I still don't understand why the highest entropy APIs aren't gated behind browser consent.

A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?

Broad geographical targeting shouldn't be an issue. In fact, it's so easy that I think we should invent an ad-targeting API people can opt in to. If I could tell advertisers my geographic location, gender, age cohort, languages, and 3 interests, I'd not feel that's an invasion of privacy when they use that to deliver ads. I'd just get lawnmower ads instead of shampoo ads and that's fine.

The problem is, they don't want to use that kind of targeting. They want to target me with ads for a travel destination that my coworker mentioned in a Messenger message to another coworker five minutes ago. But we should just not accept that.

The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis.

> The request already reveals information about you; what browser you use, the language it’s in, the OS that runs it and your IP address, which the server needs to send you the response. That often reveals your location.

If we control the servers the clients are connecting to, I don't see how there could be much hope of hiding. We can spoof things like latency toward an upper bound, but we can never ever defeat the lower bound. Physics is still quite insistent about that one.

If we control multiple servers, we know where they are, and we can periodically compel our clients to rotate between them (see: DNS), we can engage in latency-based multilateration to put them on a real-world map. Depending on the number of servers and samples over time, this can be remarkably accurate. Determining someone's actual postal code just from network timing information is feasible.

VPNs obviously confound this in first order terms, but if we aren't careful they can make it even easier to identify our activity in other ways. We are trading concealment in the woods for concealment in a crowd. Both have their advantages and disadvantages. The VPN might also have a side channel that we aren't aware of.

https://www.usenix.org/legacy/event/nsdi07/tech/full_papers/...

Reddit definitely relies on this. I got banned from a subreddit ages ago (can't even remember which one), and ever since, any fresh account created from the same device gets shadowbanned almost immediately. Very annoying.

>Test your browser:

>coveryourtracks.eff.org shows you how unique your fingerprint is, with entropy for each measured data point.

Something to note - if a fingerprint is generic enough, that might be a _good_ thing!

Having worked with fingerprinting, anti-fingerprint browsers are very hard to properly identify. The ways to get around it are things like collecting more coarse fingerprints[0], as the overall one is fairly easy to change (e.g. make your browser lie about a collection of browser apis).

What's imo more difficult though is a fingerprint like:

- iPhone <new_version> - running os <latest_stable> - using default safari - bought and used in <common_location> (e.g. usa)

on a 5g mast in a decently sized city, you'll share a fingerprint with at least one other active user using a setup like ^

grapheneOS on the other hand stands out a bit more!

[0] - https://blog.castle.io/fingerprints-beyond-device-ids-engine...

I've seen anti-fingerprinting plugins and browser configs, etc, but they all seem to make you more interesting for not being fingerprintable, or for turning off a lot of features used in fingerprinting.

Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?

Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.

Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes.

90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months).

What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.

Theres only one solution, ban third party advertising. Everything else is a compromise that doesnt work anyway.

> Remember the big fuss about third-party cookies? It was so big that the EU had already rolled out one of its greatest inventions - consent banners.

It was never about cookies. Thats what the industry made you think. You don't need to show consent banners for cookies (like auth sessions). You need consent for tracking. This includes profiling. And it doesn't matter what you use, fingerprinting or tracking cookies, the consenst banner is required either way.

Doing this on GrapheneOS's built in Vanadium browser, I am concerned to see that the ID remains the same if I move to incognito tabs, or even a private space. Or perhaps Vanadium is doing such a magnificent job of reporting generic info that this ID would be the same for anyone using Vanadium on my model of Pixel, but I don't think so, since the site says it has a "clean read" on all the info it takes. I really do not know. Curious what other Graphene/Vanadium users are seeing.

My understanding of the EU "cookie law" is that it really concerns a broader category of tracking devices rather than cookies specifically. Referring specifically to cookies is probably a side effect of the way tracking was typically implemented at the time.

The fingerprints don't need to be long-time-stable to be harmful. Some companies have your stable datapoints (e.g., email) and your fingerprint. Other companies only have your fingerprint on the same day/week. Some companies have locations of edge devices and the fingerprints. And there are companies out there that will take all of those data streams, both from above board and not-so-above-board players and mix them for commercial benefit.

