11 ms·

Against privacy defeatism: why browsers can still stop fingerprinting

299 points by randomwalker 8y ago

csours 8y ago
To be clear: Yes we should fight fingerprinting... But: I don't care if only 5% of internet users are uniquely identifiable. I care if I am uniquely identifiable.
- mhneu 8y ago
  The article mentions that the biggest impact comes from limiting the highest-entropy information. It wouldn't be hard to rank the various attributes by entropy and then you - individually - could calculate the probability that you'd be uniquely identifiable. Seems like such work would be valuable.
- guelo 8y ago
  Dropping the average number means that trackers make less money which means that they have less resources to invest in tracking which means that there's less of a chance that you specifically will be tracked.
- bluGill 8y ago
  As the % of users that are identifiable drops eventually the value isn't worth the cost. If only 5% is identifiable that is enough that it won't be done. Note that identifiable comes is degrees. If they can't tell me from my wife that doesn't matter for most purposes.
- Iolaum 8y ago
  If you are not uniquely identifiable but 99% of the users are that's enough to identify you. That's why US Navy funded the tor project. If their people were the only ones that could hide from other governments then those other governments knew who those unidentified people were.
  - meowface 8y ago
    This is also a big issue with NoScript and similar plugins. A very small percentage of real users (ignoring bots and headless browsers and such) intentionally disable JavaScript, so they're painting a target on themselves while trying to do the opposite.
    - Drdrdrq 8y ago
      Well, NoScript (and uMatrix) help with security too, so it might still be a good idea to use them.
      - meowface 8y ago
        For sure. I use NoScript for browser security, not for fingerprint protection. I would still definitely recommend people use NoScript/uMatrix/etc. It's just an unfortunate side effect.
    - mikedilger 8y ago
      This is true. However, most users of NoScript/uMatrix/uBlock are blocking the script that actually does the fingerprinting. So while the server could infer information because the script didn't run, usually they get no notification and tracking simply fails.
      - progval 8y ago
        For once, let's thank web developers who assume everyone has javascript enabled.
fpgaminer 8y ago
Over the years I've noticed this, privacy defeatism, amongst other excuses used to push back against security and privacy enhancements. Another is security chicken and egg. "Because A isn't secure, there's no point in securing B. And because B isn't secure, there's no point in securing A." I've seen arguments along those lines used against improving the security of, for example, DNS and SNI. Or just DNS in general. "There's no point in securing DNS because your ISP can see what IP addresses you connect to." The all-or-nothing argument has been used to argue against HTTPS. "State actors like China can circumvent HTTPS, since they control trusted CAs! So why use HTTPS at all?" Then there's the arguments against security because "it makes development harder!" People have argued against mandatory HTTPS saying that it makes developing websites harder. The list goes on. Luckily it seems that pro-security and pro-privacy succeed in the end, for the most part. But those that use these pathological arguments have certainly delayed things more than they should have been.
- sametmax 8y ago
  The biggest barrier for privacy is not a technical one. It's that most people don't care. We see outrages in a few intellectual or tech saavy niches, like hn, but the average joe has many, many, other priorities before this.
- walterbell 8y ago
  Speaking of mining, here’s a thread on cryptocurrency ASIC resistance defeatism, similar pattern? https://www.reddit.com/r/CryptoCurrency/comments/7fuh2l/why_asic_resistance_is_a_stupid_idea/ https://www.reddit.com/r/CryptoCurrency/comments/7fuh2l/why_...
- extralego 8y ago
  It’s also the extent of the anarchy-libertarian stance popular on HN.
  - JumpCrisscross 8y ago
    > the anarchy-libertarian stance popular on HN What’s popular in the tech community is some combination of laziness and naive political cynicism masking as strategy or anarcho-libertarianism.
