I still don't understand why the highest entropy APIs aren't gated behind browser consent.
A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
Broad geographical targeting shouldn't be an issue. In fact, it's so easy that I think we should invent an ad-targeting API people can opt in to. If I could tell advertisers my geographic location, gender, age cohort, languages, and 3 interests, I'd not feel that's an invasion of privacy when they use that to deliver ads. I'd just get lawnmower ads instead of shampoo ads and that's fine.
The problem is, they don't want to use that kind of targeting.
They want to target me with ads for a travel destination that my coworker mentioned in a Messenger message to another coworker five minutes ago. But we should just not accept that.
> "I still don't understand why the highest entropy APIs aren't gated behind browser consent"
Because it's known that interrupting the user-intent with a unrelated consent-popup doesn't help.
Older people may remember that this was the approach of Java J2ME, where you couldn't provide a fluent user-experience as the user first had to answer huge popups about individual API-permissions with "Always Allow", "Allow now" etc.
If it isn't an informed decision, it isn't really a decision at all. And the huge majority of people the huge majority of the time do not want to make an informed decision: they want what they came to the site for, news, games, family photos, etc.
You go to Facebook to see your cute nephew make spit bubbles. Do you care that they access your camera and canvas? What is a canvas? And sure access my camera, I want to upload photos!
It's fundamentally broken. They've studied the dark patterns, not to avoid them but to implement them best.
Absolutely. I spoke to an ex-Meta guy and his only answer to stuff like this was "actually its good for privacy because they don't want third parties to access your data since its valuable"
So long as it's once per API and site, it seems it doesn't need to be too bad?
If it's a site I trust, and I think it genuinely needs audio, I give it audio. If someone doesn't understand and just does allow all, they never see it again either (and their ads are suspiciously well targeted).
We already have these consent popups for camera and microphone. Reading back bytes from an audio buffer seems like such a rare thing to do that it hopefully just stops happening.
It's less rare than you'd hope. Disclosure: I do developer relations at Friendly Captcha, and our widget is one of the scripts that uses generated offline audio (but with no microphone recording) and reads the buffer back on sites that otherwise have no use for audio.
We do this to check whether the browser is what it claims to be, not to track who you are. Similarly, font rendering, floating-point math results, WebGL renderer strings, and whether built-in functions are patched is all much harder to fake. These considerations determine how hard the proof-of-work puzzle should be, and site owners can see it as a risk score. We don't do cookies or browser storage, IPs aren't stored, and nothing gets used to recognize you on another site or on a later visit. The biggest players in automated traffic prevention can't (and usually don't) say this much, because of conflicts of interest between automated bot detection and their other products (e.g. ad sales and IP-profiling).
Your example is really fair though. I chatted with our engineers, prompted by this thread, and we found nothing in our detection that currently uses the audio hashes we collect, so we've started talking about removing the collection.
I think "proof of humanity" is going to be an increasingly important thing, but I think we need to forego the age-verification and make some sort of zero-proof/integrity-preserving age/humanity verification.
Also, people not in tech do not generally understand the implication of consent popups.
For example, on multiple instances, my spouse declined "location permissions" an app designed to work with a piece of Bluetooth-connected hardware, and would blame the hardware as being crappy.
"This smart lock app doesn't work."
"You need to enable this permission."
"Why do I need to give the smart lock app location permissions?"
It's not obvious to people that "Bluetooth can be used sneakily by big-enough companies as a makeshift GPS" even if the app needing Bluetooth access doesn't actually need a GPS location.
> A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
We should go further. A web-site with mostly static content should not use user-side scripting (Javascript) at all, it's unnecessary for it. It should be required only in rare cases where a site is basically an application and require manually turning it on each time such application is opened.
I think that ship sailed and I'm pragmatic enough to accept it. The web is an application platform, not a web of hypertext content. That's not going to change, and I've given up on the idea to even try to "go back" there. If it worked, you'd just have half of websites be "sites" that work without JS, and half would be "apps" which would require switching on JS? The whole reaosn the web took off as it has is because we removed the distinction between "web app" and "web site". There's no putting that genie back in the bottle.
Sure, for the most static of static sites. But without JavaScript you can’t even do basic things client-side, such as having some variable-length list of fields in a form. Or customized field validation.
If such client-side behavior counts as “basically an application,” then “applications” is a larger set than seems useful.
Theme switchers! My favorite example of why "document-only" sites might need JS. Sure, you can use @media prefers-color-scheme for defaults, and you can do checkbox/radio shenanigans to make it switchable, but there's no way to persist that preference on a static site without JS.
If you don't care about your site being static then you can track it server side, but that has big implications for his you can just your site. Sticking a little flag in localStorage really is the best solution, if you can get past ideological purity.
Well yeah, but there's also the part where I'm not okay loading ads from a third party because they eat my battery, add latency, and can potentially be used to spread malware. So there's the conflicting preferences regarding targeting that you mention but also conflicting preferences regarding how they are served.
The conflicting interest starts with the very idea of ads already. The entire point of ads is to manipulate you into doing things you wouldn't do otherwise.
I suppose that depends on the ad. I don't mind non-intrusive ads that are directly relevant to whatever I'm currently doing. What google currently does with product placement in AI responses is a good example. It's on topic, unobtrusive, and secure.
That could also be a preference. Do you allow third party ads to begin with? But then I'd understand if people would just block visitors that don't agree to them. I think paying via showing ads is fine. Paying with my integrity isn't.
> I still don't understand why the highest entropy APIs aren't gated behind browser consent.
Simple answer: The makers of 3 largest browsers by market share (collectively 90%+) are buddies with the people who want to fingerprint you. Only the 4th largest gives a shit.
That would be nice. However, It’s easy to see why it’s way more than simply what they want, they don’t really have a preference but it boils down to money. You’ll only replace your lawnmower every couple years and the rest of the time they’re guessing what you may buy next. By spying on your daily conversations and browsing, they have an idea of what you are likely to buy this week, next week, and the week after. This is so much more valuable to an advertiser.
Exactly. And here's where regulators come in. What we need to do as a society is basically say "Unless you can make your ad-funded business work with this tiny bit of information, your ad-funded business should fail and shut down".
Most of the ads are pushed via free services. Facebook, Google, as examples. These are entirely optional to consume. And I’m not sure people are really collectively willing to give up the trade they have yet (Data for free services).
I agree with you but really from a point of privacy and what/how data is allowed to be mined, shared, sold, etc. The implications to the business/ad industry are second order effects that are just collateral damage.
> I still don't understand why the highest entropy APIs aren't gated behind browser consent.
Last I checked it's because it was generally considered that preventing fingerprinting is practically impossible anyway. It's not like you need a lot of entropy for fingerprinting, and the web API surface is enormous. To actually stop fingerprinting you'd need to make your web browser more or less useless.
That might sound good, but people already moan and groan about cookie notices. Imagine if each website that legitimately needs it would start asking for permission to each fingerprintable API. Although I do think we should have that option, just not as a default.
The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis.
Great how this is currently the 2nd highest comment despite completely ignoring the numerous fingerprinting techniques based on CSS alone (including one of the most famous fingerprinting methods by testing font support). Simply thanks to reflexive "JS=bad" upvotes.
The scope and amount of information that browsers hand over without the slightest shred of consent from the user or indication it’s happening is crazy.
And also without logging it. Even if I don’t want popups to give consent for every document.getEyeColor() call, it would be nice go back and see who’s doing which queries and/or have Firefox collect aggregate statistics. Naming and shaming the crooks won’t stop them but it might have an impact on curbing any bad behavior from big commercial retailers.
It's a UX trade off. For non-adversarial websites it's very convenient for users because things just work without having to go through loads of permissions pop ups for every website, but of course this then makes this info a juicy target if you're trying to fingerprint someone.
But it is a design trade-off. The opposite case can be seem in the many websites asking to send you notifications, and the many flavours of cookie notices. When you have to ask the user permission to do anything and everything, the user gets annoyed and desensitized. They start allowing everything (my always collects dozens of notification-enabled websites if given the chance), and the point of asking for permission is lost.
How so? There seems a fairly inherent tension between having things just work by default and hiding surface area for fingerprinting behind permissions pop ups. For example say you go to a maps website, how do you decide whether to share the users location with the website? Or enable webGL functionality to render some fancy layout on the screen? As a user having to enable all that stuff per-website is annoying.
Google's business model has been ads from the beginning. Search, gmail, drive, office, chrome, everything they do is just to drive ad revenue further.
They don't care about the user. Never have, and never will.
And the outcome we are seeing is what happens when a defunct state isn't able to protect citizens from conglomerates. That's what the Kartellamt or the FTC is supposed to be for.
> Nope. At least until 2008 I cared and Larry and Sergey cared quite a bit.
Not sure if I can't see this comment as anything else than hypocritical. It's always easier on the money receiving side, isn't it? How do you think the term malvertisement came to be?
AdMob is kind of the definition of inevitable Surveillance Capitalism and the prime example for necessary regulation through government.
Sure, but at least native apps can only do that if I download and install them. If I do that, I’ve made a conscious decision that the tradeoff is worth the utility of the app. This limits the blast radius considerably.
On the web one is drive-by fingerprinted by sites they never once approved of or intended to visit thanks to the browser’s ability to redirect and embed without input from the user. The magnitude of the problem is far greater on the web.
To reframe it, in a given week the average person only uses a small handful of apps, but in the same span of time their browser has connected to thousands, maybe tens of thousands, of unique domains, most of which are tracking them in some capacity and the majority of which are tracking things most of us would consider invasive.
I can't help but keep thinking that client-side scripting was a mistake. Sure, the web would be a lot more primitive without it, but I'm not convinced that wouldn't be for the best.
My default is to run without JS and selectively enable it when absolutely necessary, so when I clicked on this story the page was prefaced with the following comment:
"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else.
From now on I’ll call you:…"
I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it. On rare occasions when I'm forced to use JS I'll cut-and-paste the URL into another browser.
I no longer use ad blockers as I just don't see ads with JS disabled. The other privacy precautions I take are the obvious ones such as no Google or social media accounts, flushing cookies at session's end, regularly randomize my IP and never let Chrome anywhere near my machines and make judicious use of multiple browsers (this is being written in Privacy Browser on Android).
Using NewPipe and sponsor block on PipePipe increases privacy and makes YouTube ad free.
Client-side scripting was a mistake which was obvious from the outset (or not severely limiting the reach of scripting engines).
What I find hard to understand is why alternative plugin JS engines haven't been developed that are under user control. Spoofing, randomizing and returning junk data to webservers would go a huge way towards stopping fingerprinting by websites.
> I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it.
I guess you use the web in quite a limited manner? (Or use that other browser quite a lot...?).
I've tried no JS various times over the years and always end up constantly whitelisting sites. It's even worse in 2026 and gets worse each year.
Banking, insurance, webmail, groceries, eBay, CAPTCHAs... not to mention what feels like 50% of the web that is behind either Cloudflare or similar, which almost always require Javascript.
I used to believe in that and would make sure all of my sites would work without Javascript until one of my projects (a micro community) got targeted by pedotrolls which lead to an awful time and now I associate people who are staunch no JS as pedos, I am not accusing you or anything but that is the impression it left on me. Ever since then I really don't care if the site doesn't work without JS, and if users can post stuff damn straight Javascript will be involved.
Unfortunately this idealistic principle (no JS) attracts the worst people.
You're on Tor? You have JS disabled? I might as well warm up fbi.gov/investigate/cyber for the probable report I'll have to do...
Well, I find your comment pretty offensive. In the past I've had some pretty rough and disparaging comments from JavaScript fanboys but yours has to be the worst. Associating disabling JS with pedos is about as low as it gets. Where did you get those stats from, or are they just a figment of your imagination?
"Unfortunately this idealistic principle (no JS) attracts the worst people."
Again, how did you come to that opinion? Where's your evidence/stats? Generally comments like that come from web/JS programmers who've realized that client-side users have them stymied when they disable JS.
An additional reason I avoid JS is speed, webpages become blinding fast when there's no JS. Once one gets addicted to the great rendering speed there's no return. I'm not against JS per se, trouble is you JS programmers have weaponised it against users, webpages of 7, 10 and even 20MB are now commonplace. Presenting such slow massive pages to users is nothing other than abuse.
I do not use Tor.
BTW, I should point out that my views about JS and privacy abuse were formed from my years working in govt. surveillance where the stakes are very high.
I came to my opinion through experience, I’m sorry you’re offended but I did say that I don’t imply that you’re a pedo but my stats sure show a pattern.
That does not change what I have dealt with. I am not a “JavaScript fanboy” remember I made a community that could work WITHOUT needing JavaScript and that lead to a bunch of grief for me which made me understand the extreme naivety of that original idealistic idea on the internet.
I assume it's something like: choosing to forego the protection of a battle-tested sandbox in favor of rawdogging random binaries off the internet would be insane.
> The request already reveals information about you; what browser you use, the language it’s in, the OS that runs it and your IP address, which the server needs to send you the response. That often reveals your location.
If we control the servers the clients are connecting to, I don't see how there could be much hope of hiding. We can spoof things like latency toward an upper bound, but we can never ever defeat the lower bound. Physics is still quite insistent about that one.
If we control multiple servers, we know where they are, and we can periodically compel our clients to rotate between them (see: DNS), we can engage in latency-based multilateration to put them on a real-world map. Depending on the number of servers and samples over time, this can be remarkably accurate. Determining someone's actual postal code just from network timing information is feasible.
VPNs obviously confound this in first order terms, but if we aren't careful they can make it even easier to identify our activity in other ways. We are trading concealment in the woods for concealment in a crowd. Both have their advantages and disadvantages. The VPN might also have a side channel that we aren't aware of.
I've seen anti-fingerprinting plugins and browser configs, etc, but they all seem to make you more interesting for not being fingerprintable, or for turning off a lot of features used in fingerprinting.
Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
Random is often going to be indirectly fingerprintable too, since some values are always the same (or the same given each browser version). Some values can't be set to be random or otherwise non-fingerprintable data without affecting the user, like viewport size.
Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.
> Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard
It doesn't matter if it looks wrong as long as it looks differently wrong over time. Don't bother trying to blend in with the crowd because you can't ever expect to catch everything that can be used to fingerprint you. New techniques come out all the time. You can block a lot of information from even being collected. Limit what data you send at all, randomize what's left, change IP frequently (VPN) and you should be fine.
That's the thing, no web page, except for games, should ever need to know about your viewport size. So spoofing would be just fine, imho, with an override option/permission for individual sites.
It can make a small difference on this site, though. Testing it with three browsers (Safari, Brave, Firefox Focus) on iOS with Private Browsing on, each gets a different name and hash — then again, those do stick to the browser pretty well after that and are resistant to incognito mode (or session switch by other means), for example, just like you’d expect. On Safari, Private Browsing masks the IP at least, and Brave has its own tricks.
I use private browsing and could not replicate your result, though I have done a few things on my device such as enable developer mode that the OS has warned me decreases my security.
You can forcefully disable hardware acceleration, that removes a few bits - though javascript can still guesstimate your CPU and memory.
For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.
First, see our blog post. Consult also other blog posts and other questions in this FAQ.
If you want to have the same fingerprint as many users, We suggest going for Tor Browser (do not install JShelter in Tor Browser).
If you want to make cross-site fingerprinting linkage hard, go for the Recommended JShelter level. If you want better protection for the real data at the cost of having the same fingerprint on different sites, go for the Strict JShelter level.
Keep NBS active.
If you want to detect and prevent fingerprinting attempts, use FPD.
Thanks. I tried this on Firefox for Android and each time I close the browser and load the page my fingerprint ID is different. So it seems to work. Have you had any sites break with this extension installed?
The reason is that the browser maker is interested to support tracking.
On the technical level there is no problem to block tracking - intriduce noise and make APIs unavailable until user permits to a web site. But that is not implemented.
The same with native applications. If your bank app requires you to share your location you can't spoof it. The makers of Android and iOS made spoofing of geo location impossible - you don't have that control, which means the phone is not your device. You have to give up your real location.
> Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
That's basically the ideal. It's become obvious that it's impossible to try to be identical. Web browsers are too leaky, and something will out you. You really don't want to try to blend in the "typical" users because none of them use ad blockers.
>coveryourtracks.eff.org shows you how unique your fingerprint is, with entropy for each measured data point.
Something to note - if a fingerprint is generic enough, that might be a _good_ thing!
Having worked with fingerprinting, anti-fingerprint browsers are very hard to properly identify. The ways to get around it are things like collecting more coarse fingerprints[0], as the overall one is fairly easy to change (e.g. make your browser lie about a collection of browser apis).
What's imo more difficult though is a fingerprint like:
- iPhone <new_version>
- running os <latest_stable>
- using default safari
- bought and used in <common_location> (e.g. usa)
on a 5g mast in a decently sized city, you'll share a fingerprint with at least one other active user using a setup like ^
grapheneOS on the other hand stands out a bit more!
Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes.
90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months).
What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.
The problem with this is the biggest, most important, and sketchiest data brokering services (credit monitoring) are all but entrenched in law at this point.
I don't really know what you expect, people are obviously going to want to know your credit history when they're lending to you. If you can't tell what loans someone has, they could have opened a hundred different accounts and used the money in the casino.
Well, there are multiple approaches, but here's one that worked well for me: when I purchased a home in the country where I now live, and the mortgage lender asked for a credit report from the (high-privacy) country where I lived the longest, what they got was a letter from that country's central bank listing the penalties for requesting that information. Up to and including jail time.
Suddenly the credit report was no longer a prerequisite to the mortgage.
That is rad. Is your high-privacy country friendly to immigrants? Asking for a friend...
But for real. You say you no longer live there, so I'm assuming you left for more opportunities. My wife and I are interested in countries with opportunities for engineers and privacy. Bonus points if there is engineering research opportunities.
Wouldn't this make credit riskier for lenders, reducing access to credit in general and thus making housing less accessible especially to working people?
Not asking polemically, I just have never studied economics and wonder if my intuition here is flawed
I think the actual trade-off is between average acceptable risk at society level.
Some societies prefer huge risks for huge benefits, in those one (might) need a more detailed credit reports because everything is faster, people accept huge risks and the situation can suddenly change.
Some societies prefer more stability. Lower risks, lower surprises. Less opportunities, everything is slower, people can't even take that many risks, simpler histories will do th trick.
From what I notice though, housing seems to be a problem in both types of societies, irrespective on how credits are given, because there are other things involved (regulation, NIMBY, housing used as value, airbnb, geography, etc).
You are so full of BS it's scary.
No credit report is a non-starter at any financial institution that wants to stay in business. They won't be giving you a loan unless they know you are wealthy e.g. own 17 investment properties already.
'High-privacy' countries is code for 'tax-haven', and 'my money in the Cayman Islands' means your bank is about to run afoul of AML and KYC laws if they give you a loan. And this is the whole world: doing business with America means adopting their financial posture i.e. penalties for doing business with money launderers.
It feels onerous as an idea because bank statements, monthly bills, payslips, will bequests, stock vests and trades, bank robberies*, and investment income each have different ways of being tracked. At least most of these records of individual financial activity come with a PDF these days. It wasn’t that long ago that applying for a loan meant scanning in papers for your lender to review.
Computers are smarter now. Not only can they read documents (or at least match the shapes against shapes they’ve been told are real) but they can also understand the contents too (or at least match the words against ideas they’ve been told are real.)
