Comment by oofbey
1 day ago
It’s a question of entropy. If your device is unusual in detectable ways, then the fingerprint has high entropy. But on my iPhone I suspect most of the things being fingerprinted are the same. How many other people get “smug koala”?
Couple different results than that across three refreshes on iOS w/iCloud Private Relay. Apple does work to do some randomization.
But at least the moment we start using websites the largest players will know it’s us. Nobody else swipes and types exactly like me on my screen size of iOS over the relay.
fingerprints pick up on all sorts of things that make you different enough combined with another signal, 33 bits can be enough to single you out from anyone else on the planet... iOS can be 10-15, and given a residential IP that's plenty - always mobile is more anonymous on the web but guess what's much worse? apps.
a native app with 0 permission prompts gets you more bits than web
No. Almost everybody using an iPhone is on the latest release, plus or minus one while updates are rolling out. For a given iOS release and hardware type almost all of those probes are highly correlated. No way there’s 30 bits of entropy in that. I doubt there’s even 10.
Now on a desktop PC sure I believe these fingerprints are highly descriptive. And in android land they probably work okay because of the diversity of products and configurations. But iPhones resist fingerprinting just because they all give the same answers.
I just said iOS can be 10-15, correlated with anything else it can easily be 30. Download an app and visit their support site and that's likely enough to narrow you down.
The web provides:
time zone language and locale (accept-language header too) iOS version screen size and pixel ratio text size dark/light mode reduced motion ad blocker extensions for safari
An app provides (without additional permissions):
IDFA advertising ID (unique and cross app) IDFV (vendor ID) AdAttributionKit (which apple does obscure somewhat) Battery level, charging state, volume, headphones Various appearance settings again (font, dark/light, reduced motion)
Just slightly more permission granted via prompt can get you:
System boot time and uptime Disk space Keyboard languages and extensions File timestamps
Then additional individual permissions (which people agree to all the time for specific use cases)... at this level they can single you out easily: location contacts bluetooth motion sensors
To Apple's credit they're trying to make fingerprinting more difficult and attempt to ban it entirely, but it's not at all impossible.