kodablah 8y ago
> why browsers can still stop fingerprinting (emphasis mine) > privacy defenses don’t need to be perfect. Many researchers and engineers think about privacy in all-or-nothing terms So browsers can't stop fingerprinting but they can reduce it, and the article author's title falls in the same all-or-nothing trap that they criticize others for. Too often practicality is viewed as defeatism. I don't remember defeatism, I remember practical limitations to stopping all uniqueness vectors but realization that some can be stopped.
- incompatible 8y ago
  I remember somebody who worked with Firefox saying that even the idea of not by default revealing the OS and hardware platform received too much opposition.
hartator 8y ago
Chrome has no interest in doing that. Google uses browser fingerprinting for their ads, and to make sure a real user is requesting their services. I would trust Safari a lot more to implement something like this.
- Drdrdrq 8y ago
  Which is a big reason not to use Chrome. Their incentives are not aligned with users'.
- AngryData 8y ago
  That is a big reason I stopped using chrome. I block all the cookies and scripts I can but they were still collecting data from other shit and serving me obvious directed ads.
  - gsnedders 8y ago
    I don't know about Google, but AIUI FB does targeted advertising based on source IPs if there's a very small number of users from a given IP. As long as they know the source IP, they can implement some form of tracking.
ape4 8y ago
The article mentions Canvas, Battery, Audio,and WebRTC. Should these all request a user OK before being used?
- alkonaut 8y ago
  Definitely for high entropy APIs at least. Checking if audio or canvas exists is just two bits. But e.g. being able to read canvas pixels is absolutely insane that it’s allowed. So if just these sources of huge entropy were default swithed off, as the article says, fingerprinting would be a lot harder.
  - floatboth 8y ago
    Firefox with Tracking Protection (on by default in private windows I think) asks permission for reading canvas pixels. https://bugzilla.mozilla.org/show_bug.cgi?id=967895 https://bugzilla.mozilla.org/show_bug.cgi?id=967895
  - daxterspeed 8y ago
    There's many amazing things only possible in canvas because you can read the pixels directly (especially in displaying complex pixel art), so removing that capability out-right would be highly disappointing. I suppose a better solution would be to mark the canvas as tainted if any text is drawn onto it, so that pixel reading capabilities are blocked. Another aggressive solution could be to redraw the entire canvas without gpu acceleration if pixel data is requested. Together these would severely limit canvas fingerprinting.
    - alkonaut 8y ago
      Or just block it and display a warning that the user can accept before the operation is allowed. And as you say: all canvas impls should come in 2 flavors, one “reference” software impl that guarantees the exact same pixels given the exact same operations. Using any other impl should block readpixel or redraw with the reference impl before reading. I realize there are edge use cases that need reading a pixel I just don’t agree with the idea that they would more important than limiting tracking. So I think the canvas limiting mode (used in ff safe mode) should be default.
textmode 8y ago
"Another lesson is that privacy defenses don't need to be perfect. Many researchers and engineers think about privacy in all-or-nothing terms: a single mistake can be devastating, and if a defense won't be perfect, we shouldn't deploy it at all." This "all-or-nothing" perspective is rampant on www forums discussing computer topics and certainly HN is no exception. It is particularly acute in any discussions of "privacy" or "security". There are countless examples. Earlier this week the topic of SNI rose again to HN's front page. A minor percentage1 of TLS-enabled websites require SNI. An unfortunate side effect of SNI is that it makes it easier for third parties to observe which websites users are accessing via TLS because it sends domainnames unencrypted in the first packet. Forum commenters will thus argue because there are other, more difficult means for some third parties