There may well yet be a future Data Valhalla where individuals hold their life.zip themselves, and upload whatever bits of it are needed to get that Nordstrom store card / car financing / cheeseburger loan without having an intermediate credit agency.
*I feel there’s a kernel of a joke there about a bank robber asking for a receipt with the loot in anticipation of declaring it on their tax return.
I don't see how this works in reality - The issue is that users wouldn't upload negative information (e.g. county court judgements or the bank robbery from your example).
Credit isn't like insurance where these things can be checked later during a claim (which can then be denied) - you need to know the person is a bad-payer before you send them the ten thousand dollar loan as that affects the terms, not afterwards when they default and you can't get your money back.
For CCJs and bank robberies, you'd upload a clean sheet from the government that gives a list of all CCJs and criminal convictions (in the UK we have a system called DBS for criminal records).
Potentially, with loans or other things, some kind of technical solution could work. You could have a personal document that you control, and you give permission for companies to write to the document.
With a loan, for example, if I give you a loan, I can also append to your document that I've loaned you the money; for every payment you make, I write to the log to say you've made a payment. If you stop making payments, I stop writing to the log. This would be cryptographically signed by me, so it can't be forged.
When you want to take out another loan, you can proactively share your document, the bank can see everything written on the log, and make a decision based on that.
Naively, credit is if you can pay, and if you will pay.
For the latter it’s whether you’ve had a judgment against you, which is a matter of public record.
For the former it’s based on how much money you have and what you spend, including on servicing existing debt. Lying about this would be fraud. In that sense, my proposal does indeed open up a new avenue for fraud but I don’t think that’s the same as it being unworkable!
So what. Maybe it is corrosive to society to provide unsecured credit willynilly. Yes, it makes the banks giant amounts of money, but IMHO consumer credit should only be a thing for two classes of assets (that can be repo'd easy-ish) real estate and vehicles.
The Western governments have horribly failed of caring for their people - cost of living are exploding, and at the moment way too many people are papering over that with unsecured credits backed by their data being free to exploit, and everyone else not willing of doing that is increasingly locked out of existence.
It typically required more direct sources of trust. If you were a grocery store, you might let customers you personally knew to be good for it, run up a 'tab' and settle on payday. If you were a bank, you might only lend to rich high-class people. You can find this all around the world today; the US is a standout for credit scoring and for access to credit. When a British person wants to sell their house, it has to happen on the same day that the buyer sells their old house, and the house they're moving into to be sold, and so on in a big same-day daisy-chain, until you hit someone who has enough cash for initial outlay. In Japan, up until very recently, you could expect your boss to need to co-sign your apartment lease (and your landlord to immediately escalate any disagreements to your boss).
> It typically required more direct sources of trust. If you were a grocery store, you might let customers you personally knew to be good for it, run up a 'tab' and settle on payday. If you were a bank, you might only lend to rich high-class people.
You hit the nail on the head with the first statement. It required humans in the loop. It scaled linearly. Local branch managers had relationships with the people in their community, and knew who could and couldn't be trusted.
It was an imperfect system, where a human could be prejudiced against another human, and deny them access to credit.
Sometimes that would get discovered, and the human was held accountable for their actions, or had their actions upheld by a (org-chart-superior) human.
Similar to the imperfect system today, where the models a computer uses could be prejudiced against a human, and deny them access to credit. Dissimilar in that the model or the computer is rarely, if ever, held to account. "Computer says no" is a meme for a reason.
I can't tell if this is sarcasm, or do you honestly consider credit for fast food a good thing. I hesitate because I know that in America people buy everything with credit (or at least a lot), so it's possible some people think like that. But obviously not buying fast food with credit is a good thing?
Poor people couldn't borrow and middle-class people paid really high interest rates. Credit ratings are pretty much what enabled the expansion of availability to everyone.
Yes, and then in the interim we invented having a hundred trillion dollars in GDP. I prefer having access to credit and so does everyone who owns a credit card. If you own a house, you didn't have its cash value when you bought it; neither your car, nor (most likely) your education. In the days of no borrowing, we solved the problem with ramshackle one-room buildings with dirt floors, handcarts, and the one book whose distributors desperately wanted everyone to have it for free.
> Yes, and then in the interim we invented having a hundred trillion dollars in GDP.
And every now and then we have to rescue banks that are too big too fail at the cost of everyone else, because someone dreamed up a way to increase short term profits that involves giving loans to people who will never pay them back.
> neither your car,
Praising a trillion dollar GDP, but can't afford a used car.
> If you own a house, you didn't have its cash value when you bought it; neither your car, nor (most likely) your education
When I grew up I was told to not make debts if not needed. So many older people did indeed save up until they could afford a car or a house. Education was always mostly free where I lived.
Nowadays it seems like ordinary people would need to pay off a house their whole life and thus also need to keep income high enough to keep paying installments. This takes away so much freedom from people as they are trapped in their high paying jobs...
> If you own a house, you didn't have its cash value when you bought it;
> we solved the problem with ramshackle one-room buildings with dirt floors,
there is a fallacy here. People with access to debt bid up the price of an asset, like a house, against other peoples’ similar access to debt. Sans debt access, the solution was not necessarily a small ramshackle house. The fallacy is the belief that the same asset price - whether opulent or ramshackle house, wouldn’t adjust to the reduced level from the bidding environment. The differential cost of construction for a nicer house can be countenanced in the access-to-debt case, but that is second order.
Illustrative straw-man example: Suppose, once one had a parcel of land, that it was trivial to construct one’s ‘starter home’ the ramshackle house if you like. Get one’s family and friends to help build in exchange for future return favors. As one advances in life, rebuild to have something more opulent. The rub is in the parcel itself. Unlike the would-be house, it had no cost built-in, just whatever price the previous owner was willing to accept to release their parcel. That parcel’s (and those around it) price reflects the market’s access to debt, or lack of access to debt. In the market without access to debt, parcel pricing reflects which buyers have accrued more savings vs other buyers. In the market with access to debt, parcel pricing reflects who can access more debt (through the various means we know of today - down payment ability yes, which parallels the non-debt’s savings case, someone co-signing, long term expected future earning potential vs someone retired, the parcel itself put up as collateral, perhaps other non-immobile assets put up as collateral, like the family oxcart).
The point is that there isn’t necessarily a 1:1 coupling between market’s debt vs non-debt access and whether the construction is opulent vs ramshackle.
> I prefer having access to credit and so does everyone who owns a credit card.
A good number of European countries have only half the poverty rates - the dirt floors and carts you're talking about - of the US yet barely use credit cards.
You send them digitally signed statements from other lenders (who are legally required to give them for free with accurate info) or independent rating agencies, they evaluate them and make a decision. They can have their own model or license one from FICO.
That does mean banks can't know if you lie by omission and hide some unpaid bills, but they can raise the evidence requirements to compensate and I think everyone deserves a second chance.
18 months ago Google publicly stated they were going to start using browser fingerprint data to track users, a reversal of their 2019 policy on it because it was considered too invasive.
There's a fingerprint demo on github called JSCreep (https://abrahamjuliot.github.io/creepjs/) that used to keep your fingerprint profile for 90 days and show you how many times you visited. Worked extremely well, and is still around, but no longer uses the API to retain fingerprint data, so you have to track your hash yourself. It would easily track most browsers across changes in IP address. Only Mullvad, Brave, or Tor would not leave an easily tracked fingerprint.
The demo presented in the royfish.dev link is easily foiled by browser extensions that scramble fingerprint data, the presence of which would itself be detected by more sophisticated profilers and used to define the fingerprint. I can refresh the page and get a new hash and adjective-animal name with the same IP. JSCreep sticks firm to the same hash for me, even with a new IP address and some spoofed browser data.
Overall correct, but you're kind of missing some of the cat-and-mouse details for fingerprinting centered around infosec and anti-fraud purposes rather than generic ad-related tracking. That stuff can get way more intense, and is constantly changing based on new techniques developed, countermeasures from cybercriminals, and mitigations from browser developers.
Is there any way to link this data over longer periods of time?
A lot of data can change over days, weeks, but if you can maintain an accurate fingerprint with tinier changes, and granted you have consistent visits from the user, could you just keep up?
Especially if one service is tapped into several websites, and can continually keep up with smaller data changes and distribute that info. Is this possible? In practice anywhere?
I'm thinking that you just need one website where you can associate a given fingerprint to a specific user and then tracking its activity around the web becomes easy.
Let's say I'm logged in a famous search engine, they associate my fingerprint X to my account A. If they then encounter fingerprint X anywhere else, there is a good chance it was me, A, doing it.
If the next day I get fingerprint Y, it gets attached to A as well and the tracking information follows it.
on what basis do you believe this about fonts? my guess would be that the average user doesn’t install or remove fonts often if ever, but it’s only a guess
I don't actually know how much this happens - software versioning is the biggest one. Chrome updates every two weeks, Microsoft updates once a month, your GPU drivers get updated semi regularly, etc. Any one of those would break the fingerprint.
Your IP changes way less often so that combined with everything else would be more than enough to track you through browser version changes. Even a new IP with the exact same everything else would be pretty easy to correlate too. It just depends on how much they're willing to track and companies are often willing to track a lot already, including things like how fast you type, what kind of movements your mouse makes, etc.
Depending on the browser new fonts can be downloaded and installed automatically. I'd bet most people have a lot more than just the default fonts that came with their OS installed.
I was thinking about the literal fingerprint sensor a device has. Imagine a "prove youre not a bot" challenge and the finger scanner pulls up. What a nightmare, reminds me when a website asked me if I want to login with windows hello (facescan)
That is different though. That site is just creating a passkey and storing in your keychain (or windows equivalent). Windows hello unlocks the keychain. It can be your face, fingerprint, usb key, 4 digit pin anything. Chrome already uses this. You’re not sending your face to that website nor to microsoft, I hope.
One intereting part about installed fonts is that many enterprise companies buy specific fonts. Then they are rolled out to all their devices, and sometimes at least one of them will have the company name as part of it's name.
On the other hand, browsers don't need to share all this data at all. Sure, IP address can't be hidden, but from your example, installed fonts and volume settings? Why should that be shared at all? Sure, for example for a teams meeting, but you'd have to allow the use of microphones or that, youtube for example doesn't need to know how loud you're listening to a video.
> Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Sorry, but that's simply not true. It's actually the default way of how people eg track people across installs in app stores ever since they started removing that feature.
The problem isn't advertising, it's data harvesting and sale. Ads used to rent space on websites - totally reasonable. The whole industry around the purchase and sale of user data is what needs to be banned.
Consequences are deeper than the immediate cause. Advertising is at the heart that gives a lot of value to data harvesting and similar scams.
Data harvesting gains most of its value because they sell some or all data to businesses which wish to leverage that data in advertising. If they cant advertise they wont need most of the data, which should at the least reduce the problem significantly...
Advertising and paid promotion in any form has never been ok. It has always been a cancer on society. That is what happens when you ignore a mild symptom until it metastasizes into something horrible. We need to ban it completely.
Much as i hate being advertised to, i do like the existence of trade, and of new products. In the old days, you would take your products to market once a week on a cart, and the market would pass by your stall. That isn't how it works any more.
Generally, how can society discover new products and services?
I would be open to having some kind of directory that i could browse at my own convenience, but that's ultimately going to devolve to paid placement.
>Generally, how can society discover new products and services?
I'm surprised you can't imagine a society where the consumer would be the one recommending products and not the producer. Any entrepreneur can find one first consumer to test their new product. And that first consumer have access to a great communication network to recommend that products to their social network — it's called "the Internet". Social networks are a great platform for people to share interesting things to their friends, family, colleagues and also to people they don't actually know ("the Internet" can connect you to strangers). Such networks cost little to operate when the content is created by users, instead of producers and their intermediaries (people favors short, insightful written text instead of catchy commercial once detoxed).
Being born in the 1990s, I did experience that "Internet", when advertising networks didn't exist and when people intentionally interacted to make connections and actively look for information. They were happy to tell about things they discovered, with little to expect in return ("influencer", aka mercenary, wasn't a job yet).
You can never get rid of advertising entirely. Ultimately people want to learn about new products and services and new companies that couldn't ever advertise anywhere would die off. It makes sense to support limitations on how and where ads are used though. Banning surveillance capitalism would solve a lot of the problems we have and would mean that a website about cars can still show ads about things people who go to car websites would typically be interested in and that's pretty much the only level of targeting we need.
> Ultimately people want to learn about new products and services and new companies that couldn't ever advertise anywhere would die off.
I want to learn about products that are useful to me, but not through ads. As it turns out, it is incredibly difficult to learn about new products that are useful, as those do not tend to show up in ads at all and even seeking them out is very difficult.
It's weird how no one has come together to make a website specifically designed around users finding product categories that will make their life better. For example, I didn't learn about height adjustable desks from an ad. Nor did I learn about balance boards from an ad. Or trackballs. Or essentially every other product that made my life better once I realized that product category exists.
> Ultimately people want to learn about new products and services
Yes, and those people are free to visit equivalent of mail order catalog or go to the store or subscribe to consumer goods quality testing journal or to any of the enthusiast magazines about electronics or gardening or whatever where they perform independent testing and benchmarking or look up a video comparing ceiling fans across a century when they feel hot in the summer.
So yes, we should absolutely ban third party advertisements. People will still be able to discover good products.
> Ultimately people want to learn about new products and services
Maybe I'm just not a typical person, but I have never woken up in the morning and said to myself, "You know, I would just love for a corporation to help me learn about their new products and services today." Never. Not even once. When I want to learn about something, I will actively seek information out about it, and I'm not going to look to advertisements for impartial information. The purpose of advertising is never to inform. It's to bombard and saturate.
That's one perspective. Other are in different perspectives, like "anything that present something else than the very topic looked for is pure propaganda."
The spectre of possible interpretations is wide.
Some see only problems everywhere whatever the benefits might be, some see only new opportunities no matter the tragic outcomes, some see various blend of this and that.
How do you tell the difference between a regular human trying to not have a weird creepy perma-dossier collected on them... versus a bot set up to always look like a new visitor?
The only winning move is not to play--er, to somehow not to have this kind of game in the first place.
You don't, you simply make both spend a few billion cpu cycles for it. The human will tolerate the one-time cost. The bot's owner won't because it's not scalable.
I worked in fraud prevention for years and device fingerprinting didn't stop fraud, but it reduced it by upping the up the cost. It is not hard to circumvent fingerprinting, but it still takes a non-zero amount of effort on behalf of the fraudster. Device fingerprints helped us identify and block or prevent a lot of low effort fraud and abuse on various platforms.
How would you enforce that? Who can be trusted with the ability to classify things as advertising and in so doing silence their critics?
The solution is explicit trust. Not fingerprints for users, but digital signatures for content. If it's not signed by somebody the user trusts, don't render it.
The user is the only one who can be approach that task without a conflict of interest. If somebody wants the user to run code that phones home about user behavior, make them gain the user's trust.
That works if your ads have a physical location in space, like a billboard or a radio station, so that you have a place to go when you decide it's time to shut them down. You can't even get a stable URL for a web ad. Where are the cops gonna go? How many different "not my problem try this guy" hops are they gonna have to traverse before they find somebody who actually did the bad thing, how many different countries will they have to visit while they do so?
It only works if you re-architect the web into something that's even more censorship friendly than it currently is. I hate ads too, but the medicine seems worse than the disease in this case.
Reddit definitely relies on this. I got banned from a subreddit ages ago (can't even remember which one), and ever since, any fresh account created from the same device gets shadowbanned almost immediately. Very annoying.
> Remember the big fuss about third-party cookies? It was so big that the EU had already rolled out one of its greatest inventions - consent banners.
It was never about cookies. Thats what the industry made you think. You don't need to show consent banners for cookies (like auth sessions). You need consent for tracking. This includes profiling. And it doesn't matter what you use, fingerprinting or tracking cookies, the consenst banner is required either way.
Consent is required. The banner is just one mechanism, but not required. A website could hold off on all tracking until a suitable point in the usage of the site (like creating a profile, for example) and ask at that point.
The banner is an artefact of the hostile way most sites choose to try and hoodwink the user into being monetised and ultimately to piss users off so much that they complain about the legislation rather than the lack of online privacy.
And there was an initiative to include tracking preferences in browser HTTP headers, which never made it, as it was quite obvious that this would lead to a lot of people opting out.
Better to just harass them into a habit of dismissing the banner.
Well DNT indeed did not made it, but there is global privacy control
header that is nowadays required as explicit opt-out mechanism by CCPA
and some other states legislation. I always implement support for GPC in my products.
It's the complete opposite. What killed DNT is Microsoft adding it to their browser and set it to true by default, pretending they cared about their users. Doing so, it was not the expression of the users anymore and so web developers ignored it, and so it died.
It died because companies had no incentive to respect it. The writers of the GDPR could have easily added a single line saying you had to respect the DNT header, but they chose not to.
It's set on by default in "privacy browsers" like Brave or Zen, but off by default
in most mainstream ones -- user needs to set it on explicitly via about:config
I dunno man, from an outsider's perspective I used to think that but it seems to slowly be getting worse with trying to shove through internet surveillance and corporate protectionism under the guise of "protect the kids". I guess sadly someone saw how unreasonably effective that can be in the US.
When there is "legitimate purpose" there isn't reason to as soon items are put in the shopping cart this has to be tracked (be it session in url, cookie, local storage, ...) and no consent is needed.
The exact definition of "legitimate purpose" is unspecific (which is important to be able to adapt to development of new services) which leads to some lawyers being careful.
I also claim that some lobby groups promote having too many and too big consent banners to move blame from tracking companies to the EU ("stupid EU forcing all those banners!") in order to reverse the policy on tracking, which seems to have some effect.
You are confusing GDPR and ePD. Legitimate interest is GDPR legal basis for processing personal data (it has it's own requirements). ePD triggers when you read/store e.g. browser data and make it available via network. Consent is the primary ePD legal basis and the exception related to that is much narrower (strictly necessary for ISS provider to provide service requested by user).
Generally speaking JS code that makes request to server is covered by ePD while actually processing that request server side is covered by GDPR (there are some nuances to this).
I know it's tempting to put this consent-banner anti-pattern all on toxic ad-driven platforms, because their motives are bad.
The problem with this view, though, is that even the very agencies propagating these rules do the exact same thing! You can go to any site from an EU arm and get the same banners.
At this point, you can't really blame it on bad-faith actors, you have to accept that it's a bad rule. Which is not to say I know a better one!
Is too. They could have thought through the law they were writing and predicted malicious compliance. Or written a stronger law. Or revised the law when they spotted malicious compliance.
I don’t understand why that’s considered legal under GDPR. How can consent be express and informed when it would take 30 minutes just to identify each entity your data is being shared with?
In fact the law even specifies “no pre-ticked boxes” but every banner always has “accept all”. And it’s 50/50 to see “reject all” even though it is a requirement that denying must be as easy as accepting.
They should pay a bounty for reporting non-compliance.
> In fact the law even specifies “no pre-ticked boxes” but every banner always has “accept all”.
That's not entirely true. Websites that don't actively try to fuck over their users (because their purpose is not shoving third party ads at you, it's providing information about/a platform for their company's product) often provide a modal with two buttons:
'Accept' 'Decline'.
This, IMO, meets both the letter and the spirit of the law. The funny thing is, for any website actually doing that, if you click 'Accept', your data will likely only be used to improve it.
I'm sure if they had to by some EU directive, they would. Organizations that big can't conceal that, as they risk discovery findings and whistleblower activities.
