Comment by alkonaut
14 hours ago
I still don't understand why the highest entropy APIs aren't gated behind browser consent.
A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
Broad geographical targeting shouldn't be an issue. In fact, it's so easy that I think we should invent an ad-targeting API people can opt in to. If I could tell advertisers my geographic location, gender, age cohort, languages, and 3 interests, I'd not feel that's an invasion of privacy when they use that to deliver ads. I'd just get lawnmower ads instead of shampoo ads and that's fine.
The problem is, they don't want to use that kind of targeting. They want to target me with ads for a travel destination that my coworker mentioned in a Messenger message to another coworker five minutes ago. But we should just not accept that.
The most used browser comes from the same company that runs the largest ad network.
It's the browser that introduced many of these APIs in the first place.
That should answer the question.
(If you ask me if a browser should report how many cores the machine has, including physical and logical ones, I would answer never, every time. But not everyone thinks that way. https://developer.mozilla.org/en-US/docs/Web/API/Navigator/h...)
> "I still don't understand why the highest entropy APIs aren't gated behind browser consent"
Because it's known that interrupting the user-intent with a unrelated consent-popup doesn't help.
Older people may remember that this was the approach of Java J2ME, where you couldn't provide a fluent user-experience as the user first had to answer huge popups about individual API-permissions with "Always Allow", "Allow now" etc.
If it isn't an informed decision, it isn't really a decision at all. And the huge majority of people the huge majority of the time do not want to make an informed decision: they want what they came to the site for, news, games, family photos, etc.
You go to Facebook to see your cute nephew make spit bubbles. Do you care that they access your camera and canvas? What is a canvas? And sure access my camera, I want to upload photos!
It's fundamentally broken. They've studied the dark patterns, not to avoid them but to implement them best.
Absolutely. I spoke to an ex-Meta guy and his only answer to stuff like this was "actually its good for privacy because they don't want third parties to access your data since its valuable"
So long as it's once per API and site, it seems it doesn't need to be too bad?
If it's a site I trust, and I think it genuinely needs audio, I give it audio. If someone doesn't understand and just does allow all, they never see it again either (and their ads are suspiciously well targeted).
We already have these consent popups for camera and microphone. Reading back bytes from an audio buffer seems like such a rare thing to do that it hopefully just stops happening.
It's less rare than you'd hope. Disclosure: I do developer relations at Friendly Captcha, and our widget is one of the scripts that uses generated offline audio (but with no microphone recording) and reads the buffer back on sites that otherwise have no use for audio.
We do this to check whether the browser is what it claims to be, not to track who you are. Similarly, font rendering, floating-point math results, WebGL renderer strings, and whether built-in functions are patched is all much harder to fake. These considerations determine how hard the proof-of-work puzzle should be, and site owners can see it as a risk score. We don't do cookies or browser storage, IPs aren't stored, and nothing gets used to recognize you on another site or on a later visit. The biggest players in automated traffic prevention can't (and usually don't) say this much, because of conflicts of interest between automated bot detection and their other products (e.g. ad sales and IP-profiling).
Your example is really fair though. I chatted with our engineers, prompted by this thread, and we found nothing in our detection that currently uses the audio hashes we collect, so we've started talking about removing the collection.
1 reply →
Also, people not in tech do not generally understand the implication of consent popups.
For example, on multiple instances, my spouse declined "location permissions" an app designed to work with a piece of Bluetooth-connected hardware, and would blame the hardware as being crappy.
"This smart lock app doesn't work."
"You need to enable this permission."
"Why do I need to give the smart lock app location permissions?"
It's not obvious to people that "Bluetooth can be used sneakily by big-enough companies as a makeshift GPS" even if the app needing Bluetooth access doesn't actually need a GPS location.
Your partner isn’t wrong. It’s a crappy product and crappy ecosystem when you have to be hyper precise.
