I still don't understand why the highest entropy APIs aren't gated behind browser consent.
A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
Broad geographical targeting shouldn't be an issue. In fact, it's so easy that I think we should invent an ad-targeting API people can opt in to. If I could tell advertisers my geographic location, gender, age cohort, languages, and 3 interests, I'd not feel that's an invasion of privacy when they use that to deliver ads. I'd just get lawnmower ads instead of shampoo ads and that's fine.
The problem is, they don't want to use that kind of targeting.
They want to target me with ads for a travel destination that my coworker mentioned in a Messenger message to another coworker five minutes ago. But we should just not accept that.
> "I still don't understand why the highest entropy APIs aren't gated behind browser consent"
Because it's known that interrupting the user-intent with a unrelated consent-popup doesn't help.
Older people may remember that this was the approach of Java J2ME, where you couldn't provide a fluent user-experience as the user first had to answer huge popups about individual API-permissions with "Always Allow", "Allow now" etc.
If it isn't an informed decision, it isn't really a decision at all. And the huge majority of people the huge majority of the time do not want to make an informed decision: they want what they came to the site for, news, games, family photos, etc.
You go to Facebook to see your cute nephew make spit bubbles. Do you care that they access your camera and canvas? What is a canvas? And sure access my camera, I want to upload photos!
It's fundamentally broken. They've studied the dark patterns, not to avoid them but to implement them best.
So long as it's once per API and site, it seems it doesn't need to be too bad?
If it's a site I trust, and I think it genuinely needs audio, I give it audio. If someone doesn't understand and just does allow all, they never see it again either (and their ads are suspiciously well targeted).
We already have these consent popups for camera and microphone. Reading back bytes from an audio buffer seems like such a rare thing to do that it hopefully just stops happening.
Also, people not in tech do not generally understand the implication of consent popups.
For example, on multiple instances, my spouse declined "location permissions" an app designed to work with a piece of Bluetooth-connected hardware, and would blame the hardware as being crappy.
"This smart lock app doesn't work."
"You need to enable this permission."
"Why do I need to give the smart lock app location permissions?"
It's not obvious to people that "Bluetooth can be used sneakily by big-enough companies as a makeshift GPS" even if the app needing Bluetooth access doesn't actually need a GPS location.
> A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
We should go further. A web-site with mostly static content should not use user-side scripting (Javascript) at all, it's unnecessary for it. It should be required only in rare cases where a site is basically an application and require manually turning it on each time such application is opened.
I think that ship sailed and I'm pragmatic enough to accept it. The web is an application platform, not a web of hypertext content. That's not going to change, and I've given up on the idea to even try to "go back" there. If it worked, you'd just have half of websites be "sites" that work without JS, and half would be "apps" which would require switching on JS? The whole reaosn the web took off as it has is because we removed the distinction between "web app" and "web site". There's no putting that genie back in the bottle.
Sure, for the most static of static sites. But without JavaScript you can’t even do basic things client-side, such as having some variable-length list of fields in a form. Or customized field validation.
If such client-side behavior counts as “basically an application,” then “applications” is a larger set than seems useful.
Well yeah, but there's also the part where I'm not okay loading ads from a third party because they eat my battery, add latency, and can potentially be used to spread malware. So there's the conflicting preferences regarding targeting that you mention but also conflicting preferences regarding how they are served.
The conflicting interest starts with the very idea of ads already. The entire point of ads is to manipulate you into doing things you wouldn't do otherwise.
That could also be a preference. Do you allow third party ads to begin with? But then I'd understand if people would just block visitors that don't agree to them. I think paying via showing ads is fine. Paying with my integrity isn't.
> I still don't understand why the highest entropy APIs aren't gated behind browser consent.
Simple answer: The makers of 3 largest browsers by market share (collectively 90%+) are buddies with the people who want to fingerprint you. Only the 4th largest gives a shit.
That would be nice. However, It’s easy to see why it’s way more than simply what they want, they don’t really have a preference but it boils down to money. You’ll only replace your lawnmower every couple years and the rest of the time they’re guessing what you may buy next. By spying on your daily conversations and browsing, they have an idea of what you are likely to buy this week, next week, and the week after. This is so much more valuable to an advertiser.
Exactly. And here's where regulators come in. What we need to do as a society is basically say "Unless you can make your ad-funded business work with this tiny bit of information, your ad-funded business should fail and shut down".
> I still don't understand why the highest entropy APIs aren't gated behind browser consent.
Last I checked it's because it was generally considered that preventing fingerprinting is practically impossible anyway. It's not like you need a lot of entropy for fingerprinting, and the web API surface is enormous. To actually stop fingerprinting you'd need to make your web browser more or less useless.
That might sound good, but people already moan and groan about cookie notices. Imagine if each website that legitimately needs it would start asking for permission to each fingerprintable API. Although I do think we should have that option, just not as a default.
The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis.
The scope and amount of information that browsers hand over without the slightest shred of consent from the user or indication it’s happening is crazy.
And also without logging it. Even if I don’t want popups to give consent for every document.getEyeColor() call, it would be nice go back and see who’s doing which queries and/or have Firefox collect aggregate statistics. Naming and shaming the crooks won’t stop them but it might have an impact on curbing any bad behavior from big commercial retailers.
It's a UX trade off. For non-adversarial websites it's very convenient for users because things just work without having to go through loads of permissions pop ups for every website, but of course this then makes this info a juicy target if you're trying to fingerprint someone.
Google's business model has been ads from the beginning. Search, gmail, drive, office, chrome, everything they do is just to drive ad revenue further.
They don't care about the user. Never have, and never will.
And the outcome we are seeing is what happens when a defunct state isn't able to protect citizens from conglomerates. That's what the Kartellamt or the FTC is supposed to be for.
Great how this is currently the 2nd highest comment despite completely ignoring the numerous fingerprinting techniques based on CSS alone (including one of the most famous fingerprinting methods by testing font support). Simply thanks to reflexive "JS=bad" upvotes.
I can't help but keep thinking that client-side scripting was a mistake. Sure, the web would be a lot more primitive without it, but I'm not convinced that wouldn't be for the best.
My default is to run without JS and selectively enable it when absolutely necessary, so when I clicked on this story the page was prefaced with the following comment:
"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else.
From now on I’ll call you:…"
I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it. On rare occasions when I'm forced to use JS I'll cut-and-paste the URL into another browser.
I no longer use ad blockers as I just don't see ads with JS disabled. The other privacy precautions I take are the obvious ones such as no Google or social media accounts, flushing cookies at session's end, regularly randomize my IP and never let Chrome anywhere near my machines and make judicious use of multiple browsers (this is being written in Privacy Browser on Android).
Using NewPipe and sponsor block on PipePipe increases privacy and makes YouTube ad free.
Client-side scripting was a mistake which was obvious from the outset (or not severely limiting the reach of scripting engines).
What I find hard to understand is why alternative plugin JS engines haven't been developed that are under user control. Spoofing, randomizing and returning junk data to webservers would go a huge way towards stopping fingerprinting by websites.
>coveryourtracks.eff.org shows you how unique your fingerprint is, with entropy for each measured data point.
Something to note - if a fingerprint is generic enough, that might be a _good_ thing!
Having worked with fingerprinting, anti-fingerprint browsers are very hard to properly identify. The ways to get around it are things like collecting more coarse fingerprints[0], as the overall one is fairly easy to change (e.g. make your browser lie about a collection of browser apis).
What's imo more difficult though is a fingerprint like:
- iPhone <new_version>
- running os <latest_stable>
- using default safari
- bought and used in <common_location> (e.g. usa)
on a 5g mast in a decently sized city, you'll share a fingerprint with at least one other active user using a setup like ^
grapheneOS on the other hand stands out a bit more!
> The request already reveals information about you; what browser you use, the language it’s in, the OS that runs it and your IP address, which the server needs to send you the response. That often reveals your location.
If we control the servers the clients are connecting to, I don't see how there could be much hope of hiding. We can spoof things like latency toward an upper bound, but we can never ever defeat the lower bound. Physics is still quite insistent about that one.
If we control multiple servers, we know where they are, and we can periodically compel our clients to rotate between them (see: DNS), we can engage in latency-based multilateration to put them on a real-world map. Depending on the number of servers and samples over time, this can be remarkably accurate. Determining someone's actual postal code just from network timing information is feasible.
VPNs obviously confound this in first order terms, but if we aren't careful they can make it even easier to identify our activity in other ways. We are trading concealment in the woods for concealment in a crowd. Both have their advantages and disadvantages. The VPN might also have a side channel that we aren't aware of.
I've seen anti-fingerprinting plugins and browser configs, etc, but they all seem to make you more interesting for not being fingerprintable, or for turning off a lot of features used in fingerprinting.
Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
Random is often going to be indirectly fingerprintable too, since some values are always the same (or the same given each browser version). Some values can't be set to be random or otherwise non-fingerprintable data without affecting the user, like viewport size.
Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.
> Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard
It doesn't matter if it looks wrong as long as it looks differently wrong over time. Don't bother trying to blend in with the crowd because you can't ever expect to catch everything that can be used to fingerprint you. New techniques come out all the time. You can block a lot of information from even being collected. Limit what data you send at all, randomize what's left, change IP frequently (VPN) and you should be fine.
That's the thing, no web page, except for games, should ever need to know about your viewport size. So spoofing would be just fine, imho, with an override option/permission for individual sites.
You can forcefully disable hardware acceleration, that removes a few bits - though javascript can still guesstimate your CPU and memory.
For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.
The reason is that the browser maker is interested to support tracking.
On the technical level there is no problem to block tracking - intriduce noise and make APIs unavailable until user permits to a web site. But that is not implemented.
The same with native applications. If your bank app requires you to share your location you can't spoof it. The makers of Android and iOS made spoofing of geo location impossible - you don't have that control, which means the phone is not your device. You have to give up your real location.
First, see our blog post. Consult also other blog posts and other questions in this FAQ.
If you want to have the same fingerprint as many users, We suggest going for Tor Browser (do not install JShelter in Tor Browser).
If you want to make cross-site fingerprinting linkage hard, go for the Recommended JShelter level. If you want better protection for the real data at the cost of having the same fingerprint on different sites, go for the Strict JShelter level.
Keep NBS active.
If you want to detect and prevent fingerprinting attempts, use FPD.
Thanks. I tried this on Firefox for Android and each time I close the browser and load the page my fingerprint ID is different. So it seems to work. Have you had any sites break with this extension installed?
> Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
That's basically the ideal. It's become obvious that it's impossible to try to be identical. Web browsers are too leaky, and something will out you. You really don't want to try to blend in the "typical" users because none of them use ad blockers.
Doing this on GrapheneOS's built in Vanadium browser, I am concerned to see that the ID remains the same if I move to incognito tabs, or even a private space. Or perhaps Vanadium is doing such a magnificent job of reporting generic info that this ID would be the same for anyone using Vanadium on my model of Pixel, but I don't think so, since the site says it has a "clean read" on all the info it takes. I really do not know. Curious what other Graphene/Vanadium users are seeing.
Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes.
90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months).
What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.
The problem with this is the biggest, most important, and sketchiest data brokering services (credit monitoring) are all but entrenched in law at this point.
18 months ago Google publicly stated they were going to start using browser fingerprint data to track users, a reversal of their 2019 policy on it because it was considered too invasive.
There's a fingerprint demo on github called JSCreep (https://abrahamjuliot.github.io/creepjs/) that used to keep your fingerprint profile for 90 days and show you how many times you visited. Worked extremely well, and is still around, but no longer uses the API to retain fingerprint data, so you have to track your hash yourself. It would easily track most browsers across changes in IP address. Only Mullvad, Brave, or Tor would not leave an easily tracked fingerprint.
The demo presented in the royfish.dev link is easily foiled by browser extensions that scramble fingerprint data, the presence of which would itself be detected by more sophisticated profilers and used to define the fingerprint. I can refresh the page and get a new hash and adjective-animal name with the same IP. JSCreep sticks firm to the same hash for me, even with a new IP address and some spoofed browser data.
Overall correct, but you're kind of missing some of the cat-and-mouse details for fingerprinting centered around infosec and anti-fraud purposes rather than generic ad-related tracking. That stuff can get way more intense, and is constantly changing based on new techniques developed, countermeasures from cybercriminals, and mitigations from browser developers.
Is there any way to link this data over longer periods of time?
A lot of data can change over days, weeks, but if you can maintain an accurate fingerprint with tinier changes, and granted you have consistent visits from the user, could you just keep up?
Especially if one service is tapped into several websites, and can continually keep up with smaller data changes and distribute that info. Is this possible? In practice anywhere?
I'm thinking that you just need one website where you can associate a given fingerprint to a specific user and then tracking its activity around the web becomes easy.
Let's say I'm logged in a famous search engine, they associate my fingerprint X to my account A. If they then encounter fingerprint X anywhere else, there is a good chance it was me, A, doing it.
If the next day I get fingerprint Y, it gets attached to A as well and the tracking information follows it.
on what basis do you believe this about fonts? my guess would be that the average user doesn’t install or remove fonts often if ever, but it’s only a guess
I don't actually know how much this happens - software versioning is the biggest one. Chrome updates every two weeks, Microsoft updates once a month, your GPU drivers get updated semi regularly, etc. Any one of those would break the fingerprint.
I was thinking about the literal fingerprint sensor a device has. Imagine a "prove youre not a bot" challenge and the finger scanner pulls up. What a nightmare, reminds me when a website asked me if I want to login with windows hello (facescan)
That is different though. That site is just creating a passkey and storing in your keychain (or windows equivalent). Windows hello unlocks the keychain. It can be your face, fingerprint, usb key, 4 digit pin anything. Chrome already uses this. You’re not sending your face to that website nor to microsoft, I hope.
One intereting part about installed fonts is that many enterprise companies buy specific fonts. Then they are rolled out to all their devices, and sometimes at least one of them will have the company name as part of it's name.
On the other hand, browsers don't need to share all this data at all. Sure, IP address can't be hidden, but from your example, installed fonts and volume settings? Why should that be shared at all? Sure, for example for a teams meeting, but you'd have to allow the use of microphones or that, youtube for example doesn't need to know how loud you're listening to a video.
> Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Sorry, but that's simply not true. It's actually the default way of how people eg track people across installs in app stores ever since they started removing that feature.
The problem isn't advertising, it's data harvesting and sale. Ads used to rent space on websites - totally reasonable. The whole industry around the purchase and sale of user data is what needs to be banned.
Consequences are deeper than the immediate cause. Advertising is at the heart that gives a lot of value to data harvesting and similar scams.
Data harvesting gains most of its value because they sell some or all data to businesses which wish to leverage that data in advertising. If they cant advertise they wont need most of the data, which should at the least reduce the problem significantly...
Advertising and paid promotion in any form has never been ok. It has always been a cancer on society. That is what happens when you ignore a mild symptom until it metastasizes into something horrible. We need to ban it completely.
That's one perspective. Other are in different perspectives, like "anything that present something else than the very topic looked for is pure propaganda."
The spectre of possible interpretations is wide.
Some see only problems everywhere whatever the benefits might be, some see only new opportunities no matter the tragic outcomes, some see various blend of this and that.
How do you tell the difference between a regular human trying to not have a weird creepy perma-dossier collected on them... versus a bot set up to always look like a new visitor?
The only winning move is not to play--er, to somehow not to have this kind of game in the first place.
How would you enforce that? Who can be trusted with the ability to classify things as advertising and in so doing silence their critics?
The solution is explicit trust. Not fingerprints for users, but digital signatures for content. If it's not signed by somebody the user trusts, don't render it.
The user is the only one who can be approach that task without a conflict of interest. If somebody wants the user to run code that phones home about user behavior, make them gain the user's trust.
> Remember the big fuss about third-party cookies? It was so big that the EU had already rolled out one of its greatest inventions - consent banners.
It was never about cookies. Thats what the industry made you think. You don't need to show consent banners for cookies (like auth sessions). You need consent for tracking. This includes profiling. And it doesn't matter what you use, fingerprinting or tracking cookies, the consenst banner is required either way.
Consent is required. The banner is just one mechanism, but not required. A website could hold off on all tracking until a suitable point in the usage of the site (like creating a profile, for example) and ask at that point.
The banner is an artefact of the hostile way most sites choose to try and hoodwink the user into being monetised and ultimately to piss users off so much that they complain about the legislation rather than the lack of online privacy.
And there was an initiative to include tracking preferences in browser HTTP headers, which never made it, as it was quite obvious that this would lead to a lot of people opting out.
Better to just harass them into a habit of dismissing the banner.
When there is "legitimate purpose" there isn't reason to as soon items are put in the shopping cart this has to be tracked (be it session in url, cookie, local storage, ...) and no consent is needed.
The exact definition of "legitimate purpose" is unspecific (which is important to be able to adapt to development of new services) which leads to some lawyers being careful.
I also claim that some lobby groups promote having too many and too big consent banners to move blame from tracking companies to the EU ("stupid EU forcing all those banners!") in order to reverse the policy on tracking, which seems to have some effect.
I know it's tempting to put this consent-banner anti-pattern all on toxic ad-driven platforms, because their motives are bad.
The problem with this view, though, is that even the very agencies propagating these rules do the exact same thing! You can go to any site from an EU arm and get the same banners.
At this point, you can't really blame it on bad-faith actors, you have to accept that it's a bad rule. Which is not to say I know a better one!
Is too. They could have thought through the law they were writing and predicted malicious compliance. Or written a stronger law. Or revised the law when they spotted malicious compliance.
I don’t understand why that’s considered legal under GDPR. How can consent be express and informed when it would take 30 minutes just to identify each entity your data is being shared with?
In fact the law even specifies “no pre-ticked boxes” but every banner always has “accept all”. And it’s 50/50 to see “reject all” even though it is a requirement that denying must be as easy as accepting.
They should pay a bounty for reporting non-compliance.
I feel it's worth distinguishing between the Hacker News Audience that is highly tech-educated and security-conscious and the general public that just wants to use the web and seems more than happy to give all their data to Meta, Google & Co.
If you ask my 70-year-old mom to decide whether she'd like to allow the WebGL API, she'll go bonkers. If anything, the constant cookie banners have just trained her to consent to stuff out of muscle memory. You could probably design a "Are you ok to sign over the deed to your house" question in the rough shape of a cookie banner and get 90%+ agreement.
> We, and our 228 partners use cookies and similar methods to recognize visitors [...]
228 partners should make anybody concious about the fact that something is wrong and you probably should not consent to that at all. Also, nobody cares about your privacy when they think sharing data with 228 parties is okay.
it's hard to make yourself heard when your opponents have trillions of dollars hinging on you not being heard and also control the biggest communication channels.
I've never seen a consent banner for being fingerprinted even though I'm sure companies are fingering my prints in the background enough that my colon could become a national database.
The EU/banner situation keeps confusing people because there are two different laws in play:
1) ePrivacy. the OG banner law. requires you to inform the user (but not consent, as I understand it) if you store data on a user's device. includes cookies, localStorage, indexedDB, etc. does not affect fingerprinting
2) gdpr. requires you to ask consent for any kind of user data processing, unless you can find another legal basis
eprivacy was about cookies, but forgot fingerprinting. gdpr was not specifically about cookies. but gdpr (or at least its past interpretation by the dutch privacy authority) didn't require consent for limited first party analytics.
which led to situations where you'd get the impression that you wouldn't need a banner for first party tracking using cookies .. well the gdpr didn't require it, but the older ePrivacy rules still did.
we still have the digital omnibus law package coming up which is supposed to simplify and resolve the overlap between the two above, and reduce banner requirements at least for SMB just analyzing their website visitors
It does. The current version says "storing of information, or the gaining of access to information already stored, in the terminal equipment". Reading e.g. navigator.userAgent is information already stored in the terminal equipment. If you then use that in any way that gets communicated to remote server (e.g. directly or calculating some fingerprint) you read that information in manner ePD describes.
The directive itself has been transposed incorrectly in many jurisdictions. For example from what I understand the Dutch law added an exception (roughly "for obtaining information about the quality or effectiveness of a supplied information-society service, provided this has no or only minor consequences for the user's privacy.") which is not permitted under ePD. ePD exception list is exhaustive and the only other exception can be done via Article 15. The exceptions done via that are related to things like national security and certain criminal prevention/investigation.
Of course that then raises the issue on how you get invalid exception invalidated. I don't know Dutch procedural law well enough to answer that.
My understanding of the EU "cookie law" is that it really concerns a broader category of tracking devices rather than cookies specifically. Referring specifically to cookies is probably a side effect of the way tracking was typically implemented at the time.
How could this information be surfaced in a reasonable way in administration software?
Say I have a remote employee who is only able to access your internal systems via his yubikey. His fingerprint is "Genuine Antelope".
Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him. I create a new session for him on the provisioning portal (so he can enroll the new key) but now his fingerprint is "Interesting Elephant". What do I do with this information?
It might be better to log the exact forensics and show the administrator the differences, e.g, "User has a new font called "my_handwriting.ttf" since a week ago", or "appears to be a totally different processor, and the new system has Russian fonts installed".
> Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him
They should be authorized ahead of time.
> What do I do with this information?
Not much. You can't authenticate a person using their (public) fingerprint information.
Your problem boils down to: "How can I verify someone's identity over the internet". You can exchange emergency recovery codes ahead of time (e.g. in an envelope), you could trust public keys from both of their yubikeys, but they can be stolen.
> You can't authenticate a person using their (public) fingerprint information.
Yes, but it's a signal! There's a cost to spoof it. A scammer could cheaply start a VM that clones your font profile, but at what cost could they replicate your CPU SKU and GPU combination to provide identical webGL timings?
Other signals include the ability of your employee to show their face on a video call, to sound like themselves on a voice call, the ability contact you from their home IP, to receive official mail at their listed address, to produce a second 2FA token you'd previously registered (but not activated) or repeat a code word you'd exchanged. Any of these things can be spoofed, bypassed, copied, or burgled, but each one imposes some cost on the attacker.
