Web fingerprinting is worse than I thought

https://www.bitestring.com/posts/2023-03-19-web-fingerprinting-is-worse-than-I-thought.html

620 499 3 years ago

walrus01• 3 years ago

If you don't pay attention to it you might be surprised how non dynamic your residential internet last mile DHCP assigned IP really is. It's not uncommon to go many months or a year with having it always renew to the same address. That, combined with all the fingerprinting mentioned in the article...

pbhjpbhj4• 3 years ago

This would be one of the things about IPv6, we'd have lifetime fixed IP addresses (or address ranges at least). Wouldn't we?

intelVISA• 3 years ago

Then IPv6 adoption must be frustrated at all costs, in the name of liberty ...of course.

perlgeek• 3 years ago

There's "Privacy Extension" for that, from https://labs.ripe.net/author/johanna_ullrich/ipv6-addresses-...

The IPv6 Privacy Extension is defined in RFC 4941. It is a format defining temporary addresses that change in regular time intervals; successive addresses appear unrelated to each other for outsiders and are a means of protection against address correlation. Their regular change is independent from the network prefix; this way, they protect against tracking of movement as well as against temporal correlation.

colinsane• 3 years ago

DHCP and NAT are perfectly compatible with IPv6.

kavalg• 3 years ago

Indeed. The IP looks like a strong signal in the overall game of fingerprinting.

clnq• 3 years ago

Yes, the IP and the user agent string appended and CRC’d is a good enough fingerprint for basic web analytics, like for identifying returning customers.

The false positive and negative rates are reasonable, and false positives (new customer seen as returning) could be further reduced by browser feature testing.

nuker• 3 years ago

Apple added iCloud Private Relay for that.

matheusmoreira4• 3 years ago

I wish browsers did more to combat this. There should be ways to randomize or normalize every bit of information they try to gather.

donatj2• 3 years ago

It’s a double edged sword you need to walk the edge of. Almost everything they use to fingerprint you has a fully legitimate use case which is why it was added.

The more you do to prevent fingerprinting the more you hobble the web as a platform. A lot of restrictions that got placed on the canvas tag to help prevent fingerprinting for instance really limited its functionality.

In my opinion a workable solution would be to make more of these things opt-in by the end user to high accuracy data for the page.

aaomidi2• 3 years ago

Most of those APIs should be default closed. Incognito should definitely be default closed.

choeger• 3 years ago

Well, we could fingerprint the fingerprint detection code ...

sophiabits• 3 years ago

If Javascript is enabled there’s ultimately very little that can be done to prevent fingerprinting. If you don’t want to be fingerprinted then only allowing JS to run on allowlisted websites is the only way to truly be safe

pbmonster• 3 years ago

Well, and stuff like the resistFingerprinting=True option in Firefox. As described in the article. You can make your browser to just lie to the JS API.

There is a price, of course. Lying about screen resolution might mess up how the website looks. Lying about which fonts are installed might make the site a bit uglier.

neop1x3• 3 years ago

As someone said already, 'resistFingerprinting' option should be configurable per-domain. Then we could have it enabled (randomized) for most of the web and disable it (allow fingerprinting) for payment processors and similar 'trusted' websites.

chaosite4• 3 years ago

It's important to know that the mentioned "resistFingerprinting" breaks a lot of the web.

Examples include the back button, uploading photos on some websites uploads random data instead of the photo, etc.

db48x3• 3 years ago

If it breaks uploading a photo, it’s because the page unnecessarily copies the image into a <canvas> and then tries to upload the data from the <canvas> instead of the original image.

codetrotter• 3 years ago

the page unnecessarily copies the image into a <canvas> and then tries to upload the data from the <canvas> instead of the original image.

Surely there could be valid reasons for doing so?

I imagine for example that:

1. It ensures the selected file is a valid image before uploading it

2. It strips meta data like GPS position from the image before uploading it

3. It could reduce the size of the image, by either scaling it down, or compressing it more, or both, before uploading it

chaosite4• 3 years ago

It's necessary if you have filters in the upload flow, like Instagram does (which is why it breaks.)

Or it might not be strictly necessary, but Instagram does it anyway.

donatj2• 3 years ago

There are many perfectly valid reasons to do that. It’s a lot more scalable to resize images client side rather than server side and using a canvas is one of the simplest ways to achieve that.

throwawayapples• 3 years ago

unnecessarily

No, this is how most pre-upload image editors work. Why upload a 5MB avatar photo that's you're going to have the user crop and scale on the client-side to a few hundred KB first?

Using canvas for this is much more friendly to their bandwidth, no nefarious intent needed.

rolisz• 3 years ago

For the photo problem you can give explicit permission for the website to use Canvas and then reupload the photo. It's annoying, but oh well.

vesinisa3• 3 years ago

I just tried putting it on with the idea of trying it out for one workday to see if it breaks something. It immediataly broke favicons on my GitLab tabs (turning them into random vertical stripes of pixels), which is both odd and a pretty bad start.

I really like the idea behind this feature, but it seems the Web API might have become too complex to counteract bad actors like this. It's particularly scary that it can correlate your activity in private mode with your identity in normal mode.

d-z-m5• 3 years ago

RFP randomizes Canvas data extraction by default, which might have something to do with it. Gitlab favicon seems normal to me when I navigate there(RFP on).

perihelions• 3 years ago

It also breaks page zoom. The user's preferred zoom level for a domain isn't preserved between new-tab page loads, but resets itself every time.

(I'm guessing it was too much implementation work to separate out this feature: to preserve normal, expected UI behavior client-side, while presenting a fake pagezoom value to scripts. That would degrade only a handful of (poorly-designed, script-layout) websites, rather than the whole accessible browser experience).

seqizz• 3 years ago

Yeah I enabled the option yesterday after learning, today I disabled it back since NOPE without site-specific zoom settings retained the web is too inconsistent for me.

bawolff3• 3 years ago

I've been using it for years. I've barely noticed.

d-z-m5• 3 years ago

This is FUD. As others have said, been using RFP for years and barely noticed.

chaosite4• 3 years ago

I'm not saying don't use it, I also have it turned on. I'm saying that it has consequences, and you might not immediately realize it's related to RFP.

account4214• 3 years ago

It also tells websites that you want a light color scheme (instead of not indicating any preference).

victorbjorklund• 3 years ago

Damn yea I didn't know it was so easy to do in practice (I just heard about theoretical approaches)

oellegaard• 3 years ago

Actually quite surprised to see that this identifies me on Safari in Incognito, after visiting in regular mode first.

helsinkiandrew2• 3 years ago

And on Chrome - even counts the number of times you visit in incognito

momentoftop2• 3 years ago

I don't understand the test on this page. It says we should be worried because a fingerprinting website generates the same hash even after you clear your cache and site-data, and even if you go into a private tab. But I'm not overly concerned by this, provided I share that hash with other people.

The worry would be that the hash is unique to me (i.e. a fingerprint), but I don't see the evidence that it is.

mejutoco• 3 years ago

Here is evidence that the hash can be unique, or narrow down a small group of people

https://coveryourtracks.eff.org/

jefc11113• 3 years ago

This is a nice website.

suprjami• 3 years ago

The likelihood that you have the same hash as other people is exceedingly small.

So if I fingerprint you on a site which is using my commercial fingerprint service, then I can sell your hash to other places and tell them all about your browsing habits. The more places run my fingerprinting service, the more data I can collect on you.

momentoftop2• 3 years ago

I understand the principle. I'm saying that the test on this page isn't demonstrating uniqueness, and so isn't demonstrating fingerprinting.

The first time I heard about fingerprinting was with EFF's panoptoclick, which stated how many hashes had been generated from visitors, and how many you shared with them.

illiarian9• 3 years ago

It's enough to narrow you down to a specific bucket. E.g. "affluent white young male in his 30s in a specific neighbourhood" and serve you ads and news. Collate with a few other sites (even airline checkouts and boarding pages have tracking), and you have a close enough match.

The worst part of this? Trying to hide from fingerprinting makes your fingerprint more unique

geysersam3• 3 years ago

Trying to hide from fingerprinting makes your fingerprint more unique

Didn't seem so in the experiment in the article.

Sure they'll be able to place you in the bucket "tor user", but is that really more narrow than what you'd get without Tor?

geysersam3• 3 years ago

Sure, the advertisement graph only showed recall and not precision. Maybe everyone gets the same hash! That'd explain their excellent results.

However, I doubt that's a problem in practice. I'd assume these finger printers know what they're doing. It certainly seems so.

How could one make an experiment collecting lots of these finger prints and determine the false positive rate?

asdman123• 3 years ago

Unfortunately the many, many browser capabilities have given adtech enough entropy to actually create globally unique fingerprints. You can lookup yours with an estimation of uniqueness here: https://amiunique.org/fp

aflag2• 3 years ago

The site they use give you a visits counter. So, if that matches what you did, you didn't clash with any other user's hash.

toldyouso2022• 3 years ago

GDPR should have been approached at browser level. But there would not have been money to make for those that provide "compliant" banners. I guess the economy needed the stimulus.

pavlov• 3 years ago

It's not too late. The EU is breaking Apple's and Google's mobile app store monopolies next year with the Digital Markets Act.