> A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
We should go further. A web-site with mostly static content should not use user-side scripting (Javascript) at all, it's unnecessary for it. It should be required only in rare cases where a site is basically an application and require manually turning it on each time such application is opened.
I think that ship sailed and I'm pragmatic enough to accept it. The web is an application platform, not a web of hypertext content. That's not going to change, and I've given up on the idea to even try to "go back" there. If it worked, you'd just have half of websites be "sites" that work without JS, and half would be "apps" which would require switching on JS? The whole reaosn the web took off as it has is because we removed the distinction between "web app" and "web site". There's no putting that genie back in the bottle.
> A web-site with mostly static content should not use user-side scripting (Javascript) at all
Then sites that want to track will just add some JS. Seems unlikely to help.
Sure, for the most static of static sites. But without JavaScript you can’t even do basic things client-side, such as having some variable-length list of fields in a form. Or customized field validation.
If such client-side behavior counts as “basically an application,” then “applications” is a larger set than seems useful.
Theme switchers! My favorite example of why "document-only" sites might need JS. Sure, you can use @media prefers-color-scheme for defaults, and you can do checkbox/radio shenanigans to make it switchable, but there's no way to persist that preference on a static site without JS.
If you don't care about your site being static then you can track it server side, but that has big implications for his you can just your site. Sticking a little flag in localStorage really is the best solution, if you can get past ideological purity.
Most sites also don't need forms at all either, at least for normal users.
Well yeah, but there's also the part where I'm not okay loading ads from a third party because they eat my battery, add latency, and can potentially be used to spread malware. So there's the conflicting preferences regarding targeting that you mention but also conflicting preferences regarding how they are served.
The conflicting interest starts with the very idea of ads already. The entire point of ads is to manipulate you into doing things you wouldn't do otherwise.
I suppose that depends on the ad. I don't mind non-intrusive ads that are directly relevant to whatever I'm currently doing. What google currently does with product placement in AI responses is a good example. It's on topic, unobtrusive, and secure.
That could also be a preference. Do you allow third party ads to begin with? But then I'd understand if people would just block visitors that don't agree to them. I think paying via showing ads is fine. Paying with my integrity isn't.
There’s an idea for a new blocker. Fingerprint the fingerprinters and block them.
That would be nice. However, It’s easy to see why it’s way more than simply what they want, they don’t really have a preference but it boils down to money. You’ll only replace your lawnmower every couple years and the rest of the time they’re guessing what you may buy next. By spying on your daily conversations and browsing, they have an idea of what you are likely to buy this week, next week, and the week after. This is so much more valuable to an advertiser.
Exactly. And here's where regulators come in. What we need to do as a society is basically say "Unless you can make your ad-funded business work with this tiny bit of information, your ad-funded business should fail and shut down".
Most of the ads are pushed via free services. Facebook, Google, as examples. These are entirely optional to consume. And I’m not sure people are really collectively willing to give up the trade they have yet (Data for free services).
I agree with you but really from a point of privacy and what/how data is allowed to be mined, shared, sold, etc. The implications to the business/ad industry are second order effects that are just collateral damage.
> I still don't understand why the highest entropy APIs aren't gated behind browser consent.
Simple answer: The makers of 3 largest browsers by market share (collectively 90%+) are buddies with the people who want to fingerprint you. Only the 4th largest gives a shit.
> I still don't understand why the highest entropy APIs aren't gated behind browser consent.
Last I checked it's because it was generally considered that preventing fingerprinting is practically impossible anyway. It's not like you need a lot of entropy for fingerprinting, and the web API surface is enormous. To actually stop fingerprinting you'd need to make your web browser more or less useless.
That might sound good, but people already moan and groan about cookie notices. Imagine if each website that legitimately needs it would start asking for permission to each fingerprintable API. Although I do think we should have that option, just not as a default.
You could accept things once per API and site. It doesn't feel that terrible. We do it for camera and clipboard already.
[flagged]
Same reasons why browsers allow javascript on every site.