The question is how to surface this information in a way that equips help desk staff and doesn't deceive them into authorizing unnecessary risks.
The fingerprints don't need to be long-time-stable to be harmful. Some companies have your stable datapoints (e.g., email) and your fingerprint. Other companies only have your fingerprint on the same day/week. Some companies have locations of edge devices and the fingerprints. And there are companies out there that will take all of those data streams, both from above board and not-so-above-board players and mix them for commercial benefit.
Per coveryourtracks.eff.org, just my HTTP headers leak 18.46 bits of information, which seems to be the most the tool can report? Presumably most of that entropy comes from my language settings (en-AU,en;q=0.9,de-CH;q=0.8,de;q=0.7), so the only way to be not fingerprintable is to give up on smart localisation.
If people have a problem with fingerprinting, they need to focus on making it illegal to trade data tied to fingerprints, not trying to make users all look the same (we aren't!).
RFC 3282 allows for the exclusion of the quality value, in which case the languages are just given in priority order. Removing that will shave some entropy off.
I have a hard time figuring out why quality values are even included for Accept-Language. They either have one of the preferred values, or they don't.
The quality values here seem pretty generically tied to the order, so shaving them off probably wouldn't help? I presume they are there at all to let you express ties?
Fingerprinting is a way to track you. Cookies is a way for you to keep your own configuration (a panel inside an app open or closed, theme choice, pre-filled calendar, etc). They are completely different.
It is offensive that browsers give away so much unnecessary info. What is necessary? Language preference, Javascript (yes/no), screen resolution. Optionally, latest supported html/css versions. That it, nothing else.
I understand Google having Chrome send way more info. Why do all other browsers go along with this?
Why can't a government simply ban all advertising and instead provide a good enough yellow pages service that just provides the specs of the product in a templated way?
Why would it be a good idea to expose unsuspecting citizens to false claims by the sellers?
These fingerprints now track us much more effectively than ever, not just for security but for real ad tracking and data selling. Instead of using cookies that are mostly vulnerable to ad blockers and other content blockers, these fingerprints can track us more precisely and can easily bypass our current data security systems like ad blockers. So I think the demand for sophisticated anti-detect browsers and proxy-level tracking prevention will increase.
Hmm, let's see what will happen.
The solution has to come from law. I propose we handle privacy invasion the same as rape. Body and mind aren't up for grabs. That the average internet user is unconscious isn't a valid excuse.
It would be great if a wave of lawmaking started in the USA, because most tech behemots operate from there. I would expect EU to take the lead though IF such a wave would start. The EU has still a fair share of christian/conservative MP's that keeps doing the bidding for companies by pushing chat control, but on the other hand also has some progressive and knowledgeable representatives doing great work, so there might be a glimmer of hope. We need media campaigns and public education though. Political leaders are selected for their political abilities and as such rarely have leadership qualities. If the electorate moves, the leaders will follow it. So we have to start at the bottom.
I like your idea, but as a pessimist, I believe the ship has sailed, all government are craving on monitoring their citizens' move. If there are way for the government to fingerprint their citizen digitally, they will want to do it instead of protect us.
Fingerprinting is really bad for privacy and the defenses against it are not there. See https://fingerprint.com. Tor Browser defeats it but I don't think there's a highly usable browser like Brave you can use and prevent being tracked by it.
I've been obfuscating my fingerprint with Brave for years, which I selected specifically because it was the browser I was able to do this with, based on my testing of 5 popular browsers, using https://coveryourtracks.eff.org/ as my benchmark.
It does mean that sites that uses 2FA (so every site nowadays) flag me as a coming from a new device each visit, and I have to have my phone nearby every time I want to use my computer, which is quite annoying. If you use GrapheneOS, you can obfuscate your phone too on WiFi networks (and sites, but GrapheneOS not needed for that, just Brave). You can't obfuscate yourself on cellular networks though, unless you have a ton of sim cards you rotate through.
For years, I've been practicing good privacy-hygiene in public. At my doctor's office, I always wear a Groucho Marx moustache to keep them guessing. Before I walk into my bank for a withdrawal, I team up with two of my friends, set them on my shoulders, and throw a trenchcoat over us! I made a fake ID with my birthday on July 4th and my weight as 98 pounds, but my pharmacy is now refusing to fill my prescriptions!
So what sort of benefits are you reaping from your anti-fingerprinting measures?
Wow, that is a seriously impressive demo. I wonder how it’s able to distinguish people using identical hardware and software versions (e.g., iPhones on the same iOS version). It was able to correlate my sessions across multiple independent ISPs, with a VPN, and with Apple’s extra tracking resistance in private mode.
Huh, it is different for me on every page refresh. No VPN, etc... just Firefox on Windows with uBlock, CanvasBlocker, and a PiHole. No persistent fingerprint for me!
I wonder if a browser extension could be made that inspects your fingerprint and informs you if you're too unique, then one-click to 'correct' those unique items (or at least list them), so you can conveniently go back to being ~anonymous if preferred.
If you use Firefox, do the following:
Use the extension Chameleon (set it to rotate Random profile every minute), had strict mode with JShelter extension.
This royfish blog example, or anyother, including that fingerprint.com gets new value everytime.
Fingerprint.com charges around $0.004 per investigation, and really encourages you to set up a first party proxy - so iOS doesn't nuke storage after 7 days. And even there, unless its a cookie match; your ID usually carries a confidence number.
That should give some hint about how difficult it is to do in real life, at scale.
This site gave me the name “Greedy Bison”, but it didn’t say how many other “Greedy Bison” are out there. I’m guessing everyone using the very common device I’m using and using the very common browser that I’m using would get the same name as me
Lets hope AI coding agents will let us to modify browsers and OSes quickly. "Remove tracking from Chrome". "Privacy friendly Android, in particular, allow geo location spoofing"
Cookies, in and of themselves, are not bad. Like any tool that can be misused, they're just being abused by a ton of really shitty people in an effort to try to enrich themselves at the expense of others. Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"
> Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Don't you people remember how it was done back when web browsers didn't have cookies, or could be configured to reject or ask for each cookie? The server software automatically added a PHPSESSID parameter to every link, containing the session identifier.
RFC 2109 predates anything that vaguely resembles PHP, and Netscape (thus, defacto, basically everyone using the internet), had cookies 3 years before the RFC. PHPSESSID wasn't added until PHP 4 in 2000.
If you're going to be a bitchy pedant, you'd damn well better be CORRECT.
I have heard from some power users that Brave is one of the best browsers with regard to ad-blocking and privacy.
But I think I have read elsewhere that it receives money from ad companies to display only certain ads, which does not make me trust it.
Does anyone have facts or know where to find them?
As a general role, always be suspicious of very loud and vocal opinions about product and services. Specially for closed source products and paid services, they often invest in what is called Native Advertisement/Marketing which is basically paying people to lie and pretend it is organic content/opinion.
Second, despite the dumpsterfire that Mozilla’s leadership has been in a decade or so, it is very robust with privacy and anti fingerprint features out of the box, the containers has also stabilised and works great.
I see so many misconceptions on HN about that coveryourtracks site. Neither of those results are ideal.
"randomized fingerprint" -> that's a bad result, it means the site can detect you're spoofing info
"unique fingerprint" -> this is good, ONLY IF you refresh and it still says "unique fingerprint", because it means the site sees you as a brand new visitor each visit, and doesn't detect any (what advertisers would call) nefarious behavior. however, if you visit again and the second time it says "nearly-unique fingerprint", that's a fail because your two visits were linked
The ideal result you should aim for is "non-unique fingerprint". That means your device is indistinguishable from countless others. Blending in to the crowd is what you want.
These tests aren't reliable - Brave does randomise values but it ultimately doesn't do much to prevent fingerprinting, as many values remain static. For example, Brave still exposes your GPU model and driver version.
See Fingerprint.com, despite Brave's protections you'll likely find it works reliably.
At least when tracking was unregulated, at least you knew who was by the cookie left in your browser, now I just assume everyone and everything is tracking me
With the cookie, at least you could just whitelist some sites and have everything else be deleted once you leave the related website. Though, admittedly cookie-auto-delete often stops doing what it is supposed to.
Yet I am constantly flagged by various pages because Cloudflare decided I had some bot running at some point on my network. And my IP is fixed. Whatever EU is doing, it doesn't work.
You might have a residential proxy running somewhere on the network. The latest in botnets is bundling a proxy in with some TV torrent streaming app or whatever else that can run in the background and proxy malicious traffic from your residential IP. Services like cloudflare and crowdsec will keep a constantly updating list of the IP addresses that are actively sending bot traffic and blacklist them. If you can work out where the traffic is coming from and shut it down you should have this issue go away.
I have experienced the same with Google and with PayPal, whenever I used Tor. When I afterwards visited those sites using my normal browser I got Captchas. They are actively fighting attempts to avoid fingerprinting. Also, I am pretty sure that no browser protects against getting fingerprinted. Test with https://fingerprint.com/.
> they have always been about the tracking itself!
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
Yep, and somehow there's always someone who thinks that the "Ah, but this is not a cookie!" is a loophole. It is not, he is just undereducated.
The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)
Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).
Right, and that wording is why fingerprinting doesn't get around it. The EDPB's Guidelines 2/2023 on the technical scope of Art. 5(3) (final version adopted October 2024) say that when a site's JavaScript instructs the browser to send information back, that is "gaining access" just like reading a cookie (paras 32-34). WP29 had already said in Opinion 9/2014 that device fingerprinting is in scope.
So a canvas/font/WebGL fingerprint used for tracking needs the same consent as a tracking cookie. The guidelines even suggest passively collected protocol signals can fall under it (para 43), though that's where it gets argued.
The weak point is enforcement. A cookie shows up in devtools and in every cookie-scanner audit. A fingerprinting script looks like any other analytics JS, so it's much harder for a DPA to spot and prove.
cloudflare (the cdn monopoly) interpretation of gdpr, is that clicking the "I'm not a bot" you are giving consent to fingerprint because they have to provide you a service you asked by clicking the button.
...it's something i hope no court will uphold. but we know what happens to european courts even looking sideways at American monopolies working as front for fiveeyes.
imo, eff should be starting trials to stress this instead of blogposts.
If you've ever worked at a startup, you're probably familiar with the fact that no one gives a crap about this type of stuff early on
The hell with pretty much anything, the only thing that matters is revenue
People only start to care about this after the fact if you've grown to large enough size
If you think stuff like this or right to be deleted stuff is moving the needle anywhere but at the biggest companies, you've been misled
That's the real painful truth of this stuff, most of the time it's just lip service anyway
Wth is anyone going to do anyway? Go through a resource-draining lawsuit against a 20 person company where it will take a year of discovery just to maybe-sort-of prove they've been mishandling your data?
It's going to take some pretty radical new laws for this type of stuff to ever have any meaningful impact
We have over 10+ years of employing this tech, and we've found fingerprints for a browser are constantly changing. As such, they are far from being a silver bullet when used as a persistent identifier.