Those same two companies effectively control the browser market. If there's political will in Europe, they can be forced to implement working privacy controls.

illiarian9• 3 years ago

GDPR should have been approached at browser level.

GDPR. isn't. about. browsers.

fstrazzante• 3 years ago

I totally agree with you! .. and second: the website navigation would be smoother without those banners!

geysersam3• 3 years ago

GDPR isn't about cookies, browsers or the web.

But there would not have been money to make for those that provide "compliant" banners.

Are you serious? Do you think WordPress addon makers lobbied GDPR through the European parlament?

Kaotique• 3 years ago

Too bad the biggest violator also created the biggest browser.

illiarian9• 3 years ago

Note also: As the number of APIs increases, so does the fingerprinting. E.g. MIDI device enumeration (no prompt in Chrome, prompt in FF, not implemented in Safari): https://twitter.com/denschub/status/1582730985778556931?s=20

factormeta• 3 years ago

We need 2 classes of web. One for document based that doesn't require JS to run (secure). Insecure, all the SPA and anything that require JS to see the full content.

grishka4• 3 years ago

Back in the day, we had a nice boundary between the document and the "app". Then for some reason we decided that Flash doesn't need to be a thing any more and erased that boundary by building the app functionality into browsers themselves, making the app and the document inseparable. We should have invested that effort into building an open source Flash player instead.

One of the nicest things about Flash was that you could set your browser to only load and run Flash content after you click it.

olebedev2• 3 years ago

I think we will end up with something like permissions grants (including granular JS APIs available for the website, as we do for the location, camera APIs etc, at the moment) per website and convenient tools built-in browser that allow you create/re-use patterns so you don't actually interrupted by this strictness too much.

wraptile• 3 years ago

Yeah that's never going to happen - javascript is a lost cause. There's no way any sort of conflict and backwards compitability will lose out to "a bit more privacy" especially when people in control benefit immensely from this.

nordsieck3• 3 years ago

We need 2 classes of web. One for document based that doesn't require JS to run (secure).

I've wondered for a long time if a sort of posh gopher based on markdown with extensions would be able to make a comeback. Especially if it allowed for CSS.

Spivak• 3 years ago

Which class you're in will be in control of the developer and they'll always choose SPA even for the presentation of static text.

And to be fair it makes a lot of sense because writing HTML templates feels super jank once you've experienced not doing it. Even for a site with static content I would still prefer to deliver it as a static JS bundle and a data payload.

I really like https://docsify.js.org. Gotta be one of the lowest touch libs out there. The whole site from git repo to page one single completely static asset.

derefr4• 3 years ago

The dark web is the document-based web. Sites built for Tor Browser have to assume JavaScript is disabled. So they have to rely on server-side rendering, old-school HTML forms, HTML meta refresh, etc.

Surprisingly, one thing that seems to work just fine in this environment is (even modern versions of) phpBB. Lot of phpBB dark web forums.

Also surprisingly, this doesn’t preclude polish or some level of app-like stateful interactivity, because CSS still works. You just have to think differently about how you use it.

jefftk5• 3 years ago

MIDI device enumeration is behind a permissions prompt, though? "The user must explicitly grant permission to use the API though a user-agent specific mechanism, or have previously granted permission." https://developer.mozilla.org/en-US/docs/Web/API/Navigator/r...

EDIT: nope, not as implemented in Chrome https://www.jefftk.com/test/webmidi

illiarian9• 3 years ago

At the time of the tweet not in Chrome: https://twitter.com/denschub/status/1582730988118867968?s=20

Vinnl• 3 years ago

Didn't Firefox also require the user to install an extension before enabling MIDI support?

Edit: I think MDN confirms this, with the asterisk next to Firefox: https://developer.mozilla.org/en-US/docs/Web/API/Web_MIDI_AP...

Edit 2: oh, the tweet shows two prompts, one of them to install the extension, so I suppose that is actually the prompt you're referring to.

1vuio0pswjnm72• 3 years ago

"That's how web works."

Nah. I make an HTTP request and I get a response. That's how the web works. Perhaps people can have different opinions on "how the web works".

Web fingerprinting relies on a heap of assumptions. For example, that someone uses a web browser to make HTTP requests, that the web browser sends certain HTTP headers in a certain order, that the web browser runs Javascript, that it processes cookies, recognises HSTS response headers, and so on and so on.

If all the assumptions are true, maybe web fingerprinting is effective. But if the assumptions fail, maybe web fingerprinting does not work so well.

I have only ever read blog posts about web fingerprinting that take all the assumptions as true.

The majority of traffic on the internet is said to be "bots". Not web browsers running Javascript, processing cookies, and so on.

It seems to me that someone should discuss what happens when the assumptions fail.

Do advertisers care about computer users who do not use graphical browsers much. As such a user, IME, the answer is no.

(Interesting to see how defensive replies get. It's obvious the "tech" crowd intent to spy on web users is heavily reliant on certain assumptions to remain true forever. It shows that there is necessary pressure to keep web users using a "preferred" web browser and web ""features" that will subject them to "web fingerprinting". Perhaps the assumptions will always be true, conditions will never change, in the same way that interest rates could never change.)

twelve402• 3 years ago

"bots". Not web browsers running Javascript, processing cookies, and so on

even the simplest bots nowadays can run Javascript and process cookies. What's much harder for a bot (or some other actor that has been doing shady things across many websites) to uniquely fake are things like the graphics card (WebGL Vendor & Renderer), audio and other hardware, which gets queried during fingerprinting.

Full fingerprinting is relatively expensive, so it originally was used by fintechs to combat fraudulent/automated signups, but with the third-party cookie situation it might be already economical to track regular users for ads/retargeting.

JD557• 3 years ago

I think you can still be fingerprinted without cookies or Javascript (e.g. with HSTS supercookies). It's obviously not as effective.

bearmode• 3 years ago

Do advertisers care about computer users who do not use graphical browsers much. As such a user, IME, the answer is no.

Almost nobody does this, so obviously not. You're probably in a group that makes up less than 0.0001% of web users. And that might even be generous.

1vuio0pswjnm72• 3 years ago

Let's take the CommonCrawl bot, "CCbot", as an example. There are no images, CSS, or JS files in the CommonCrawl archive. Is the CCbot running Javascript. Is it equivalent to a graphical web browser with all the same features.

GPT-3 was trained on a filtered version of CommonCrawl.

IMO, this is text-only web use. No (fingerprint-friendly) graphical web browser needed. Others may have different opinions. Perhaps I am biased as I use the web this way seven days a week.

kapsteur• 3 years ago

You can try https://www.amiunique.org/fp to get a view of all params can used to track you

stefncb2• 3 years ago

It's interesting that they can narrow me down to less than 0.1% with just my language list (en-US,en,fr,ro). My user agent is practically unique as well, since I'm running an unusual configuration. I've never thought of that as a disadvantage when it comes to tracking, hah.

iudqnolq4• 3 years ago

They narrowed me down to an order of magnitude less based on just my browser user agent (latest Firefox Android). I'm not sure what that actually means.

Semaphor4• 3 years ago

I have "prefer English, German as fallback". That alone makes me almost unique as well. Not fully (like your special config :D), but enough that other resist fingerprinting options become meaningless.

throwaway20230211• 3 years ago

I observed this too, but I cannot really believe it. For me it finds just german on the iphone. I get 0.88% for it. But if all Apples do it the same, I can hardly believe this provides already such selectivity. The problem with such test sites seems to me that only nerds visit them, and therefore the database is small and biased.

macinjosh• 3 years ago

Almost no one visits that site so their data set is very small

est2• 3 years ago

so in order to stay anonymous, one can clear these parameters, alternatively one can generate different parameters for every HTTP call.

than312• 3 years ago

No, any session based protocol (HTTPS) would expect certain characteristics to stay the same between the same session.

If it changed with every call they'd just block you as a bot.

justusw• 3 years ago

Ironically, that site has a cookie banner. This made me confused as to whether I should accept cookies or not.

pr0zac• 3 years ago

I like this site for the info on how tracking is done it provides but the data set it generates uniqueness from is really tiny and differs a lot from real world browser makeup.

For instance it claims iOS is 4.63% of users and Safari is 3,42% when all other more complete statistical sources put those numbers at closer to 20%-30%.

helsinkiandrew2• 3 years ago

Surely if your website collects data using browser fingerprinting this is covered by GDPR and you have to tell your visitors/ask for permission?

https://www.eff.org/deeplinks/2018/06/gdpr-and-browser-finge...

Zurrrrr4• 3 years ago

GDPR doesn't really apply outside of Europe, despite what the EU might claim.

twelve402• 3 years ago

also, one could just roll it up into a wall of fine print or something, no? who reads these things anyway?

akie3• 3 years ago

The EU does not claim that it applies outside of Europe, just that the law applies to all your customers/visitors that are within the EU.