Sounds like you don't have the global privacy control flag set. In Firefox there's a "tell websites not to share or sell my data" flag. In Chrome you need to install an extension (such as an adblocker).
I feel it's worth distinguishing between the Hacker News Audience that is highly tech-educated and security-conscious and the general public that just wants to use the web and seems more than happy to give all their data to Meta, Google & Co.
If you ask my 70-year-old mom to decide whether she'd like to allow the WebGL API, she'll go bonkers. If anything, the constant cookie banners have just trained her to consent to stuff out of muscle memory. You could probably design a "Are you ok to sign over the deed to your house" question in the rough shape of a cookie banner and get 90%+ agreement.
> We, and our 228 partners use cookies and similar methods to recognize visitors [...]
228 partners should make anybody concious about the fact that something is wrong and you probably should not consent to that at all. Also, nobody cares about your privacy when they think sharing data with 228 parties is okay.
I've seen some sites, mainly in the video game field, that have even higher numbers such as 750. Do I want to share my info with your 750 partners? Um, no. Typically I just leave the site.
it's hard to make yourself heard when your opponents have trillions of dollars hinging on you not being heard and also control the biggest communication channels.
I've never seen a consent banner for being fingerprinted even though I'm sure companies are fingering my prints in the background enough that my colon could become a national database.
The EU/banner situation keeps confusing people because there are two different laws in play:
1) ePrivacy. the OG banner law. requires you to inform the user (but not consent, as I understand it) if you store data on a user's device. includes cookies, localStorage, indexedDB, etc. does not affect fingerprinting
2) gdpr. requires you to ask consent for any kind of user data processing, unless you can find another legal basis
eprivacy was about cookies, but forgot fingerprinting. gdpr was not specifically about cookies. but gdpr (or at least its past interpretation by the dutch privacy authority) didn't require consent for limited first party analytics.
which led to situations where you'd get the impression that you wouldn't need a banner for first party tracking using cookies .. well the gdpr didn't require it, but the older ePrivacy rules still did.
we still have the digital omnibus law package coming up which is supposed to simplify and resolve the overlap between the two above, and reduce banner requirements at least for SMB just analyzing their website visitors
It does. The current version says "storing of information, or the gaining of access to information already stored, in the terminal equipment". Reading e.g. navigator.userAgent is information already stored in the terminal equipment. If you then use that in any way that gets communicated to remote server (e.g. directly or calculating some fingerprint) you read that information in manner ePD describes.
The directive itself has been transposed incorrectly in many jurisdictions. For example from what I understand the Dutch law added an exception (roughly "for obtaining information about the quality or effectiveness of a supplied information-society service, provided this has no or only minor consequences for the user's privacy.") which is not permitted under ePD. ePD exception list is exhaustive and the only other exception can be done via Article 15. The exceptions done via that are related to things like national security and certain criminal prevention/investigation.
Of course that then raises the issue on how you get invalid exception invalidated. I don't know Dutch procedural law well enough to answer that.
Doing this on GrapheneOS's built in Vanadium browser, I am concerned to see that the ID remains the same if I move to incognito tabs, or even a private space. Or perhaps Vanadium is doing such a magnificent job of reporting generic info that this ID would be the same for anyone using Vanadium on my model of Pixel, but I don't think so, since the site says it has a "clean read" on all the info it takes. I really do not know. Curious what other Graphene/Vanadium users are seeing.
My understanding of the EU "cookie law" is that it really concerns a broader category of tracking devices rather than cookies specifically. Referring specifically to cookies is probably a side effect of the way tracking was typically implemented at the time.
The fingerprints don't need to be long-time-stable to be harmful. Some companies have your stable datapoints (e.g., email) and your fingerprint. Other companies only have your fingerprint on the same day/week. Some companies have locations of edge devices and the fingerprints. And there are companies out there that will take all of those data streams, both from above board and not-so-above-board players and mix them for commercial benefit.
Per coveryourtracks.eff.org, just my HTTP headers leak 18.46 bits of information, which seems to be the most the tool can report? Presumably most of that entropy comes from my language settings (en-AU,en;q=0.9,de-CH;q=0.8,de;q=0.7), so the only way to be not fingerprintable is to give up on smart localisation.
If people have a problem with fingerprinting, they need to focus on making it illegal to trade data tied to fingerprints, not trying to make users all look the same (we aren't!).
RFC 3282 allows for the exclusion of the quality value, in which case the languages are just given in priority order. Removing that will shave some entropy off.
I have a hard time figuring out why quality values are even included for Accept-Language. They either have one of the preferred values, or they don't.
The quality values here seem pretty generically tied to the order, so shaving them off probably wouldn't help? I presume they are there at all to let you express ties?
It seems so, but I don't know that all browsers map quality values to order of preference in the same way.
I don't know about expressing ties. If there really is a tie and the client is just as happy to receive either language of equal Q, then it doesn't matter to the client that one is consistently preferred over another. Perhaps it could matter to the server if e.g. the client indicated that "en" and "zh" are tied, but the "en" content can be served in fewer bytes than it can serve the "zh" content, but it seems like such a niche use case.
edit: RFC 9110 offers an explanation: "Note that some recipients treat the order in which language tags are listed as an indication of descending priority, particularly for tags that are assigned equal quality values (no value is the same as q=1). However, this behavior cannot be relied upon. For consistency and to maximize interoperability, many user agents assign each language tag a unique quality value while also listing them in order of decreasing quality."
re: ties, often a page has "main" language(s) with more content, and translated version with just the basics. If you speak both you probably want the former. Actually for me often I need to go to the German version of a site rather than English to get what I'm looking for, contra my stated preferences... Localisation is a mess.
That's a good point. I suppose that the quality of the translation could also be a factor. If for example I only slightly prefer my native language over English, the website could (theoretically) spare me the poorly machine translated page in my native language over the original page in English. Multiply the client's quality assessment of the relative degradation in quality given language options with the server's quality assessment of the localizations on offer and serve the content with the highest score.
Fun anecdote: I remember seeing a screenshot of a website selling a scented candle called "basic bitch", which was machine translated so that the idiomatic meaning was entirely lost. So the translation ended up meaning something like "foundational female dog".
How could this information be surfaced in a reasonable way in administration software?
Say I have a remote employee who is only able to access your internal systems via his yubikey. His fingerprint is "Genuine Antelope".
Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him. I create a new session for him on the provisioning portal (so he can enroll the new key) but now his fingerprint is "Interesting Elephant". What do I do with this information?
It might be better to log the exact forensics and show the administrator the differences, e.g, "User has a new font called "my_handwriting.ttf" since a week ago", or "appears to be a totally different processor, and the new system has Russian fonts installed".
> Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him
They should be authorized ahead of time.
> What do I do with this information?
Not much. You can't authenticate a person using their (public) fingerprint information.
Your problem boils down to: "How can I verify someone's identity over the internet". You can exchange emergency recovery codes ahead of time (e.g. in an envelope), you could trust public keys from both of their yubikeys, but they can be stolen.
> You can't authenticate a person using their (public) fingerprint information.
Yes, but it's a signal! There's a cost to spoof it. A scammer could cheaply start a VM that clones your font profile, but at what cost could they replicate your CPU SKU and GPU combination to provide identical webGL timings?
Other signals include the ability of your employee to show their face on a video call, to sound like themselves on a voice call, the ability contact you from their home IP, to receive official mail at their listed address, to produce a second 2FA token you'd previously registered (but not activated) or repeat a code word you'd exchanged. Any of these things can be spoofed, bypassed, copied, or burgled, but each one imposes some cost on the attacker.
The question is how to surface this information in a way that equips help desk staff and doesn't deceive them into authorizing unnecessary risks.
Fingerprinting is a way to track you. Cookies is a way for you to keep your own configuration (a panel inside an app open or closed, theme choice, pre-filled calendar, etc). They are completely different.
Fingerprinting is really bad for privacy and the defenses against it are not there. See https://fingerprint.com. Tor Browser defeats it but I don't think there's a highly usable browser like Brave you can use and prevent being tracked by it.
I've been obfuscating my fingerprint with Brave for years, which I selected specifically because it was the browser I was able to do this with, based on my testing of 5 popular browsers, using https://coveryourtracks.eff.org/ as my benchmark.
It does mean that sites that uses 2FA (so every site nowadays) flag me as a coming from a new device each visit, and I have to have my phone nearby every time I want to use my computer, which is quite annoying. If you use GrapheneOS, you can obfuscate your phone too on WiFi networks (and sites, but GrapheneOS not needed for that, just Brave). You can't obfuscate yourself on cellular networks though, unless you have a ton of sim cards you rotate through.
IMO The EFF test is very flawed because it only tests your uniqueness among the other visitors to that site, not the total possible uniqueness from all the bits of data.
I would bet money that Brave cannot defeat CreepJS. The only thing I've ever seen do it, ironically, is Safari in private mode.
Also just using your computer normally and visiting regular websites already tracks you regardless of your browser's privacy abilities, and I promise data brokers don't care what browser you use, your overall online behavior is still unique.
I accept the challenge. What testing did you do to ensure that you were able to defeat CreepJS on Safari private mode? I would like to replicate it and then see if I can do the same on Brave or another browser.
For years, I've been practicing good privacy-hygiene in public. At my doctor's office, I always wear a Groucho Marx moustache to keep them guessing. Before I walk into my bank for a withdrawal, I team up with two of my friends, set them on my shoulders, and throw a trenchcoat over us! I made a fake ID with my birthday on July 4th and my weight as 98 pounds, but my pharmacy is now refusing to fill my prescriptions!
So what sort of benefits are you reaping from your anti-fingerprinting measures?
Your wit mad my day even though we probably won't agree. I appreciate your humor.
> So what sort of benefits are you reaping from your anti-fingerprinting measures?
Mostly pride on knowing that I'm preventing companies from doing to me exactly what I wouldn't consent to if they asked me outright.
Sure its just for ads (mostly). Sure the chances of my data leak leading to a personalized cyber attack are slim (I don't actually believe this but you might). Sure, [niche scenario] [non-zero probability] might be prevented. Sure there is a meatspace equivalent to the cyberspace invasion of privacy.
I wouldn't consent to stalking in meatspace, for any reason, and conveniently to my knowledge no one is stalking me physically. I dont consent to stalking in cyber space either, for any reason, and I do know that companies do, and they make it an unending uphill battle to let them know and force them to not be blatantly disrespectful. So I will make it as hard as possible, within what I think is reasonable, to make it useless or difficult for them to stalk me online.
And yes, online things have affected my physical life, so these niche applications have occurred to me and my efforts have reduced the negative impacts, to a satisfactory level, and I will continue to kick against the pricks, because it works.
> So what sort of benefits are you reaping from your anti-fingerprinting measures?
A better question would be how are you being screwed over if you never bother to try to stop companies from collecting as much data as they possibly can about your private life? It can cost you a job offer, or cause you to pay more than your neighbor for the same products/services. It can get your data leaked, or sold to scammers. Companies use the data they collect on you for things as trivial as deciding how long to you leave you on hold. The more data they have on you, the easier it becomes for them to use it against you.
Feel free to give companies every bit of personal data they want from you. They'll be thrilled to use that information at any time and in any way they think it will benefit them. Until we have laws against surveillance capitalism the only person looking out for your interests is you, but only if you can be bothered. It'll sure help companies take advantage of you if you decide it's not worth trying.
Yeah, you know what? Life is far too short to live in fear and paranoia of the scenarios you suggest.
Anywhere I go in meatspace, people could be collecting data about me and my behavior. That has always been true since the beginning of time. An old lady can sit on her porch and take notes about my outfit, my comings and goings, and every driver who comes to my door. Today, they're saying that Target can definitely hear our WiFi/BT MACs as soon as we get into their store, and they see/track everything on camera everywhere inside. My Groucho Marx isn't going to hinder or change that!
All I can do, honestly, is be judicious about what sites I visit, and be forthright in my interactions. I should cultivate good relationships with trustworthy, reputable companies, and stay away from the rest. I cannot ultimately prevent the buying and selling behind the scenes. We cannot realistically prevent collection of everything possible.
I don't shop at Temu or Alibaba, and I don't search on Yandex. I checked my "About Me" on Amazon yesterday and it's shockingly bland and shallow. However I interact with Google, YouTube, Microsoft, and Cloudflare, it's a foregone conclusion that they know everything. My extensive 19-year history on Wikimedia projects is a shockingly rich treasure trove, if anything just my waking hours of every day since 2007! Your own karma score 22,495 in 14 years is probably a fantastic track record of when you were awake and using a computer. If you're so paranoid about Internet privacy, then you wouldn't be so willingly revealing that stuff in public.
I'm using adblocking DNS again, but awhile ago I sort of dropped the pretense of paranoia, because I understood its futility, and again, life's too short. If evil corpos want to do evil to me based on what they think they know, they can do their worst. I am a Christian man accustomed to suffering and infirmity. I got nothing to lose in this life, except integrity.
> I cannot ultimately prevent the buying and selling behind the scenes. We cannot realistically prevent collection of everything possible.
Yeah, but you can very easily _limit_ what is collected and sold behind the scenes just buy switching browsers, changing browser settings, or using a couple privacy extensions. A little goes a long way.
It’s really kind of pointless. They fingerprint you to target ads and that’s it. The valuable data that’s collected and sold can’t be hidden through fingerprint avoidance: anything you actually pay for. Sure there’s privacy cards, but the second you purchase a physical product you have to give up a delivery address and now they’ll just correlate all your disposable emails and privacy cards and whatever else.
Your only option is to never buy anything online and only pay cash.
> Your only option is to never buy anything online and only pay cash.
I probably wouldn't go as far as never buying anything online, but paying cash IRL should be something done by everyone to protect their privacy. There are a few other easy things that can massively improve your privacy with minor or no inconvenience: Linux on every PC/laptop, GrapheneOS on phone(s), uBlock on every browser (or a DNS-level sanitizer), car without cellular modem (pull the fuse), non-Google and non-Apple email (ideally your own server or a small provider in a friendly jurisdiction). Also, don't use social media and text over Signal instead. Of course, TVs and other home appliances should be kept off the Internet. Overall, those are some very minor sacrifices for anyone with a little bit of maturity. It's very far from living off the grid or anything like that.
> It’s really kind of pointless. They fingerprint you to target ads and that’s it.
That's a very early 2000s view of the issue. Ads are not what all the surveillance is for, it's just the publicly acceptable excuse for tracking you that companies love to use because nobody cares which ad they get shown. Being able to build a profile of which websites you visit can provide a ton of information about you and that data is increasingly being used offline. It stopped being about ads ages ago and now what you do online can impact your next job offer, what prices you pay, which policies companies apply to you, etc.
You can never limit all data collection. Going to the store and paying in cash will still have you tracked by Flock cameras. The point is just to limit what you can, where you can. Every scrap of data collected about you is going to eventually be used against you later by somebody. No point in giving them anymore ammo than you have to.
Wow, that is a seriously impressive demo. I wonder how it’s able to distinguish people using identical hardware and software versions (e.g., iPhones on the same iOS version). It was able to correlate my sessions across multiple independent ISPs, with a VPN, and with Apple’s extra tracking resistance in private mode.
The solution has to come from law. I propose we handle privacy invasion the same as rape. Body and mind aren't up for grabs. That the average internet user is unconscious isn't a valid excuse.
It would be great if a wave of lawmaking started in the USA, because most tech behemots operate from there. I would expect EU to take the lead though IF such a wave would start. The EU has still a fair share of christian/conservative MP's that keeps doing the bidding for companies by pushing chat control, but on the other hand also has some progressive and knowledgeable representatives doing great work, so there might be a glimmer of hope. We need media campaigns and public education though. Political leaders are selected for their political abilities and as such rarely have leadership qualities. If the electorate moves, the leaders will follow it. So we have to start at the bottom.
I like your idea, but as a pessimist, I believe the ship has sailed, all government are craving on monitoring their citizens' move. If there are way for the government to fingerprint their citizen digitally, they will want to do it instead of protect us.
These fingerprints now track us much more effectively than ever, not just for security but for real ad tracking and data selling. Instead of using cookies that are mostly vulnerable to ad blockers and other content blockers, these fingerprints can track us more precisely and can easily bypass our current data security systems like ad blockers. So I think the demand for sophisticated anti-detect browsers and proxy-level tracking prevention will increase.
Hmm, let's see what will happen.
It is offensive that browsers give away so much unnecessary info. What is necessary? Language preference, Javascript (yes/no), screen resolution. Optionally, latest supported html/css versions. That it, nothing else.
I understand Google having Chrome send way more info. Why do all other browsers go along with this?
Why can't a government simply ban all advertising and instead provide a good enough yellow pages service that just provides the specs of the product in a templated way?
Why would it be a good idea to expose unsuspecting citizens to false claims by the sellers?
Huh, it is different for me on every page refresh. No VPN, etc... just Firefox on Windows with uBlock, CanvasBlocker, and a PiHole. No persistent fingerprint for me!
I wonder if a browser extension could be made that inspects your fingerprint and informs you if you're too unique, then one-click to 'correct' those unique items (or at least list them), so you can conveniently go back to being ~anonymous if preferred.
If you use Firefox, do the following:
Use the extension Chameleon (set it to rotate Random profile every minute), had strict mode with JShelter extension.
This royfish blog example, or anyother, including that fingerprint.com gets new value everytime.
Fingerprint.com charges around $0.004 per investigation, and really encourages you to set up a first party proxy - so iOS doesn't nuke storage after 7 days. And even there, unless its a cookie match; your ID usually carries a confidence number.
That should give some hint about how difficult it is to do in real life, at scale.
This site gave me the name “Greedy Bison”, but it didn’t say how many other “Greedy Bison” are out there. I’m guessing everyone using the very common device I’m using and using the very common browser that I’m using would get the same name as me
Lets hope AI coding agents will let us to modify browsers and OSes quickly. "Remove tracking from Chrome". "Privacy friendly Android, in particular, allow geo location spoofing"
Cookies, in and of themselves, are not bad. Like any tool that can be misused, they're just being abused by a ton of really shitty people in an effort to try to enrich themselves at the expense of others. Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"
> Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Don't you people remember how it was done back when web browsers didn't have cookies, or could be configured to reject or ask for each cookie? The server software automatically added a PHPSESSID parameter to every link, containing the session identifier.
RFC 2109 predates anything that vaguely resembles PHP, and Netscape (thus, defacto, basically everyone using the internet), had cookies 3 years before the RFC. PHPSESSID wasn't added until PHP 4 in 2000.
If you're going to be a bitchy pedant, you'd damn well better be CORRECT.
I have heard from some power users that Brave is one of the best browsers with regard to ad-blocking and privacy.
But I think I have read elsewhere that it receives money from ad companies to display only certain ads, which does not make me trust it.
Does anyone have facts or know where to find them?
As a general role, always be suspicious of very loud and vocal opinions about product and services. Specially for closed source products and paid services, they often invest in what is called Native Advertisement/Marketing which is basically paying people to lie and pretend it is organic content/opinion.
Second, despite the dumpsterfire that Mozilla’s leadership has been in a decade or so, it is very robust with privacy and anti fingerprint features out of the box, the containers has also stabilised and works great.
I see so many misconceptions on HN about that coveryourtracks site. Neither of those results are ideal.