Furthermore, in corporate environments where boxes are set up the same for many users, there are often, or too often, two different users and two different boxes with the same exact fingerprint.
I'm skeptical of this magic trick, maybe add a counter with the amount of times I logged in to the website. Or let me save some data to read it from another session. Otherwise lots of people can be identified by that hash, there's no proof that it is unique
> Let’s give it up for Google - the biggest ad company on Earth
I think Google needs to be forbidden from causing more damage to the
EU market. And there need to be replacements too, once we forbid this
Evil entity from sabotaging EU citizens any further.
We also need real open browsers not controlled by greedy Ad companies.
I am also aware of the irony of using thorium here right now (based on
the adChrome code base). If I use Firefox, I can not listen to audio
since mozilla claims only systemd-pulseaudio using people can listen to
audio. Well, chrome plays audio on youtube (which is also owned by
Google, do people begin to see how big of a problem Google has become)
just fine, so I have no idea what Mozilla devs are smoking. I could
recompile firefox, to just use ALSA, but who in his right mind wants
to compile a 1% usage base legacy browser that uses ancient technology
to compile its outdated code base please?
Mozilla gave up decades ago on fighting adGoogle. And it can be seen via
small things too.
Ladybird may be a competitor at one point in time but they ban people from
their github repository, which also sends the message "do not contribute
to us because we don't care about you if you have dissenting opinions". Well,
so much for real competition, when projects get all emo early on. You can't
beat the evil adGoogle empire with wishful projections about "conduct of
people". That's not going to work. I don't subscribe to any random ruleset
made by random people I don't know and don't want to know when they resort
to censorship. But hopefully more and more people realise that something has
to be done about Google one way or another.
> See, the thing is, it’s not about you at all. It’s not really about the ads anymore either. Nobody cares about you. And if the police or your government happen to care, I’ll gladly take their money too.
> I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.
> And to the highest bidder it goes!
> What does that make you then? A gear? An ox? A volunteer?
This does absolutely nothing for me. If this resonates with you, can you explain?
I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.
It’s a question of entropy. If your device is unusual in detectable ways, then the fingerprint has high entropy. But on my iPhone I suspect most of the things being fingerprinted are the same. How many other people get “smug koala”?
Couple different results than that across three refreshes on iOS w/iCloud Private Relay. Apple does work to do some randomization.
But at least the moment we start using websites the largest players will know it’s us. Nobody else swipes and types exactly like me on my screen size of iOS over the relay.
fingerprints pick up on all sorts of things that make you different enough combined with another signal, 33 bits can be enough to single you out from anyone else on the planet... iOS can be 10-15, and given a residential IP that's plenty - always mobile is more anonymous on the web but guess what's much worse? apps.
a native app with 0 permission prompts gets you more bits than web
No. Almost everybody using an iPhone is on the latest release, plus or minus one while updates are rolling out. For a given iOS release and hardware type almost all of those probes are highly correlated. No way there’s 30 bits of entropy in that. I doubt there’s even 10.
Now on a desktop PC sure I believe these fingerprints are highly descriptive. And in android land they probably work okay because of the diversity of products and configurations. But iPhones resist fingerprinting just because they all give the same answers.
Some of these guys sound like they erase their fingerprints off the plates when they visit a restaurant, and ask people to forget about them when done talking.
Like it or not, as web gets more complex, it will recognize you more. If you don't want that, just don't use the web - perhaps buy a farm and life off-grid.
I just don't get what's the appeal to this endless damn cat and mouse game.
Goycattle like yourself ought to be executed for the sheer stupidity of your opinions. Privacy is the only reasonable response to the unhinged behavior of web advertisers, who will spend trillions of dollars and decades of research, who will bribe politicians, who will do everything in their power to figure out the shape of your butthole so they can perfectly optimize which sex toy ads to show you. It is utterly psychotic behavior and pretending it is anything else is the either dumbest or most malicious thing anyone has ever done in the last century. If restaurants were to frantically scan their dirty plates for fingerprints after customers are done eating, the customers would be damn right to try to wipe their fingerprints off. Obviously that isn't necessary, because restaurant owners aren't completely out of their minds. So why does the web have to be this way?
"By the way, if anyone here is in marketing or advertising... kill yourself..."
So you're basically saying the old "I have nothing to hide" argument which has been debunked over a million times...
In particular because "I have nothing to hide" means "I have nothing to hide until now, and because of the corporations and states that have access to my data are lead right now by people I trust not to misuse that data"
But if tomorrow the government change, and suddenly your searches for "gay bars near my location" becomes illegal, you'd rather this info not be in everyone's hands...
Lack of privacy harms journalism and activism, making the government too powerful and not accountable. If only activists and journalists will try to have the privacy, it will be much easier to target them. Everyone should have privacy to protect them. It’s sort of like freedom of speech is necessary not just for journalists, but for everyone, even if you have nothing to say.
"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else."
You took a guess. You guessed wrong
I have not "disabled Javascript". The software (pl.) I'm using to request and read web pages has no Javascript interpreter
I can also insert a CSP response header such as "default-src: 'none'" and get the same result ("...") even when using software that runs Javascript with Javascript enabled
This "data" does not seem very useful for advertising except perhaps something like "don's waste time trying to target this user as they will not see or hear the ads"^1
What are these "network-based" methods exactly
I never see any ads when using the www. I attribute this mostly to not using popular software controlled by companies or individuals that advocate for internet advertising. This software could be something as complex as an operating system or a "browser" or something as simple as a Javascript sourced/planted in a web page
Whatever these "network-based methods" are, they don't seem to be very effective at targeting me with ads
I generallly stay in textmode. Most internet ads seem to be graphical and/or audiovisual in nature
Hypothetically, if a "developer" tried to target me with text-based ads, I could easily filter them out
I already filter the text in response bodies using a local forward proxy
For example, the "score" on HN comments I submit never goes below 1 in the HTML I'm reading. In theory this helps avoid self-censorship
Here is an excerpt from rewrite.lua
if host=="news.ycombinator.com" then
body = string.gsub(body, "%(<span id=\"karma\">%d+</span>%)","")
body = string.gsub(body, "-%d points","1 point")
body = string.gsub(body, ">0 points",">1 point")
body = string.gsub(body, "width=\"%d+\"></td>","width=\"0\"></td>")
end
1. Of course companies like Cloudflare are using the www user's choice to run/not run Javascript as a way to collect fingerprints and filter out users who are not using advertising-friendly software
I still don't understand why the highest entropy APIs aren't gated behind browser consent.
A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
Broad geographical targeting shouldn't be an issue. In fact, it's so easy that I think we should invent an ad-targeting API people can opt in to. If I could tell advertisers my geographic location, gender, age cohort, languages, and 3 interests, I'd not feel that's an invasion of privacy when they use that to deliver ads. I'd just get lawnmower ads instead of shampoo ads and that's fine.
The problem is, they don't want to use that kind of targeting. They want to target me with ads for a travel destination that my coworker mentioned in a Messenger message to another coworker five minutes ago. But we should just not accept that.
The most used browser comes from the same company that runs the largest ad network.
It's the browser that introduced many of these APIs in the first place.
That should answer the question.
(If you ask me if a browser should report how many cores the machine has, including physical and logical ones, I would answer never, every time. But not everyone thinks that way. https://developer.mozilla.org/en-US/docs/Web/API/Navigator/h...)
> "I still don't understand why the highest entropy APIs aren't gated behind browser consent"
Because it's known that interrupting the user-intent with a unrelated consent-popup doesn't help.
Older people may remember that this was the approach of Java J2ME, where you couldn't provide a fluent user-experience as the user first had to answer huge popups about individual API-permissions with "Always Allow", "Allow now" etc.
If it isn't an informed decision, it isn't really a decision at all. And the huge majority of people the huge majority of the time do not want to make an informed decision: they want what they came to the site for, news, games, family photos, etc.
You go to Facebook to see your cute nephew make spit bubbles. Do you care that they access your camera and canvas? What is a canvas? And sure access my camera, I want to upload photos!
It's fundamentally broken. They've studied the dark patterns, not to avoid them but to implement them best.
1 reply →
So long as it's once per API and site, it seems it doesn't need to be too bad?
If it's a site I trust, and I think it genuinely needs audio, I give it audio. If someone doesn't understand and just does allow all, they never see it again either (and their ads are suspiciously well targeted).
We already have these consent popups for camera and microphone. Reading back bytes from an audio buffer seems like such a rare thing to do that it hopefully just stops happening.
2 replies →
Also, people not in tech do not generally understand the implication of consent popups.
For example, on multiple instances, my spouse declined "location permissions" an app designed to work with a piece of Bluetooth-connected hardware, and would blame the hardware as being crappy.
"This smart lock app doesn't work."
"You need to enable this permission."
"Why do I need to give the smart lock app location permissions?"
It's not obvious to people that "Bluetooth can be used sneakily by big-enough companies as a makeshift GPS" even if the app needing Bluetooth access doesn't actually need a GPS location.
1 reply →
> A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
We should go further. A web-site with mostly static content should not use user-side scripting (Javascript) at all, it's unnecessary for it. It should be required only in rare cases where a site is basically an application and require manually turning it on each time such application is opened.
I think that ship sailed and I'm pragmatic enough to accept it. The web is an application platform, not a web of hypertext content. That's not going to change, and I've given up on the idea to even try to "go back" there. If it worked, you'd just have half of websites be "sites" that work without JS, and half would be "apps" which would require switching on JS? The whole reaosn the web took off as it has is because we removed the distinction between "web app" and "web site". There's no putting that genie back in the bottle.
> A web-site with mostly static content should not use user-side scripting (Javascript) at all
Then sites that want to track will just add some JS. Seems unlikely to help.
Sure, for the most static of static sites. But without JavaScript you can’t even do basic things client-side, such as having some variable-length list of fields in a form. Or customized field validation.
If such client-side behavior counts as “basically an application,” then “applications” is a larger set than seems useful.
1 reply →
Well yeah, but there's also the part where I'm not okay loading ads from a third party because they eat my battery, add latency, and can potentially be used to spread malware. So there's the conflicting preferences regarding targeting that you mention but also conflicting preferences regarding how they are served.
The conflicting interest starts with the very idea of ads already. The entire point of ads is to manipulate you into doing things you wouldn't do otherwise.
1 reply →
That could also be a preference. Do you allow third party ads to begin with? But then I'd understand if people would just block visitors that don't agree to them. I think paying via showing ads is fine. Paying with my integrity isn't.
> I still don't understand why the highest entropy APIs aren't gated behind browser consent.
Simple answer: The makers of 3 largest browsers by market share (collectively 90%+) are buddies with the people who want to fingerprint you. Only the 4th largest gives a shit.
That would be nice. However, It’s easy to see why it’s way more than simply what they want, they don’t really have a preference but it boils down to money. You’ll only replace your lawnmower every couple years and the rest of the time they’re guessing what you may buy next. By spying on your daily conversations and browsing, they have an idea of what you are likely to buy this week, next week, and the week after. This is so much more valuable to an advertiser.