to observe these domainnames, e.g., through traffic analysis, that the unencrypted SNI is therefore not an issue worth addressing. All-or-nothing. If the privacy achieved by some proactive measure is not "perfect" then to these commenters it is worthless. But the HN front page reference suggested otherwise: It was an RFC describing how the IETF is taking a proactive measure, trying to "fix" SNI, encrypting it to prevent third parties from using it in ways detrimental to users. There is an easier proactive measure. The popular browsers send SNI by default, even if the website does not require it. The default behaviour is to accomodate a minority of TLS-enabled websites at the expense of all users, including those who may not be using this minority of websites. To make an analogy to fingerprinting, imagine sending 17 unique identifiers with every HTTP transaction when, say, only 5 are actually needed. The all-or-nothing perspective adopted by forum commenters would dictate that it makes no sense to reduce the number unless the number can be reduced to zero. Amongst the security folks there is a concept sometimes called "defense in depth". Commenters in discussions about security often agree there is no such thing as "perfect" security and they cannot rely on a single, "silver bullet". They must use multiple tactics. Is privacy somehow different? There are many tactics users can take that, cumulatively, can make things more difficult for the data collectors. 1 Survey of websites currently appearing on HN Number of unique urls: 367 Number of http urls: 43 Number of https urls: 324 Number of https urls requiring SNI: 38 Number of https urls requiring correct SNI: 26 "Requiring correct SNI" means SNI must match Host header. Summary One can fetch 286 of the 324 https urls currently posted on HN with a HTTP client that does not send SNI. An additional 12 can be retrieved by sending a decoy SNI name that does not match the Host header.
mikedilger 8y ago
There are two ways to defeat fingerprinting: 1) Be common: have your data match what others are sending 2) Be unique on every page request: scramble your data Browsers in category (2) are not trackable, even though they appear to be fingerprintable. Each page request is a different fingerprint. What is unclear from the article is whether the studies mentioned (EFF, INRIA) considered that and tested that. Does anyone know? Because privacy does not require non-unique fingerprints, it just requires untrackability.
- incompatible 8y ago
  Are there any readily-available browser plugins (or whatever) that implement (2)?
  - propogandist 8y ago
    this is close https://multiloginapp.com/canvasdefender-browser-extension/ https://multiloginapp.com/canvasdefender-browser-extension/
  - beagle3 8y ago
    Firefox has two about:Config settings, one stops canvas fingerprinting, the other notifies. Other settings stop giving out a list of plugins or fonts. And e.g. unlock or umatriz can rotate your user agent. It’s not perfect, but with a few tweaks Firefox is much much harder to fingerprint - though IPv6 tends to undo all of that because many providers assign a prefix per customer which will never change and can be used by anyone to correlate.
    - gsnedders 8y ago
      How common is the setup those settings put you in, though? Are you more or less unique in that bin?
mirimir 8y ago
There's generally a tradeoff between usability and performance, and resistance to fingerprinting. If your browser has WebGL enabled, the machine (not just the browser) can be fingerprinted. If it caches resources, adversaries can discover browsing history.
- amelius 8y ago
  > If your browser has WebGL enabled, the machine (not just the browser) can be fingerprinted. Curious, how would that work exactly? (I've never used WebGL yet in any code). > If it caches resources, adversaries can discover browsing history. Same question. I was under the impression that cached resources can be accessed only by the domain that introduces them.
  - mirimir 8y ago