"randomized fingerprint" -> that's a bad result, it means the site can detect you're spoofing info
"unique fingerprint" -> this is good, ONLY IF you refresh and it still says "unique fingerprint", because it means the site sees you as a brand new visitor each visit, and doesn't detect any (what advertisers would call) nefarious behavior. however, if you visit again and the second time it says "nearly-unique fingerprint", that's a fail because your two visits were linked
The ideal result you should aim for is "non-unique fingerprint". That means your device is indistinguishable from countless others. Blending in to the crowd is what you want.
These tests aren't reliable - Brave does randomise values but it ultimately doesn't do much to prevent fingerprinting, as many values remain static. For example, Brave still exposes your GPU model and driver version.
See Fingerprint.com, despite Brave's protections you'll likely find it works reliably.
At least when tracking was unregulated, at least you knew who was by the cookie left in your browser, now I just assume everyone and everything is tracking me
With the cookie, at least you could just whitelist some sites and have everything else be deleted once you leave the related website. Though, admittedly cookie-auto-delete often stops doing what it is supposed to.
Yet I am constantly flagged by various pages because Cloudflare decided I had some bot running at some point on my network. And my IP is fixed. Whatever EU is doing, it doesn't work.
You might have a residential proxy running somewhere on the network. The latest in botnets is bundling a proxy in with some TV torrent streaming app or whatever else that can run in the background and proxy malicious traffic from your residential IP. Services like cloudflare and crowdsec will keep a constantly updating list of the IP addresses that are actively sending bot traffic and blacklist them. If you can work out where the traffic is coming from and shut it down you should have this issue go away.
I have a similar issue. I see cloudflare checkboxes all the time. Google makes me fill out captchas all the time. Sometimes it decides I can’t search, sometimes cloudflare doesnt let me past the checkbox.
I’ve checked my network. I’ve monitored egress traffic. There is no residential proxy. I’m not on a VPN. If anything, services should be able to track me entirely by my home IP that doesn’t change that often.
My best guess is that I’ve committed the crime of not allowing third party cookies? Or maybe the crime of not being logged into a Google account 24/7. It’s not browser or device specific. My iPhone is just as likely to fail the cloudflare checkbox as my desktop with Firefox + uBlock.
I've committed the extreme crime of running no JS and clean cache of cookies.
Plus, something as simple as containerizing work/play/research reading, into different browsers, has provoked the Eye of Google to be cast on me
I haven't seen a YT ad in years while in lurk-only mode (no login), which is nice, but I also see cloudflare everywhere , which is not great.
One of the nicer things about LLMs, is that they arrived just in time to erase my dependency in search.
I have experienced the same with Google and with PayPal, whenever I used Tor. When I afterwards visited those sites using my normal browser I got Captchas. They are actively fighting attempts to avoid fingerprinting. Also, I am pretty sure that no browser protects against getting fingerprinted. Test with https://fingerprint.com/.
Yes, PayPal has blacklists and people land on them very quickly. I play according to their rules, as I need the service when I need something which is not available on Amazon (Which has IBAN).
> they have always been about the tracking itself!
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
Yep, and somehow there's always someone who thinks that the "Ah, but this is not a cookie!" is a loophole. It is not, he is just undereducated.
The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)
Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).
Point is that tracking isn't the only thing that's not "strictly necessary". And additionally that "strictly necessary" is tied to something specific: internet society service. That includes a very specific requirement: "Normally provided for remuneration". That's why e.g. public authorities should not (usually) be allowed to rely on it, public services are not often provided for remuneration in EU-law sense.
It also limits the exception in relation to e.g. employment.
Right, and that wording is why fingerprinting doesn't get around it. The EDPB's Guidelines 2/2023 on the technical scope of Art. 5(3) (final version adopted October 2024) say that when a site's JavaScript instructs the browser to send information back, that is "gaining access" just like reading a cookie (paras 32-34). WP29 had already said in Opinion 9/2014 that device fingerprinting is in scope.
So a canvas/font/WebGL fingerprint used for tracking needs the same consent as a tracking cookie. The guidelines even suggest passively collected protocol signals can fall under it (para 43), though that's where it gets argued.
The weak point is enforcement. A cookie shows up in devtools and in every cookie-scanner audit. A fingerprinting script looks like any other analytics JS, so it's much harder for a DPA to spot and prove.
cloudflare (the cdn monopoly) interpretation of gdpr, is that clicking the "I'm not a bot" you are giving consent to fingerprint because they have to provide you a service you asked by clicking the button.
...it's something i hope no court will uphold. but we know what happens to european courts even looking sideways at American monopolies working as front for fiveeyes.
imo, eff should be starting trials to stress this instead of blogposts.
If you've ever worked at a startup, you're probably familiar with the fact that no one gives a crap about this type of stuff early on
The hell with pretty much anything, the only thing that matters is revenue
People only start to care about this after the fact if you've grown to large enough size
If you think stuff like this or right to be deleted stuff is moving the needle anywhere but at the biggest companies, you've been misled
That's the real painful truth of this stuff, most of the time it's just lip service anyway
Wth is anyone going to do anyway? Go through a resource-draining lawsuit against a 20 person company where it will take a year of discovery just to maybe-sort-of prove they've been mishandling your data?
It's going to take some pretty radical new laws for this type of stuff to ever have any meaningful impact
We have over 10+ years of employing this tech, and we've found fingerprints for a browser are constantly changing. As such, they are far from being a silver bullet when used as a persistent identifier.
Furthermore, in corporate environments where boxes are set up the same for many users, there are often, or too often, two different users and two different boxes with the same exact fingerprint.
I'm skeptical of this magic trick, maybe add a counter with the amount of times I logged in to the website. Or let me save some data to read it from another session. Otherwise lots of people can be identified by that hash, there's no proof that it is unique
I did want to add a counter and see how my script would perform in the wild! But that'd mean I have to store these fingerprints and that requires a bunch of formalities I don't want on my website.
Anyway, it's a simple script for the sake of demonstration. I'm sure you'll get a different hash on other browsers/devices.
> Let’s give it up for Google - the biggest ad company on Earth
I think Google needs to be forbidden from causing more damage to the
EU market. And there need to be replacements too, once we forbid this
Evil entity from sabotaging EU citizens any further.
We also need real open browsers not controlled by greedy Ad companies.
I am also aware of the irony of using thorium here right now (based on
the adChrome code base). If I use Firefox, I can not listen to audio
since mozilla claims only systemd-pulseaudio using people can listen to
audio. Well, chrome plays audio on youtube (which is also owned by
Google, do people begin to see how big of a problem Google has become)
just fine, so I have no idea what Mozilla devs are smoking. I could
recompile firefox, to just use ALSA, but who in his right mind wants
to compile a 1% usage base legacy browser that uses ancient technology
to compile its outdated code base please?
Mozilla gave up decades ago on fighting adGoogle. And it can be seen via
small things too.
Ladybird may be a competitor at one point in time but they ban people from
their github repository, which also sends the message "do not contribute
to us because we don't care about you if you have dissenting opinions". Well,
so much for real competition, when projects get all emo early on. You can't
beat the evil adGoogle empire with wishful projections about "conduct of
people". That's not going to work. I don't subscribe to any random ruleset
made by random people I don't know and don't want to know when they resort
to censorship. But hopefully more and more people realise that something has
to be done about Google one way or another.
> See, the thing is, it’s not about you at all. It’s not really about the ads anymore either. Nobody cares about you. And if the police or your government happen to care, I’ll gladly take their money too.
> I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.
> And to the highest bidder it goes!
> What does that make you then? A gear? An ox? A volunteer?
This does absolutely nothing for me. If this resonates with you, can you explain?
I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.
Is the implication that the machine knows me so deeply that it doesn't matter if it connect my device ID to my name? That it knows me deeply as a person regardless of what identifiers are used?
If that's what meant, I have to say:
1. That's an absurd overestimation of the current capabilities of adtech
2. Even if it were true, I'm not sure I'd be that bothered by it? What I'm bothered by is what could be done with that intimate knowledge. And if the answer is just "show me the absolute most optimal ads", this doesn't really bother me.
It’s a question of entropy. If your device is unusual in detectable ways, then the fingerprint has high entropy. But on my iPhone I suspect most of the things being fingerprinted are the same. How many other people get “smug koala”?
Couple different results than that across three refreshes on iOS w/iCloud Private Relay. Apple does work to do some randomization.
But at least the moment we start using websites the largest players will know it’s us. Nobody else swipes and types exactly like me on my screen size of iOS over the relay.
fingerprints pick up on all sorts of things that make you different enough combined with another signal, 33 bits can be enough to single you out from anyone else on the planet... iOS can be 10-15, and given a residential IP that's plenty - always mobile is more anonymous on the web but guess what's much worse? apps.
a native app with 0 permission prompts gets you more bits than web
No. Almost everybody using an iPhone is on the latest release, plus or minus one while updates are rolling out. For a given iOS release and hardware type almost all of those probes are highly correlated. No way there’s 30 bits of entropy in that. I doubt there’s even 10.
Now on a desktop PC sure I believe these fingerprints are highly descriptive. And in android land they probably work okay because of the diversity of products and configurations. But iPhones resist fingerprinting just because they all give the same answers.
I just said iOS can be 10-15, correlated with anything else it can easily be 30. Download an app and visit their support site and that's likely enough to narrow you down.
The web provides:
time zone
language and locale (accept-language header too)
iOS version
screen size and pixel ratio
text size
dark/light mode
reduced motion
ad blocker extensions for safari
An app provides (without additional permissions):
IDFA advertising ID (unique and cross app)
IDFV (vendor ID)
AdAttributionKit (which apple does obscure somewhat)
Battery level, charging state, volume, headphones
Various appearance settings again (font, dark/light, reduced motion)
Just slightly more permission granted via prompt can get you:
System boot time and uptime
Disk space
Keyboard languages and extensions
File timestamps
Then additional individual permissions (which people agree to all the time for specific use cases)... at this level they can single you out easily:
location
contacts
bluetooth
motion sensors
To Apple's credit they're trying to make fingerprinting more difficult and attempt to ban it entirely, but it's not at all impossible.
Some of these guys sound like they erase their fingerprints off the plates when they visit a restaurant, and ask people to forget about them when done talking.
Like it or not, as web gets more complex, it will recognize you more. If you don't want that, just don't use the web - perhaps buy a farm and life off-grid.
I just don't get what's the appeal to this endless damn cat and mouse game.
Goycattle like yourself ought to be executed for the sheer stupidity of your opinions. Privacy is the only reasonable response to the unhinged behavior of web advertisers, who will spend trillions of dollars and decades of research, who will bribe politicians, who will do everything in their power to figure out the shape of your butthole so they can perfectly optimize which sex toy ads to show you. It is utterly psychotic behavior and pretending it is anything else is the either dumbest or most malicious thing anyone has ever done in the last century. If restaurants were to frantically scan their dirty plates for fingerprints after customers are done eating, the customers would be damn right to try to wipe their fingerprints off. Obviously that isn't necessary, because restaurant owners aren't completely out of their minds. So why does the web have to be this way?
"By the way, if anyone here is in marketing or advertising... kill yourself..."
So you're basically saying the old "I have nothing to hide" argument which has been debunked over a million times...
In particular because "I have nothing to hide" means "I have nothing to hide until now, and because of the corporations and states that have access to my data are lead right now by people I trust not to misuse that data"
But if tomorrow the government change, and suddenly your searches for "gay bars near my location" becomes illegal, you'd rather this info not be in everyone's hands...
Lack of privacy harms journalism and activism, making the government too powerful and not accountable. If only activists and journalists will try to have the privacy, it will be much easier to target them. Everyone should have privacy to protect them. It’s sort of like freedom of speech is necessary not just for journalists, but for everyone, even if you have nothing to say.
"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else."
You took a guess. You guessed wrong
I have not "disabled Javascript". The software (pl.) I'm using to request and read web pages has no Javascript interpreter
I can also insert a CSP response header such as "default-src: 'none'" and get the same result ("...") even when using software that runs Javascript with Javascript enabled
This "data" does not seem very useful for advertising except perhaps something like "don's waste time trying to target this user as they will not see or hear the ads"^1
What are these "network-based" methods exactly
I never see any ads when using the www. I attribute this mostly to not using popular software controlled by companies or individuals that advocate for internet advertising. This software could be something as complex as an operating system or a "browser" or something as simple as a Javascript sourced/planted in a web page
Whatever these "network-based methods" are, they don't seem to be very effective at targeting me with ads
I generallly stay in textmode. Most internet ads seem to be graphical and/or audiovisual in nature
Hypothetically, if a "developer" tried to target me with text-based ads, I could easily filter them out
I already filter the text in response bodies using a local forward proxy
For example, the "score" on HN comments I submit never goes below 1 in the HTML I'm reading. In theory this helps avoid self-censorship
Here is an excerpt from rewrite.lua
if host=="news.ycombinator.com" then
body = string.gsub(body, "%(<span id=\"karma\">%d+</span>%)","")
body = string.gsub(body, "-%d points","1 point")
body = string.gsub(body, ">0 points",">1 point")
body = string.gsub(body, "width=\"%d+\"></td>","width=\"0\"></td>")
end
1. Of course companies like Cloudflare are using the www user's choice to run/not run Javascript as a way to collect fingerprints and filter out users who are not using advertising-friendly software
I still don't understand why the highest entropy APIs aren't gated behind browser consent.
A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
Broad geographical targeting shouldn't be an issue. In fact, it's so easy that I think we should invent an ad-targeting API people can opt in to. If I could tell advertisers my geographic location, gender, age cohort, languages, and 3 interests, I'd not feel that's an invasion of privacy when they use that to deliver ads. I'd just get lawnmower ads instead of shampoo ads and that's fine.
The problem is, they don't want to use that kind of targeting. They want to target me with ads for a travel destination that my coworker mentioned in a Messenger message to another coworker five minutes ago. But we should just not accept that.
The most used browser comes from the same company that runs the largest ad network.
It's the browser that introduced many of these APIs in the first place.
That should answer the question.
(If you ask me if a browser should report how many cores the machine has, including physical and logical ones, I would answer never, every time. But not everyone thinks that way. https://developer.mozilla.org/en-US/docs/Web/API/Navigator/h...)
> "I still don't understand why the highest entropy APIs aren't gated behind browser consent"
Because it's known that interrupting the user-intent with a unrelated consent-popup doesn't help.
Older people may remember that this was the approach of Java J2ME, where you couldn't provide a fluent user-experience as the user first had to answer huge popups about individual API-permissions with "Always Allow", "Allow now" etc.
If it isn't an informed decision, it isn't really a decision at all. And the huge majority of people the huge majority of the time do not want to make an informed decision: they want what they came to the site for, news, games, family photos, etc.
You go to Facebook to see your cute nephew make spit bubbles. Do you care that they access your camera and canvas? What is a canvas? And sure access my camera, I want to upload photos!
It's fundamentally broken. They've studied the dark patterns, not to avoid them but to implement them best.
Absolutely. I spoke to an ex-Meta guy and his only answer to stuff like this was "actually its good for privacy because they don't want third parties to access your data since its valuable"
So long as it's once per API and site, it seems it doesn't need to be too bad?
If it's a site I trust, and I think it genuinely needs audio, I give it audio. If someone doesn't understand and just does allow all, they never see it again either (and their ads are suspiciously well targeted).
We already have these consent popups for camera and microphone. Reading back bytes from an audio buffer seems like such a rare thing to do that it hopefully just stops happening.
It's less rare than you'd hope. Disclosure: I do developer relations at Friendly Captcha, and our widget is one of the scripts that uses generated offline audio (but with no microphone recording) and reads the buffer back on sites that otherwise have no use for audio.
We do this to check whether the browser is what it claims to be, not to track who you are. Similarly, font rendering, floating-point math results, WebGL renderer strings, and whether built-in functions are patched is all much harder to fake. These considerations determine how hard the proof-of-work puzzle should be, and site owners can see it as a risk score. We don't do cookies or browser storage, IPs aren't stored, and nothing gets used to recognize you on another site or on a later visit. The biggest players in automated traffic prevention can't (and usually don't) say this much, because of conflicts of interest between automated bot detection and their other products (e.g. ad sales and IP-profiling).
Your example is really fair though. I chatted with our engineers, prompted by this thread, and we found nothing in our detection that currently uses the audio hashes we collect, so we've started talking about removing the collection.
I think "proof of humanity" is going to be an increasingly important thing, but I think we need to forego the age-verification and make some sort of zero-proof/integrity-preserving age/humanity verification.
Also, people not in tech do not generally understand the implication of consent popups.
For example, on multiple instances, my spouse declined "location permissions" an app designed to work with a piece of Bluetooth-connected hardware, and would blame the hardware as being crappy.
"This smart lock app doesn't work."
"You need to enable this permission."
"Why do I need to give the smart lock app location permissions?"
It's not obvious to people that "Bluetooth can be used sneakily by big-enough companies as a makeshift GPS" even if the app needing Bluetooth access doesn't actually need a GPS location.
Your partner isn’t wrong. It’s a crappy product and crappy ecosystem when you have to be hyper precise.
> A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
We should go further. A web-site with mostly static content should not use user-side scripting (Javascript) at all, it's unnecessary for it. It should be required only in rare cases where a site is basically an application and require manually turning it on each time such application is opened.
I think that ship sailed and I'm pragmatic enough to accept it. The web is an application platform, not a web of hypertext content. That's not going to change, and I've given up on the idea to even try to "go back" there. If it worked, you'd just have half of websites be "sites" that work without JS, and half would be "apps" which would require switching on JS? The whole reaosn the web took off as it has is because we removed the distinction between "web app" and "web site". There's no putting that genie back in the bottle.
> A web-site with mostly static content should not use user-side scripting (Javascript) at all
Then sites that want to track will just add some JS. Seems unlikely to help.
Sure, for the most static of static sites. But without JavaScript you can’t even do basic things client-side, such as having some variable-length list of fields in a form. Or customized field validation.
If such client-side behavior counts as “basically an application,” then “applications” is a larger set than seems useful.
Theme switchers! My favorite example of why "document-only" sites might need JS. Sure, you can use @media prefers-color-scheme for defaults, and you can do checkbox/radio shenanigans to make it switchable, but there's no way to persist that preference on a static site without JS.
If you don't care about your site being static then you can track it server side, but that has big implications for his you can just your site. Sticking a little flag in localStorage really is the best solution, if you can get past ideological purity.
Most sites also don't need forms at all either, at least for normal users.
Well yeah, but there's also the part where I'm not okay loading ads from a third party because they eat my battery, add latency, and can potentially be used to spread malware. So there's the conflicting preferences regarding targeting that you mention but also conflicting preferences regarding how they are served.
The conflicting interest starts with the very idea of ads already. The entire point of ads is to manipulate you into doing things you wouldn't do otherwise.
I suppose that depends on the ad. I don't mind non-intrusive ads that are directly relevant to whatever I'm currently doing. What google currently does with product placement in AI responses is a good example. It's on topic, unobtrusive, and secure.
That could also be a preference. Do you allow third party ads to begin with? But then I'd understand if people would just block visitors that don't agree to them. I think paying via showing ads is fine. Paying with my integrity isn't.
> I still don't understand why the highest entropy APIs aren't gated behind browser consent.
Simple answer: The makers of 3 largest browsers by market share (collectively 90%+) are buddies with the people who want to fingerprint you. Only the 4th largest gives a shit.
That would be nice. However, It’s easy to see why it’s way more than simply what they want, they don’t really have a preference but it boils down to money. You’ll only replace your lawnmower every couple years and the rest of the time they’re guessing what you may buy next. By spying on your daily conversations and browsing, they have an idea of what you are likely to buy this week, next week, and the week after. This is so much more valuable to an advertiser.
