Comment by legitster
21 hours ago
Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes.
90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months).
What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.
IMO, data brokering is what should be illegal, not the cookie .
The problem with this is the biggest, most important, and sketchiest data brokering services (credit monitoring) are all but entrenched in law at this point.
I don't really know what you expect, people are obviously going to want to know your credit history when they're lending to you. If you can't tell what loans someone has, they could have opened a hundred different accounts and used the money in the casino.
How should credit reports work?
31 replies →
It is illegal, if it's PII without explicit consent.
18 months ago Google publicly stated they were going to start using browser fingerprint data to track users, a reversal of their 2019 policy on it because it was considered too invasive.
https://www.malwarebytes.com/blog/news/2025/02/google-now-al...
There's a fingerprint demo on github called JSCreep (https://abrahamjuliot.github.io/creepjs/) that used to keep your fingerprint profile for 90 days and show you how many times you visited. Worked extremely well, and is still around, but no longer uses the API to retain fingerprint data, so you have to track your hash yourself. It would easily track most browsers across changes in IP address. Only Mullvad, Brave, or Tor would not leave an easily tracked fingerprint.
The demo presented in the royfish.dev link is easily foiled by browser extensions that scramble fingerprint data, the presence of which would itself be detected by more sophisticated profilers and used to define the fingerprint. I can refresh the page and get a new hash and adjective-animal name with the same IP. JSCreep sticks firm to the same hash for me, even with a new IP address and some spoofed browser data.
This fingerprint breaks every 2 weeks when Chrome auto updates. Or any other modern browser.
Overall correct, but you're kind of missing some of the cat-and-mouse details for fingerprinting centered around infosec and anti-fraud purposes rather than generic ad-related tracking. That stuff can get way more intense, and is constantly changing based on new techniques developed, countermeasures from cybercriminals, and mitigations from browser developers.
I think the idea here is that the details shouldn't be publicly known. (Or that if they were they would have to invent their details!)
Is there any way to link this data over longer periods of time?
A lot of data can change over days, weeks, but if you can maintain an accurate fingerprint with tinier changes, and granted you have consistent visits from the user, could you just keep up?
Especially if one service is tapped into several websites, and can continually keep up with smaller data changes and distribute that info. Is this possible? In practice anywhere?
I'm thinking that you just need one website where you can associate a given fingerprint to a specific user and then tracking its activity around the web becomes easy.
Let's say I'm logged in a famous search engine, they associate my fingerprint X to my account A. If they then encounter fingerprint X anywhere else, there is a good chance it was me, A, doing it. If the next day I get fingerprint Y, it gets attached to A as well and the tracking information follows it.
Does this make sense?
You mean, like a really popular web service or app that someone would log into every day/week/month...?
Even easier if, additionally, many of the smaller websites were syndicated into a tracking network?
on what basis do you believe this about fonts? my guess would be that the average user doesn’t install or remove fonts often if ever, but it’s only a guess
I don't actually know how much this happens - software versioning is the biggest one. Chrome updates every two weeks, Microsoft updates once a month, your GPU drivers get updated semi regularly, etc. Any one of those would break the fingerprint.
Your IP changes way less often so that combined with everything else would be more than enough to track you through browser version changes. Even a new IP with the exact same everything else would be pretty easy to correlate too. It just depends on how much they're willing to track and companies are often willing to track a lot already, including things like how fast you type, what kind of movements your mouse makes, etc.
Most people probably have completely default fonts, right? Doesn't seem like much of an identifier anyway
Depending on the browser new fonts can be downloaded and installed automatically. I'd bet most people have a lot more than just the default fonts that came with their OS installed.
3 replies →
Hmm. I used to have to do that a lot, but I haven't in a few years now.
Perhaps, but that would also mean the cardinality is lower.
I was thinking about the literal fingerprint sensor a device has. Imagine a "prove youre not a bot" challenge and the finger scanner pulls up. What a nightmare, reminds me when a website asked me if I want to login with windows hello (facescan)
That is different though. That site is just creating a passkey and storing in your keychain (or windows equivalent). Windows hello unlocks the keychain. It can be your face, fingerprint, usb key, 4 digit pin anything. Chrome already uses this. You’re not sending your face to that website nor to microsoft, I hope.
Yes, very much. I just fear we may end up there at some point...
One intereting part about installed fonts is that many enterprise companies buy specific fonts. Then they are rolled out to all their devices, and sometimes at least one of them will have the company name as part of it's name.
> Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days.
Indeed. I checked this website a few hours ago and got one fingerprint. Just rechecked and got another.
On the other hand, browsers don't need to share all this data at all. Sure, IP address can't be hidden, but from your example, installed fonts and volume settings? Why should that be shared at all? Sure, for example for a teams meeting, but you'd have to allow the use of microphones or that, youtube for example doesn't need to know how loud you're listening to a video.
[dead]
[flagged]
> Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Sorry, but that's simply not true. It's actually the default way of how people eg track people across installs in app stores ever since they started removing that feature.