AraceliHarker• 3 years ago

They claim to be ‘GDPR and CCPA Compliant: Your compliance officer will love us, too’. However, GDPR defines ‘personal data’ as ‘any information relating to an identified or identifiable natural person’, and this includes ‘an identifier such as an online identifier’. Therefore, browser fingerprinting may also fall under the scope of GDPR.

akie3• 3 years ago

I believe that, despite their claims, this fingerprinting technique actually DOES violate the GDPR.

throwaway20563• 3 years ago

It is interesting that the site can fingerprint individual profiles/dir easily:

For example

chromium-browser --user-data-dir=/tmp/profile_A

chromium-browser --user-data-dir=/tmp/profile_A --incognito

chromium-browser --user-data-dir=/tmp/profile_B

chromium-browser --user-data-dir=/tmp/profile_B --incognito

For each command + its incognito it can detect them as separate profiles.

For ultimate privacy one needs to everytime launch browser with a new profile.

vesinisa3• 3 years ago

... on a new computer, each time ordered from a different brand and reseller, paid with a unique type of cryptocurrency and delivered each time to a new dead drop in a different country.

throwaway20563• 3 years ago

I tried live boot of ubuntu. Every time it can detect accurately. Looks like the whole privacy thing is OVER. Unless lawmakers do something - (i.e) not going to happen!

Atleast they can use this to prevent reCaptcha - and make passwords disappear!

jb19914• 3 years ago

How does the fingerprinting know the payment method you used to pay for the computer, is that stored somewhere in the operating system? How would they know it was a dead drop also? Genuinely curious.

throwaway20230211• 3 years ago

Do these profiles clear their cookies after request? I assume if the service finds a matching cookie, it will prefer it, or at least use as an extra identifier.

throwaway20563• 3 years ago

Technically one can create this and launch a new profile everytime. It can still detect the device (there are some failures - if I change the screen resolution/dpi). May be after 3 or 4 times, the server may also detect that a certain ip address is trying the same thing.

TEMP_DIR=$(mktemp -d /tmp/chromium.XXXXXXX) ; /usr/bin/chromium-browser --user-data-dir=$TEMP_DIR

At the end as other say they use hardware information + IP + other stuff. It is a lost battle.

throwaway20230211• 3 years ago

Did you check amiunique.org as well with these?

ale422• 3 years ago

Is this _only_ figerprinting then? If the profiles are different, do they manage to extract some UID from the profile (which I would assume is a bug in the browser), or do they store data client-side using persistent storage APIs?

richthegeek2• 3 years ago

Chrome does give access to localStorage/sessionStorage in Incognito and this can be used to communicate between tabs on the same domain, but just like cookies and cache this data is wiped if you close the Incognito instance.

It's certainly a mystery, because you'd expect any capability fingerprinting (some combo of UA, extensions, CPU/GPU specs, IP etc) to give an identical result between profiles, so it does seem there's some per-profile difference. But I can't think of any browser API that exposes something like an ID...

noduerme10• 3 years ago

Look, forget about threat models. It's relatively trivial these days to avoid fingerprinting attacks if you want to (as a private, web browsing individual).

I use fingerprinting actively in enterprise apps as a form of silent 3FA. It's a useful backstop. If I have a user who forgot their password but retrieves it via email, I'll usually let them pass if their fingerprint matches one of their priors; otherwise my software shoots off an email to their immediate superior to make that manager validate that the machine the employee is using is one they can vouch for.

I've always viewed browser fingerprinting as something that can be leveraged as a security feature. It's far more useful for that than for some sort of distributed tracking. I'd never want to live in a world (ahem ... China) where submitting to such fingerprinting actively was mandatory, or politically punishable if you didn't. No society should be run like an employer/employee organization with that sort of lack of trust. No sane free person would allow their own browser to transmit a fingerprint. But for employer/employee systems management? It's a great tool in the box.

rat9988• 3 years ago

"It's relatively trivial these days to avoid fingerprinting attacks". Why should it be on me to avoid them? And more importantly, it's NOT trivial.

noduerme10• 3 years ago

really? it takes a minute to set up a VPN and do your web browsing through a virtual machine. I guess it's not "trivial" for the average American, but it definitely is for the average terrorist or child pornographer, so it's easy compared to surmounting most other threat models faced by people intending to evade detection. Therefore, "trivial".

[edit] also, the less trivial it is, the better for corporate security.

zelphirkalt3• 3 years ago

(1) Users should not receive passwords via e-mail. (2) How very enterprisey of you to even be able to send passwords, which one also should not be able to do. (3) Users can change or modify their browser, either to another browser entirely or through installation of addons. The fingerprint is not guaranteed at all to stay the same or similar.

praestigiare• 3 years ago

This is an uncharitable reading of the comment. "Retrieve via email" can just as well be understood as reset using an email flow, as is common on most websites. And the comment does not claim they rely on fingerprints never changing, they say that if you do have a matching fingerprint, you can use that instead of another procedure.

charcircuit4• 3 years ago

(1) There is nothing wrong with sending a password via email. Even if you send a reset link instead an email provider could steal that too.

(2) The server gets sent your password every time you log in. You shouldn't rely on a server operator not knowing your password.

(3) You can tune how sensative the system is in response to changes in the fingerprint. Even if their in a failure to match that just means authentication will be extra strict.

ashildr• 3 years ago

Dunning and Kruger agree.

reportgunner2• 3 years ago

I'm afraid your view is how the journey to the *"world where submitting to such fingerprinting actively was mandatory" starts. Something with frogs in very warm water.

noduerme10• 3 years ago

I upvoted this because it's the only smart comment to my post here. This is the ultimate concern.

That said, fingerprinting is only useful as a third security measure because most people don't understand its mechanics. The mechanics of avoiding being tracked are pretty basic. If our country required browsers or computers to transmit their fingerprint, people would find ways around it and it would stop being useful as a security metric.

Put another way, the moment this becomes a feature of an oppressive regime, it's one of the easiest things to work around. The obscurity is what makes it remain somewhat useful.

xkcd19633• 3 years ago

You seem to have a conflict of interest here. How can you accept this for employee/employer but at the same time say it's not ok for a person to submit fingerprinting? Employees are also persons.

noduerme10• 3 years ago

Because the software is only allowed to be used on company computers and a few personal devices which have to be approved by upper management. It isn't fingerprinting the person or the public. It's checking that the software is running on a known/approved machine.

raverbashing• 3 years ago

There's a flipside question as well, how many users have the same fingerprint as you?

speedgoose• 3 years ago

It depends on your browser. You have a common iPhone with Safari in your local language, many people have the same fingerprint. You configure your iPhone with Chrome (that is a webkit view on iOs) and another language, you are suddenly much more rare. You compile Firefox on your ArchLinux with Nouveau drivers and a 16/10 screen, you are unique in your area.

You can experiment there: https://coveryourtracks.eff.org

zamubafoo• 3 years ago

As the years pass, I keep thinking back and realize that Richard Stallman was right all along:

For personal reasons, I do not browse the web from my computer. (I also have not net connection much of the time.) To look at page I send mail to a demon which runs wget and mails the page back to me. It is very efficient use of my time, but it is slow in real time.

Technotroll3• 3 years ago

I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built up around WGET requests, and then employing some "likelihood machine" on it, to make educated guesses as to how likely it is that the WGET request was actually from Richard Stallman. I think we've just stumbled upon a new and "fun" Where's Wally game here!

BeefWellington• 3 years ago

WGET can be pretty trivially told to send custom headers.

TylerE4• 3 years ago

The GNU/Hurd in the IA didn’t already do it?

gabipurcaru• 3 years ago

I'm pretty sure wget has plenty more users in addition to Stallman

GuB-42• 3 years ago

I actually did exactly that a while ago. Where I worked, we didn't have internet access but we had email access, so as a workaround, I made an email server on my home machine that fetched web pages for me. A coworker took it even further and made a proxy server that automated the process so you could actually browse the web, although very slowly. Just to say that Stallman is not the only one with this idea.

It was in the early 2000, and smartphones weren't a thing. It also was a time where companies were paranoid into letting employees access the internet, but at the same time had abysmal security. By that I mean viruses ran free on shared folders, undetected because their antivirus software was years outdated. Very different times...

croes• 3 years ago

Maybe he's setting a false trail and using curl

boopmaster• 3 years ago

Are we losing the point, here? “Does not browse” When interacting with webmail- also does not browse directly, preferring CLI scripts to act as intermediary. Does wget execute .js or .css or execute anything it reads beyond a URL redirect? Is wget a huge attack surface like a browser?

m4jor• 3 years ago

There are so many bots sending wgets I dont think its a real issue.

nebula8804• 3 years ago

Stallman shot himself in the foot by having a text only blog that was easily searchable when it came time for the wolves to cancel him. A crappy proprietary blog or thousands of hours of ranting via Youtube videos ironically would have slowed down the haters and maybe even cause them to miss things with which to cancel him with. Its hilarious in an ironic way. Bonus points if the cancelers were running GNU software. :D

anthk4• 3 years ago

Wget can mask the User Agent and lots of variables.

szundi• 3 years ago

Hard to watch netflix or YouTube whis way. Considering I have just learned electronics design from YouTube, this is inconvenient.

arjvik• 3 years ago

mpv is perfect for this

cobbzilla• 3 years ago

For Youtube, try invidious or yt-dlp

anthk4• 3 years ago

I use DilloNG, an Invidious instance and mpv being called from the page with a right button click.

jonhohle3• 3 years ago

A more modern equivalent might be using something like archivebox instead of browsing directly.