Exactly. And here's where regulators come in. What we need to do as a society is basically say "Unless you can make your ad-funded business work with this tiny bit of information, your ad-funded business should fail and shut down".
Most of the ads are pushed via free services. Facebook, Google, as examples. These are entirely optional to consume. And I’m not sure people are really collectively willing to give up the trade they have yet (Data for free services).
I agree with you but really from a point of privacy and what/how data is allowed to be mined, shared, sold, etc. The implications to the business/ad industry are second order effects that are just collateral damage.
> I still don't understand why the highest entropy APIs aren't gated behind browser consent.
Last I checked it's because it was generally considered that preventing fingerprinting is practically impossible anyway. It's not like you need a lot of entropy for fingerprinting, and the web API surface is enormous. To actually stop fingerprinting you'd need to make your web browser more or less useless.
That might sound good, but people already moan and groan about cookie notices. Imagine if each website that legitimately needs it would start asking for permission to each fingerprintable API. Although I do think we should have that option, just not as a default.
You could accept things once per API and site. It doesn't feel that terrible. We do it for camera and clipboard already.
Same reasons why browsers allow javascript on every site.
The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis.
Great how this is currently the 2nd highest comment despite completely ignoring the numerous fingerprinting techniques based on CSS alone (including one of the most famous fingerprinting methods by testing font support). Simply thanks to reflexive "JS=bad" upvotes.
https://en.wikipedia.org/wiki/CSS_fingerprinting
The scope and amount of information that browsers hand over without the slightest shred of consent from the user or indication it’s happening is crazy.
And also without logging it. Even if I don’t want popups to give consent for every document.getEyeColor() call, it would be nice go back and see who’s doing which queries and/or have Firefox collect aggregate statistics. Naming and shaming the crooks won’t stop them but it might have an impact on curbing any bad behavior from big commercial retailers.
I like this idea a lot. It’s similar in principal to how macOS shames battery hog apps in its battery menu extra.
It's a UX trade off. For non-adversarial websites it's very convenient for users because things just work without having to go through loads of permissions pop ups for every website, but of course this then makes this info a juicy target if you're trying to fingerprint someone.
It's not a tradeoff, it's poor design.
But it is a design trade-off. The opposite case can be seem in the many websites asking to send you notifications, and the many flavours of cookie notices. When you have to ask the user permission to do anything and everything, the user gets annoyed and desensitized. They start allowing everything (my always collects dozens of notification-enabled websites if given the chance), and the point of asking for permission is lost.
> It's not a tradeoff, it's poor design.
How so? There seems a fairly inherent tension between having things just work by default and hiding surface area for fingerprinting behind permissions pop ups. For example say you go to a maps website, how do you decide whether to share the users location with the website? Or enable webGL functionality to render some fancy layout on the screen? As a user having to enable all that stuff per-website is annoying.
Maybe there's some other way Im missing?
Is it though?
Google's business model has been ads from the beginning. Search, gmail, drive, office, chrome, everything they do is just to drive ad revenue further.
They don't care about the user. Never have, and never will.
And the outcome we are seeing is what happens when a defunct state isn't able to protect citizens from conglomerates. That's what the Kartellamt or the FTC is supposed to be for.
Nope. At least until 2008 I cared and Larry and Sergey cared quite a bit.
Yes, I believe they initially really meant it when making their “don’t be evil” statement.
The company as a whole also really stopped caring at some point and are now following the “do be evil” paradigm
So "never have" might not be true. But what about the rest of the comment?
> Nope. At least until 2008 I cared and Larry and Sergey cared quite a bit.
Not sure if I can't see this comment as anything else than hypocritical. It's always easier on the money receiving side, isn't it? How do you think the term malvertisement came to be?
AdMob is kind of the definition of inevitable Surveillance Capitalism and the prime example for necessary regulation through government.
That's not a browser thing. Fingerprinting native apps is much easier.
Sure, but at least native apps can only do that if I download and install them. If I do that, I’ve made a conscious decision that the tradeoff is worth the utility of the app. This limits the blast radius considerably.
On the web one is drive-by fingerprinted by sites they never once approved of or intended to visit thanks to the browser’s ability to redirect and embed without input from the user. The magnitude of the problem is far greater on the web.
To reframe it, in a given week the average person only uses a small handful of apps, but in the same span of time their browser has connected to thousands, maybe tens of thousands, of unique domains, most of which are tracking them in some capacity and the majority of which are tracking things most of us would consider invasive.
I can't help but keep thinking that client-side scripting was a mistake. Sure, the web would be a lot more primitive without it, but I'm not convinced that wouldn't be for the best.
My default is to run without JS and selectively enable it when absolutely necessary, so when I clicked on this story the page was prefaced with the following comment:
"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else.
From now on I’ll call you:…"
I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it. On rare occasions when I'm forced to use JS I'll cut-and-paste the URL into another browser.
I no longer use ad blockers as I just don't see ads with JS disabled. The other privacy precautions I take are the obvious ones such as no Google or social media accounts, flushing cookies at session's end, regularly randomize my IP and never let Chrome anywhere near my machines and make judicious use of multiple browsers (this is being written in Privacy Browser on Android).
Using NewPipe and sponsor block on PipePipe increases privacy and makes YouTube ad free.
Client-side scripting was a mistake which was obvious from the outset (or not severely limiting the reach of scripting engines).
What I find hard to understand is why alternative plugin JS engines haven't been developed that are under user control. Spoofing, randomizing and returning junk data to webservers would go a huge way towards stopping fingerprinting by websites.
> I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it.
I guess you use the web in quite a limited manner? (Or use that other browser quite a lot...?).
I've tried no JS various times over the years and always end up constantly whitelisting sites. It's even worse in 2026 and gets worse each year.
Banking, insurance, webmail, groceries, eBay, CAPTCHAs... not to mention what feels like 50% of the web that is behind either Cloudflare or similar, which almost always require Javascript.
I used to believe in that and would make sure all of my sites would work without Javascript until one of my projects (a micro community) got targeted by pedotrolls which lead to an awful time and now I associate people who are staunch no JS as pedos, I am not accusing you or anything but that is the impression it left on me. Ever since then I really don't care if the site doesn't work without JS, and if users can post stuff damn straight Javascript will be involved.
Unfortunately this idealistic principle (no JS) attracts the worst people.
You're on Tor? You have JS disabled? I might as well warm up fbi.gov/investigate/cyber for the probable report I'll have to do...
Well, I find your comment pretty offensive. In the past I've had some pretty rough and disparaging comments from JavaScript fanboys but yours has to be the worst. Associating disabling JS with pedos is about as low as it gets. Where did you get those stats from, or are they just a figment of your imagination?
"Unfortunately this idealistic principle (no JS) attracts the worst people."
Again, how did you come to that opinion? Where's your evidence/stats? Generally comments like that come from web/JS programmers who've realized that client-side users have them stymied when they disable JS.
An additional reason I avoid JS is speed, webpages become blinding fast when there's no JS. Once one gets addicted to the great rendering speed there's no return. I'm not against JS per se, trouble is you JS programmers have weaponised it against users, webpages of 7, 10 and even 20MB are now commonplace. Presenting such slow massive pages to users is nothing other than abuse.
I do not use Tor.
BTW, I should point out that my views about JS and privacy abuse were formed from my years working in govt. surveillance where the stakes are very high.
I came to my opinion through experience, I’m sorry you’re offended but I did say that I don’t imply that you’re a pedo but my stats sure show a pattern.
That does not change what I have dealt with. I am not a “JavaScript fanboy” remember I made a community that could work WITHOUT needing JavaScript and that lead to a bunch of grief for me which made me understand the extreme naivety of that original idealistic idea on the internet.
The alternative is to install a binary that has full access to the computer.
Chrome is a binary. What's your point?
I assume it's something like: choosing to forego the protection of a battle-tested sandbox in favor of rawdogging random binaries off the internet would be insane.
You can do plenty (like view port size) via just CSS.
https://fingerprint.com/blog/disabling-javascript-wont-stop-...
Even without JS, there is timing, HTTP headers, conditional CSS, etc.
If everyone else you know has JavaScript turned on, congrats, you're still fingerprinted.
If anyone else has JavaScript turned off you're fine (as long as you can account for all the other stuff like IP address).
> identifying hardware,
> language
I dont think js is needed for either of those things.
> The request already reveals information about you; what browser you use, the language it’s in, the OS that runs it and your IP address, which the server needs to send you the response. That often reveals your location.
If we control the servers the clients are connecting to, I don't see how there could be much hope of hiding. We can spoof things like latency toward an upper bound, but we can never ever defeat the lower bound. Physics is still quite insistent about that one.
If we control multiple servers, we know where they are, and we can periodically compel our clients to rotate between them (see: DNS), we can engage in latency-based multilateration to put them on a real-world map. Depending on the number of servers and samples over time, this can be remarkably accurate. Determining someone's actual postal code just from network timing information is feasible.
VPNs obviously confound this in first order terms, but if we aren't careful they can make it even easier to identify our activity in other ways. We are trading concealment in the woods for concealment in a crowd. Both have their advantages and disadvantages. The VPN might also have a side channel that we aren't aware of.
https://www.usenix.org/legacy/event/nsdi07/tech/full_papers/...
I think that's how ipinfo works: https://ipinfo.io/trace
I've seen anti-fingerprinting plugins and browser configs, etc, but they all seem to make you more interesting for not being fingerprintable, or for turning off a lot of features used in fingerprinting.
Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
Random is often going to be indirectly fingerprintable too, since some values are always the same (or the same given each browser version). Some values can't be set to be random or otherwise non-fingerprintable data without affecting the user, like viewport size.
Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.
There are projects that do this already e.g. https://github.com/lwthiker/curl-impersonate
> Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard
It doesn't matter if it looks wrong as long as it looks differently wrong over time. Don't bother trying to blend in with the crowd because you can't ever expect to catch everything that can be used to fingerprint you. New techniques come out all the time. You can block a lot of information from even being collected. Limit what data you send at all, randomize what's left, change IP frequently (VPN) and you should be fine.
That's the thing, no web page, except for games, should ever need to know about your viewport size. So spoofing would be just fine, imho, with an override option/permission for individual sites.
Any idea how iOS’ private browsing impacts fingerprinting?
It doesn’t. Same there
It can make a small difference on this site, though. Testing it with three browsers (Safari, Brave, Firefox Focus) on iOS with Private Browsing on, each gets a different name and hash — then again, those do stick to the browser pretty well after that and are resistant to incognito mode (or session switch by other means), for example, just like you’d expect. On Safari, Private Browsing masks the IP at least, and Brave has its own tricks.
I use private browsing and could not replicate your result, though I have done a few things on my device such as enable developer mode that the OS has warned me decreases my security.
You can forcefully disable hardware acceleration, that removes a few bits - though javascript can still guesstimate your CPU and memory.
For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.
IIRC that is what https://jshelter.org/ does.
> "What JShelter configuration should I pick?
https://jshelter.org/faq/#what-jshelter-configuration-should... :
First, see our blog post. Consult also other blog posts and other questions in this FAQ.
If you want to have the same fingerprint as many users, We suggest going for Tor Browser (do not install JShelter in Tor Browser). If you want to make cross-site fingerprinting linkage hard, go for the Recommended JShelter level. If you want better protection for the real data at the cost of having the same fingerprint on different sites, go for the Strict JShelter level. Keep NBS active. If you want to detect and prevent fingerprinting attempts, use FPD.
Thanks. I tried this on Firefox for Android and each time I close the browser and load the page my fingerprint ID is different. So it seems to work. Have you had any sites break with this extension installed?
Yes, Anubis and other sites that really insist on abusing browser APIs breaks a lot of sites, but that is kind of the point.
The reason is that the browser maker is interested to support tracking.
On the technical level there is no problem to block tracking - intriduce noise and make APIs unavailable until user permits to a web site. But that is not implemented.
The same with native applications. If your bank app requires you to share your location you can't spoof it. The makers of Android and iOS made spoofing of geo location impossible - you don't have that control, which means the phone is not your device. You have to give up your real location.
> Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
That's basically the ideal. It's become obvious that it's impossible to try to be identical. Web browsers are too leaky, and something will out you. You really don't want to try to blend in the "typical" users because none of them use ad blockers.
This very often will trigger cloudflare protection.
I think this is what canvas blocker does.
>Test your browser:
>coveryourtracks.eff.org shows you how unique your fingerprint is, with entropy for each measured data point.
Something to note - if a fingerprint is generic enough, that might be a _good_ thing!
Having worked with fingerprinting, anti-fingerprint browsers are very hard to properly identify. The ways to get around it are things like collecting more coarse fingerprints[0], as the overall one is fairly easy to change (e.g. make your browser lie about a collection of browser apis).
What's imo more difficult though is a fingerprint like:
- iPhone <new_version> - running os <latest_stable> - using default safari - bought and used in <common_location> (e.g. usa)
on a 5g mast in a decently sized city, you'll share a fingerprint with at least one other active user using a setup like ^
grapheneOS on the other hand stands out a bit more!
[0] - https://blog.castle.io/fingerprints-beyond-device-ids-engine...
Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes.
90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months).
What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.
IMO, data brokering is what should be illegal, not the cookie .
The problem with this is the biggest, most important, and sketchiest data brokering services (credit monitoring) are all but entrenched in law at this point.
I don't really know what you expect, people are obviously going to want to know your credit history when they're lending to you. If you can't tell what loans someone has, they could have opened a hundred different accounts and used the money in the casino.
How should credit reports work?
Well, there are multiple approaches, but here's one that worked well for me: when I purchased a home in the country where I now live, and the mortgage lender asked for a credit report from the (high-privacy) country where I lived the longest, what they got was a letter from that country's central bank listing the penalties for requesting that information. Up to and including jail time.
Suddenly the credit report was no longer a prerequisite to the mortgage.
That is rad. Is your high-privacy country friendly to immigrants? Asking for a friend...
But for real. You say you no longer live there, so I'm assuming you left for more opportunities. My wife and I are interested in countries with opportunities for engineers and privacy. Bonus points if there is engineering research opportunities.
Wouldn't this make credit riskier for lenders, reducing access to credit in general and thus making housing less accessible especially to working people?
Not asking polemically, I just have never studied economics and wonder if my intuition here is flawed
I think the actual trade-off is between average acceptable risk at society level.
Some societies prefer huge risks for huge benefits, in those one (might) need a more detailed credit reports because everything is faster, people accept huge risks and the situation can suddenly change.
Some societies prefer more stability. Lower risks, lower surprises. Less opportunities, everything is slower, people can't even take that many risks, simpler histories will do th trick.
From what I notice though, housing seems to be a problem in both types of societies, irrespective on how credits are given, because there are other things involved (regulation, NIMBY, housing used as value, airbnb, geography, etc).
You are so full of BS it's scary. No credit report is a non-starter at any financial institution that wants to stay in business. They won't be giving you a loan unless they know you are wealthy e.g. own 17 investment properties already. 'High-privacy' countries is code for 'tax-haven', and 'my money in the Cayman Islands' means your bank is about to run afoul of AML and KYC laws if they give you a loan. And this is the whole world: doing business with America means adopting their financial posture i.e. penalties for doing business with money launderers.
You bring your own data to each credit check.
It feels onerous as an idea because bank statements, monthly bills, payslips, will bequests, stock vests and trades, bank robberies*, and investment income each have different ways of being tracked. At least most of these records of individual financial activity come with a PDF these days. It wasn’t that long ago that applying for a loan meant scanning in papers for your lender to review.
Computers are smarter now. Not only can they read documents (or at least match the shapes against shapes they’ve been told are real) but they can also understand the contents too (or at least match the words against ideas they’ve been told are real.)
There may well yet be a future Data Valhalla where individuals hold their life.zip themselves, and upload whatever bits of it are needed to get that Nordstrom store card / car financing / cheeseburger loan without having an intermediate credit agency.
*I feel there’s a kernel of a joke there about a bank robber asking for a receipt with the loot in anticipation of declaring it on their tax return.
I don't see how this works in reality - The issue is that users wouldn't upload negative information (e.g. county court judgements or the bank robbery from your example).
Credit isn't like insurance where these things can be checked later during a claim (which can then be denied) - you need to know the person is a bad-payer before you send them the ten thousand dollar loan as that affects the terms, not afterwards when they default and you can't get your money back.
For CCJs and bank robberies, you'd upload a clean sheet from the government that gives a list of all CCJs and criminal convictions (in the UK we have a system called DBS for criminal records).
Potentially, with loans or other things, some kind of technical solution could work. You could have a personal document that you control, and you give permission for companies to write to the document.
With a loan, for example, if I give you a loan, I can also append to your document that I've loaned you the money; for every payment you make, I write to the log to say you've made a payment. If you stop making payments, I stop writing to the log. This would be cryptographically signed by me, so it can't be forged.
When you want to take out another loan, you can proactively share your document, the bank can see everything written on the log, and make a decision based on that.
Naively, credit is if you can pay, and if you will pay.
For the latter it’s whether you’ve had a judgment against you, which is a matter of public record.
For the former it’s based on how much money you have and what you spend, including on servicing existing debt. Lying about this would be fraud. In that sense, my proposal does indeed open up a new avenue for fraud but I don’t think that’s the same as it being unworkable!
So what. Maybe it is corrosive to society to provide unsecured credit willynilly. Yes, it makes the banks giant amounts of money, but IMHO consumer credit should only be a thing for two classes of assets (that can be repo'd easy-ish) real estate and vehicles.
The Western governments have horribly failed of caring for their people - cost of living are exploding, and at the moment way too many people are papering over that with unsecured credits backed by their data being free to exploit, and everyone else not willing of doing that is increasingly locked out of existence.
The point of the credit agency is to work for the lender?
How did lending work before nationwide mass surveillance of consumers and reporting on their activities?
It typically required more direct sources of trust. If you were a grocery store, you might let customers you personally knew to be good for it, run up a 'tab' and settle on payday. If you were a bank, you might only lend to rich high-class people. You can find this all around the world today; the US is a standout for credit scoring and for access to credit. When a British person wants to sell their house, it has to happen on the same day that the buyer sells their old house, and the house they're moving into to be sold, and so on in a big same-day daisy-chain, until you hit someone who has enough cash for initial outlay. In Japan, up until very recently, you could expect your boss to need to co-sign your apartment lease (and your landlord to immediately escalate any disagreements to your boss).
> It typically required more direct sources of trust. If you were a grocery store, you might let customers you personally knew to be good for it, run up a 'tab' and settle on payday. If you were a bank, you might only lend to rich high-class people.
You hit the nail on the head with the first statement. It required humans in the loop. It scaled linearly. Local branch managers had relationships with the people in their community, and knew who could and couldn't be trusted.
It was an imperfect system, where a human could be prejudiced against another human, and deny them access to credit.
Sometimes that would get discovered, and the human was held accountable for their actions, or had their actions upheld by a (org-chart-superior) human.
Similar to the imperfect system today, where the models a computer uses could be prejudiced against a human, and deny them access to credit. Dissimilar in that the model or the computer is rarely, if ever, held to account. "Computer says no" is a meme for a reason.
Sounds like a mess! How in that system will people get access to credit for things like buying fast food or books?