Exactly. And here's where regulators come in. What we need to do as a society is basically say "Unless you can make your ad-funded business work with this tiny bit of information, your ad-funded business should fail and shut down".
1 reply →
> I still don't understand why the highest entropy APIs aren't gated behind browser consent.
Last I checked it's because it was generally considered that preventing fingerprinting is practically impossible anyway. It's not like you need a lot of entropy for fingerprinting, and the web API surface is enormous. To actually stop fingerprinting you'd need to make your web browser more or less useless.
That might sound good, but people already moan and groan about cookie notices. Imagine if each website that legitimately needs it would start asking for permission to each fingerprintable API. Although I do think we should have that option, just not as a default.
You could accept things once per API and site. It doesn't feel that terrible. We do it for camera and clipboard already.
[flagged]
Same reasons why browsers allow javascript on every site.
The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis.
The scope and amount of information that browsers hand over without the slightest shred of consent from the user or indication it’s happening is crazy.
And also without logging it. Even if I don’t want popups to give consent for every document.getEyeColor() call, it would be nice go back and see who’s doing which queries and/or have Firefox collect aggregate statistics. Naming and shaming the crooks won’t stop them but it might have an impact on curbing any bad behavior from big commercial retailers.
1 reply →
It's a UX trade off. For non-adversarial websites it's very convenient for users because things just work without having to go through loads of permissions pop ups for every website, but of course this then makes this info a juicy target if you're trying to fingerprint someone.
3 replies →
Is it though?
Google's business model has been ads from the beginning. Search, gmail, drive, office, chrome, everything they do is just to drive ad revenue further.
They don't care about the user. Never have, and never will.
And the outcome we are seeing is what happens when a defunct state isn't able to protect citizens from conglomerates. That's what the Kartellamt or the FTC is supposed to be for.
4 replies →
That's not a browser thing. Fingerprinting native apps is much easier.
1 reply →
Great how this is currently the 2nd highest comment despite completely ignoring the numerous fingerprinting techniques based on CSS alone (including one of the most famous fingerprinting methods by testing font support). Simply thanks to reflexive "JS=bad" upvotes.
https://en.wikipedia.org/wiki/CSS_fingerprinting
I can't help but keep thinking that client-side scripting was a mistake. Sure, the web would be a lot more primitive without it, but I'm not convinced that wouldn't be for the best.
My default is to run without JS and selectively enable it when absolutely necessary, so when I clicked on this story the page was prefaced with the following comment:
"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else.
From now on I’ll call you:…"
I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it. On rare occasions when I'm forced to use JS I'll cut-and-paste the URL into another browser.
I no longer use ad blockers as I just don't see ads with JS disabled. The other privacy precautions I take are the obvious ones such as no Google or social media accounts, flushing cookies at session's end, regularly randomize my IP and never let Chrome anywhere near my machines and make judicious use of multiple browsers (this is being written in Privacy Browser on Android).
Using NewPipe and sponsor block on PipePipe increases privacy and makes YouTube ad free.
Client-side scripting was a mistake which was obvious from the outset (or not severely limiting the reach of scripting engines).
What I find hard to understand is why alternative plugin JS engines haven't been developed that are under user control. Spoofing, randomizing and returning junk data to webservers would go a huge way towards stopping fingerprinting by websites.
4 replies →
The alternative is to install a binary that has full access to the computer.
2 replies →
https://fingerprint.com/blog/disabling-javascript-wont-stop-...
You can do plenty (like view port size) via just CSS.
Even without JS, there is timing, HTTP headers, conditional CSS, etc.
If everyone else you know has JavaScript turned on, congrats, you're still fingerprinted.
If anyone else has JavaScript turned off you're fine (as long as you can account for all the other stuff like IP address).
> identifying hardware,
> language
I dont think js is needed for either of those things.
>Test your browser:
>coveryourtracks.eff.org shows you how unique your fingerprint is, with entropy for each measured data point.
Something to note - if a fingerprint is generic enough, that might be a _good_ thing!
Having worked with fingerprinting, anti-fingerprint browsers are very hard to properly identify. The ways to get around it are things like collecting more coarse fingerprints[0], as the overall one is fairly easy to change (e.g. make your browser lie about a collection of browser apis).
What's imo more difficult though is a fingerprint like:
- iPhone <new_version> - running os <latest_stable> - using default safari - bought and used in <common_location> (e.g. usa)
on a 5g mast in a decently sized city, you'll share a fingerprint with at least one other active user using a setup like ^
grapheneOS on the other hand stands out a bit more!
[0] - https://blog.castle.io/fingerprints-beyond-device-ids-engine...
> The request already reveals information about you; what browser you use, the language it’s in, the OS that runs it and your IP address, which the server needs to send you the response. That often reveals your location.
If we control the servers the clients are connecting to, I don't see how there could be much hope of hiding. We can spoof things like latency toward an upper bound, but we can never ever defeat the lower bound. Physics is still quite insistent about that one.
If we control multiple servers, we know where they are, and we can periodically compel our clients to rotate between them (see: DNS), we can engage in latency-based multilateration to put them on a real-world map. Depending on the number of servers and samples over time, this can be remarkably accurate. Determining someone's actual postal code just from network timing information is feasible.
VPNs obviously confound this in first order terms, but if we aren't careful they can make it even easier to identify our activity in other ways. We are trading concealment in the woods for concealment in a crowd. Both have their advantages and disadvantages. The VPN might also have a side channel that we aren't aware of.
https://www.usenix.org/legacy/event/nsdi07/tech/full_papers/...
I think that's how ipinfo works: https://ipinfo.io/trace
I've seen anti-fingerprinting plugins and browser configs, etc, but they all seem to make you more interesting for not being fingerprintable, or for turning off a lot of features used in fingerprinting.
Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
Random is often going to be indirectly fingerprintable too, since some values are always the same (or the same given each browser version). Some values can't be set to be random or otherwise non-fingerprintable data without affecting the user, like viewport size.
Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.
There are projects that do this already e.g. https://github.com/lwthiker/curl-impersonate
> Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard
It doesn't matter if it looks wrong as long as it looks differently wrong over time. Don't bother trying to blend in with the crowd because you can't ever expect to catch everything that can be used to fingerprint you. New techniques come out all the time. You can block a lot of information from even being collected. Limit what data you send at all, randomize what's left, change IP frequently (VPN) and you should be fine.
That's the thing, no web page, except for games, should ever need to know about your viewport size. So spoofing would be just fine, imho, with an override option/permission for individual sites.
Any idea how iOS’ private browsing impacts fingerprinting?
4 replies →
You can forcefully disable hardware acceleration, that removes a few bits - though javascript can still guesstimate your CPU and memory.
For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.
The reason is that the browser maker is interested to support tracking.
On the technical level there is no problem to block tracking - intriduce noise and make APIs unavailable until user permits to a web site. But that is not implemented.
The same with native applications. If your bank app requires you to share your location you can't spoof it. The makers of Android and iOS made spoofing of geo location impossible - you don't have that control, which means the phone is not your device. You have to give up your real location.
IIRC that is what https://jshelter.org/ does.
> "What JShelter configuration should I pick?
https://jshelter.org/faq/#what-jshelter-configuration-should... :
First, see our blog post. Consult also other blog posts and other questions in this FAQ.
If you want to have the same fingerprint as many users, We suggest going for Tor Browser (do not install JShelter in Tor Browser). If you want to make cross-site fingerprinting linkage hard, go for the Recommended JShelter level. If you want better protection for the real data at the cost of having the same fingerprint on different sites, go for the Strict JShelter level. Keep NBS active. If you want to detect and prevent fingerprinting attempts, use FPD.
Thanks. I tried this on Firefox for Android and each time I close the browser and load the page my fingerprint ID is different. So it seems to work. Have you had any sites break with this extension installed?
1 reply →
> Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
That's basically the ideal. It's become obvious that it's impossible to try to be identical. Web browsers are too leaky, and something will out you. You really don't want to try to blend in the "typical" users because none of them use ad blockers.
This very often will trigger cloudflare protection.
I think this is what canvas blocker does.
"Fingerprints are new cookies"
What if "fingerprints" are contained in the values of Cookie: headers
Doing this on GrapheneOS's built in Vanadium browser, I am concerned to see that the ID remains the same if I move to incognito tabs, or even a private space. Or perhaps Vanadium is doing such a magnificent job of reporting generic info that this ID would be the same for anyone using Vanadium on my model of Pixel, but I don't think so, since the site says it has a "clean read" on all the info it takes. I really do not know. Curious what other Graphene/Vanadium users are seeing.
Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes.
90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months).
What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.
IMO, data brokering is what should be illegal, not the cookie .
The problem with this is the biggest, most important, and sketchiest data brokering services (credit monitoring) are all but entrenched in law at this point.
31 replies →
It is illegal, if it's PII without explicit consent.
18 months ago Google publicly stated they were going to start using browser fingerprint data to track users, a reversal of their 2019 policy on it because it was considered too invasive.
https://www.malwarebytes.com/blog/news/2025/02/google-now-al...
There's a fingerprint demo on github called JSCreep (https://abrahamjuliot.github.io/creepjs/) that used to keep your fingerprint profile for 90 days and show you how many times you visited. Worked extremely well, and is still around, but no longer uses the API to retain fingerprint data, so you have to track your hash yourself. It would easily track most browsers across changes in IP address. Only Mullvad, Brave, or Tor would not leave an easily tracked fingerprint.
The demo presented in the royfish.dev link is easily foiled by browser extensions that scramble fingerprint data, the presence of which would itself be detected by more sophisticated profilers and used to define the fingerprint. I can refresh the page and get a new hash and adjective-animal name with the same IP. JSCreep sticks firm to the same hash for me, even with a new IP address and some spoofed browser data.
This fingerprint breaks every 2 weeks when Chrome auto updates. Or any other modern browser.
Overall correct, but you're kind of missing some of the cat-and-mouse details for fingerprinting centered around infosec and anti-fraud purposes rather than generic ad-related tracking. That stuff can get way more intense, and is constantly changing based on new techniques developed, countermeasures from cybercriminals, and mitigations from browser developers.
I think the idea here is that the details shouldn't be publicly known. (Or that if they were they would have to invent their details!)
Is there any way to link this data over longer periods of time?
A lot of data can change over days, weeks, but if you can maintain an accurate fingerprint with tinier changes, and granted you have consistent visits from the user, could you just keep up?
Especially if one service is tapped into several websites, and can continually keep up with smaller data changes and distribute that info. Is this possible? In practice anywhere?
I'm thinking that you just need one website where you can associate a given fingerprint to a specific user and then tracking its activity around the web becomes easy.
Let's say I'm logged in a famous search engine, they associate my fingerprint X to my account A. If they then encounter fingerprint X anywhere else, there is a good chance it was me, A, doing it. If the next day I get fingerprint Y, it gets attached to A as well and the tracking information follows it.
Does this make sense?
You mean, like a really popular web service or app that someone would log into every day/week/month...?