How could this information be surfaced in a reasonable way in administration software?

Say I have a remote employee who is only able to access your internal systems via his yubikey. His fingerprint is "Genuine Antelope".

Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him. I create a new session for him on the provisioning portal (so he can enroll the new key) but now his fingerprint is "Interesting Elephant". What do I do with this information?

It might be better to log the exact forensics and show the administrator the differences, e.g, "User has a new font called "my_handwriting.ttf" since a week ago", or "appears to be a totally different processor, and the new system has Russian fonts installed".

Per coveryourtracks.eff.org, just my HTTP headers leak 18.46 bits of information, which seems to be the most the tool can report? Presumably most of that entropy comes from my language settings (en-AU,en;q=0.9,de-CH;q=0.8,de;q=0.7), so the only way to be not fingerprintable is to give up on smart localisation.

If people have a problem with fingerprinting, they need to focus on making it illegal to trade data tied to fingerprints, not trying to make users all look the same (we aren't!).

"Fingerprints are new cookies"

What if "fingerprints" are contained in the values of Cookie: headers

Fingerprinting is a way to track you. Cookies is a way for you to keep your own configuration (a panel inside an app open or closed, theme choice, pre-filled calendar, etc). They are completely different.

These fingerprints now track us much more effectively than ever, not just for security but for real ad tracking and data selling. Instead of using cookies that are mostly vulnerable to ad blockers and other content blockers, these fingerprints can track us more precisely and can easily bypass our current data security systems like ad blockers. So I think the demand for sophisticated anti-detect browsers and proxy-level tracking prevention will increase. Hmm, let's see what will happen.

Fingerprinting is really bad for privacy and the defenses against it are not there. See https://fingerprint.com. Tor Browser defeats it but I don't think there's a highly usable browser like Brave you can use and prevent being tracked by it.

My reaction to this is always two fold; firstly cool tech, secondly horrifying invasion of privacy.

At {{job}} we did briefly consider rolling out fingerprint.com, but settled on ja3/ja4 at the CDN layer.

The solution has to come from law. I propose we handle privacy invasion the same as rape. Body and mind aren't up for grabs. That the average internet user is unconscious isn't a valid excuse.

It would be great if a wave of lawmaking started in the USA, because most tech behemots operate from there. I would expect EU to take the lead though IF such a wave would start. The EU has still a fair share of christian/conservative MP's that keeps doing the bidding for companies by pushing chat control, but on the other hand also has some progressive and knowledgeable representatives doing great work, so there might be a glimmer of hope. We need media campaigns and public education though. Political leaders are selected for their political abilities and as such rarely have leadership qualities. If the electorate moves, the leaders will follow it. So we have to start at the bottom.

It is offensive that browsers give away so much unnecessary info. What is necessary? Language preference, Javascript (yes/no), screen resolution. Optionally, latest supported html/css versions. That it, nothing else.

I understand Google having Chrome send way more info. Why do all other browsers go along with this?

Make it make sense...

Why can't a government simply ban all advertising and instead provide a good enough yellow pages service that just provides the specs of the product in a templated way?

Why would it be a good idea to expose unsuspecting citizens to false claims by the sellers?

Huh, it is different for me on every page refresh. No VPN, etc... just Firefox on Windows with uBlock, CanvasBlocker, and a PiHole. No persistent fingerprint for me!

I wonder if a browser extension could be made that inspects your fingerprint and informs you if you're too unique, then one-click to 'correct' those unique items (or at least list them), so you can conveniently go back to being ~anonymous if preferred.

If you use Firefox, do the following: Use the extension Chameleon (set it to rotate Random profile every minute), had strict mode with JShelter extension.

This royfish blog example, or anyother, including that fingerprint.com gets new value everytime.

Fingerprint.com charges around $0.004 per investigation, and really encourages you to set up a first party proxy - so iOS doesn't nuke storage after 7 days. And even there, unless its a cookie match; your ID usually carries a confidence number.

That should give some hint about how difficult it is to do in real life, at scale.