Wow credit for fast food! What about toilet paper? The companies producing toilet paper can't just run a "tab" for their good customers
I can't tell if this is sarcasm, or do you honestly consider credit for fast food a good thing. I hesitate because I know that in America people buy everything with credit (or at least a lot), so it's possible some people think like that. But obviously not buying fast food with credit is a good thing?
they shouldn't
Poor people couldn't borrow and middle-class people paid really high interest rates. Credit ratings are pretty much what enabled the expansion of availability to everyone.
Why should they work. We used to think that money lenders were evil.
Yes, and then in the interim we invented having a hundred trillion dollars in GDP. I prefer having access to credit and so does everyone who owns a credit card. If you own a house, you didn't have its cash value when you bought it; neither your car, nor (most likely) your education. In the days of no borrowing, we solved the problem with ramshackle one-room buildings with dirt floors, handcarts, and the one book whose distributors desperately wanted everyone to have it for free.
> Yes, and then in the interim we invented having a hundred trillion dollars in GDP.
And every now and then we have to rescue banks that are too big too fail at the cost of everyone else, because someone dreamed up a way to increase short term profits that involves giving loans to people who will never pay them back.
> neither your car,
Praising a trillion dollar GDP, but can't afford a used car.
> If you own a house, you didn't have its cash value when you bought it; neither your car, nor (most likely) your education
When I grew up I was told to not make debts if not needed. So many older people did indeed save up until they could afford a car or a house. Education was always mostly free where I lived.
Nowadays it seems like ordinary people would need to pay off a house their whole life and thus also need to keep income high enough to keep paying installments. This takes away so much freedom from people as they are trapped in their high paying jobs...
> If you own a house, you didn't have its cash value when you bought it;
> we solved the problem with ramshackle one-room buildings with dirt floors,
there is a fallacy here. People with access to debt bid up the price of an asset, like a house, against other peoples’ similar access to debt. Sans debt access, the solution was not necessarily a small ramshackle house. The fallacy is the belief that the same asset price - whether opulent or ramshackle house, wouldn’t adjust to the reduced level from the bidding environment. The differential cost of construction for a nicer house can be countenanced in the access-to-debt case, but that is second order.
Illustrative straw-man example: Suppose, once one had a parcel of land, that it was trivial to construct one’s ‘starter home’ the ramshackle house if you like. Get one’s family and friends to help build in exchange for future return favors. As one advances in life, rebuild to have something more opulent. The rub is in the parcel itself. Unlike the would-be house, it had no cost built-in, just whatever price the previous owner was willing to accept to release their parcel. That parcel’s (and those around it) price reflects the market’s access to debt, or lack of access to debt. In the market without access to debt, parcel pricing reflects which buyers have accrued more savings vs other buyers. In the market with access to debt, parcel pricing reflects who can access more debt (through the various means we know of today - down payment ability yes, which parallels the non-debt’s savings case, someone co-signing, long term expected future earning potential vs someone retired, the parcel itself put up as collateral, perhaps other non-immobile assets put up as collateral, like the family oxcart).
The point is that there isn’t necessarily a 1:1 coupling between market’s debt vs non-debt access and whether the construction is opulent vs ramshackle.
> I prefer having access to credit and so does everyone who owns a credit card.
A good number of European countries have only half the poverty rates - the dirt floors and carts you're talking about - of the US yet barely use credit cards.
You send them digitally signed statements from other lenders (who are legally required to give them for free with accurate info) or independent rating agencies, they evaluate them and make a decision. They can have their own model or license one from FICO.
That does mean banks can't know if you lie by omission and hide some unpaid bills, but they can raise the evidence requirements to compensate and I think everyone deserves a second chance.
Having someone vouch for you.
It is illegal, if it's PII without explicit consent.
18 months ago Google publicly stated they were going to start using browser fingerprint data to track users, a reversal of their 2019 policy on it because it was considered too invasive.
https://www.malwarebytes.com/blog/news/2025/02/google-now-al...
There's a fingerprint demo on github called JSCreep (https://abrahamjuliot.github.io/creepjs/) that used to keep your fingerprint profile for 90 days and show you how many times you visited. Worked extremely well, and is still around, but no longer uses the API to retain fingerprint data, so you have to track your hash yourself. It would easily track most browsers across changes in IP address. Only Mullvad, Brave, or Tor would not leave an easily tracked fingerprint.
The demo presented in the royfish.dev link is easily foiled by browser extensions that scramble fingerprint data, the presence of which would itself be detected by more sophisticated profilers and used to define the fingerprint. I can refresh the page and get a new hash and adjective-animal name with the same IP. JSCreep sticks firm to the same hash for me, even with a new IP address and some spoofed browser data.
This fingerprint breaks every 2 weeks when Chrome auto updates. Or any other modern browser.
Overall correct, but you're kind of missing some of the cat-and-mouse details for fingerprinting centered around infosec and anti-fraud purposes rather than generic ad-related tracking. That stuff can get way more intense, and is constantly changing based on new techniques developed, countermeasures from cybercriminals, and mitigations from browser developers.
I think the idea here is that the details shouldn't be publicly known. (Or that if they were they would have to invent their details!)
Is there any way to link this data over longer periods of time?
A lot of data can change over days, weeks, but if you can maintain an accurate fingerprint with tinier changes, and granted you have consistent visits from the user, could you just keep up?
Especially if one service is tapped into several websites, and can continually keep up with smaller data changes and distribute that info. Is this possible? In practice anywhere?
I'm thinking that you just need one website where you can associate a given fingerprint to a specific user and then tracking its activity around the web becomes easy.
Let's say I'm logged in a famous search engine, they associate my fingerprint X to my account A. If they then encounter fingerprint X anywhere else, there is a good chance it was me, A, doing it. If the next day I get fingerprint Y, it gets attached to A as well and the tracking information follows it.
Does this make sense?
You mean, like a really popular web service or app that someone would log into every day/week/month...?
Even easier if, additionally, many of the smaller websites were syndicated into a tracking network?
on what basis do you believe this about fonts? my guess would be that the average user doesn’t install or remove fonts often if ever, but it’s only a guess
I don't actually know how much this happens - software versioning is the biggest one. Chrome updates every two weeks, Microsoft updates once a month, your GPU drivers get updated semi regularly, etc. Any one of those would break the fingerprint.
Your IP changes way less often so that combined with everything else would be more than enough to track you through browser version changes. Even a new IP with the exact same everything else would be pretty easy to correlate too. It just depends on how much they're willing to track and companies are often willing to track a lot already, including things like how fast you type, what kind of movements your mouse makes, etc.
Most people probably have completely default fonts, right? Doesn't seem like much of an identifier anyway
Depending on the browser new fonts can be downloaded and installed automatically. I'd bet most people have a lot more than just the default fonts that came with their OS installed.
Automatically installed fonts don't give much of a signal if they are automatically installed on everyone's machines.
Hmm. I used to have to do that a lot, but I haven't in a few years now.
Perhaps, but that would also mean the cardinality is lower.
I was thinking about the literal fingerprint sensor a device has. Imagine a "prove youre not a bot" challenge and the finger scanner pulls up. What a nightmare, reminds me when a website asked me if I want to login with windows hello (facescan)
That is different though. That site is just creating a passkey and storing in your keychain (or windows equivalent). Windows hello unlocks the keychain. It can be your face, fingerprint, usb key, 4 digit pin anything. Chrome already uses this. You’re not sending your face to that website nor to microsoft, I hope.
Yes, very much. I just fear we may end up there at some point...
One intereting part about installed fonts is that many enterprise companies buy specific fonts. Then they are rolled out to all their devices, and sometimes at least one of them will have the company name as part of it's name.
> Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days.
Indeed. I checked this website a few hours ago and got one fingerprint. Just rechecked and got another.
On the other hand, browsers don't need to share all this data at all. Sure, IP address can't be hidden, but from your example, installed fonts and volume settings? Why should that be shared at all? Sure, for example for a teams meeting, but you'd have to allow the use of microphones or that, youtube for example doesn't need to know how loud you're listening to a video.
> Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Sorry, but that's simply not true. It's actually the default way of how people eg track people across installs in app stores ever since they started removing that feature.
Theres only one solution, ban third party advertising. Everything else is a compromise that doesnt work anyway.
The problem isn't advertising, it's data harvesting and sale. Ads used to rent space on websites - totally reasonable. The whole industry around the purchase and sale of user data is what needs to be banned.
Consequences are deeper than the immediate cause. Advertising is at the heart that gives a lot of value to data harvesting and similar scams.
Data harvesting gains most of its value because they sell some or all data to businesses which wish to leverage that data in advertising. If they cant advertise they wont need most of the data, which should at the least reduce the problem significantly...
Advertising and paid promotion in any form has never been ok. It has always been a cancer on society. That is what happens when you ignore a mild symptom until it metastasizes into something horrible. We need to ban it completely.
Much as i hate being advertised to, i do like the existence of trade, and of new products. In the old days, you would take your products to market once a week on a cart, and the market would pass by your stall. That isn't how it works any more.
Generally, how can society discover new products and services?
I would be open to having some kind of directory that i could browse at my own convenience, but that's ultimately going to devolve to paid placement.
>Generally, how can society discover new products and services?
I'm surprised you can't imagine a society where the consumer would be the one recommending products and not the producer. Any entrepreneur can find one first consumer to test their new product. And that first consumer have access to a great communication network to recommend that products to their social network — it's called "the Internet". Social networks are a great platform for people to share interesting things to their friends, family, colleagues and also to people they don't actually know ("the Internet" can connect you to strangers). Such networks cost little to operate when the content is created by users, instead of producers and their intermediaries (people favors short, insightful written text instead of catchy commercial once detoxed).
Being born in the 1990s, I did experience that "Internet", when advertising networks didn't exist and when people intentionally interacted to make connections and actively look for information. They were happy to tell about things they discovered, with little to expect in return ("influencer", aka mercenary, wasn't a job yet).
You can never get rid of advertising entirely. Ultimately people want to learn about new products and services and new companies that couldn't ever advertise anywhere would die off. It makes sense to support limitations on how and where ads are used though. Banning surveillance capitalism would solve a lot of the problems we have and would mean that a website about cars can still show ads about things people who go to car websites would typically be interested in and that's pretty much the only level of targeting we need.
> Ultimately people want to learn about new products and services and new companies that couldn't ever advertise anywhere would die off.
I want to learn about products that are useful to me, but not through ads. As it turns out, it is incredibly difficult to learn about new products that are useful, as those do not tend to show up in ads at all and even seeking them out is very difficult.
It's weird how no one has come together to make a website specifically designed around users finding product categories that will make their life better. For example, I didn't learn about height adjustable desks from an ad. Nor did I learn about balance boards from an ad. Or trackballs. Or essentially every other product that made my life better once I realized that product category exists.
> You can never get rid of advertising entirely.
What a myopic view. Also, the world is very much filled with shades of gray. I’m certain this dichotomy is indeed a false one.
> Ultimately people want to learn about new products and services
Yes, and those people are free to visit equivalent of mail order catalog or go to the store or subscribe to consumer goods quality testing journal or to any of the enthusiast magazines about electronics or gardening or whatever where they perform independent testing and benchmarking or look up a video comparing ceiling fans across a century when they feel hot in the summer.
So yes, we should absolutely ban third party advertisements. People will still be able to discover good products.
> Ultimately people want to learn about new products and services
Maybe I'm just not a typical person, but I have never woken up in the morning and said to myself, "You know, I would just love for a corporation to help me learn about their new products and services today." Never. Not even once. When I want to learn about something, I will actively seek information out about it, and I'm not going to look to advertisements for impartial information. The purpose of advertising is never to inform. It's to bombard and saturate.
You are 100% typical in this. Advertising is the opposite of informing.
Nobody claims one can get rid of it entirely. Nothing in this world is black and white, there are always shades of gray.
We also cant get rid of cancer, it doesnt mean we shoudl close down all hospitals.
That's one perspective. Other are in different perspectives, like "anything that present something else than the very topic looked for is pure propaganda."
The spectre of possible interpretations is wide.
Some see only problems everywhere whatever the benefits might be, some see only new opportunities no matter the tragic outcomes, some see various blend of this and that.
Theres only one problem most what people call opportunities are not actually positive life experiences.
Or ban all advertising, https://news.ycombinator.com/item?id=43595269
Fingerprinting is still needing for preventing fraud and platform abuse like spam.
How do you tell the difference between a regular human trying to not have a weird creepy perma-dossier collected on them... versus a bot set up to always look like a new visitor?
The only winning move is not to play--er, to somehow not to have this kind of game in the first place.
You don't, you simply make both spend a few billion cpu cycles for it. The human will tolerate the one-time cost. The bot's owner won't because it's not scalable.
It doesn't actually work for that
I worked in fraud prevention for years and device fingerprinting didn't stop fraud, but it reduced it by upping the up the cost. It is not hard to circumvent fingerprinting, but it still takes a non-zero amount of effort on behalf of the fraudster. Device fingerprints helped us identify and block or prevent a lot of low effort fraud and abuse on various platforms.
If it didn't, why do you think every captcha solution uses it? It doesn't have to be 100% effective to be useful.
How would you enforce that? Who can be trusted with the ability to classify things as advertising and in so doing silence their critics?
The solution is explicit trust. Not fingerprints for users, but digital signatures for content. If it's not signed by somebody the user trusts, don't render it.
The user is the only one who can be approach that task without a conflict of interest. If somebody wants the user to run code that phones home about user behavior, make them gain the user's trust.
Many countries ban cigarette advertising. Not saying its perfect but has helped reduce smoking.
That works if your ads have a physical location in space, like a billboard or a radio station, so that you have a place to go when you decide it's time to shut them down. You can't even get a stable URL for a web ad. Where are the cops gonna go? How many different "not my problem try this guy" hops are they gonna have to traverse before they find somebody who actually did the bad thing, how many different countries will they have to visit while they do so?
It only works if you re-architect the web into something that's even more censorship friendly than it currently is. I hate ads too, but the medicine seems worse than the disease in this case.
This is silly, you are dismissing a solution which improves a problem in a positive way.
Hospitals are not perfect, people die, with your l;ogic we should close down them all.
Doing nothing and keeping advertising keeps a negative situation alive.
Reddit definitely relies on this. I got banned from a subreddit ages ago (can't even remember which one), and ever since, any fresh account created from the same device gets shadowbanned almost immediately. Very annoying.
> Remember the big fuss about third-party cookies? It was so big that the EU had already rolled out one of its greatest inventions - consent banners.
It was never about cookies. Thats what the industry made you think. You don't need to show consent banners for cookies (like auth sessions). You need consent for tracking. This includes profiling. And it doesn't matter what you use, fingerprinting or tracking cookies, the consenst banner is required either way.
> the consenst banner is required either way.
Consent is required. The banner is just one mechanism, but not required. A website could hold off on all tracking until a suitable point in the usage of the site (like creating a profile, for example) and ask at that point.
The banner is an artefact of the hostile way most sites choose to try and hoodwink the user into being monetised and ultimately to piss users off so much that they complain about the legislation rather than the lack of online privacy.
And there was an initiative to include tracking preferences in browser HTTP headers, which never made it, as it was quite obvious that this would lead to a lot of people opting out.
Better to just harass them into a habit of dismissing the banner.
Well DNT indeed did not made it, but there is global privacy control header that is nowadays required as explicit opt-out mechanism by CCPA and some other states legislation. I always implement support for GPC in my products.
Never seen this offered to be set by any browsers, though.
Firefox offers it: https://support.mozilla.org/en-US/kb/global-privacy-control
They don't seem to call it GPC, but their "ask websites not to track" feature now uses it instead of GPC.
I wonder how many websites use that header as part of their fingerprint mechanism.
Yes ok, and Firefox was also the only browser that offered DNT, which is why it pretty much died.
It's the complete opposite. What killed DNT is Microsoft adding it to their browser and set it to true by default, pretending they cared about their users. Doing so, it was not the expression of the users anymore and so web developers ignored it, and so it died.
Sorry, that does seem like a reasonable default. This is the fault of web developers to not respect it, not Microsoft. Nice cope.
It died because companies had no incentive to respect it. The writers of the GDPR could have easily added a single line saying you had to respect the DNT header, but they chose not to.
It's set on by default in "privacy browsers" like Brave or Zen, but off by default in most mainstream ones -- user needs to set it on explicitly via about:config
There is also https://killthecookiebanner.eu/
if you write to your reps, they might just change that. The Eu is one of the few democracies left. Slow but powered by the people
I dunno man, from an outsider's perspective I used to think that but it seems to slowly be getting worse with trying to shove through internet surveillance and corporate protectionism under the guise of "protect the kids". I guess sadly someone saw how unreasonably effective that can be in the US.
When there is "legitimate purpose" there isn't reason to as soon items are put in the shopping cart this has to be tracked (be it session in url, cookie, local storage, ...) and no consent is needed.
The exact definition of "legitimate purpose" is unspecific (which is important to be able to adapt to development of new services) which leads to some lawyers being careful.
I also claim that some lobby groups promote having too many and too big consent banners to move blame from tracking companies to the EU ("stupid EU forcing all those banners!") in order to reverse the policy on tracking, which seems to have some effect.
Legitimate interest definition is pretty narrowly scoped. Most of the sneakiness relies on nobody checking or enforcing it.
You are confusing GDPR and ePD. Legitimate interest is GDPR legal basis for processing personal data (it has it's own requirements). ePD triggers when you read/store e.g. browser data and make it available via network. Consent is the primary ePD legal basis and the exception related to that is much narrower (strictly necessary for ISS provider to provide service requested by user).
Generally speaking JS code that makes request to server is covered by ePD while actually processing that request server side is covered by GDPR (there are some nuances to this).
I know it's tempting to put this consent-banner anti-pattern all on toxic ad-driven platforms, because their motives are bad.
The problem with this view, though, is that even the very agencies propagating these rules do the exact same thing! You can go to any site from an EU arm and get the same banners.
At this point, you can't really blame it on bad-faith actors, you have to accept that it's a bad rule. Which is not to say I know a better one!
And then you open the details mentioned in those cookie banners and see literally 600, 700 entities that get data about you shared by the website.
Malicious compliance is not the law-maker's fault.
It's not even compliance. You're required to make consent and decline require equal effort. A large percentage of them make it much easier to consent.
Not to mention the large number of "legitimate interest" exceptions that are absolutely not justifiable.
The main problem with the legislation is its lack of teeth and enforcement.
Is too. They could have thought through the law they were writing and predicted malicious compliance. Or written a stronger law. Or revised the law when they spotted malicious compliance.
I don’t understand why that’s considered legal under GDPR. How can consent be express and informed when it would take 30 minutes just to identify each entity your data is being shared with?
In fact the law even specifies “no pre-ticked boxes” but every banner always has “accept all”. And it’s 50/50 to see “reject all” even though it is a requirement that denying must be as easy as accepting.
They should pay a bounty for reporting non-compliance.
> In fact the law even specifies “no pre-ticked boxes” but every banner always has “accept all”.
That's not entirely true. Websites that don't actively try to fuck over their users (because their purpose is not shoving third party ads at you, it's providing information about/a platform for their company's product) often provide a modal with two buttons:
'Accept' 'Decline'.
This, IMO, meets both the letter and the spirit of the law. The funny thing is, for any website actually doing that, if you click 'Accept', your data will likely only be used to improve it.
A 'cookie banner' I've came across recently (https://www.courthousenews.com/scotus-calls-for-redo-on-wash...) feels so bizarre yet arguably should be the standard.
> Global Privacy Control detected. Advertising cookies are turned OFF.
> Global Privacy Control detected. Advertising cookies are turned OFF.