NoZebra120vClip• 3 years ago

& . . . . @

"Mail for you, sir!"

ThePhysicist• 3 years ago

Using the IP address & user agent alone already gives you nearly 100 % accuracy, so the fact that they can re-identify you when these things stay identical isn't surprising at all. I tested that website as well and if you take care to rotate your IP address their re-identification rate becomes abysmal, especially if you're using a privacy-focused browser and extensions like Privacy Badger / uBlock.

misja111• 3 years ago

Exactly. IP address identification is the elephant in the room that the article just briefly mentions. Nearly all websites that want to target adds to you use that. It's just so simple to use, you can't switch it off like you can with cookies, except of course by using a VPN but almost nobody does that.

ridgered4• 3 years ago

I often see the narrative on here that consumer VPN providers are almost useless for privacy due to other fingerprinting methods, which I've never really bought.

aflag2• 3 years ago

And if we ever migrate to ipv6, the IP alone may be all anyone needs to fingerprint you.

bauruine4• 3 years ago

Every device implements privacy extensions which changes the address every 24 hours. It's no longer based on the MAC and hasn't been for a long time.

brunoqc• 3 years ago

I wonder if https://jshelter.org helps with that. And if it's not too slow.

hilbert424• 3 years ago

Ha! I followed the instructions and went to fingerprint.com and it all 'crashed' because I had JavaScript turned off—that's my normal default setting.

I have five different browsers on my smartphone and three on the PC all sans JS and none of them are Chrome. Also, normal operation is to automatically delete all cookies at session's end.

My smartphone and PCs are de-googleized and firewalled and I never see ads in my browsers nor in apps. The apps are mainly from F-Droid and sans ads and the few Playstore ones I use are via Aurora Store and are firewalled from the internet when in use. Honestly, I cannot remember when I last saw an app display an ad, it has to be years back.

In the past I used to go to more extensive measures to stop the spying but I found it was unnecessary as the spy leakage was essentially negligible with much less stringent efforts.

It's pretty easy to render one's online personal data essentially wothlesss if one wants to. On the other hand if you insist on using JS, Gmail, Google search, Facebook etc. then you're fair game and you only have yourself to blame if your personal data is stolen.

comboy• 3 years ago

The more you customize the more unique your session becomes.

kuschku3• 3 years ago

Not if you disable JS, cause the website then can't see any of these customizations.

smirgel2• 3 years ago

To me this seems extremely elitist. Non-technical people deserve to have their personal data stolen because they don't know about javascript for example?

RalfWausE• 3 years ago

I run a similar setup as the OP when browsing the modern web, but i think it is in a way our responsibility as professionals to help the less tech inclined to navigate the sea of monsters the modern web has become.

For example: I have set up the systems of family members for whom i am some sort of digital janitor with a nice collection of firefox plugins to get rid of the worst offenders.

orbisvicis• 3 years ago

Technical defenses are never perfect. In a sense they provide security through obscurity, as evinced by the comments above regarding Stallman's use of wget. If everyone applied technical defenses equally then workarounds would quickly be found, and everyone would be equally vulnerable. So privacy is a scale, and being in the minority provides its own defense. If in aggregate each individual is equally valuable, then the value of breaching a minority's technical defenses is some inverse multiplier of the minority's size. Personally my threat model is to put in just enough work to never be the juiciest target.

favaq• 3 years ago

Yeah? If they don't know how to operate a computer then they shouldn't be operating one. The same I would feel if someone without a licence crashed their car.

yjftsjthsd-h3• 3 years ago

Non-technical people deserve to have their personal data stolen

Nobody said that. "My defenses work" != "my defenses should be necessary".

dylan6043• 3 years ago

I get where you're coming from,but...

If you continue to willingly use socials like FB, TikTok, et al, your complaints about stolen personal data fall on deaf ears. Show me that you don't have those apps installed or do not visit their websites, then we can talk about being serious on deserving to not have data stolen.

matheusmoreira4• 3 years ago

Have you ever tried to talk to "non-technical" people about this subject? They treat you like you're one of those tinfoil hat crazies.

At this point I'm 100% OK with us being the only ones able to protect ourselves. We warned them and they didn't care. Allow them to remain uncaring. We don't have to help everyone. People must want to be helped.

hilbert424• 3 years ago

"To me this seems extremely elitist."

Right, it probably is. But the issue of stolen personal data has been around for so long that nontechnical people have had years to develop political lobbying and to swing elections to put a stop to it.

The fact is that most people don't give a damn about such matters, if most did then the problems would be behind us by now.

Thus, unfortunately, with the internet it's every man and woman for him or herself. QED!

psacawa• 3 years ago

Before you get all jubilant, note that they have fingerprinting techniques which don't use JS[0]. It was able to identity me. Contrary to popular opinion, disabling JS doesn't protect you from fingerprinting.

They describe their approach[1]. They use HTTP headers and conditional request triggered by CSS conditional media queries to gather data. Something like @media(...) {background: url(/tracking/$clientid)}. But in principle, they could also try and fingerprint the TCP/IP stack or the TLS implementation. I'm not sure it would get them more data than OS+Browser, though.

[0] https://noscriptfingerprint.com/

[1] https://fingerprint.com/blog/disabling-javascript-wont-stop-...

worg• 3 years ago

FF mobile gives be different IDs each time I run a new private session on both the JS an non-js demos (I run w/o JS usually AND have enabled the resistFingerprint setting)

labcomputer• 3 years ago

It’s one thing to generate the same hash for the same client, but it would be interesting to know how often the hashes collide, too.

I also notice that the no-JS hash changes when I move the window to a different monitor.

hilbert424• 3 years ago

"Before you get all jubilant, note that they have fingerprinting techniques which don't use JS[0]. It was able to identity me."

I didn't detail every protection I've put in place or the post would have been too long. However, I'd suggest that spreading my browsing over at least eight browsers (and I actually use more than two machines and do so at different locations and with different ISPs) effectively reduces my profile across the net.

I also use randomized browser user agents and clean links, occasionally I'll even cut-and-paste links between multiple browsers in a single session. I often do this on HN not to hide from HN but for convenience when multitasking. (Having worked in surveillance professionally, this modus operandi just comes naturally, it's now second nature for me to work this way.)

Working with multiple browsers and multiple machines also solves the problem when on rare occasions I have to use JS. That said, I never watch YouTube with a JS-enabled browser, instead I'll use NewPipe or similar. There are other measures I could list but you get the idea. Oh, and I never use the internet on a smartphone with a SIM enabled, instead the SIM resides in a separate portable router and my 'real' phone is a dumb feature phone, it's only capable of making phone calls.

I really don't care if some stuff leaks but I've satisfied myself it's pretty trivial, as frankly, I've not had one indication over the past 20 or so years that I've been targeted as a result of fingerprinting. It's not necessary to make things completely watertight, I'm not trying to hide from the NSA or GCHQ, etc. (and it'd be unsuccessful and a complete waste of time to bother trying).

Moreover, even if something were to leak, I'm simply not a revenue-making target—that means I never respond to any targeted marketing because I simply never receive any.

izacus5• 3 years ago

Why is this being fought with technical measures (which are ineffective and cripple the web as a platform) instead of legal consumer law where you can easily fine and punish companies that do the fingerprinting?

EDIT: Note that you can do BOTH - but one without the other is just a game of whack-a-mole.

mcherm2• 3 years ago

Because some browser-makers (Firefox at least) believe that the identity of those browsing the web should be protected. Legislators do not believe that. (At least, a majority of legislators do not.)

dgroshev6• 3 years ago

Would you consider the entire European Union a minority of the legislators? Because that's what GDPR is designed to do, make identifying customers well controlled and expensive whatever the method.

Granted, the enforcement should be stepped up.

giancarlostoro8• 3 years ago

What kills me is the cookie consent stuff, they should of enforced that Do Not Track is honored, and have fees that make sites ensure compliance or be sued over not honoring DNT which iirc was sent as a HTTP header, it would of actually been a meaningful solve.

dismalpedigree• 3 years ago

What a legislator believes is irrelevant. Only what the lobbyist is paid to believe is relevant.

siquick• 3 years ago

Because like the climate crisis, it’s easier to make the individual clean up the mess and make the changes than hold large organisations accountable.

masklinn• 3 years ago

Because like the climate crisis, it’s easier to blame the individual than clean up the mess and make the changes.

FTFY?

Arnt5• 3 years ago

A law needs a justification and needs to apply equally to everyone. Writing that about fingerprinting would not be trivial. Some site operators can make a believable argument that they use it in ways that are good for society.

hutzlibu• 3 years ago

"Some site operators can make a believable argument that they use it in ways that are good for society."