Even easier if, additionally, many of the smaller websites were syndicated into a tracking network?
on what basis do you believe this about fonts? my guess would be that the average user doesn’t install or remove fonts often if ever, but it’s only a guess
I don't actually know how much this happens - software versioning is the biggest one. Chrome updates every two weeks, Microsoft updates once a month, your GPU drivers get updated semi regularly, etc. Any one of those would break the fingerprint.
1 reply →
Most people probably have completely default fonts, right? Doesn't seem like much of an identifier anyway
2 replies →
Hmm. I used to have to do that a lot, but I haven't in a few years now.
Perhaps, but that would also mean the cardinality is lower.
I was thinking about the literal fingerprint sensor a device has. Imagine a "prove youre not a bot" challenge and the finger scanner pulls up. What a nightmare, reminds me when a website asked me if I want to login with windows hello (facescan)
That is different though. That site is just creating a passkey and storing in your keychain (or windows equivalent). Windows hello unlocks the keychain. It can be your face, fingerprint, usb key, 4 digit pin anything. Chrome already uses this. You’re not sending your face to that website nor to microsoft, I hope.
1 reply →
One intereting part about installed fonts is that many enterprise companies buy specific fonts. Then they are rolled out to all their devices, and sometimes at least one of them will have the company name as part of it's name.
> Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days.
Indeed. I checked this website a few hours ago and got one fingerprint. Just rechecked and got another.
On the other hand, browsers don't need to share all this data at all. Sure, IP address can't be hidden, but from your example, installed fonts and volume settings? Why should that be shared at all? Sure, for example for a teams meeting, but you'd have to allow the use of microphones or that, youtube for example doesn't need to know how loud you're listening to a video.
[flagged]
> Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Sorry, but that's simply not true. It's actually the default way of how people eg track people across installs in app stores ever since they started removing that feature.
Theres only one solution, ban third party advertising. Everything else is a compromise that doesnt work anyway.
The problem isn't advertising, it's data harvesting and sale. Ads used to rent space on websites - totally reasonable. The whole industry around the purchase and sale of user data is what needs to be banned.
Consequences are deeper than the immediate cause. Advertising is at the heart that gives a lot of value to data harvesting and similar scams.
Data harvesting gains most of its value because they sell some or all data to businesses which wish to leverage that data in advertising. If they cant advertise they wont need most of the data, which should at the least reduce the problem significantly...
Advertising and paid promotion in any form has never been ok. It has always been a cancer on society. That is what happens when you ignore a mild symptom until it metastasizes into something horrible. We need to ban it completely.
9 replies →
That's one perspective. Other are in different perspectives, like "anything that present something else than the very topic looked for is pure propaganda."
The spectre of possible interpretations is wide.
Some see only problems everywhere whatever the benefits might be, some see only new opportunities no matter the tragic outcomes, some see various blend of this and that.
1 reply →
Or ban all advertising, https://news.ycombinator.com/item?id=43595269
Fingerprinting is still needing for preventing fraud and platform abuse like spam.
How do you tell the difference between a regular human trying to not have a weird creepy perma-dossier collected on them... versus a bot set up to always look like a new visitor?
The only winning move is not to play--er, to somehow not to have this kind of game in the first place.
1 reply →
It doesn't actually work for that
2 replies →
How would you enforce that? Who can be trusted with the ability to classify things as advertising and in so doing silence their critics?
The solution is explicit trust. Not fingerprints for users, but digital signatures for content. If it's not signed by somebody the user trusts, don't render it.
The user is the only one who can be approach that task without a conflict of interest. If somebody wants the user to run code that phones home about user behavior, make them gain the user's trust.
Many countries ban cigarette advertising. Not saying its perfect but has helped reduce smoking.
> Remember the big fuss about third-party cookies? It was so big that the EU had already rolled out one of its greatest inventions - consent banners.
It was never about cookies. Thats what the industry made you think. You don't need to show consent banners for cookies (like auth sessions). You need consent for tracking. This includes profiling. And it doesn't matter what you use, fingerprinting or tracking cookies, the consenst banner is required either way.
> the consenst banner is required either way.
Consent is required. The banner is just one mechanism, but not required. A website could hold off on all tracking until a suitable point in the usage of the site (like creating a profile, for example) and ask at that point.
The banner is an artefact of the hostile way most sites choose to try and hoodwink the user into being monetised and ultimately to piss users off so much that they complain about the legislation rather than the lack of online privacy.
And there was an initiative to include tracking preferences in browser HTTP headers, which never made it, as it was quite obvious that this would lead to a lot of people opting out.
Better to just harass them into a habit of dismissing the banner.
11 replies →
When there is "legitimate purpose" there isn't reason to as soon items are put in the shopping cart this has to be tracked (be it session in url, cookie, local storage, ...) and no consent is needed.
The exact definition of "legitimate purpose" is unspecific (which is important to be able to adapt to development of new services) which leads to some lawyers being careful.
I also claim that some lobby groups promote having too many and too big consent banners to move blame from tracking companies to the EU ("stupid EU forcing all those banners!") in order to reverse the policy on tracking, which seems to have some effect.
2 replies →
I know it's tempting to put this consent-banner anti-pattern all on toxic ad-driven platforms, because their motives are bad.
The problem with this view, though, is that even the very agencies propagating these rules do the exact same thing! You can go to any site from an EU arm and get the same banners.
At this point, you can't really blame it on bad-faith actors, you have to accept that it's a bad rule. Which is not to say I know a better one!
And then you open the details mentioned in those cookie banners and see literally 600, 700 entities that get data about you shared by the website.
Malicious compliance is not the law-maker's fault.
It's not even compliance. You're required to make consent and decline require equal effort. A large percentage of them make it much easier to consent.
Not to mention the large number of "legitimate interest" exceptions that are absolutely not justifiable.
The main problem with the legislation is its lack of teeth and enforcement.
Is too. They could have thought through the law they were writing and predicted malicious compliance. Or written a stronger law. Or revised the law when they spotted malicious compliance.
I don’t understand why that’s considered legal under GDPR. How can consent be express and informed when it would take 30 minutes just to identify each entity your data is being shared with?
In fact the law even specifies “no pre-ticked boxes” but every banner always has “accept all”. And it’s 50/50 to see “reject all” even though it is a requirement that denying must be as easy as accepting.
They should pay a bounty for reporting non-compliance.
1 reply →
A 'cookie banner' I've came across recently (https://www.courthousenews.com/scotus-calls-for-redo-on-wash...) feels so bizarre yet arguably should be the standard.
> Global Privacy Control detected. Advertising cookies are turned OFF.
> Global Privacy Control detected. Advertising cookies are turned OFF.
Yes, I love this. My browser is already sending "do not track" requests.
3 replies →
I'm getting a cookie popup floating thing myself with five options, "Accept all", "reject all", "cookie settings", "confirm my choices", and... "cookie settings" again.
1 reply →
I feel it's worth distinguishing between the Hacker News Audience that is highly tech-educated and security-conscious and the general public that just wants to use the web and seems more than happy to give all their data to Meta, Google & Co.
If you ask my 70-year-old mom to decide whether she'd like to allow the WebGL API, she'll go bonkers. If anything, the constant cookie banners have just trained her to consent to stuff out of muscle memory. You could probably design a "Are you ok to sign over the deed to your house" question in the rough shape of a cookie banner and get 90%+ agreement.
My favorite cookie banner is on arstechnica.com:
> We Care About Your Privacy
> We, and our 228 partners use cookies and similar methods to recognize visitors [...]
228 partners should make anybody concious about the fact that something is wrong and you probably should not consent to that at all. Also, nobody cares about your privacy when they think sharing data with 228 parties is okay.
3 replies →
Yeah it’s absolutely how effective the industry psyop against that was
Or alternatively how weak the EU messaging was I guess
it's hard to make yourself heard when your opponents have trillions of dollars hinging on you not being heard and also control the biggest communication channels.
I've never seen a consent banner for being fingerprinted even though I'm sure companies are fingering my prints in the background enough that my colon could become a national database.
The banners were for those other cookies, often for affiliate marketing and needed permission or at least the appearance of state order
The EU/banner situation keeps confusing people because there are two different laws in play:
1) ePrivacy. the OG banner law. requires you to inform the user (but not consent, as I understand it) if you store data on a user's device. includes cookies, localStorage, indexedDB, etc. does not affect fingerprinting 2) gdpr. requires you to ask consent for any kind of user data processing, unless you can find another legal basis
eprivacy was about cookies, but forgot fingerprinting. gdpr was not specifically about cookies. but gdpr (or at least its past interpretation by the dutch privacy authority) didn't require consent for limited first party analytics.
which led to situations where you'd get the impression that you wouldn't need a banner for first party tracking using cookies .. well the gdpr didn't require it, but the older ePrivacy rules still did.
we still have the digital omnibus law package coming up which is supposed to simplify and resolve the overlap between the two above, and reduce banner requirements at least for SMB just analyzing their website visitors
> does not affect fingerprinting
It does. The current version says "storing of information, or the gaining of access to information already stored, in the terminal equipment". Reading e.g. navigator.userAgent is information already stored in the terminal equipment. If you then use that in any way that gets communicated to remote server (e.g. directly or calculating some fingerprint) you read that information in manner ePD describes.
The directive itself has been transposed incorrectly in many jurisdictions. For example from what I understand the Dutch law added an exception (roughly "for obtaining information about the quality or effectiveness of a supplied information-society service, provided this has no or only minor consequences for the user's privacy.") which is not permitted under ePD. ePD exception list is exhaustive and the only other exception can be done via Article 15. The exceptions done via that are related to things like national security and certain criminal prevention/investigation.
Of course that then raises the issue on how you get invalid exception invalidated. I don't know Dutch procedural law well enough to answer that.
That would be pretty narrow analytics to not need GDPR consent. No IP addresses or any way to uniquely identify a person.
Consent banners are generally malicious compliance and designed to annoy.
My understanding of the EU "cookie law" is that it really concerns a broader category of tracking devices rather than cookies specifically. Referring specifically to cookies is probably a side effect of the way tracking was typically implemented at the time.
How could this information be surfaced in a reasonable way in administration software?
Say I have a remote employee who is only able to access your internal systems via his yubikey. His fingerprint is "Genuine Antelope".
Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him. I create a new session for him on the provisioning portal (so he can enroll the new key) but now his fingerprint is "Interesting Elephant". What do I do with this information?
It might be better to log the exact forensics and show the administrator the differences, e.g, "User has a new font called "my_handwriting.ttf" since a week ago", or "appears to be a totally different processor, and the new system has Russian fonts installed".
> Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him
They should be authorized ahead of time.
> What do I do with this information?
Not much. You can't authenticate a person using their (public) fingerprint information.
Your problem boils down to: "How can I verify someone's identity over the internet". You can exchange emergency recovery codes ahead of time (e.g. in an envelope), you could trust public keys from both of their yubikeys, but they can be stolen.
> You can't authenticate a person using their (public) fingerprint information.
Yes, but it's a signal! There's a cost to spoof it. A scammer could cheaply start a VM that clones your font profile, but at what cost could they replicate your CPU SKU and GPU combination to provide identical webGL timings?