This site gave me the name “Greedy Bison”, but it didn’t say how many other “Greedy Bison” are out there. I’m guessing everyone using the very common device I’m using and using the very common browser that I’m using would get the same name as me

Lets hope AI coding agents will let us to modify browsers and OSes quickly. "Remove tracking from Chrome". "Privacy friendly Android, in particular, allow geo location spoofing"

Cookies, in and of themselves, are not bad. Like any tool that can be misused, they're just being abused by a ton of really shitty people in an effort to try to enrich themselves at the expense of others. Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"

Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"

It's creepy that we all have stalkers that want to know our intimate details.

Just think how are daily actions are someones data and how entire masses are manipulated by using this data.

Iphone safari incognito gives different with every page load.

I have heard from some power users that Brave is one of the best browsers with regard to ad-blocking and privacy. But I think I have read elsewhere that it receives money from ad companies to display only certain ads, which does not make me trust it. Does anyone have facts or know where to find them?

So what is next in this cat and mouse game? Fake-slow browser to miss fingerprint? Declare revolution and declare all advertising illegal?

Can anyone confirm that they are also "Gentle Llama" on Mullvad browser?

I just installed it, I want to know if everyone gets the same hash (same identity for everyone).

Amazingly, Firefox incognito seems to defeat this

I think this app is broken. Every time it refreshes it calls me a different name.

At least when tracking was unregulated, at least you knew who was by the cookie left in your browser, now I just assume everyone and everything is tracking me

Ok, but are they really all that new at this stage?

The regulation is not about cookies. It’s about tracking.

The whole cookie thing has always been bs

This is already illegal in the EU. The consent banners were never about cookies, they have always been about the tracking itself!

Same thing the other way: no need to have a banner for a simple login cookie which isn't being used for privacy-invading tracking purposes.

Mullvad browser. It's Tor browser minus connection to Tor.

Relevant: https://mlfa.org/how-government-surveillance-and-big-tech-er...

the scary part is how little of this needs a third-party script anymore

opening in a different browser resulted in a different name

These are all a joke anyway

If you've ever worked at a startup, you're probably familiar with the fact that no one gives a crap about this type of stuff early on

The hell with pretty much anything, the only thing that matters is revenue

People only start to care about this after the fact if you've grown to large enough size

If you think stuff like this or right to be deleted stuff is moving the needle anywhere but at the biggest companies, you've been misled

That's the real painful truth of this stuff, most of the time it's just lip service anyway

Wth is anyone going to do anyway? Go through a resource-draining lawsuit against a 20 person company where it will take a year of discovery just to maybe-sort-of prove they've been mishandling your data?

It's going to take some pretty radical new laws for this type of stuff to ever have any meaningful impact

I can't wait for the new EU law for more useless fkin popups

I was the Gentle Owl. Then I connected to a VPN, opened a private window in the same browser, and didn't maximize the window. Now I'm the Nosy Toucan.

The article's points still stand, but the trick didn't work this one time.

We have over 10+ years of employing this tech, and we've found fingerprints for a browser are constantly changing. As such, they are far from being a silver bullet when used as a persistent identifier.

Furthermore, in corporate environments where boxes are set up the same for many users, there are often, or too often, two different users and two different boxes with the same exact fingerprint.

idk man fingerprints don't taste that good

They are not "new cookies". Fingerprinting has been a thing for close to 20 years now.

The whole cookies discussion is a successful diversion by the ads industry. It was never about cookies.

Fingerprints are used for over a decade already, nothing new, just users keep closing their eyes despite knowing, even advanced ones.

I'm skeptical of this magic trick, maybe add a counter with the amount of times I logged in to the website. Or let me save some data to read it from another session. Otherwise lots of people can be identified by that hash, there's no proof that it is unique

>and the solutions Google has developed (Privacy Sandbox) kinda suck and have raised antitrust concerns so nobody uses them.

This is backwards. The antitrust concerns of removing 3rd party cookies led to them developing alternatives.

> Let’s give it up for Google - the biggest ad company on Earth

I think Google needs to be forbidden from causing more damage to the EU market. And there need to be replacements too, once we forbid this Evil entity from sabotaging EU citizens any further.

