades ago on fighting adGoogle. And it can be seen via small things too.
Ladybird may be a competitor at one point in time but they ban people from their github repository, which also sends the message "do not contribute to us because we don't care about you if you have dissenting opinions". Well, so much for real competition, when projects get all emo early on. You can't beat the evil adGoogle empire with wishful projections about "conduct of people". That's not going to work. I don't subscribe to any random ruleset made by random people I don't know and don't want to know when they resort to censorship. But hopefully more and more people realise that something has to be done about Google one way or another.
>and the solutions Google has developed (Privacy Sandbox) kinda suck and have raised antitrust concerns so nobody uses them.
This is backwards. The antitrust concerns of removing 3rd party cookies led to them developing alternatives.
I was the Gentle Owl. Then I connected to a VPN, opened a private window in the same browser, and didn't maximize the window. Now I'm the Nosy Toucan.
The article's points still stand, but the trick didn't work this one time.
Private window is called out in the article as creating a second entity
Fingerprints are used for over a decade already, nothing new, just users keep closing their eyes despite knowing, even advanced ones.
I'm skeptical of this magic trick, maybe add a counter with the amount of times I logged in to the website. Or let me save some data to read it from another session. Otherwise lots of people can be identified by that hash, there's no proof that it is unique
They are not "new cookies". Fingerprinting has been a thing for close to 20 years now.
The whole cookies discussion is a successful diversion by the ads industry. It was never about cookies.
> See, the thing is, it’s not about you at all. It’s not really about the ads anymore either. Nobody cares about you. And if the police or your government happen to care, I’ll gladly take their money too.
> I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.
> And to the highest bidder it goes!
> What does that make you then? A gear? An ox? A volunteer?
This does absolutely nothing for me. If this resonates with you, can you explain?
I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.
If every website you ever visits knows it is you, exactly what links you clicked on, and what content you viewed, forever, are you truly ok with that?
Guaranteed deidentified, as the quote above is talking implying?
It's truly totally ok with me, yes.
(I get the non-anonymized concerns, or risk of becoming non-anonymized, that's not what I'm confused about)
But you are deanonymized. That’s the entire argument. I’m not sure you understand.
I don't think I do.
Is the implication that the machine knows me so deeply that it doesn't matter if it connect my device ID to my name? That it knows me deeply as a person regardless of what identifiers are used?
If that's what meant, I have to say: 1. That's an absurd overestimation of the current capabilities of adtech 2. Even if it were true, I'm not sure I'd be that bothered by it? What I'm bothered by is what could be done with that intimate knowledge. And if the answer is just "show me the absolute most optimal ads", this doesn't really bother me.
That's why the quote I highlighted confuses me.
wow on chrome based browsers, the fingerprint survives even in incognito mode.
On Safari, fingerprinting doesn't survive in incognito mode. Same with Firefox.
Good thing I use different computers for different purposes, though it looks like using different browsers seems sufficient.
It's not true, fingerprinting on Safari is also easy regardless of Incognito, VPN and whatnot.
Different computers doesn't solve a lot of fingerprinting methods as well.
It’s a question of entropy. If your device is unusual in detectable ways, then the fingerprint has high entropy. But on my iPhone I suspect most of the things being fingerprinted are the same. How many other people get “smug koala”?
Couple different results than that across three refreshes on iOS w/iCloud Private Relay. Apple does work to do some randomization.
But at least the moment we start using websites the largest players will know it’s us. Nobody else swipes and types exactly like me on my screen size of iOS over the relay.
fingerprints pick up on all sorts of things that make you different enough combined with another signal, 33 bits can be enough to single you out from anyone else on the planet... iOS can be 10-15, and given a residential IP that's plenty - always mobile is more anonymous on the web but guess what's much worse? apps.
a native app with 0 permission prompts gets you more bits than web
No. Almost everybody using an iPhone is on the latest release, plus or minus one while updates are rolling out. For a given iOS release and hardware type almost all of those probes are highly correlated. No way there’s 30 bits of entropy in that. I doubt there’s even 10.
Now on a desktop PC sure I believe these fingerprints are highly descriptive. And in android land they probably work okay because of the diversity of products and configurations. But iPhones resist fingerprinting just because they all give the same answers.
Fingerprints of one kind another have also been around for a very long time.
[flagged]
[dead]
[flagged]
[dead]
[flagged]
[flagged]
[dead]
[dead]
Privacy people are insane to me.
Some of these guys sound like they erase their fingerprints off the plates when they visit a restaurant, and ask people to forget about them when done talking.
Like it or not, as web gets more complex, it will recognize you more. If you don't want that, just don't use the web - perhaps buy a farm and life off-grid.
I just don't get what's the appeal to this endless damn cat and mouse game.
It’s a lot of work to collect fingerprints off plates. You can build surveillance that way but it scales terribly.
On the web you can do that much more efficiently. That scares people.
As in any defense/offense situation, it’s all about balance.
So you're basically saying the old "I have nothing to hide" argument which has been debunked over a million times...
In particular because "I have nothing to hide" means "I have nothing to hide until now, and because of the corporations and states that have access to my data are lead right now by people I trust not to misuse that data"
But if tomorrow the government change, and suddenly your searches for "gay bars near my location" becomes illegal, you'd rather this info not be in everyone's hands...
Lack of privacy harms journalism and activism, making the government too powerful and not accountable. If only activists and journalists will try to have the privacy, it will be much easier to target them. Everyone should have privacy to protect them. It’s sort of like freedom of speech is necessary not just for journalists, but for everyone, even if you have nothing to say.