Other signals include the ability of your employee to show their face on a video call, to sound like themselves on a voice call, the ability contact you from their home IP, to receive official mail at their listed address, to produce a second 2FA token you'd previously registered (but not activated) or repeat a code word you'd exchanged. Any of these things can be spoofed, bypassed, copied, or burgled, but each one imposes some cost on the attacker.
The question is how to surface this information in a way that equips help desk staff and doesn't deceive them into authorizing unnecessary risks.
The fingerprints don't need to be long-time-stable to be harmful. Some companies have your stable datapoints (e.g., email) and your fingerprint. Other companies only have your fingerprint on the same day/week. Some companies have locations of edge devices and the fingerprints. And there are companies out there that will take all of those data streams, both from above board and not-so-above-board players and mix them for commercial benefit.
Per coveryourtracks.eff.org, just my HTTP headers leak 18.46 bits of information, which seems to be the most the tool can report? Presumably most of that entropy comes from my language settings (en-AU,en;q=0.9,de-CH;q=0.8,de;q=0.7), so the only way to be not fingerprintable is to give up on smart localisation.
If people have a problem with fingerprinting, they need to focus on making it illegal to trade data tied to fingerprints, not trying to make users all look the same (we aren't!).
RFC 3282 allows for the exclusion of the quality value, in which case the languages are just given in priority order. Removing that will shave some entropy off.
I have a hard time figuring out why quality values are even included for Accept-Language. They either have one of the preferred values, or they don't.
The quality values here seem pretty generically tied to the order, so shaving them off probably wouldn't help? I presume they are there at all to let you express ties?
2 replies →
Apparently, I have to enable JavaScript to receive a rating.
Fingerprinting is a way to track you. Cookies is a way for you to keep your own configuration (a panel inside an app open or closed, theme choice, pre-filled calendar, etc). They are completely different.
Cookies are also used to track you. And I’d guess way more cookies are for tracking than personalization.
"Cookies are a way to track you. Fingerprinting is a way to detect fraud. They are completely different."
It is offensive that browsers give away so much unnecessary info. What is necessary? Language preference, Javascript (yes/no), screen resolution. Optionally, latest supported html/css versions. That it, nothing else.
I understand Google having Chrome send way more info. Why do all other browsers go along with this?
Make it make sense...
Why can't a government simply ban all advertising and instead provide a good enough yellow pages service that just provides the specs of the product in a templated way?
Why would it be a good idea to expose unsuspecting citizens to false claims by the sellers?
These fingerprints now track us much more effectively than ever, not just for security but for real ad tracking and data selling. Instead of using cookies that are mostly vulnerable to ad blockers and other content blockers, these fingerprints can track us more precisely and can easily bypass our current data security systems like ad blockers. So I think the demand for sophisticated anti-detect browsers and proxy-level tracking prevention will increase. Hmm, let's see what will happen.
The solution has to come from law. I propose we handle privacy invasion the same as rape. Body and mind aren't up for grabs. That the average internet user is unconscious isn't a valid excuse.
It would be great if a wave of lawmaking started in the USA, because most tech behemots operate from there. I would expect EU to take the lead though IF such a wave would start. The EU has still a fair share of christian/conservative MP's that keeps doing the bidding for companies by pushing chat control, but on the other hand also has some progressive and knowledgeable representatives doing great work, so there might be a glimmer of hope. We need media campaigns and public education though. Political leaders are selected for their political abilities and as such rarely have leadership qualities. If the electorate moves, the leaders will follow it. So we have to start at the bottom.
I like your idea, but as a pessimist, I believe the ship has sailed, all government are craving on monitoring their citizens' move. If there are way for the government to fingerprint their citizen digitally, they will want to do it instead of protect us.
Fingerprinting is really bad for privacy and the defenses against it are not there. See https://fingerprint.com. Tor Browser defeats it but I don't think there's a highly usable browser like Brave you can use and prevent being tracked by it.
I've been obfuscating my fingerprint with Brave for years, which I selected specifically because it was the browser I was able to do this with, based on my testing of 5 popular browsers, using https://coveryourtracks.eff.org/ as my benchmark.
It does mean that sites that uses 2FA (so every site nowadays) flag me as a coming from a new device each visit, and I have to have my phone nearby every time I want to use my computer, which is quite annoying. If you use GrapheneOS, you can obfuscate your phone too on WiFi networks (and sites, but GrapheneOS not needed for that, just Brave). You can't obfuscate yourself on cellular networks though, unless you have a ton of sim cards you rotate through.
> unless you have a ton of sim cards you rotate through
And phones!
For years, I've been practicing good privacy-hygiene in public. At my doctor's office, I always wear a Groucho Marx moustache to keep them guessing. Before I walk into my bank for a withdrawal, I team up with two of my friends, set them on my shoulders, and throw a trenchcoat over us! I made a fake ID with my birthday on July 4th and my weight as 98 pounds, but my pharmacy is now refusing to fill my prescriptions!
So what sort of benefits are you reaping from your anti-fingerprinting measures?
7 replies →
Wow, that is a seriously impressive demo. I wonder how it’s able to distinguish people using identical hardware and software versions (e.g., iPhones on the same iOS version). It was able to correlate my sessions across multiple independent ISPs, with a VPN, and with Apple’s extra tracking resistance in private mode.
> Wow, that is a seriously impressive demo
https://abrahamjuliot.github.io/creepjs/
My reaction to this is always two fold; firstly cool tech, secondly horrifying invasion of privacy.
At {{job}} we did briefly consider rolling out fingerprint.com, but settled on ja3/ja4 at the CDN layer.
Huh, it is different for me on every page refresh. No VPN, etc... just Firefox on Windows with uBlock, CanvasBlocker, and a PiHole. No persistent fingerprint for me!
firefox, ublock and canvasblocker seems to be enough for me. New identity every refresh
I wonder if a browser extension could be made that inspects your fingerprint and informs you if you're too unique, then one-click to 'correct' those unique items (or at least list them), so you can conveniently go back to being ~anonymous if preferred.
The regulation is not about cookies. It’s about tracking.
The whole cookie thing has always been bs
If you use Firefox, do the following: Use the extension Chameleon (set it to rotate Random profile every minute), had strict mode with JShelter extension.
This royfish blog example, or anyother, including that fingerprint.com gets new value everytime.
Fingerprint.com charges around $0.004 per investigation, and really encourages you to set up a first party proxy - so iOS doesn't nuke storage after 7 days. And even there, unless its a cookie match; your ID usually carries a confidence number.
That should give some hint about how difficult it is to do in real life, at scale.
This site gave me the name “Greedy Bison”, but it didn’t say how many other “Greedy Bison” are out there. I’m guessing everyone using the very common device I’m using and using the very common browser that I’m using would get the same name as me
Lets hope AI coding agents will let us to modify browsers and OSes quickly. "Remove tracking from Chrome". "Privacy friendly Android, in particular, allow geo location spoofing"
Iphone safari incognito gives different with every page load.
Cookies, in and of themselves, are not bad. Like any tool that can be misused, they're just being abused by a ton of really shitty people in an effort to try to enrich themselves at the expense of others. Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"
> Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Don't you people remember how it was done back when web browsers didn't have cookies, or could be configured to reject or ask for each cookie? The server software automatically added a PHPSESSID parameter to every link, containing the session identifier.
The "PHPSESSID" thing is why many message boards couldn't be archived in wayback machine.
RFC 2109 predates anything that vaguely resembles PHP, and Netscape (thus, defacto, basically everyone using the internet), had cookies 3 years before the RFC. PHPSESSID wasn't added until PHP 4 in 2000.
If you're going to be a bitchy pedant, you'd damn well better be CORRECT.
Amazingly, Firefox incognito seems to defeat this
It's creepy that we all have stalkers that want to know our intimate details.
Just think how are daily actions are someones data and how entire masses are manipulated by using this data.
Can anyone confirm that they are also "Gentle Llama" on Mullvad browser?
I just installed it, I want to know if everyone gets the same hash (same identity for everyone).
I have heard from some power users that Brave is one of the best browsers with regard to ad-blocking and privacy. But I think I have read elsewhere that it receives money from ad companies to display only certain ads, which does not make me trust it. Does anyone have facts or know where to find them?
As a general role, always be suspicious of very loud and vocal opinions about product and services. Specially for closed source products and paid services, they often invest in what is called Native Advertisement/Marketing which is basically paying people to lie and pretend it is organic content/opinion.
Second, despite the dumpsterfire that Mozilla’s leadership has been in a decade or so, it is very robust with privacy and anti fingerprint features out of the box, the containers has also stabilised and works great.
Isn't Brave open source? https://github.com/brave/brave-core
Brave outperforms Firefox on the EFF fingerprinting test at https://coveryourtracks.eff.org/
Using Brave EFF reports that I have a randomized fingerprint.
Using Firefox or Edge EFF reports I have a unique fingerprint
I see so many misconceptions on HN about that coveryourtracks site. Neither of those results are ideal.
"randomized fingerprint" -> that's a bad result, it means the site can detect you're spoofing info
"unique fingerprint" -> this is good, ONLY IF you refresh and it still says "unique fingerprint", because it means the site sees you as a brand new visitor each visit, and doesn't detect any (what advertisers would call) nefarious behavior. however, if you visit again and the second time it says "nearly-unique fingerprint", that's a fail because your two visits were linked
The ideal result you should aim for is "non-unique fingerprint". That means your device is indistinguishable from countless others. Blending in to the crowd is what you want.
These tests aren't reliable - Brave does randomise values but it ultimately doesn't do much to prevent fingerprinting, as many values remain static. For example, Brave still exposes your GPU model and driver version.
See Fingerprint.com, despite Brave's protections you'll likely find it works reliably.
2 replies →
So what is next in this cat and mouse game? Fake-slow browser to miss fingerprint? Declare revolution and declare all advertising illegal?
At least when tracking was unregulated, at least you knew who was by the cookie left in your browser, now I just assume everyone and everything is tracking me
With the cookie, at least you could just whitelist some sites and have everything else be deleted once you leave the related website. Though, admittedly cookie-auto-delete often stops doing what it is supposed to.
[flagged]
I think this app is broken. Every time it refreshes it calls me a different name.
Chameleon?
Ok, but are they really all that new at this stage?
Mullvad browser. It's Tor browser minus connection to Tor.
Relevant: https://mlfa.org/how-government-surveillance-and-big-tech-er...
This is already illegal in the EU. The consent banners were never about cookies, they have always been about the tracking itself!
Same thing the other way: no need to have a banner for a simple login cookie which isn't being used for privacy-invading tracking purposes.
Yet I am constantly flagged by various pages because Cloudflare decided I had some bot running at some point on my network. And my IP is fixed. Whatever EU is doing, it doesn't work.
You might have a residential proxy running somewhere on the network. The latest in botnets is bundling a proxy in with some TV torrent streaming app or whatever else that can run in the background and proxy malicious traffic from your residential IP. Services like cloudflare and crowdsec will keep a constantly updating list of the IP addresses that are actively sending bot traffic and blacklist them. If you can work out where the traffic is coming from and shut it down you should have this issue go away.