    Re WebGL, I gather that canvas fingerprints are based on graphics hardware and drivers. So all browsers on a given machine have the same canvas fingerprint. I've used https://browserleaks.com/webgl https://browserleaks.com/webgl for testing. And with VMs, it's even worse. I found that all Debian-family VMs on a given host have the same canvas fingerprint. But Windows, macOS, CentOS, Arch and TrueOS (aka PC-BSD) VMs each have distinct fingerprints. About cached resources, it's my impression that adversaries can exploit XSS vulnerabilities for detection. Most simply, you just measure load time.
    - yjftsjthsd-h 8y ago
      If drivers are involved, then it would follow that updating changes your fingerprint? Still bad, but mitigated by being time-fenced.
      - mirimir 8y ago
        I don't know. In my testing, I don't recall that I even used related Debian and Ubuntu releases. So I doubt that just updating the graphics driver would change the fingerprint. However, I was using VirtualBox VMs, so it's possible that my results were artifacts caused by restricted choice in virtual graphics drivers. Testing that would be rather tedious, and I'd appreciate correction.
gasull 8y ago
There is Privacy Possum, a Firefox and Chrome extension that works better against fingerprinting than Privacy Badger: https://github.com/cowlicks/privacypossum https://github.com/cowlicks/privacypossum
- aendruk 8y ago
  How does it differ from Privacy Badger? (In goals, threat model, implementation, etc.?) I found the readme to be a little incomprehensible.
jstewartmobile 8y ago
Sets up a straw man of "privacy defeatism", then knocks it down with an analysis of some French website's logs--as though any of this were a technological problem in the first place. This is not a case of "defense in depth" or "something is better than nothing." This is the case of a surveillance capitalism asset performing to spec. Privacy in the browser is/was f-ed, plain and simple. Patch one hole, make two more. That's how it's been for at least 20 years now. I see no reason for that to change until the browser is obsolesced by something even better at fleecing the peasants.
auslander 8y ago
It starts saying all the right things, I was, like, expecting real tech stuff, after intro, and ... post ends. Where is per browser stats, correlations, data points and features? Canvas vs IP vs User-agents?
- ComodoHacker 8y ago
  That's what hypertext is for. Follow the links.
TekMol 8y ago
The whole article seems to be based on this study: https://www.doc.ic.ac.uk/~maffeis/331/EffectivenessOfFingerprinting.pdf https://www.doc.ic.ac.uk/~maffeis/331/EffectivenessOfFingerp... And sees it as an indicator that preventing fingerprinting is possible: Only a third of users had unique fingerprints, despite the researchers’ use of a comprehensive set of 17 fingerprinting attributes. To me, the 17 attributes do not seem comprehensive at all. For example they don't make use of the users IP. So much can be derived from the IP. Carrier, approximate location etc. They also don't use the local IP, which is leaked via WebRTC: https://browserleaks.com/webrtc https://browserleaks.com/webrtc They also don't seem to measure the performance of CPU, RAM and GPU when performing different tasks. But yes: Browsers should do more to prevent fingerprinting. But it seems they have no inclination to do so. That they don't plug the WebRTC hole that leaks the local IP is a strong indicator for me that privacy is low on the list of the browser vendors. Or maybe not on the list at all.
raven11 8y ago
What is needed is a community written and funded privacy browser. Mozilla the billion dollar non profit and Firefox their so called privacy first brwoser is the biggest exfiltrator of user data. Their default 5000 user settings are all geared towards feeding them and Google real time user activity feed. They have moved from being Google data bi.ch to a major data collection thug themselves. As such fingerprinting becomes at best a tangential issue.
xg15 8y ago
The irony seems to be this: > But there’s another pill that’s harder to swallow: the recent study was able to test users in the wild only because the researchers didn’t ask or notify the users. [2] With Internet experiments, there is a tension between traditional informed consent and validity of findings, and we need new ethical norms to resolve this. So the result of their privacy-advocating study was itself only obtainable by breaching the privacy of their participants. (I.e. making them participants without them knowing or consenting to it)

