Comment by drnick1
20 hours ago
The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis.
Great how this is currently the 2nd highest comment despite completely ignoring the numerous fingerprinting techniques based on CSS alone (including one of the most famous fingerprinting methods by testing font support). Simply thanks to reflexive "JS=bad" upvotes.
https://en.wikipedia.org/wiki/CSS_fingerprinting
The scope and amount of information that browsers hand over without the slightest shred of consent from the user or indication it’s happening is crazy.
And also without logging it. Even if I don’t want popups to give consent for every document.getEyeColor() call, it would be nice go back and see who’s doing which queries and/or have Firefox collect aggregate statistics. Naming and shaming the crooks won’t stop them but it might have an impact on curbing any bad behavior from big commercial retailers.
I like this idea a lot. It’s similar in principal to how macOS shames battery hog apps in its battery menu extra.
It's a UX trade off. For non-adversarial websites it's very convenient for users because things just work without having to go through loads of permissions pop ups for every website, but of course this then makes this info a juicy target if you're trying to fingerprint someone.
It's not a tradeoff, it's poor design.
2 replies →
Is it though?
Google's business model has been ads from the beginning. Search, gmail, drive, office, chrome, everything they do is just to drive ad revenue further.
They don't care about the user. Never have, and never will.
And the outcome we are seeing is what happens when a defunct state isn't able to protect citizens from conglomerates. That's what the Kartellamt or the FTC is supposed to be for.
Nope. At least until 2008 I cared and Larry and Sergey cared quite a bit.
3 replies →
That's not a browser thing. Fingerprinting native apps is much easier.
Sure, but at least native apps can only do that if I download and install them. If I do that, I’ve made a conscious decision that the tradeoff is worth the utility of the app. This limits the blast radius considerably.
On the web one is drive-by fingerprinted by sites they never once approved of or intended to visit thanks to the browser’s ability to redirect and embed without input from the user. The magnitude of the problem is far greater on the web.
To reframe it, in a given week the average person only uses a small handful of apps, but in the same span of time their browser has connected to thousands, maybe tens of thousands, of unique domains, most of which are tracking them in some capacity and the majority of which are tracking things most of us would consider invasive.
I can't help but keep thinking that client-side scripting was a mistake. Sure, the web would be a lot more primitive without it, but I'm not convinced that wouldn't be for the best.
My default is to run without JS and selectively enable it when absolutely necessary, so when I clicked on this story the page was prefaced with the following comment:
"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else.
From now on I’ll call you:…"
I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it. On rare occasions when I'm forced to use JS I'll cut-and-paste the URL into another browser.
I no longer use ad blockers as I just don't see ads with JS disabled. The other privacy precautions I take are the obvious ones such as no Google or social media accounts, flushing cookies at session's end, regularly randomize my IP and never let Chrome anywhere near my machines and make judicious use of multiple browsers (this is being written in Privacy Browser on Android).
Using NewPipe and sponsor block on PipePipe increases privacy and makes YouTube ad free.
Client-side scripting was a mistake which was obvious from the outset (or not severely limiting the reach of scripting engines).
What I find hard to understand is why alternative plugin JS engines haven't been developed that are under user control. Spoofing, randomizing and returning junk data to webservers would go a huge way towards stopping fingerprinting by websites.
> I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it.
I guess you use the web in quite a limited manner? (Or use that other browser quite a lot...?).
I've tried no JS various times over the years and always end up constantly whitelisting sites. It's even worse in 2026 and gets worse each year.
Banking, insurance, webmail, groceries, eBay, CAPTCHAs... not to mention what feels like 50% of the web that is behind either Cloudflare or similar, which almost always require Javascript.
I used to believe in that and would make sure all of my sites would work without Javascript until one of my projects (a micro community) got targeted by pedotrolls which lead to an awful time and now I associate people who are staunch no JS as pedos, I am not accusing you or anything but that is the impression it left on me. Ever since then I really don't care if the site doesn't work without JS, and if users can post stuff damn straight Javascript will be involved.
Unfortunately this idealistic principle (no JS) attracts the worst people.
You're on Tor? You have JS disabled? I might as well warm up fbi.gov/investigate/cyber for the probable report I'll have to do...
2 replies →
The alternative is to install a binary that has full access to the computer.
Chrome is a binary. What's your point?
1 reply →
You can do plenty (like view port size) via just CSS.
https://fingerprint.com/blog/disabling-javascript-wont-stop-...
Even without JS, there is timing, HTTP headers, conditional CSS, etc.
If everyone else you know has JavaScript turned on, congrats, you're still fingerprinted.
If anyone else has JavaScript turned off you're fine (as long as you can account for all the other stuff like IP address).
> identifying hardware,
> language
I dont think js is needed for either of those things.