5 ms·

What are the legitimate uses for fingerprinting?

• educar 9y ago
  Mostly ad tracking.
  • eli 9y ago
    In general, sure, but ad networks don't care about OS spoofing.
    • educar 9y ago
      No, the point is they can serve up targeted ads using browser fingerprint
      • eli 9y ago
        Detecting OS despite a spoofed user agent is not relevant to that goal
• ambicapter 9y ago
  The same reason you would ever want to identify an actor. Possibly he is abusing your system and taking advantage of his relative anonymity.
• michaelt 9y ago
  "Legitimate" is a subjective term, obviously, but I've heard of it being used in anti-fraud tools [1] - presumably as one of a suite of inputs into a risk estimation model. Of course, whether it's effective or just marketing is difficult to prove :) [1] https://blogs.wsj.com/digits/2010/12/01/evercookies-and-fingerprinting-finding-fraudsters-tracking-consumers/ https://blogs.wsj.com/digits/2010/12/01/evercookies-and-fing...
  • slv77 9y ago
    It's still used pretty extensively but it's becoming less effective to identify fraud as the techniques have become more widely known. These days the most effective use is guarding against account takeover. When logging in from an unknown device a user may go through additional authentication steps. Fraud ring counter this with man-in-the-browser attacks. There are a couple of vendors that offer it as a standalone service or bundle it with other offerings.
• nso 9y ago
  I'm guessing it could be used for googles recaptcha
• ioulian 9y ago
  We've made an online action website where people can vote on things and the people with most votes win prizes. We thought it was a good idea to validate the user by email (by sending an email with a unique link, that when clicked, the vote was authenticated.) We thought it was good enough as a "security measure", but we thought wrong! Some people made disposable email accounts and sent the emails to there, so there were some people with thousands of votes, while most only had a few dozen. When looking in the database, we were glad that we stored some basic info like IP, Agent Strings and timestamps. These people were smart enough to (sometimes) change IP's but then when looking to the timestamps and agent strings, we saw that these people were cheaters with disposable email addresses. We removed all these votes and the "winners" didn't win anything at the end, because they had much less votes than "normal" players. They started sending angry emails to the customer, and did not leave them alone. We are currently making another action for that customer, but this time we have added browser fingerprinting, that checks a lot of variables (like fonts, canvas rendering, webgl, screen sizes, number of monitors, device pixel ratios, ...). This way we'll going to identify cheaters much easily, ... BUT you can still spoof it, so it's never a foolproof method of identifying users, it just makes our lives a little bit easier when there's some cheating going on ;) // EDIT: some typos
  • i336_ 9y ago
    I'm very curious to learn what website this is, perhaps via email. This type of thing sounds like a fun way to spend a few minutes. :)
• ch4s3 9y ago
  Banks for example use this to help prevent unauthorized access to your account.
  • adrr 9y ago
    It also help with user experience. The more confidence we have that user is actually the real person the less challenges we have to use for authentication. If we see a new device, we're going to present more challenges(MFA,KBA etc) to protect our users from account takeovers.
• ArtDev 9y ago
  None. Its blackhat territory.