Yes, I love this. My browser is already sending "do not track" requests.
I’m sure the Meta’s and Google’s on this planet will all faithfully honor our “do not track” requests.
I'm sure if they had to by some EU directive, they would. Organizations that big can't conceal that, as they risk discovery findings and whistleblower activities.
Only when the punishment for not complying is a certain (ever increasing) % of their revenue. And it is actually enforced.
I'm getting a cookie popup floating thing myself with five options, "Accept all", "reject all", "cookie settings", "confirm my choices", and... "cookie settings" again.
Sounds like you don't have the global privacy control flag set. In Firefox there's a "tell websites not to share or sell my data" flag. In Chrome you need to install an extension (such as an adblocker).
I feel it's worth distinguishing between the Hacker News Audience that is highly tech-educated and security-conscious and the general public that just wants to use the web and seems more than happy to give all their data to Meta, Google & Co.
If you ask my 70-year-old mom to decide whether she'd like to allow the WebGL API, she'll go bonkers. If anything, the constant cookie banners have just trained her to consent to stuff out of muscle memory. You could probably design a "Are you ok to sign over the deed to your house" question in the rough shape of a cookie banner and get 90%+ agreement.
My favorite cookie banner is on arstechnica.com:
> We Care About Your Privacy
> We, and our 228 partners use cookies and similar methods to recognize visitors [...]
228 partners should make anybody concious about the fact that something is wrong and you probably should not consent to that at all. Also, nobody cares about your privacy when they think sharing data with 228 parties is okay.
I've seen some sites, mainly in the video game field, that have even higher numbers such as 750. Do I want to share my info with your 750 partners? Um, no. Typically I just leave the site.
The typical wording is "We value your privacy". Which just means they think it's valuable and want a part of that pie thank you very much.
I like that! "We value your privacy. At about $.0003 per data point."
Yeah it’s absolutely how effective the industry psyop against that was
Or alternatively how weak the EU messaging was I guess
it's hard to make yourself heard when your opponents have trillions of dollars hinging on you not being heard and also control the biggest communication channels.
The banners were for those other cookies, often for affiliate marketing and needed permission or at least the appearance of state order
I've never seen a consent banner for being fingerprinted even though I'm sure companies are fingering my prints in the background enough that my colon could become a national database.
The EU/banner situation keeps confusing people because there are two different laws in play:
1) ePrivacy. the OG banner law. requires you to inform the user (but not consent, as I understand it) if you store data on a user's device. includes cookies, localStorage, indexedDB, etc. does not affect fingerprinting 2) gdpr. requires you to ask consent for any kind of user data processing, unless you can find another legal basis
eprivacy was about cookies, but forgot fingerprinting. gdpr was not specifically about cookies. but gdpr (or at least its past interpretation by the dutch privacy authority) didn't require consent for limited first party analytics.
which led to situations where you'd get the impression that you wouldn't need a banner for first party tracking using cookies .. well the gdpr didn't require it, but the older ePrivacy rules still did.
we still have the digital omnibus law package coming up which is supposed to simplify and resolve the overlap between the two above, and reduce banner requirements at least for SMB just analyzing their website visitors
> does not affect fingerprinting
It does. The current version says "storing of information, or the gaining of access to information already stored, in the terminal equipment". Reading e.g. navigator.userAgent is information already stored in the terminal equipment. If you then use that in any way that gets communicated to remote server (e.g. directly or calculating some fingerprint) you read that information in manner ePD describes.
The directive itself has been transposed incorrectly in many jurisdictions. For example from what I understand the Dutch law added an exception (roughly "for obtaining information about the quality or effectiveness of a supplied information-society service, provided this has no or only minor consequences for the user's privacy.") which is not permitted under ePD. ePD exception list is exhaustive and the only other exception can be done via Article 15. The exceptions done via that are related to things like national security and certain criminal prevention/investigation.
Of course that then raises the issue on how you get invalid exception invalidated. I don't know Dutch procedural law well enough to answer that.
That would be pretty narrow analytics to not need GDPR consent. No IP addresses or any way to uniquely identify a person.
Consent banners are generally malicious compliance and designed to annoy.
Doing this on GrapheneOS's built in Vanadium browser, I am concerned to see that the ID remains the same if I move to incognito tabs, or even a private space. Or perhaps Vanadium is doing such a magnificent job of reporting generic info that this ID would be the same for anyone using Vanadium on my model of Pixel, but I don't think so, since the site says it has a "clean read" on all the info it takes. I really do not know. Curious what other Graphene/Vanadium users are seeing.
My understanding of the EU "cookie law" is that it really concerns a broader category of tracking devices rather than cookies specifically. Referring specifically to cookies is probably a side effect of the way tracking was typically implemented at the time.
The fingerprints don't need to be long-time-stable to be harmful. Some companies have your stable datapoints (e.g., email) and your fingerprint. Other companies only have your fingerprint on the same day/week. Some companies have locations of edge devices and the fingerprints. And there are companies out there that will take all of those data streams, both from above board and not-so-above-board players and mix them for commercial benefit.
Per coveryourtracks.eff.org, just my HTTP headers leak 18.46 bits of information, which seems to be the most the tool can report? Presumably most of that entropy comes from my language settings (en-AU,en;q=0.9,de-CH;q=0.8,de;q=0.7), so the only way to be not fingerprintable is to give up on smart localisation.
If people have a problem with fingerprinting, they need to focus on making it illegal to trade data tied to fingerprints, not trying to make users all look the same (we aren't!).
RFC 3282 allows for the exclusion of the quality value, in which case the languages are just given in priority order. Removing that will shave some entropy off.
I have a hard time figuring out why quality values are even included for Accept-Language. They either have one of the preferred values, or they don't.
The quality values here seem pretty generically tied to the order, so shaving them off probably wouldn't help? I presume they are there at all to let you express ties?
It seems so, but I don't know that all browsers map quality values to order of preference in the same way.
I don't know about expressing ties. If there really is a tie and the client is just as happy to receive either language of equal Q, then it doesn't matter to the client that one is consistently preferred over another. Perhaps it could matter to the server if e.g. the client indicated that "en" and "zh" are tied, but the "en" content can be served in fewer bytes than it can serve the "zh" content, but it seems like such a niche use case.
edit: RFC 9110 offers an explanation: "Note that some recipients treat the order in which language tags are listed as an indication of descending priority, particularly for tags that are assigned equal quality values (no value is the same as q=1). However, this behavior cannot be relied upon. For consistency and to maximize interoperability, many user agents assign each language tag a unique quality value while also listing them in order of decreasing quality."
re: ties, often a page has "main" language(s) with more content, and translated version with just the basics. If you speak both you probably want the former. Actually for me often I need to go to the German version of a site rather than English to get what I'm looking for, contra my stated preferences... Localisation is a mess.
That's a good point. I suppose that the quality of the translation could also be a factor. If for example I only slightly prefer my native language over English, the website could (theoretically) spare me the poorly machine translated page in my native language over the original page in English. Multiply the client's quality assessment of the relative degradation in quality given language options with the server's quality assessment of the localizations on offer and serve the content with the highest score.
Fun anecdote: I remember seeing a screenshot of a website selling a scented candle called "basic bitch", which was machine translated so that the idiomatic meaning was entirely lost. So the translation ended up meaning something like "foundational female dog".
Apparently, I have to enable JavaScript to receive a rating.
How could this information be surfaced in a reasonable way in administration software?
Say I have a remote employee who is only able to access your internal systems via his yubikey. His fingerprint is "Genuine Antelope".
Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him. I create a new session for him on the provisioning portal (so he can enroll the new key) but now his fingerprint is "Interesting Elephant". What do I do with this information?
It might be better to log the exact forensics and show the administrator the differences, e.g, "User has a new font called "my_handwriting.ttf" since a week ago", or "appears to be a totally different processor, and the new system has Russian fonts installed".
> Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him
They should be authorized ahead of time.
> What do I do with this information?
Not much. You can't authenticate a person using their (public) fingerprint information.
Your problem boils down to: "How can I verify someone's identity over the internet". You can exchange emergency recovery codes ahead of time (e.g. in an envelope), you could trust public keys from both of their yubikeys, but they can be stolen.
> You can't authenticate a person using their (public) fingerprint information.
Yes, but it's a signal! There's a cost to spoof it. A scammer could cheaply start a VM that clones your font profile, but at what cost could they replicate your CPU SKU and GPU combination to provide identical webGL timings?
Other signals include the ability of your employee to show their face on a video call, to sound like themselves on a voice call, the ability contact you from their home IP, to receive official mail at their listed address, to produce a second 2FA token you'd previously registered (but not activated) or repeat a code word you'd exchanged. Any of these things can be spoofed, bypassed, copied, or burgled, but each one imposes some cost on the attacker.
The question is how to surface this information in a way that equips help desk staff and doesn't deceive them into authorizing unnecessary risks.
Fingerprinting is a way to track you. Cookies is a way for you to keep your own configuration (a panel inside an app open or closed, theme choice, pre-filled calendar, etc). They are completely different.
Cookies are also used to track you. And I’d guess way more cookies are for tracking than personalization.
"Cookies are a way to track you. Fingerprinting is a way to detect fraud. They are completely different."
My reaction to this is always two fold; firstly cool tech, secondly horrifying invasion of privacy.
At {{job}} we did briefly consider rolling out fingerprint.com, but settled on ja3/ja4 at the CDN layer.
Fingerprinting is really bad for privacy and the defenses against it are not there. See https://fingerprint.com. Tor Browser defeats it but I don't think there's a highly usable browser like Brave you can use and prevent being tracked by it.
I've been obfuscating my fingerprint with Brave for years, which I selected specifically because it was the browser I was able to do this with, based on my testing of 5 popular browsers, using https://coveryourtracks.eff.org/ as my benchmark.
It does mean that sites that uses 2FA (so every site nowadays) flag me as a coming from a new device each visit, and I have to have my phone nearby every time I want to use my computer, which is quite annoying. If you use GrapheneOS, you can obfuscate your phone too on WiFi networks (and sites, but GrapheneOS not needed for that, just Brave). You can't obfuscate yourself on cellular networks though, unless you have a ton of sim cards you rotate through.
IMO The EFF test is very flawed because it only tests your uniqueness among the other visitors to that site, not the total possible uniqueness from all the bits of data.
I would bet money that Brave cannot defeat CreepJS. The only thing I've ever seen do it, ironically, is Safari in private mode.
Also just using your computer normally and visiting regular websites already tracks you regardless of your browser's privacy abilities, and I promise data brokers don't care what browser you use, your overall online behavior is still unique.
I accept the challenge. What testing did you do to ensure that you were able to defeat CreepJS on Safari private mode? I would like to replicate it and then see if I can do the same on Brave or another browser.
> unless you have a ton of sim cards you rotate through
And phones!
For years, I've been practicing good privacy-hygiene in public. At my doctor's office, I always wear a Groucho Marx moustache to keep them guessing. Before I walk into my bank for a withdrawal, I team up with two of my friends, set them on my shoulders, and throw a trenchcoat over us! I made a fake ID with my birthday on July 4th and my weight as 98 pounds, but my pharmacy is now refusing to fill my prescriptions!
So what sort of benefits are you reaping from your anti-fingerprinting measures?
Your wit mad my day even though we probably won't agree. I appreciate your humor.
> So what sort of benefits are you reaping from your anti-fingerprinting measures?
Mostly pride on knowing that I'm preventing companies from doing to me exactly what I wouldn't consent to if they asked me outright.
Sure its just for ads (mostly). Sure the chances of my data leak leading to a personalized cyber attack are slim (I don't actually believe this but you might). Sure, [niche scenario] [non-zero probability] might be prevented. Sure there is a meatspace equivalent to the cyberspace invasion of privacy.
I wouldn't consent to stalking in meatspace, for any reason, and conveniently to my knowledge no one is stalking me physically. I dont consent to stalking in cyber space either, for any reason, and I do know that companies do, and they make it an unending uphill battle to let them know and force them to not be blatantly disrespectful. So I will make it as hard as possible, within what I think is reasonable, to make it useless or difficult for them to stalk me online.
And yes, online things have affected my physical life, so these niche applications have occurred to me and my efforts have reduced the negative impacts, to a satisfactory level, and I will continue to kick against the pricks, because it works.
> So what sort of benefits are you reaping from your anti-fingerprinting measures?
A better question would be how are you being screwed over if you never bother to try to stop companies from collecting as much data as they possibly can about your private life? It can cost you a job offer, or cause you to pay more than your neighbor for the same products/services. It can get your data leaked, or sold to scammers. Companies use the data they collect on you for things as trivial as deciding how long to you leave you on hold. The more data they have on you, the easier it becomes for them to use it against you.
Feel free to give companies every bit of personal data they want from you. They'll be thrilled to use that information at any time and in any way they think it will benefit them. Until we have laws against surveillance capitalism the only person looking out for your interests is you, but only if you can be bothered. It'll sure help companies take advantage of you if you decide it's not worth trying.
Yeah, you know what? Life is far too short to live in fear and paranoia of the scenarios you suggest.
Anywhere I go in meatspace, people could be collecting data about me and my behavior. That has always been true since the beginning of time. An old lady can sit on her porch and take notes about my outfit, my comings and goings, and every driver who comes to my door. Today, they're saying that Target can definitely hear our WiFi/BT MACs as soon as we get into their store, and they see/track everything on camera everywhere inside. My Groucho Marx isn't going to hinder or change that!
All I can do, honestly, is be judicious about what sites I visit, and be forthright in my interactions. I should cultivate good relationships with trustworthy, reputable companies, and stay away from the rest. I cannot ultimately prevent the buying and selling behind the scenes. We cannot realistically prevent collection of everything possible.
I don't shop at Temu or Alibaba, and I don't search on Yandex. I checked my "About Me" on Amazon yesterday and it's shockingly bland and shallow. However I interact with Google, YouTube, Microsoft, and Cloudflare, it's a foregone conclusion that they know everything. My extensive 19-year history on Wikimedia projects is a shockingly rich treasure trove, if anything just my waking hours of every day since 2007! Your own karma score 22,495 in 14 years is probably a fantastic track record of when you were awake and using a computer. If you're so paranoid about Internet privacy, then you wouldn't be so willingly revealing that stuff in public.
I'm using adblocking DNS again, but awhile ago I sort of dropped the pretense of paranoia, because I understood its futility, and again, life's too short. If evil corpos want to do evil to me based on what they think they know, they can do their worst. I am a Christian man accustomed to suffering and infirmity. I got nothing to lose in this life, except integrity.
> I cannot ultimately prevent the buying and selling behind the scenes. We cannot realistically prevent collection of everything possible.
Yeah, but you can very easily _limit_ what is collected and sold behind the scenes just buy switching browsers, changing browser settings, or using a couple privacy extensions. A little goes a long way.
It’s really kind of pointless. They fingerprint you to target ads and that’s it. The valuable data that’s collected and sold can’t be hidden through fingerprint avoidance: anything you actually pay for. Sure there’s privacy cards, but the second you purchase a physical product you have to give up a delivery address and now they’ll just correlate all your disposable emails and privacy cards and whatever else.
Your only option is to never buy anything online and only pay cash.
> Your only option is to never buy anything online and only pay cash.
I probably wouldn't go as far as never buying anything online, but paying cash IRL should be something done by everyone to protect their privacy. There are a few other easy things that can massively improve your privacy with minor or no inconvenience: Linux on every PC/laptop, GrapheneOS on phone(s), uBlock on every browser (or a DNS-level sanitizer), car without cellular modem (pull the fuse), non-Google and non-Apple email (ideally your own server or a small provider in a friendly jurisdiction). Also, don't use social media and text over Signal instead. Of course, TVs and other home appliances should be kept off the Internet. Overall, those are some very minor sacrifices for anyone with a little bit of maturity. It's very far from living off the grid or anything like that.
Well you can buy prepaid cards with monero on xmrbazaar if you want
> It’s really kind of pointless. They fingerprint you to target ads and that’s it.
That's a very early 2000s view of the issue. Ads are not what all the surveillance is for, it's just the publicly acceptable excuse for tracking you that companies love to use because nobody cares which ad they get shown. Being able to build a profile of which websites you visit can provide a ton of information about you and that data is increasingly being used offline. It stopped being about ads ages ago and now what you do online can impact your next job offer, what prices you pay, which policies companies apply to you, etc.
You can never limit all data collection. Going to the store and paying in cash will still have you tracked by Flock cameras. The point is just to limit what you can, where you can. Every scrap of data collected about you is going to eventually be used against you later by somebody. No point in giving them anymore ammo than you have to.
Wow, that is a seriously impressive demo. I wonder how it’s able to distinguish people using identical hardware and software versions (e.g., iPhones on the same iOS version). It was able to correlate my sessions across multiple independent ISPs, with a VPN, and with Apple’s extra tracking resistance in private mode.
> Wow, that is a seriously impressive demo
https://abrahamjuliot.github.io/creepjs/
"Fingerprints are new cookies"
What if "fingerprints" are contained in the values of Cookie: headers
The solution has to come from law. I propose we handle privacy invasion the same as rape. Body and mind aren't up for grabs. That the average internet user is unconscious isn't a valid excuse.
It would be great if a wave of lawmaking started in the USA, because most tech behemots operate from there. I would expect EU to take the lead though IF such a wave would start. The EU has still a fair share of christian/conservative MP's that keeps doing the bidding for companies by pushing chat control, but on the other hand also has some progressive and knowledgeable representatives doing great work, so there might be a glimmer of hope. We need media campaigns and public education though. Political leaders are selected for their political abilities and as such rarely have leadership qualities. If the electorate moves, the leaders will follow it. So we have to start at the bottom.
I like your idea, but as a pessimist, I believe the ship has sailed, all government are craving on monitoring their citizens' move. If there are way for the government to fingerprint their citizen digitally, they will want to do it instead of protect us.
These fingerprints now track us much more effectively than ever, not just for security but for real ad tracking and data selling. Instead of using cookies that are mostly vulnerable to ad blockers and other content blockers, these fingerprints can track us more precisely and can easily bypass our current data security systems like ad blockers. So I think the demand for sophisticated anti-detect browsers and proxy-level tracking prevention will increase. Hmm, let's see what will happen.
It is offensive that browsers give away so much unnecessary info. What is necessary? Language preference, Javascript (yes/no), screen resolution. Optionally, latest supported html/css versions. That it, nothing else.
I understand Google having Chrome send way more info. Why do all other browsers go along with this?
Make it make sense...
Why can't a government simply ban all advertising and instead provide a good enough yellow pages service that just provides the specs of the product in a templated way?
Why would it be a good idea to expose unsuspecting citizens to false claims by the sellers?
Huh, it is different for me on every page refresh. No VPN, etc... just Firefox on Windows with uBlock, CanvasBlocker, and a PiHole. No persistent fingerprint for me!
firefox, ublock and canvasblocker seems to be enough for me. New identity every refresh
I wonder if a browser extension could be made that inspects your fingerprint and informs you if you're too unique, then one-click to 'correct' those unique items (or at least list them), so you can conveniently go back to being ~anonymous if preferred.
If you use Firefox, do the following: Use the extension Chameleon (set it to rotate Random profile every minute), had strict mode with JShelter extension.
This royfish blog example, or anyother, including that fingerprint.com gets new value everytime.
Fingerprint.com charges around $0.004 per investigation, and really encourages you to set up a first party proxy - so iOS doesn't nuke storage after 7 days. And even there, unless its a cookie match; your ID usually carries a confidence number.
