3 ms·

Canvas API allows fingerprinting precise enough to, by itself, create a unique identifier for a user. However, fingerprinting doesn't require any kind of singl

by nwah1 9y ago

Canvas API allows fingerprinting precise enough to, by itself, create a unique identifier for a user. However, fingerprinting doesn't require any kind of single magic API, but almost certainly will use a collection of techniques to narrow down users. If they know your browser version, default language, screen resolution, etc those three alone can narrow you down by many orders of magnitude. And they are adding more APIs like Device Memory which, while not as precise as a canvas fingerprint by itself, could probably whittle it down an order of magnitude further. Apparently turning on "Do Not Track" has long been known as a way to single you out on the web. You'll help them narrow you down by about three orders of magnitude. It was a silly idea to begin with.

gkya 9y ago
> Apparently turning on "Do Not Track" has long been known as a way to single you out on the web. You'll help them narrow you down by about three orders of magnitude. It was a silly idea to begin with. Wouldn't that be solved if FF turned DNT on by default?
- mook 9y ago
  It would also make it even more useless. IE originally had it default on; they turned it off after people complained that it meant advertisers wouldn't honour it anymore. https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer_10_default_setting_controversy https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer...
  - gkya 9y ago
    Well it was useless to begin with anyways, as it's just kindly asking ad-publishers to please not track you, which is the closest thing we have to the platonic idea of naivety.
    - yborg 9y ago
      It's not useless in the context of a legislative requirement to honor it, which was the original goal that DNT was supposed to drive to. Since we now have pretty much 100% regulatory capture in the Internet space that of course is now dead.
      - chimeracoder 9y ago
        > It's not useless in the context of a legislative requirement to honor it, which was the original goal that DNT was supposed to drive to. Since we now have pretty much 100% regulatory capture in the Internet space that of course is now dead. It was never really likely to happen, especially when even advocacy groups like the EFF opposed legislative approaches to enforcing DNT.
- yborg 9y ago
  It might actually be useful to randomly turn it on and off per request...
- Sylos 9y ago
  DNT is meant as an explicit opt-out. A unified way for users to expressly say that they do not want to be tracked, if possible. Users actually going into the settings and flipping that switch makes it clear that it's their request and therefore could have given it legal bearing. (Exceptions from that for functionality that requires tracking, like online shopping, would be given implicitely by using that functionality.) Unfortunately, Google, Facebook and Microsoft managed to kill that effort off. Microsoft by doing exactly that, they default-enabled it in Internet Explorer, taking away any legal bearing. And Google+Facebook came out saying they don't give a fuck, they'll track users anyways, and then with something around 2/3 of all bigger webpages having Google Analytics deployed and some other ridiculous percentage having a Facebook Like-Button, there were essentially no webpages left that could have come out and said that they want to respect it in some fashion.
bzbarsky 9y ago
Note that Mozilla is explicitly pushing back on the Device Memory API, because of fingerprinting concerns. See https://groups.google.com/forum/#!topic/mozilla.dev.platform/cfydu35XdnY https://groups.google.com/forum/#!topic/mozilla.dev.platform...
MichaelGG 9y ago
How can that be? If 100 users buy a specific MacBook or ThinkPad they have identical hardware. Or do different revisions of the same chip have different rendering? Windows and browsers force updates at about the same schedule on everyone. I'd expect it to narrow you down to hardware/OS, perhaps driver (though most users use whatever Windows or the OEM throws at them). How can it do more?
- simooooo 9y ago
  What?
  - MichaelGG 9y ago
    If 2 people buy a new MacBook and run a WebGL or Canvas fingerprint, why would they have different results? I do not believe it is unique at all. It will be unique for a hardware-OS-driver-browser combo. And if you are not doing anything strange, those numbers will be pretty common (most users just use whatever OS/driver package ships, and the browser gets upgraded like everyone else).
- kccqzy 9y ago
  100 users buy the same hardware but decided to resize their browser window slightly differently. Bravo, window.outerHeight and window.outerWidth. 100 users buy the same hardware but some decided to install some custom font they need. Bravo there’s a difference now. GP is very clear that there’s no single magical API used for fingerprinting. It’s anything and everything.

by nwah1 9y ago

gkya 9y ago

> Apparently turning on "Do Not Track" has long been known as a way to single you out on the web. You'll help them narrow you down by about three orders of magnitude. It was a silly idea to begin with. Wouldn't that be solved if FF turned DNT on by default?

mook 9y ago
It would also make it even more useless. IE originally had it default on; they turned it off after people complained that it meant advertisers wouldn't honour it anymore. https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer_10_default_setting_controversy https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer...
- gkya 9y ago
  Well it was useless to begin with anyways, as it's just kindly asking ad-publishers to please not track you, which is the closest thing we have to the platonic idea of naivety.
  - yborg 9y ago
    It's not useless in the context of a legislative requirement to honor it, which was the original goal that DNT was supposed to drive to. Since we now have pretty much 100% regulatory capture in the Internet space that of course is now dead.
    - chimeracoder 9y ago
      > It's not useless in the context of a legislative requirement to honor it, which was the original goal that DNT was supposed to drive to. Since we now have pretty much 100% regulatory capture in the Internet space that of course is now dead. It was never really likely to happen, especially when even advocacy groups like the EFF opposed legislative approaches to enforcing DNT.
yborg 9y ago
It might actually be useful to randomly turn it on and off per request...
Sylos 9y ago
DNT is meant as an explicit opt-out. A unified way for users to expressly say that they do not want to be tracked, if possible. Users actually going into the settings and flipping that switch makes it clear that it's their request and therefore could have given it legal bearing. (Exceptions from that for functionality that requires tracking, like online shopping, would be given implicitely by using that functionality.) Unfortunately, Google, Facebook and Microsoft managed to kill that effort off. Microsoft by doing exactly that, they default-enabled it in Internet Explorer, taking away any legal bearing. And Google+Facebook came out saying they don't give a fuck, they'll track users anyways, and then with something around 2/3 of all bigger webpages having Google Analytics deployed and some other ridiculous percentage having a Facebook Like-Button, there were essentially no webpages left that could have come out and said that they want to respect it in some fashion.

bzbarsky 9y ago

Note that Mozilla is explicitly pushing back on the Device Memory API, because of fingerprinting concerns. See https://groups.google.com/forum/#!topic/mozilla.dev.platform/cfydu35XdnY https://groups.google.com/forum/#!topic/mozilla.dev.platform...

MichaelGG 9y ago

How can that be? If 100 users buy a specific MacBook or ThinkPad they have identical hardware. Or do different revisions of the same chip have different rendering? Windows and browsers force updates at about the same schedule on everyone. I'd expect it to narrow you down to hardware/OS, perhaps driver (though most users use whatever Windows or the OEM throws at them). How can it do more?

simooooo 9y ago
What?
- MichaelGG 9y ago
  If 2 people buy a new MacBook and run a WebGL or Canvas fingerprint, why would they have different results? I do not believe it is unique at all. It will be unique for a hardware-OS-driver-browser combo. And if you are not doing anything strange, those numbers will be pretty common (most users just use whatever OS/driver package ships, and the browser gets upgraded like everyone else).
kccqzy 9y ago
100 users buy the same hardware but decided to resize their browser window slightly differently. Bravo, window.outerHeight and window.outerWidth. 100 users buy the same hardware but some decided to install some custom font they need. Bravo there’s a difference now. GP is very clear that there’s no single magical API used for fingerprinting. It’s anything and everything.