Example please

mschuster912• 3 years ago

Because bad actors have an easy time on an actually global network. It's disturbingly hard to hold bad actors accountable, particularly if they have zero legal presence (e.g. a corporation's subsidiary) in one's jurisdiction.

bigfudge6• 3 years ago

But we’re talking here about major corporations who would (largely) follow the law if there was a law with teeth commensurate with the potential rewards form abuse of privacy.

izacus5• 3 years ago

Is it really that hard? I haven't seen anyone from US actually attempt any accountability - zero punishments for spam callers, zero punishments for data collectors, not even a semblance of attempt to punish data traffickers?

than312• 3 years ago

The short answer which should be obvious... regulatory doesn't work, legal doesn't currently work.

The burden of proof is on the claimant, and with proper information control you can't ever meet that burden of proof. It becomes an ant versus a gorilla instead of David vs. Goliath.

Tell me, how do you differentiate a simple random alpha-numeric string from another random string that may have been generated as a fingerprint.

Mathematically do you think there's any way to actually prove one way or the other? If not, how would that bias the system if the person is adversarial and lies.

The only way to prevent this is to make sure the information is nonsensical.

Preventing collection would identify you in a way that they can prevent access. Even though websites are public, you see this happening with any captcha service.

izacus5• 3 years ago

Can you provide any proof that "regulatory doesn't work"?

Might be my European outlook, but consumer law has been stupidly effective at curbing abuses from companies here and was much more effective than playing the technology race USA is trying to fight. There's always a next side-step, the next abuse a company can invent - and you keep trying to push the responsibility of avoiding it to users (by adding more and more onerous technology) instead of punishing the abusers.

sneak2• 3 years ago

Laws only apply in some countries. The internet is global. Technical measures are faster, more effective, and can be applied in all places.

account4214• 3 years ago

Laws can be as global as those in power want them to be. See e.g. copyright.

kuschku3• 3 years ago

That law already exists. It's called the GDPR. That's what it's for, and what you’re giving permission for when clicking "accept all".

luckystarr• 3 years ago

I use the usual adblocker UBlock and:

* https://addons.mozilla.org/de/firefox/addon/canvasblocker/

which prevents fingerprinting via Canvas elements, additionally warns you if a site does it. There are more sites out there than you would assume. Some stupid blogs even.

* https://addons.mozilla.org/en-US/firefox/addon/multi-account...

This splits your tabs into different categories, each with their own cookie storage.

The fingerprinting website in the article didn't manage to correlate me visiting the website concurrently from two distinct container tabs.

stinos• 3 years ago

The fingerprinting website in the article didn't manage to correlate me visiting the website concurrently from two distinct container tabs.

But that's merely because of the canvasblocker (or something else you have), because just separate containers doesn't cut it?

sluuuuurpey• 3 years ago

If you buy two of the same exact model iPhone and boot/config IDENTICALLY, on the same Wi-Fi network, they would have the same fingerprint, right?

Technotroll3• 3 years ago

I'm just guessing here, but I'm fairly sure that they use a model that updates dynamically as the "user" or victim changes his or her web browsing settings, and even when the user tries to hide. It easily sounds like some kind of Bayesian filtering going on, or some sort of Markov Chain or decision tree. That is to say that their model tracks the likelihood that you're the same unique user that reloads the page based on the information it can glean from you.

This makes it exceedingly hard to hide from such a filter, because in communicating with these sites, you are bound to reveal at least some information about yourself. And then the "likelihood-machine" does the rest by connecting the dots, even if you gave them "fewer dots."

It's also quite interesting - or perhaps chilling - to see how fingerprinting through NLP and other language tracking algorithms can also track just about any forum post you do, even if you're using a pseudonym.

Jaer3hah• 3 years ago

Well, I'm glad to report that my efforts to fight fingerprinting have paid off.

I use a text based browser, with no js, no cookies, no css, no external requests past the first html page download, no user agent, no etag, I connect through Tor and I've modified the browser to randomize http headers. And of course, it sometimes happens that I want to see something that is refused to me with that configuration (like, seeing anything behind the big internet killer, aka Cloudflare - thanks archive.org for existing), so I have also a classic browser for the occasional lowering of barrier.

At first, I thought fingerprint.com did identify it, giving me the hZ4W5oQ7pJVIHbW2fBXA id. Then I realized it was giving the same id when using curl with and without Tor. Then I realized, by googling and ddging that id that it's the one reported as well to search engines. So it's not unique and it's basically a "dunno" reply.

Semaphor4• 3 years ago

For anyone who this is news to: This is why I always call the "I don't care about cookies" extension an adtech submarine, because it deceives you into thinking it’s all about cookies, when the permission you give automatically in many cases are about tracking, so using that extension will often have you consent that fingerprinting you and creating a profile based on that is perfectly fine.

meghan_rain3• 3 years ago

Implying they actually stop tracking when you press "Reject"

TeMPOraL• 3 years ago

They may not, but if you're in/from the EU and press "Reject" and they still track you, they're breaking the law.

miggol• 3 years ago

To me, the thing is that I can't count on the consent modals to actually do anything. Am I really going to invest time into checking their word? How would I even do that? That's on top of all the time wasted moving sliders or hiting "reject all".

For me, the cookie consent modals are the submarines. Why would I outsource the responsibility not to track me to the people with the incentive to track me? IDCAC, Cookie Autodelete, and strict tracking protection feels like the better alternative for me.

(From today onwards, I'll add resistFingerprinting=true to that list as well.)

Semaphor4• 3 years ago

Obviously this only is relevant for people who think companies care a bit about trying not to flaunt the law, I thought that was a given.

There are also proper consent blockers [0], but they are not as big because everyone tells people to use that please track me shit.

[0] https://github.com/cavi-au/Consent-O-Matic

dariosalvi78• 3 years ago

the problem is that the alternative, that is native applications, is even worse. Let's face it, some level of identification comes with networking, there are ways to anonymize connections, but none is perfect.

Tracking should be limited with legal means.

jamesfisher• 3 years ago

Why do these systems use hash-based fingerprinting? Wouldn't it be "better" to have a "browserspace vector", or "browser embedding"? So that if one fingerprint tactic fails in incognito, you don't completely lose the fingerprint, you just get a slightly different vector?

KoftaBob• 3 years ago

I was able to "trick" the fingerprint.com test by opening it first with firefox, then with tor browser. Gave two different visitor IDs. So as suspected, it largely relies on IP address.

aembleton• 3 years ago

A different browser with the same IP also gives you a different hash.

reportgunner2• 3 years ago

Seems like a disguised ad for that fingerprinting service. Resist fingerprinting was already set to true in my Firefox. "Worse than I thought" apparently means "I thought there was no fingerprinting but I found out there is fingerprinting."

SV_BubbleTime6• 3 years ago

Try to get a non-unique on iPhone. I’ll admit it’s worse than I thought.

alkonaut2• 3 years ago

What is the use case for these fingerprints when adhering to the GDPR? You can't store them in a DB and use them to target your returning anonymous visitor with products relevant to their last visit. You can't send them to a third party ad service to get more relevant ads. Isn't the whole point of the fingerprint to maintain an pseudonym for your users over some time window? But that requires storing them which would be against the GDPR?

charcircuit4• 3 years ago

To prevent spam. If someone is spamming your site how do you tell if a request is coming from a legitimate user or if it is coming from the spammer. Fingerprints are how you can tell the two apart.

alkonaut2• 3 years ago

I thouht that was most commonly dealth with with a first party cookie. I.e. show the captcha to anyone who doesn't have the cookie. At least that's how it feels when you browse incognito.

darefalcon2• 3 years ago

Agree - cross site tracking of devices without consent is going the way of the dodos. With respect to fraud prevention, being able to analyse device signatures along with identity and behavior on a per-site basis is the only reason we are enable to enjoy what’s left of the ‘open web’

beeforpork• 3 years ago

When I switched off fingerprinting in this browser, the font size here on Hacker News changed. I suppose it just uses the user agent to set a certain font size, or does Hacker News track based on fingerprinting?

richthegeek2• 3 years ago

The CSS for HN is very terse, and aside from a mobile-specific set of rules it doesn't really do any variation.

Is it possible you had set the zoom level previously, which the browser remembers between sessions, and turning off the tracking reset the zoom to 100%? Do you have any extensions like Greasemonkey or Stylus for per-site customisation?

red_trumpet• 3 years ago

You mean `privacy.resistFingerprinting` in Firefox? I guess that disables custom font configurations.

EastSmith• 3 years ago

It is sad that Brave + uBlock Origin + DDG Privacy Essentials does not seem to be able to fight this.

CatWChainsaw• 3 years ago

Wouldn't the browser and extensions make you more unique?

redbell• 3 years ago

Another method for web fingerprinting is called GPU-Fingerprinting [0], codenamed 'DrawnApart', it relies on WebGL to count the number and speed of the execution units in the GPU, measure the time needed to complete vertex renders, handle stall functions, and more stuff..

_______________________

0. https://www.bleepingcomputer.com/news/security/researchers-u...

est2• 3 years ago

What the world needs:

danbruc3• 3 years ago

Can we fingerprint fingerprinting code and block it? At first glance it seems like code accessing all kinds of unrelated high entropy APIs should be something detectable. But then static analysis might be too hard in face of obfuscation so it would have to be done using dynamic analysis which kind of means you let the fingerprinting happen but are now at least aware of it. So how do you prevent the fingerprint from being used? In principle one could maybe mark values from entropy sources as tainted [1] an taint all the variables potentially influenced by those values and prevent them from leaving the browser. Not sure if this would be practical and I am even more skeptical that this could be easily added to existing browsers.