299 points by randomwalker 8y ago

To be clear: Yes we should fight fingerprinting... But: I don't care if only 5% of internet users are uniquely identifiable. I care if I am uniquely identifiable.

mhneu 8y ago
The article mentions that the biggest impact comes from limiting the highest-entropy information. It wouldn't be hard to rank the various attributes by entropy and then you - individually - could calculate the probability that you'd be uniquely identifiable. Seems like such work would be valuable.
guelo 8y ago
Dropping the average number means that trackers make less money which means that they have less resources to invest in tracking which means that there's less of a chance that you specifically will be tracked.
bluGill 8y ago
As the % of users that are identifiable drops eventually the value isn't worth the cost. If only 5% is identifiable that is enough that it won't be done. Note that identifiable comes is degrees. If they can't tell me from my wife that doesn't matter for most purposes.
Iolaum 8y ago
If you are not uniquely identifiable but 99% of the users are that's enough to identify you. That's why US Navy funded the tor project. If their people were the only ones that could hide from other governments then those other governments knew who those unidentified people were.
- meowface 8y ago
  This is also a big issue with NoScript and similar plugins. A very small percentage of real users (ignoring bots and headless browsers and such) intentionally disable JavaScript, so they're painting a target on themselves while trying to do the opposite.
  - Drdrdrq 8y ago
    Well, NoScript (and uMatrix) help with security too, so it might still be a good idea to use them.
    - meowface 8y ago
      For sure. I use NoScript for browser security, not for fingerprint protection. I would still definitely recommend people use NoScript/uMatrix/etc. It's just an unfortunate side effect.
  - mikedilger 8y ago
    This is true. However, most users of NoScript/uMatrix/uBlock are blocking the script that actually does the fingerprinting. So while the server could infer information because the script didn't run, usually they get no notification and tracking simply fails.
    - progval 8y ago
      For once, let's thank web developers who assume everyone has javascript enabled.

fpgaminer 8y ago

Over the years I've noticed this, privacy defeatism, amongst other excuses used to push back against security and privacy enhancements. Another is security chicken and egg. "Because A isn't secure, there's no point in securing B. And because B isn't secure, there's no point in securing A." I've seen arguments along those lines used against improving the security of, for example, DNS and SNI. Or just DNS in general. "There's no point in securing DNS because your ISP can see what IP addresses you connect to." The all-or-nothing argument has been used to argue against HTTPS. "State actors like China can circumvent HTTPS, since they control trusted CAs! So why use HTTPS at all?" Then there's the arguments against security because "it makes development harder!" People have argued against mandatory HTTPS saying that it makes developing websites harder. The list goes on. Luckily it seems that pro-security and pro-privacy succeed in the end, for the most part. But those that use these pathological arguments have certainly delayed things more than they should have been.

sametmax 8y ago
The biggest barrier for privacy is not a technical one. It's that most people don't care. We see outrages in a few intellectual or tech saavy niches, like hn, but the average joe has many, many, other priorities before this.
walterbell 8y ago
Speaking of mining, here’s a thread on cryptocurrency ASIC resistance defeatism, similar pattern? https://www.reddit.com/r/CryptoCurrency/comments/7fuh2l/why_asic_resistance_is_a_stupid_idea/ https://www.reddit.com/r/CryptoCurrency/comments/7fuh2l/why_...
extralego 8y ago
It’s also the extent of the anarchy-libertarian stance popular on HN.
- JumpCrisscross 8y ago
  > the anarchy-libertarian stance popular on HN What’s popular in the tech community is some combination of laziness and naive political cynicism masking as strategy or anarcho-libertarianism.

kodablah 8y ago

> why browsers can still stop fingerprinting (emphasis mine) > privacy defenses don’t need to be perfect. Many researchers and engineers think about privacy in all-or-nothing terms So browsers can't stop fingerprinting but they can reduce it, and the article author's title falls in the same all-or-nothing trap that they criticize others for. Too often practicality is viewed as defeatism. I don't remember defeatism, I remember practical limitations to stopping all uniqueness vectors but realization that some can be stopped.

incompatible 8y ago
I remember somebody who worked with Firefox saying that even the idea of not by default revealing the OS and hardware platform received too much opposition.

hartator 8y ago

Chrome has no interest in doing that. Google uses browser fingerprinting for their ads, and to make sure a real user is requesting their services. I would trust Safari a lot more to implement something like this.