3 replies →
I have experienced the same with Google and with PayPal, whenever I used Tor. When I afterwards visited those sites using my normal browser I got Captchas. They are actively fighting attempts to avoid fingerprinting. Also, I am pretty sure that no browser protects against getting fingerprinted. Test with https://fingerprint.com/.
2 replies →
Have you got a TV? Or a car?
if your IP is fixed, surely no further fingerprinting is necessary?
2 replies →
> they have always been about the tracking itself!
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
Yep, and somehow there's always someone who thinks that the "Ah, but this is not a cookie!" is a loophole. It is not, he is just undereducated.
The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)
Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).
Eh reads like a “civil war was about states rights not slavery” argument.
The thing the site is doing that isn’t “strictly necessary” is always tracking.
3 replies →
Right, and that wording is why fingerprinting doesn't get around it. The EDPB's Guidelines 2/2023 on the technical scope of Art. 5(3) (final version adopted October 2024) say that when a site's JavaScript instructs the browser to send information back, that is "gaining access" just like reading a cookie (paras 32-34). WP29 had already said in Opinion 9/2014 that device fingerprinting is in scope.
So a canvas/font/WebGL fingerprint used for tracking needs the same consent as a tracking cookie. The guidelines even suggest passively collected protocol signals can fall under it (para 43), though that's where it gets argued.
The weak point is enforcement. A cookie shows up in devtools and in every cookie-scanner audit. A fingerprinting script looks like any other analytics JS, so it's much harder for a DPA to spot and prove.
Yet you can’t set a cookie to remember the preference of opting out.
It's not a preference. It literally is the default requirement.
cloudflare (the cdn monopoly) interpretation of gdpr, is that clicking the "I'm not a bot" you are giving consent to fingerprint because they have to provide you a service you asked by clicking the button.
...it's something i hope no court will uphold. but we know what happens to european courts even looking sideways at American monopolies working as front for fiveeyes.
imo, eff should be starting trials to stress this instead of blogposts.
the scary part is how little of this needs a third-party script anymore
These are all a joke anyway
If you've ever worked at a startup, you're probably familiar with the fact that no one gives a crap about this type of stuff early on
The hell with pretty much anything, the only thing that matters is revenue
People only start to care about this after the fact if you've grown to large enough size
If you think stuff like this or right to be deleted stuff is moving the needle anywhere but at the biggest companies, you've been misled
That's the real painful truth of this stuff, most of the time it's just lip service anyway
Wth is anyone going to do anyway? Go through a resource-draining lawsuit against a 20 person company where it will take a year of discovery just to maybe-sort-of prove they've been mishandling your data?
It's going to take some pretty radical new laws for this type of stuff to ever have any meaningful impact
opening in a different browser resulted in a different name
I can't wait for the new EU law for more useless fkin popups
Fingerprinting based tracking is already covered by gdpr.
Fingerprinting itself is also not new.
idk man fingerprints don't taste that good
We have over 10+ years of employing this tech, and we've found fingerprints for a browser are constantly changing. As such, they are far from being a silver bullet when used as a persistent identifier.
Furthermore, in corporate environments where boxes are set up the same for many users, there are often, or too often, two different users and two different boxes with the same exact fingerprint.
I was the Gentle Owl. Then I connected to a VPN, opened a private window in the same browser, and didn't maximize the window. Now I'm the Nosy Toucan.
The article's points still stand, but the trick didn't work this one time.
Private window is called out in the article as creating a second entity
They are not "new cookies". Fingerprinting has been a thing for close to 20 years now.
The whole cookies discussion is a successful diversion by the ads industry. It was never about cookies.
Fingerprints are used for over a decade already, nothing new, just users keep closing their eyes despite knowing, even advanced ones.
I'm skeptical of this magic trick, maybe add a counter with the amount of times I logged in to the website. Or let me save some data to read it from another session. Otherwise lots of people can be identified by that hash, there's no proof that it is unique
>and the solutions Google has developed (Privacy Sandbox) kinda suck and have raised antitrust concerns so nobody uses them.
This is backwards. The antitrust concerns of removing 3rd party cookies led to them developing alternatives.
> Let’s give it up for Google - the biggest ad company on Earth
I think Google needs to be forbidden from causing more damage to the EU market. And there need to be replacements too, once we forbid this Evil entity from sabotaging EU citizens any further.
We also need real open browsers not controlled by greedy Ad companies.
I am also aware of the irony of using thorium here right now (based on the adChrome code base). If I use Firefox, I can not listen to audio since mozilla claims only systemd-pulseaudio using people can listen to audio. Well, chrome plays audio on youtube (which is also owned by Google, do people begin to see how big of a problem Google has become) just fine, so I have no idea what Mozilla devs are smoking. I could recompile firefox, to just use ALSA, but who in his right mind wants to compile a 1% usage base legacy browser that uses ancient technology to compile its outdated code base please?
See: https://www.linuxfromscratch.org/blfs/view/svn/xsoft/firefox...
Mozilla gave up decades ago on fighting adGoogle. And it can be seen via small things too.
Ladybird may be a competitor at one point in time but they ban people from their github repository, which also sends the message "do not contribute to us because we don't care about you if you have dissenting opinions". Well, so much for real competition, when projects get all emo early on. You can't beat the evil adGoogle empire with wishful projections about "conduct of people". That's not going to work. I don't subscribe to any random ruleset made by random people I don't know and don't want to know when they resort to censorship. But hopefully more and more people realise that something has to be done about Google one way or another.
> See, the thing is, it’s not about you at all. It’s not really about the ads anymore either. Nobody cares about you. And if the police or your government happen to care, I’ll gladly take their money too.
> I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.
> And to the highest bidder it goes!
> What does that make you then? A gear? An ox? A volunteer?
This does absolutely nothing for me. If this resonates with you, can you explain?
I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.
If every website you ever visits knows it is you, exactly what links you clicked on, and what content you viewed, forever, are you truly ok with that?
Guaranteed deidentified, as the quote above is talking implying?
It's truly totally ok with me, yes.
(I get the non-anonymized concerns, or risk of becoming non-anonymized, that's not what I'm confused about)
2 replies →
wow on chrome based browsers, the fingerprint survives even in incognito mode.
On Safari, fingerprinting doesn't survive in incognito mode. Same with Firefox.
Good thing I use different computers for different purposes, though it looks like using different browsers seems sufficient.
It's not true, fingerprinting on Safari is also easy regardless of Incognito, VPN and whatnot.
Different computers doesn't solve a lot of fingerprinting methods as well.
It’s a question of entropy. If your device is unusual in detectable ways, then the fingerprint has high entropy. But on my iPhone I suspect most of the things being fingerprinted are the same. How many other people get “smug koala”?
Couple different results than that across three refreshes on iOS w/iCloud Private Relay. Apple does work to do some randomization.
But at least the moment we start using websites the largest players will know it’s us. Nobody else swipes and types exactly like me on my screen size of iOS over the relay.
fingerprints pick up on all sorts of things that make you different enough combined with another signal, 33 bits can be enough to single you out from anyone else on the planet... iOS can be 10-15, and given a residential IP that's plenty - always mobile is more anonymous on the web but guess what's much worse? apps.
a native app with 0 permission prompts gets you more bits than web
No. Almost everybody using an iPhone is on the latest release, plus or minus one while updates are rolling out. For a given iOS release and hardware type almost all of those probes are highly correlated. No way there’s 30 bits of entropy in that. I doubt there’s even 10.
Now on a desktop PC sure I believe these fingerprints are highly descriptive. And in android land they probably work okay because of the diversity of products and configurations. But iPhones resist fingerprinting just because they all give the same answers.
1 reply →
Fingerprints of one kind another have also been around for a very long time.
[flagged]
[dead]
[dead]
[flagged]
[flagged]
[flagged]
[flagged]
[dead]
[dead]
Privacy people are insane to me.
Some of these guys sound like they erase their fingerprints off the plates when they visit a restaurant, and ask people to forget about them when done talking.
Like it or not, as web gets more complex, it will recognize you more. If you don't want that, just don't use the web - perhaps buy a farm and life off-grid.
I just don't get what's the appeal to this endless damn cat and mouse game.
Goycattle like yourself ought to be executed for the sheer stupidity of your opinions. Privacy is the only reasonable response to the unhinged behavior of web advertisers, who will spend trillions of dollars and decades of research, who will bribe politicians, who will do everything in their power to figure out the shape of your butthole so they can perfectly optimize which sex toy ads to show you. It is utterly psychotic behavior and pretending it is anything else is the either dumbest or most malicious thing anyone has ever done in the last century. If restaurants were to frantically scan their dirty plates for fingerprints after customers are done eating, the customers would be damn right to try to wipe their fingerprints off. Obviously that isn't necessary, because restaurant owners aren't completely out of their minds. So why does the web have to be this way?
"By the way, if anyone here is in marketing or advertising... kill yourself..."
It’s a lot of work to collect fingerprints off plates. You can build surveillance that way but it scales terribly.
On the web you can do that much more efficiently. That scares people.
As in any defense/offense situation, it’s all about balance.
So you're basically saying the old "I have nothing to hide" argument which has been debunked over a million times...
In particular because "I have nothing to hide" means "I have nothing to hide until now, and because of the corporations and states that have access to my data are lead right now by people I trust not to misuse that data"
But if tomorrow the government change, and suddenly your searches for "gay bars near my location" becomes illegal, you'd rather this info not be in everyone's hands...
Lack of privacy harms journalism and activism, making the government too powerful and not accountable. If only activists and journalists will try to have the privacy, it will be much easier to target them. Everyone should have privacy to protect them. It’s sort of like freedom of speech is necessary not just for journalists, but for everyone, even if you have nothing to say.
"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else."
You took a guess. You guessed wrong
I have not "disabled Javascript". The software (pl.) I'm using to request and read web pages has no Javascript interpreter
I can also insert a CSP response header such as "default-src: 'none'" and get the same result ("...") even when using software that runs Javascript with Javascript enabled
This "data" does not seem very useful for advertising except perhaps something like "don's waste time trying to target this user as they will not see or hear the ads"^1
What are these "network-based" methods exactly
I never see any ads when using the www. I attribute this mostly to not using popular software controlled by companies or individuals that advocate for internet advertising. This software could be something as complex as an operating system or a "browser" or something as simple as a Javascript sourced/planted in a web page
Whatever these "network-based methods" are, they don't seem to be very effective at targeting me with ads
I generallly stay in textmode. Most internet ads seem to be graphical and/or audiovisual in nature
Hypothetically, if a "developer" tried to target me with text-based ads, I could easily filter them out
I already filter the text in response bodies using a local forward proxy
For example, the "score" on HN comments I submit never goes below 1 in the HTML I'm reading. In theory this helps avoid self-censorship
Here is an excerpt from rewrite.lua
1. Of course companies like Cloudflare are using the www user's choice to run/not run Javascript as a way to collect fingerprints and filter out users who are not using advertising-friendly software