That should give some hint about how difficult it is to do in real life, at scale.
This site gave me the name “Greedy Bison”, but it didn’t say how many other “Greedy Bison” are out there. I’m guessing everyone using the very common device I’m using and using the very common browser that I’m using would get the same name as me
Lets hope AI coding agents will let us to modify browsers and OSes quickly. "Remove tracking from Chrome". "Privacy friendly Android, in particular, allow geo location spoofing"
Cookies, in and of themselves, are not bad. Like any tool that can be misused, they're just being abused by a ton of really shitty people in an effort to try to enrich themselves at the expense of others. Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"
> Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Don't you people remember how it was done back when web browsers didn't have cookies, or could be configured to reject or ask for each cookie? The server software automatically added a PHPSESSID parameter to every link, containing the session identifier.
The "PHPSESSID" thing is why many message boards couldn't be archived in wayback machine.
RFC 2109 predates anything that vaguely resembles PHP, and Netscape (thus, defacto, basically everyone using the internet), had cookies 3 years before the RFC. PHPSESSID wasn't added until PHP 4 in 2000.
If you're going to be a bitchy pedant, you'd damn well better be CORRECT.
It's creepy that we all have stalkers that want to know our intimate details.
Just think how are daily actions are someones data and how entire masses are manipulated by using this data.
I have heard from some power users that Brave is one of the best browsers with regard to ad-blocking and privacy. But I think I have read elsewhere that it receives money from ad companies to display only certain ads, which does not make me trust it. Does anyone have facts or know where to find them?
As a general role, always be suspicious of very loud and vocal opinions about product and services. Specially for closed source products and paid services, they often invest in what is called Native Advertisement/Marketing which is basically paying people to lie and pretend it is organic content/opinion.
Second, despite the dumpsterfire that Mozilla’s leadership has been in a decade or so, it is very robust with privacy and anti fingerprint features out of the box, the containers has also stabilised and works great.
Isn't Brave open source? https://github.com/brave/brave-core
Brave outperforms Firefox on the EFF fingerprinting test at https://coveryourtracks.eff.org/
Using Brave EFF reports that I have a randomized fingerprint.
Using Firefox or Edge EFF reports I have a unique fingerprint
I see so many misconceptions on HN about that coveryourtracks site. Neither of those results are ideal.
"randomized fingerprint" -> that's a bad result, it means the site can detect you're spoofing info
"unique fingerprint" -> this is good, ONLY IF you refresh and it still says "unique fingerprint", because it means the site sees you as a brand new visitor each visit, and doesn't detect any (what advertisers would call) nefarious behavior. however, if you visit again and the second time it says "nearly-unique fingerprint", that's a fail because your two visits were linked
The ideal result you should aim for is "non-unique fingerprint". That means your device is indistinguishable from countless others. Blending in to the crowd is what you want.
These tests aren't reliable - Brave does randomise values but it ultimately doesn't do much to prevent fingerprinting, as many values remain static. For example, Brave still exposes your GPU model and driver version.
See Fingerprint.com, despite Brave's protections you'll likely find it works reliably.
> Brave still exposes your GPU model and driver version.
I love that things like this are coming too light. But, I fucking cannot understand how anyone would’ve ever thought this was OK.
> Brave still exposes your GPU model and driver version
They made some improvements August this year
https://brave.com/privacy-updates/38-webgl-webgpu-fingerprin...
So what is next in this cat and mouse game? Fake-slow browser to miss fingerprint? Declare revolution and declare all advertising illegal?
Can anyone confirm that they are also "Gentle Llama" on Mullvad browser?
I just installed it, I want to know if everyone gets the same hash (same identity for everyone).
Iphone safari incognito gives different with every page load.
I think this app is broken. Every time it refreshes it calls me a different name.
Chameleon?
At least when tracking was unregulated, at least you knew who was by the cookie left in your browser, now I just assume everyone and everything is tracking me
With the cookie, at least you could just whitelist some sites and have everything else be deleted once you leave the related website. Though, admittedly cookie-auto-delete often stops doing what it is supposed to.
Amazingly, Firefox incognito seems to defeat this
Ok, but are they really all that new at this stage?
This is already illegal in the EU. The consent banners were never about cookies, they have always been about the tracking itself!
Same thing the other way: no need to have a banner for a simple login cookie which isn't being used for privacy-invading tracking purposes.
Yet I am constantly flagged by various pages because Cloudflare decided I had some bot running at some point on my network. And my IP is fixed. Whatever EU is doing, it doesn't work.
You might have a residential proxy running somewhere on the network. The latest in botnets is bundling a proxy in with some TV torrent streaming app or whatever else that can run in the background and proxy malicious traffic from your residential IP. Services like cloudflare and crowdsec will keep a constantly updating list of the IP addresses that are actively sending bot traffic and blacklist them. If you can work out where the traffic is coming from and shut it down you should have this issue go away.
I have a similar issue. I see cloudflare checkboxes all the time. Google makes me fill out captchas all the time. Sometimes it decides I can’t search, sometimes cloudflare doesnt let me past the checkbox.
I’ve checked my network. I’ve monitored egress traffic. There is no residential proxy. I’m not on a VPN. If anything, services should be able to track me entirely by my home IP that doesn’t change that often.
My best guess is that I’ve committed the crime of not allowing third party cookies? Or maybe the crime of not being logged into a Google account 24/7. It’s not browser or device specific. My iPhone is just as likely to fail the cloudflare checkbox as my desktop with Firefox + uBlock.
I've committed the extreme crime of running no JS and clean cache of cookies. Plus, something as simple as containerizing work/play/research reading, into different browsers, has provoked the Eye of Google to be cast on me
I haven't seen a YT ad in years while in lurk-only mode (no login), which is nice, but I also see cloudflare everywhere , which is not great.
One of the nicer things about LLMs, is that they arrived just in time to erase my dependency in search.
I don't. I had a RSS software that was polling a local auctions website (Allegro) once an hour and that's it.
This should be absolutely illegal, one entity is capable of making my life extra difficult and there's no one to appeal to.
I have experienced the same with Google and with PayPal, whenever I used Tor. When I afterwards visited those sites using my normal browser I got Captchas. They are actively fighting attempts to avoid fingerprinting. Also, I am pretty sure that no browser protects against getting fingerprinted. Test with https://fingerprint.com/.
Oh. PayPal is super interesting because they outfight ban me! But I can change a browser and it works just fine.
Yes, PayPal has blacklists and people land on them very quickly. I play according to their rules, as I need the service when I need something which is not available on Amazon (Which has IBAN).
Have you got a TV? Or a car?
if your IP is fixed, surely no further fingerprinting is necessary?
They don't know that and don't rely on that. That's why fingerprinting exists. They ban only my one browser, that's it.
Static IPs completely destroy privacy when not being shared with many users. Our university has one outgoing static IP for hundreds of users :)
> they have always been about the tracking itself!
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
Yep, and somehow there's always someone who thinks that the "Ah, but this is not a cookie!" is a loophole. It is not, he is just undereducated.
The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)
Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).
Eh reads like a “civil war was about states rights not slavery” argument.
The thing the site is doing that isn’t “strictly necessary” is always tracking.
Point is that tracking isn't the only thing that's not "strictly necessary". And additionally that "strictly necessary" is tied to something specific: internet society service. That includes a very specific requirement: "Normally provided for remuneration". That's why e.g. public authorities should not (usually) be allowed to rely on it, public services are not often provided for remuneration in EU-law sense.
It also limits the exception in relation to e.g. employment.
Well now the thing that isn’t “strictly necessary” and they’re not allowed to do is remember my no cookie preference.
It's not a preference. It literally is the default requirement.
Right, and that wording is why fingerprinting doesn't get around it. The EDPB's Guidelines 2/2023 on the technical scope of Art. 5(3) (final version adopted October 2024) say that when a site's JavaScript instructs the browser to send information back, that is "gaining access" just like reading a cookie (paras 32-34). WP29 had already said in Opinion 9/2014 that device fingerprinting is in scope.
So a canvas/font/WebGL fingerprint used for tracking needs the same consent as a tracking cookie. The guidelines even suggest passively collected protocol signals can fall under it (para 43), though that's where it gets argued.
The weak point is enforcement. A cookie shows up in devtools and in every cookie-scanner audit. A fingerprinting script looks like any other analytics JS, so it's much harder for a DPA to spot and prove.
Yet you can’t set a cookie to remember the preference of opting out.
It's not a preference. It literally is the default requirement.
cloudflare (the cdn monopoly) interpretation of gdpr, is that clicking the "I'm not a bot" you are giving consent to fingerprint because they have to provide you a service you asked by clicking the button.
...it's something i hope no court will uphold. but we know what happens to european courts even looking sideways at American monopolies working as front for fiveeyes.
imo, eff should be starting trials to stress this instead of blogposts.
The regulation is not about cookies. It’s about tracking.
The whole cookie thing has always been bs
the scary part is how little of this needs a third-party script anymore
Mullvad browser. It's Tor browser minus connection to Tor.
opening in a different browser resulted in a different name
Relevant: https://mlfa.org/how-government-surveillance-and-big-tech-er...
These are all a joke anyway
If you've ever worked at a startup, you're probably familiar with the fact that no one gives a crap about this type of stuff early on
The hell with pretty much anything, the only thing that matters is revenue
People only start to care about this after the fact if you've grown to large enough size
If you think stuff like this or right to be deleted stuff is moving the needle anywhere but at the biggest companies, you've been misled
That's the real painful truth of this stuff, most of the time it's just lip service anyway
Wth is anyone going to do anyway? Go through a resource-draining lawsuit against a 20 person company where it will take a year of discovery just to maybe-sort-of prove they've been mishandling your data?
It's going to take some pretty radical new laws for this type of stuff to ever have any meaningful impact
I can't wait for the new EU law for more useless fkin popups
Fingerprinting based tracking is already covered by gdpr.
Fingerprinting itself is also not new.
I was the Gentle Owl. Then I connected to a VPN, opened a private window in the same browser, and didn't maximize the window. Now I'm the Nosy Toucan.
The article's points still stand, but the trick didn't work this one time.
Private window is called out in the article as creating a second entity
We have over 10+ years of employing this tech, and we've found fingerprints for a browser are constantly changing. As such, they are far from being a silver bullet when used as a persistent identifier.
Furthermore, in corporate environments where boxes are set up the same for many users, there are often, or too often, two different users and two different boxes with the same exact fingerprint.
idk man fingerprints don't taste that good
They are not "new cookies". Fingerprinting has been a thing for close to 20 years now.
The whole cookies discussion is a successful diversion by the ads industry. It was never about cookies.
Fingerprints are used for over a decade already, nothing new, just users keep closing their eyes despite knowing, even advanced ones.
I'm skeptical of this magic trick, maybe add a counter with the amount of times I logged in to the website. Or let me save some data to read it from another session. Otherwise lots of people can be identified by that hash, there's no proof that it is unique
I did want to add a counter and see how my script would perform in the wild! But that'd mean I have to store these fingerprints and that requires a bunch of formalities I don't want on my website.
Anyway, it's a simple script for the sake of demonstration. I'm sure you'll get a different hash on other browsers/devices.
>and the solutions Google has developed (Privacy Sandbox) kinda suck and have raised antitrust concerns so nobody uses them.
This is backwards. The antitrust concerns of removing 3rd party cookies led to them developing alternatives.
> Let’s give it up for Google - the biggest ad company on Earth
I think Google needs to be forbidden from causing more damage to the EU market. And there need to be replacements too, once we forbid this Evil entity from sabotaging EU citizens any further.
We also need real open browsers not controlled by greedy Ad companies.
I am also aware of the irony of using thorium here right now (based on the adChrome code base). If I use Firefox, I can not listen to audio since mozilla claims only systemd-pulseaudio using people can listen to audio. Well, chrome plays audio on youtube (which is also owned by Google, do people begin to see how big of a problem Google has become) just fine, so I have no idea what Mozilla devs are smoking. I could recompile firefox, to just use ALSA, but who in his right mind wants to compile a 1% usage base legacy browser that uses ancient technology to compile its outdated code base please?
See: https://www.linuxfromscratch.org/blfs/view/svn/xsoft/firefox...
Mozilla gave up decades ago on fighting adGoogle. And it can be seen via small things too.
Ladybird may be a competitor at one point in time but they ban people from their github repository, which also sends the message "do not contribute to us because we don't care about you if you have dissenting opinions". Well, so much for real competition, when projects get all emo early on. You can't beat the evil adGoogle empire with wishful projections about "conduct of people". That's not going to work. I don't subscribe to any random ruleset made by random people I don't know and don't want to know when they resort to censorship. But hopefully more and more people realise that something has to be done about Google one way or another.
> See, the thing is, it’s not about you at all. It’s not really about the ads anymore either. Nobody cares about you. And if the police or your government happen to care, I’ll gladly take their money too.
> I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.
> And to the highest bidder it goes!
> What does that make you then? A gear? An ox? A volunteer?
This does absolutely nothing for me. If this resonates with you, can you explain?
I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.
If every website you ever visits knows it is you, exactly what links you clicked on, and what content you viewed, forever, are you truly ok with that?
Guaranteed deidentified, as the quote above is talking implying?
It's truly totally ok with me, yes.
(I get the non-anonymized concerns, or risk of becoming non-anonymized, that's not what I'm confused about)
But you are deanonymized. That’s the entire argument. I’m not sure you understand.
I don't think I do.
Is the implication that the machine knows me so deeply that it doesn't matter if it connect my device ID to my name? That it knows me deeply as a person regardless of what identifiers are used?
If that's what meant, I have to say: 1. That's an absurd overestimation of the current capabilities of adtech 2. Even if it were true, I'm not sure I'd be that bothered by it? What I'm bothered by is what could be done with that intimate knowledge. And if the answer is just "show me the absolute most optimal ads", this doesn't really bother me.
That's why the quote I highlighted confuses me.
wow on chrome based browsers, the fingerprint survives even in incognito mode.
On Safari, fingerprinting doesn't survive in incognito mode. Same with Firefox.
Good thing I use different computers for different purposes, though it looks like using different browsers seems sufficient.
It's not true, fingerprinting on Safari is also easy regardless of Incognito, VPN and whatnot.
Different computers doesn't solve a lot of fingerprinting methods as well.
It’s a question of entropy. If your device is unusual in detectable ways, then the fingerprint has high entropy. But on my iPhone I suspect most of the things being fingerprinted are the same. How many other people get “smug koala”?
Couple different results than that across three refreshes on iOS w/iCloud Private Relay. Apple does work to do some randomization.
But at least the moment we start using websites the largest players will know it’s us. Nobody else swipes and types exactly like me on my screen size of iOS over the relay.
fingerprints pick up on all sorts of things that make you different enough combined with another signal, 33 bits can be enough to single you out from anyone else on the planet... iOS can be 10-15, and given a residential IP that's plenty - always mobile is more anonymous on the web but guess what's much worse? apps.
a native app with 0 permission prompts gets you more bits than web
No. Almost everybody using an iPhone is on the latest release, plus or minus one while updates are rolling out. For a given iOS release and hardware type almost all of those probes are highly correlated. No way there’s 30 bits of entropy in that. I doubt there’s even 10.
Now on a desktop PC sure I believe these fingerprints are highly descriptive. And in android land they probably work okay because of the diversity of products and configurations. But iPhones resist fingerprinting just because they all give the same answers.
I just said iOS can be 10-15, correlated with anything else it can easily be 30. Download an app and visit their support site and that's likely enough to narrow you down.
The web provides:
time zone language and locale (accept-language header too) iOS version screen size and pixel ratio text size dark/light mode reduced motion ad blocker extensions for safari
An app provides (without additional permissions):
IDFA advertising ID (unique and cross app) IDFV (vendor ID) AdAttributionKit (which apple does obscure somewhat) Battery level, charging state, volume, headphones Various appearance settings again (font, dark/light, reduced motion)
Just slightly more permission granted via prompt can get you:
System boot time and uptime Disk space Keyboard languages and extensions File timestamps
Then additional individual permissions (which people agree to all the time for specific use cases)... at this level they can single you out easily: location contacts bluetooth motion sensors
To Apple's credit they're trying to make fingerprinting more difficult and attempt to ban it entirely, but it's not at all impossible.
Fingerprints of one kind another have also been around for a very long time.
Privacy people are insane to me.
Some of these guys sound like they erase their fingerprints off the plates when they visit a restaurant, and ask people to forget about them when done talking.
Like it or not, as web gets more complex, it will recognize you more. If you don't want that, just don't use the web - perhaps buy a farm and life off-grid.
I just don't get what's the appeal to this endless damn cat and mouse game.
It’s a lot of work to collect fingerprints off plates. You can build surveillance that way but it scales terribly.
On the web you can do that much more efficiently. That scares people.
As in any defense/offense situation, it’s all about balance.
Goycattle like yourself ought to be executed for the sheer stupidity of your opinions. Privacy is the only reasonable response to the unhinged behavior of web advertisers, who will spend trillions of dollars and decades of research, who will bribe politicians, who will do everything in their power to figure out the shape of your butthole so they can perfectly optimize which sex toy ads to show you. It is utterly psychotic behavior and pretending it is anything else is the either dumbest or most malicious thing anyone has ever done in the last century. If restaurants were to frantically scan their dirty plates for fingerprints after customers are done eating, the customers would be damn right to try to wipe their fingerprints off. Obviously that isn't necessary, because restaurant owners aren't completely out of their minds. So why does the web have to be this way?
"By the way, if anyone here is in marketing or advertising... kill yourself..."
So you're basically saying the old "I have nothing to hide" argument which has been debunked over a million times...
In particular because "I have nothing to hide" means "I have nothing to hide until now, and because of the corporations and states that have access to my data are lead right now by people I trust not to misuse that data"
But if tomorrow the government change, and suddenly your searches for "gay bars near my location" becomes illegal, you'd rather this info not be in everyone's hands...
Lack of privacy harms journalism and activism, making the government too powerful and not accountable. If only activists and journalists will try to have the privacy, it will be much easier to target them. Everyone should have privacy to protect them. It’s sort of like freedom of speech is necessary not just for journalists, but for everyone, even if you have nothing to say.
"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else."
You took a guess. You guessed wrong
I have not "disabled Javascript". The software (pl.) I'm using to request and read web pages has no Javascript interpreter
I can also insert a CSP response header such as "default-src: 'none'" and get the same result ("...") even when using software that runs Javascript with Javascript enabled
This "data" does not seem very useful for advertising except perhaps something like "don's waste time trying to target this user as they will not see or hear the ads"^1
What are these "network-based" methods exactly
I never see any ads when using the www. I attribute this mostly to not using popular software controlled by companies or individuals that advocate for internet advertising. This software could be something as complex as an operating system or a "browser" or something as simple as a Javascript sourced/planted in a web page
Whatever these "network-based methods" are, they don't seem to be very effective at targeting me with ads
I generallly stay in textmode. Most internet ads seem to be graphical and/or audiovisual in nature
Hypothetically, if a "developer" tried to target me with text-based ads, I could easily filter them out
I already filter the text in response bodies using a local forward proxy
For example, the "score" on HN comments I submit never goes below 1 in the HTML I'm reading. In theory this helps avoid self-censorship
Here is an excerpt from rewrite.lua
1. Of course companies like Cloudflare are using the www user's choice to run/not run Javascript as a way to collect fingerprints and filter out users who are not using advertising-friendly software