[1] https://en.wikipedia.org/wiki/Taint_checking

than312• 3 years ago

The short answer is no you can't block it because that identifies to the site owner that you are blocking it (as a negative match).

You'd have to mask every informational API with a suitable corrupted alternative that is plausible.

danbruc3• 3 years ago

This is confusing whether it can be blocked and whether it would be effective. Every time you do something unique, you of course become identifiable. But the idea is of course that you are not the only one blocking these scripts which will only make the entire group identifiable. You could for example try to block those scripts with a widely used ad blocker which would make you not stand out any more than any user of that specific ad blocker. It would probably not be too effective as URIs and file hashes or whatever ad blockers use are relatively easy to change, but in principle you do not have to become uniquely identifiable by blocking fingerprinting scripts if enough people are doing so.

t0bia_s• 3 years ago

Mull (FF fork on Android) and LibreWolf (FF fork on desktop) has privacy.resistFingerprinting = true by default. Highly recommended!

https://f-droid.org/en/packages/us.spotco.fennec_dos/

https://librewolf.net/

timbit42• 3 years ago

Do they remember site zoom levels?

mihaic• 3 years ago

Fingerprinting is doing terrible things for big-tech data collection, and at the same time it's excruciatingly hard to protect against bots, spammers, fraudaters etc without it.

Few people seem to try to reconcile this, since neither side cares about the other.

I personally think that discussion about fingerprinting as raw tech, without mentioning the size of the company collecting the date or the purpose is meaningless, and only leads to a few tech savy users having less data collected on them.

Most people want to use Javascript, use the default setting and not be afraid of clicking on links. I can't really see a good solution without a coordination of regulation and tech standards, so I'm hopeful at least for decent solutions.

enjoytheview3• 3 years ago

You don't need to precisely identify users across sessions without their consent to detect bots, advanced anti-bots make heavy use of biometrics to detect bots and don't rely too heavily on fingerprinting, mostly because they're easy to spoof in general, but generating human-like mouse data is a bigger challange.

paleotrope• 3 years ago

I wonder if you could use a chicken like in the old chicken tic-tac-toe machines to mimic real user behavior.

jsmith45• 3 years ago

Sure, but on the other hand, a lot of anti-fingerprinting efforts strive to reduce the info available including things like mouse movement data.

Mouse movement data is a fairly potent fingerprinting vector. Bucketing the average spouse speed and acceleration rates could provide provide useful information. This may imply specific OS speed settings, or physical mouse DPI. A machine learning system would likely be able to distinguish traditional mouse, vs trackpoint, vs touchpad, vs trackball. Etc.

Also it is not just bots that have non-human like mouse movement. Many assistive technologies would have no mouse movement, or would auto snap the mouse to relevant spot. That is actually a quite powerful for fingerprinting, since assistive technology users are a pretty small subset of internet users, so only a relatively small amount of additional data is needed to uniquely fingerprint that user/machine.

faet• 3 years ago

https://github.com/Xetera/ghost-cursor

shanebellone• 3 years ago

Disabling JavaScript does not stop fingerprinting either. HTTP headers are sufficient to construct unique user identifiers. Passing that data via API to a FaaS provider would enable cross site tracking that's invisible to the visitor.

Edit: The required FaaS implementation is trivial too. I could launch an endpoint that performs exactly this function in 30-60 minutes.

fnordpiglet2• 3 years ago

In fact, the disablement of JavaScript itself is a very identifying characteristic.

TheRealDunkirk2• 3 years ago

I can't really see a good solution without a coordination of regulation...

Totally agree that this is perfectly within the government's purview, and they should be doing something about it. But, as with anything else in the US, until a Fortune 100, some few 1%-ers, or the deep state MIC wants it, we're not going to be getting it.

zer00eyz2• 3 years ago

Target and the model that found the pregnant girl (bad counter argument here: https://medium.com/@colin.fraser/target-didnt-figure-out-a-t...

There are three options:

1. Prevent/Stop it: This ship sailed long ago. Not to be grim about it but pandoras box got opened.

2. Fight it: Tool up, change your print, your behavior, your place. Build focused VM's that you use per topic. Simply do a WHOLE lot less. In the grand scheme, its a lot of work for low return. Note: there are exceptions.

3. Increase Noise: The whole point of most data collection is to sell more to you. Because most people are sheep, a fairly simple model can be surprisingly accurate (over targeting is an issue). Don't be a sheep, diversify, make more noise in the system, search out side your comfort zone and change it up often.

cuu508• 3 years ago

Regarding the more noise strategy, Mozilla has this fun tool: https://trackthis.link/

avnigo• 3 years ago

I thought about the noise route, but doesn't that make you more unique? Maybe if many users share the noise, but then that makes it easier to identify what's noise and what's not.

zer00eyz2• 3 years ago

Any thing that doesn't impact the signal, or can be separated from the signal does not qualify as noise.

You want to quickly throw targeting systems off your scent (or get them distracted) see how sticky high value sales are for the ad's you see on line. Start looking for a new car, use the word wedding too much (god help you if your a woman) or say vacation 3 times near search engine and watch how quickly your ad experience changes.

This won't work "long term"

As an example: You get an ID as a 24 year old male, who likes his local sports ball team, drinks canned domestic beer... that's a profile that is perfect to sell you a BBQ grill and a subscription to the meat of the month club. Spend an hour or two a week pursuing sewing, the engine is going to get confused! Maybe you share a device with your wife, or she got on it...

This is the sort of noise you create, its not random its "more" and you do it by going off type for a while. Have a friend who is into something you aren't (music, art, and so on) ask them some questions and go spend a week getting more informed on their hobby and have a chat with them. Suddenly the systems will see you as MORE...

ergonaught2• 3 years ago

Even after discovering it is worse than they thought, it remains far worse than the author thinks.

Public knowledge is far behind the actual capabilities in practice.

d-z-m5• 3 years ago

This is easy to say, but not always true. Can you elaborate about concrete details of the "capabilities in practice"?

ergonaught2• 3 years ago

I can but frankly I'm pretty happy about the lack of lawsuits in my life currently.

IvanK_net• 3 years ago

The idea of the Incognito mode is, that the website should be unable to detect that you are using the Incognito mode.

There is a bug in Chorme, which I reported, but they told me they will not fix it: https://bugs.chromium.org/p/chromium/issues/detail?id=120485...

Brigand• 3 years ago

You are not detecting incognito mode but another attribute that correlates with incognito mode.

switch007• 3 years ago

On iOS I visited fingerprint.com on safari twice and then opened used Brave with its “Block fingerprinting” setting enabled and it registered it as my third visit! They should label it as “resist” as it’s a lot more honest

And https://www.amiunique.org/ says I’m unique in Brave compared to “nearly” in Safari haha

SV_BubbleTime6• 3 years ago

Same. I did iPhone with VON change, cleared cache, firefox or IOS, blocking extensions, and… it gets me every time.

dean2432• 3 years ago

with resist fingerprinting enabled in FF, it resets the zoom level i have set on each individual site, so it's just annoying.

darefalcon2• 3 years ago

“Worlds most accurate”: Source, fingerprintjs. Sounds legit.

someoneFromWeb• 3 years ago

I tested it on Brave mobile (Android) and I got different fingerprint each time

fnord77• 3 years ago

the demo got my browser totally wrong. it has me showing up in various places around the country and I don't use a VPN. One of the dates I was out of the country and my laptop was at home, turned off

SV_BubbleTime6• 3 years ago

You are using cellular data then. Your exit point when using 3-5G can be a lot of strange places. Not unusual.

mwexler• 3 years ago

The EFF has tried to get folks to pay attention to this for years. See https://coveryourtracks.eff.org/ aka Panopticlick

And it probably understates the problem these days, missing some of the more recent techniques.

cobbaut• 3 years ago

How many websites do you need to visit before being unique in the world?

Say I follow AS Monaco football, then look for Lego Castle figurines and finally visit a forum on Alaskan Malamute dogs. The combination of these three websites is pretty close to unique in the world imho.

Surely most people can be uniquely identified after visiting a couple more, unless we change browser and ip-address and GPU and set resistFingerprinting=true and ... and clear cookies after every website we visit.

shashashank• 3 years ago

I remember once in college I'd shared my phone's hotspot to connect a TV to the internet after it had abruptly stopped working. And all of a sudden the ads being shown (on YouTube) switched from the local language to mine, both of which are completely different.

ttyprintk• 3 years ago

The combination of IP, language preference and available fonts is very potent and not obvious to Americans.

tomxor• 3 years ago

I think Firefox might actually enable this by default for third party sites, but not 100% what this about:config one does:

  privacy.trackingprotection.fingerprinting.enabled

This would make sense since messing with values for the root frame could cause unwanted side effects, but you're not likely to care if some iframe gets your screen resolution or CPU count wrong.

bawolff3• 3 years ago

I dont think this is a proper way to test it.