We also need real open browsers not controlled by greedy Ad companies.

I am also aware of the irony of using thorium here right now (based on the adChrome code base). If I use Firefox, I can not listen to audio since mozilla claims only systemd-pulseaudio using people can listen to audio. Well, chrome plays audio on youtube (which is also owned by Google, do people begin to see how big of a problem Google has become) just fine, so I have no idea what Mozilla devs are smoking. I could recompile firefox, to just use ALSA, but who in his right mind wants to compile a 1% usage base legacy browser that uses ancient technology to compile its outdated code base please?

See: https://www.linuxfromscratch.org/blfs/view/svn/xsoft/firefox...

Mozilla gave up decades ago on fighting adGoogle. And it can be seen via small things too.

Ladybird may be a competitor at one point in time but they ban people from their github repository, which also sends the message "do not contribute to us because we don't care about you if you have dissenting opinions". Well, so much for real competition, when projects get all emo early on. You can't beat the evil adGoogle empire with wishful projections about "conduct of people". That's not going to work. I don't subscribe to any random ruleset made by random people I don't know and don't want to know when they resort to censorship. But hopefully more and more people realise that something has to be done about Google one way or another.

> See, the thing is, it’s not about you at all. It’s not really about the ads anymore either. Nobody cares about you. And if the police or your government happen to care, I’ll gladly take their money too.

> I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.

> And to the highest bidder it goes!

> What does that make you then? A gear? An ox? A volunteer?

This does absolutely nothing for me. If this resonates with you, can you explain?

I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.

wow on chrome based browsers, the fingerprint survives even in incognito mode.

On Safari, fingerprinting doesn't survive in incognito mode. Same with Firefox.

Good thing I use different computers for different purposes, though it looks like using different browsers seems sufficient.

It’s a question of entropy. If your device is unusual in detectable ways, then the fingerprint has high entropy. But on my iPhone I suspect most of the things being fingerprinted are the same. How many other people get “smug koala”?

Fingerprints of one kind another have also been around for a very long time.

[dead]

[dead]

[flagged]

[flagged]

[flagged]

[flagged]

[flagged]

[dead]

[dead]

Privacy people are insane to me.

Some of these guys sound like they erase their fingerprints off the plates when they visit a restaurant, and ask people to forget about them when done talking.

Like it or not, as web gets more complex, it will recognize you more. If you don't want that, just don't use the web - perhaps buy a farm and life off-grid.

I just don't get what's the appeal to this endless damn cat and mouse game.

"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else."

You took a guess. You guessed wrong

I have not "disabled Javascript". The software (pl.) I'm using to request and read web pages has no Javascript interpreter

I can also insert a CSP response header such as "default-src: 'none'" and get the same result ("...") even when using software that runs Javascript with Javascript enabled

This "data" does not seem very useful for advertising except perhaps something like "don's waste time trying to target this user as they will not see or hear the ads"^1

What are these "network-based" methods exactly

I never see any ads when using the www. I attribute this mostly to not using popular software controlled by companies or individuals that advocate for internet advertising. This software could be something as complex as an operating system or a "browser" or something as simple as a Javascript sourced/planted in a web page

Whatever these "network-based methods" are, they don't seem to be very effective at targeting me with ads

I generallly stay in textmode. Most internet ads seem to be graphical and/or audiovisual in nature

Hypothetically, if a "developer" tried to target me with text-based ads, I could easily filter them out

I already filter the text in response bodies using a local forward proxy

For example, the "score" on HN comments I submit never goes below 1 in the HTML I'm reading. In theory this helps avoid self-censorship

Here is an excerpt from rewrite.lua

   if host=="news.ycombinator.com" then
   body = string.gsub(body, "%(<span id=\"karma\">%d+</span>%)","")
   body = string.gsub(body, "-%d points","1 point")
   body = string.gsub(body, ">0 points",">1 point")
   body = string.gsub(body, "width=\"%d+\"></td>","width=\"0\"></td>")
   end

1. Of course companies like Cloudflare are using the www user's choice to run/not run Javascript as a way to collect fingerprints and filter out users who are not using advertising-friendly software