It matters more how unique your fingerprint is than how consistent or reproducible it is. Just testing if you get the same fingerprint back on your second visit doesn't tell you much if you don't know how many people "share" your fingerprint.

As a silly example, if you gave all users the same fingerprint, it would be very consistent but also useless as a tracking method.

jamespking• 3 years ago

On the demo they have previous visits from your fingerprint listed (so you can get an idea of how common the fingerprint is... at least once enough people have tried the demo). Mine had two visits listed which are not mine when using Safari and private relay. On Firefox there were none (and it tracked in normal and private mode).

lh7777• 3 years ago

On my iPhone, I was surprised to see I had made 20+ visits when in reality that was my first visit to fingerprint.com. It makes me feel better that my fingerprint isn't actually unique!

aaronrobert• 3 years ago

From my testing, this doesn't seem to work on Safari. But it actually works on Chrome. Another reason for using Safari instead of Chrome.

aktuel• 3 years ago

If I have a certain phone model with updates applied. Is there something that distinguishes me from other people with the same phone and browser version other than the IP address?

mdorazio• 3 years ago

I, too, would like to know this and find it odd it wasn't mentioned at all. Most web traffic these days is from mobile devices, not desktops/laptops. And Apple at least seems to try doing a decent job of obfuscating trackable info by default on top of massive numbers of people having the same device (probably not true for Android).

SV_BubbleTime6• 3 years ago

I have been trying Apple devices for an hour now. Nothing I can do gets them to pass the eff or linked tracker sites.

Firefox, VPN, privacy extensions, nothing works.

Apple has work to do.

29083011397778• 3 years ago

Literally the comment below yours mentions GPU fingerprinting (0). Regardless of whether you won or lost the silicon lottery, you're different enough to be tracked.

(0) https://www.bleepingcomputer.com/news/security/researchers-u...

boomlinde• 3 years ago

Do you have the same localization settings? The same timezone? The same browser settings? The same screen orientation? The same model of bluetooth headset? These are all likely factors in a client-side fingerprint.

funstuff0072• 3 years ago

We use web fingerprinting and adjacent methods to crack down on ID sharing for our SaaS that charges (per person). I make no apologies for this practice.

msm_3• 3 years ago

How does that work out for you? This doesn't strike me as a good use of fingerprinting:

- Since you charge per person, what about people that use multiple machines and browsers (with presumably different fingerprints)? - On the other hand, unless two people share the same workstation and computer account, how do you expect to use fingerprints to detect license abuse?

funstuff0072• 3 years ago

We use other signals as well: time of day, ip address, new cookie logs out old cookie. At the end of day we are dealing in probabilities, but we can definitely find the most aggressive sharers.

chrisMyzel• 3 years ago

I find it scary coming back to the fingerprint.js site after years and still being correctly identified and see the exact dates I visited

dinkleberg• 3 years ago

Interesting, despite me not using a VPN, it has me “identified” in the totally wrong location (in fact, multiple wrong locations within minutes).

msm_3• 3 years ago

Maybe your fingerprint is just common? Location probably comes from geoip.

jefc11113• 3 years ago

Is anyone trying to tie users to multiple devices, and consequently identify both fingerprints as being from one user? I.e. Let's say I visit HN on both my laptop and on my mobile phone, each will have a very different fingerprint, but not only do I visit the same site on both devices but I am unlikely to do so simultaneously across the two devices, and there are likely to be other factors such as not visiting on either device during sleeping hours, not visiting on either device before some date (i.e. when I got into HN).

Perhaps you could call this something like 'cross-device fingerprint unification', idk.

domh3• 3 years ago

I think it would have to have some code that tied those two fingerprints together... something like `fingerprint.identifyUser("jefc1111")` which would then store both of those fingerprints against your user id.

jefc11113• 3 years ago

Another technique you that could be used would be to look for distinct fingerprints that both have visited the same extremely niche web addresses. Someone is surely doing this already.

thakoppno• 3 years ago

We did a demo at CES in 2015 which retargeted users on a secondary device.

The demo delivered an ad-unit on mobile after viewing an ad-unit on TV.

domh3• 3 years ago

I just tried to turn on `resistFingerprinting` in Firefox and it meant that my zoom preference for HN got reset every time I opened a new page (I have it set to 120% by default). Anyone know why? Bug?

largepeepee• 3 years ago

You don't want to be fingerprinted means default options for everything Firefox can do it on

domh3• 3 years ago

Ohhh that makes sense! Meaning there's a way for a website to detect my zoom level? I wonder how? Checking calculated font size via JS or something? Ugh

xkcd19633• 3 years ago

I guess we could hijack our browsers to lie about the parameters that are being collected at the fingerprinting, that would be far more convenient than disable JS etc.

EDIT: Or block the extraction

giancarlostoro8• 3 years ago

Anyone know if there's been any forks of Chrome that enforce more privacy features? I know Chromium is a thing, but I doubt the builds for Chromium (except when tweaked by some Linux distros) do much like Firefox does.

I only use Chrome to test some things, or to create a completely isolated browser session disconnected from my use of Firefox.

Tajnymag• 3 years ago

Brave, Iridium, Bromite comes to mind

giancarlostoro8• 3 years ago

Iridium sounds like it might be what I want, thanks!

jonhohle3• 3 years ago

Until everyday people realize they’re being stalked, I don’t know what will change. I am seriously thinking about trying to go through the proposition process in my state to forbid selling of data (this should already run afoul of wiretapping laws, imho).

I thought having an ad campaign that targeted subgroups very specifically and boldly might be enough drum up public interest. Something like: “Hello $name from $city. How did $recent_embarrasing_purchase work out? I hope you enjoy your birthday in $birth_month.” And then a link to the proposed policy.

Unfortunately, marketers have neither scruples nor the ability to control themselves and have captured an asymmetric advantage. Technologists do what they do, preoccupied with whether or not they could, not stopping to think if they should. It seems like legislation may be the only remaining option.

A4ET8a8uTh04• 3 years ago

I will admit that it always made me confused as to why browser has access to detailed hardware information. I can understand OS. I can understand resolution. I can rationalize GPU. I don't understand though why it should be able to access .. well, everything about the machine.

edit: It is still impressive. Even with the firefox settings on, the website was able to identify me. I am not entirely certain how I want to approach this.

SV_BubbleTime6• 3 years ago

I got me on iPhone through VPN change, clear cache, private window, and reboot.

I know what to think about this… I fucking hate it.

whamlastxmas• 3 years ago

I would assume for more advanced browser features, like 4k video playing, that hardware information could tell the player whether your machine is capable of playing back 4k video without stuttering.

tenebrisalietum• 3 years ago

Because the browser has become a vendor neutral, architecture neutral app engine and people want to do things like play MIDI instruments, use serial ports, use proprietary USB check scanners for accounting/ERP apps that work on the web and don't need SCCM to manage, etc.

A4ET8a8uTh04• 3 years ago

edit/ update from original post cuz i cant edit anymore

So quick update since I am mildly obsessive.

I was sure it was either GPU, CPU or addons that were giving me away ( I do have a mildly unique setup ).

I ran few tests in VM and the moment I dropped GPU passthrough ( left CPU passthrough ), I was no longer ( based on that website anyway ) tracked across sessions.

In other words, cat and mouse game continues.

account4214• 3 years ago

I can understand OS. I can understand resolution. I can rationalize GPU.

None of these should be available to websites by default. The first two come from simpler times when people were not as concerned with privacy implications. The third has been and continues to be pushed by advertising companies (Google, Apple, Microsoft).

prettyStandard• 3 years ago

Do it.

Firmwarrior3• 3 years ago

Yeah man, I think that's the only way anything is going to change

People are such dumb fucking cattle that they'll lash out at you rather than the data brokers or the software vendors who ratted them out though

warner25• 3 years ago

they'll lash out at you

Not only that, but they might have a legal case against you. I've been slowly working through Seek and Hide: The Tangled History of the Right to Privacy, and my main takeaways have been:

(1) The constitutional right to free speech and a free press is not as broad as most people probably think.

(2) Truth is not necessarily an air-tight defense in a case of libel, as courts at various times and places have decided against publishers for true but embarrassing things intended to humiliate or harm.

omginternets• 3 years ago

I would consider donating to such an effort. I'm sure there are others like me.

cryptoboid• 3 years ago

Pretty much what Signal did a few years ago [1], but on a bigger scale. Sadly Facebook banned their Ads account and couldn't do it further, would be interesting if someone tries the same.

[1] https://signal.org/blog/the-instagram-ads-you-will-never-see...

shantnutiwari• 3 years ago

> I thought having an ad campaign that targeted subgroups very specifically a

This has been tried by a guy who placed Facebook ads like these. FB blocked his account in a few hours.

So good in theory, wont work in practice

hooverd• 3 years ago

Ad platforms aren't that stupid.

TheRealDunkirk2• 3 years ago

Until everyday people realize they’re being stalked, I don’t know what will change.

FTFY: People already know; nothing will change.

Many of the things that are happening (at least in the US) are deeply, deeply unpopular, but are not changing, and show no signs that they are even susceptible to change. Fortune-sized companies, the 1%, and the deep state are calling the shots, despite how much can be seen in real time, through things like Twitter and TikTok. I've actually had to pull back from Twitter because of all the things that are obviously beyond the pale, yet will never change. (Snowden, Assange, et. al.)

jonhohle3• 3 years ago

That’s why I, unfortunately, think legislation is necessary. My state allows citizen proposals with 250k signatures to get on ballot and >50% support to become law that cannot be overturned by the legislature (that has its own issues, but in this case it would be binding).

troad• 3 years ago

People realise they're being stalked, they don't know what that means though.

Techie people are convinced non-techie people don't know they're being tracked. They do! Ask your smart non-techie friends what they think about online privacy. I guarantee you they'll say something like "yeah, I know it's probably tracking me, but whachya gonna do".

Thanks to this disconnect, we have so many privacy campaigns with a message like "Did you know you can be uniquely identified on the web?", but so few (none?) that actually proceed to explain why that's bad, and what someone could do with that information. That's the missing piece. Give average people an actual reason to dislike or fear tracking, not just the mere curio that it exists.

cmrdporcupine• 3 years ago

Fingerprinting is one of those things where there's really been a slippery slope we've just slid further and further down it over the last decade; back when I worked at an ad-tech startup (almost 15 years ago) I ran an experiment myself with our data to see if a simple hash of IP, browser agent, and maybe a couple other signals we had in our logs (don't recall) would co-relate with the cookies we already had through cookie matching from other sources. And the answer was: yes, about 95% of the time. Enough to be reliable enough to do basic retargeting without worrying about excessive false matches.

But at the time, it was considered to be a big do not touch -- just don't do this. Not so much for ethical reasons, but for optics in the industry. (I wasn't proposing doing it, was just curious)

In the meantime, though, this seems to have just become standard practice, but way more sophisticated with way higher accuracy, as this article touches on.

What was not acceptable a decade ago is now "ok." Not just by sketchy ad startups, but by major players.

But this whole mess ties back to one of the things that worries me the most about the propagation of LLM type ML out into the general industry. It's only a matter of time before ad targeting takes on an extra dimension of creepiness through this (and I'm sure it's already happening in some aspects, inside Google & Meta.)

In the past, in ad tech & search, etc. people could say things like: "Yes, it's highly targeted. Yes we've co-related an absolutely huge quantity of data to fingerprint you exactly, and retarget you. But it's anonymized. No humans saw your personal data. It's just statistics.". Not saying whether or not this argument has merit or not, just repeating it.

But now, here we are, where "just statistics" is a far more intricate learning model. One which is capable not just of corelating your purchases and browsing activity, but of "understanding" you, and which -- while not an AGI -- is pretty damn smart.

At what point does "a computer scanned your browsing for patterns and recommend this TV set" become ethically the same as "a human read your logs, and would like to talk to you about television sets..."?

Having worked in ad-tech before (and having worked at Google, in ads and other things as well), I do not trust the people in that industry to make the right decisions here.

royletron• 3 years ago

I have a sort of love hate relationhip with this stuff. On the one hand, yes tracking me is bad if I am not aware, but on the other hand I work for a company that uses it's expert knowledge to help consumers purchase the right tools for them. Ideally we would like the end product to reward us for putting them in touch with the right customer that we've used our name to help land. Much like a hairdresser would recommend a certain brand of hairspray, or a mechanic who carries their preferred oil - there is always a need for a middleman 'tell Bob I sent ya!'. Obviously this an exception to a large majority of what tracking is currently in place for, but until we drop the whole 'tracking is bad we should just shut it all down', and start to think of a fair and reasonable way for users to say 'I am ok with company B knowing that I have a relationship with company A' then these increasingly nerfarious tracking efforts will happen.

yjftsjthsd-h3• 3 years ago

until we drop the whole 'tracking is bad we should just shut it all down', and start to think of a fair and reasonable way for users to say 'I am ok with company B knowing that I have a relationship with company A' then these increasingly nerfarious tracking efforts will happen.

Given how companies have completely and utterly ignored the idea of consent banners, I am deeply disinclined to believe that most companies would ever actually be satisfied with a user controlled choice in the matter. Where we actually are is that companies will relentlessly attempt to stalk everyone all the time no matter what, and in face of that the only sane conclusion is that in practice tracking is bad and we should shut it all down.

LeifCarrotson• 3 years ago

Actually valuable educational sales middlemen - making an individual aware of a tool that they didn't know existed but which solved a problem they already had - are such an infinitesimally small part of online advertising that those use cases can be completely ignored.

This isn't a situation where one rotten apple spoils the whole bunch, it's more like one good apple inadvertently was dropped into a toxic cesspool of rotten apples.

unrequited• 3 years ago

Asking the wider audience here, I have uBlock origin installed on my Chrome browser, while I surf mostly on the incognito mode. I know this is no where close to an optimum setup, hence asking. What setup do you folks use to prevent the best you could from being tracked?

textread• 3 years ago

EFF has an excellent tool to check your browser's fingerprint uniqueness:-

https://coveryourtracks.eff.org/

I use a lot of browser extensions. Unfortunately, this makes my browser easily identifiable.

throwaway20230211• 3 years ago

Oh, finally I found an element of distinguation for the Iphone:

The zoom settings in the display/brightness section of the iphone seem quite relevant for fingerprint.com algorithm.

Toggling between standard/bigger text toggles the fingerprint value.

This could be because the visible area in the screen size changes, as well as some value of the CSS-fingerprint.

dcow• 3 years ago

In hindsight it’s clear. Why did we allow the web advertising mega corp to own the browser we use? Huge conflict of interest. There’s no way our privacy was going to survive.

throwawayacc5• 3 years ago

Is there a firecracker VM or something similar that comes preconfigured with a browser and VNC/RDP that can be used like a native browser but is running in a VM that's not fingerprintable?

_Mobius_• 3 years ago

I tested this myself with librewolf and firefox. Librewolf that is supposed to be hardened and has resistFingerpinting by default couldn't stand a chance. The visitor ID was always the same in Librewolf. In Firefox the visitor ID was always different.

AtNightWeCode• 3 years ago

"Given there are companies selling fingerprinting as a service, if you want to really protect yourself from fingerprinting, you should use Tor Browser or Firefox with resistFingerprinting=true."

Fingerprinting services tries to figure out browsing settings. Since very few people have this feature enabled. You might be easier to fingerprint by enabling it. A metric that historically been used for fingerprinting is the "do not track" feature which is a bit of irony.

Operative0198• 3 years ago

As another vote against JS, this website is able to accurately tell at least half of the extensions I have installed on chrome.

https://browserleaks.com/chrome

comfypotato• 3 years ago

This author doesn’t seem to know what they’re talking about. Just because the service generated the same ID for their Chromium sessions doesn’t mean that applies to all users’ Chromium sessions. Chromium just exposes more of their machine. My guess is that they, writing a computer-technical blog post, have a particularly unique machine. Even having 16Gb of RAM separates you from the masses and might make you unique depending on graphics card etc..

The fingerprinting discussion is relatively new. The first research paper’s author is only 35 or so. (Its title is Cookie Monster.) The discussion is also a little amusing on a site like Hacker News. A perfect example of someone who’s easy to fingerprint is someone who built their own computer (likely to be found on HN). On the opposite end of the spectrum, Safari iPhone users with the same model are impossible to distinguish.

There’s a paper out there where the researchers worked with a public entity’s website to get more accurate fingerprinting data. There are very few unique fingerprints in reality and therefore no reason for any company to track them. This tech probably won’t ever identify users uniquely.

There are actually some positive aspects of fingerprinting. Tor leaves a very obvious fingerprint, and it’s easy for banks to detect its use by criminals.

npteljes• 3 years ago

Fingerprint.com gives me different IDs across different tabs, and also in private mode. I guess the privacy setup still works somewhat. The stack I use:

- Firefox, Enhanced Tracking Protection ON

- Multi-Account Containers + Temporary Containers addon

- Privacy Settings addon, most settings private, but referrers enabled

- uBO with lots enabled, Decentraleyes addon

giuliomagnifico• 3 years ago

It would be nice to have also the Safari evaluation.

OOPMan• 3 years ago

Tested fingerprint.com with Vivaldi Mobile and it didn't correlate me across a norm tab and an Incognito one, so it's not fool foolproof...

throwaway20230211• 3 years ago

Is someone here working at apple?

https://niespodd.github.io/webrtc-local-ip-leak/ still? leaks local IP in mobile safari. On browserleaks local ip check fails, giving false feeling of safety.

neop1x3• 3 years ago

It is even worse than the OP realizes. They should run these EFF tests [1] to see how severe the problem is and that it is practically impossible to combat.

[1] https://coveryourtracks.eff.org/

DavideNL3• 3 years ago

Strange, `privacy.resistFingerprinting = true` did not solve the issue for me, i'm still fingerprinted by https://fingerprint.com/. Even after clearing all cache and restarting Firefox.

Adding the extensions `Canvasblocker` and `Temporariy Containers` did solve the issue though.

Web fingerprinting is worse than I thought

Related Stories