Drdrdrq 8y ago
Which is a big reason not to use Chrome. Their incentives are not aligned with users'.
AngryData 8y ago
That is a big reason I stopped using chrome. I block all the cookies and scripts I can but they were still collecting data from other shit and serving me obvious directed ads.
- gsnedders 8y ago
  I don't know about Google, but AIUI FB does targeted advertising based on source IPs if there's a very small number of users from a given IP. As long as they know the source IP, they can implement some form of tracking.

ape4 8y ago

The article mentions Canvas, Battery, Audio,and WebRTC. Should these all request a user OK before being used?

alkonaut 8y ago
Definitely for high entropy APIs at least. Checking if audio or canvas exists is just two bits. But e.g. being able to read canvas pixels is absolutely insane that it’s allowed. So if just these sources of huge entropy were default swithed off, as the article says, fingerprinting would be a lot harder.
- floatboth 8y ago
  Firefox with Tracking Protection (on by default in private windows I think) asks permission for reading canvas pixels. https://bugzilla.mozilla.org/show_bug.cgi?id=967895 https://bugzilla.mozilla.org/show_bug.cgi?id=967895
- daxterspeed 8y ago
  There's many amazing things only possible in canvas because you can read the pixels directly (especially in displaying complex pixel art), so removing that capability out-right would be highly disappointing. I suppose a better solution would be to mark the canvas as tainted if any text is drawn onto it, so that pixel reading capabilities are blocked. Another aggressive solution could be to redraw the entire canvas without gpu acceleration if pixel data is requested. Together these would severely limit canvas fingerprinting.
  - alkonaut 8y ago
    Or just block it and display a warning that the user can accept before the operation is allowed. And as you say: all canvas impls should come in 2 flavors, one “reference” software impl that guarantees the exact same pixels given the exact same operations. Using any other impl should block readpixel or redraw with the reference impl before reading. I realize there are edge use cases that need reading a pixel I just don’t agree with the idea that they would more important than limiting tracking. So I think the canvas limiting mode (used in ff safe mode) should be default.

textmode 8y ago

"Another lesson is that privacy defenses don't need to be perfect. Many researchers and engineers think about privacy in all-or-nothing terms: a single mistake can be devastating, and if a defense won't be perfect, we shouldn't deploy it at all." This "all-or-nothing" perspective is rampant on www forums discussing computer topics and certainly HN is no exception. It is particularly acute in any discussions of "privacy" or "security". There are countless examples. Earlier this week the topic of SNI rose again to HN's front page. A minor percentage1 of TLS-enabled websites require SNI. An unfortunate side effect of SNI is that it makes it easier for third parties to observe which websites users are accessing via TLS because it sends domainnames unencrypted in the first packet. Forum commenters will thus argue because there are other, more difficult means for some third parties to observe these domainnames, e.g., through traffic analysis, that the unencrypted SNI is therefore not an issue worth addressing. All-or-nothing. If the privacy achieved by some proactive measure is not "perfect" then to these commenters it is worthless. But the HN front page reference suggested otherwise: It was an RFC describing how the IETF is taking a proactive measure, trying to "fix" SNI, encrypting it to prevent third parties from using it in ways detrimental to users. There is an easier proactive measure. The popular browsers send SNI by default, even if the website does not require it. The default behaviour is to accomodate a minority of TLS-enabled websites at the expense of all users, including those who may not be using this minority of websites. To make an analogy to fingerprinting, imagine sending 17 unique identifiers with every HTTP transaction when, say, only 5 are actually needed. The all-or-nothing perspective adopted by forum commenters would dictate that it makes no sense to reduce the number unless the number can be reduced to zero. Amongst the security folks there is a concept sometimes called "defense in depth". Commenters in discussions about security often agree there is no such thing as "perfect" security and they cannot rely on a single, "silver bullet". They must use multiple tactics. Is privacy somehow different? There are many tactics users can take that, cumulatively, can make things more difficult for the data collectors. 1 Survey of websites currently appearing on HN Number of unique urls: 367 Number of http urls: 43 Number of https urls: 324 Number of https urls requiring SNI: 38 Number of https urls requiring correct SNI: 26 "Requiring correct SNI" means SNI must match Host header. Summary One can fetch 286 of the 324 https urls currently posted on HN with a HTTP client that does not send SNI. An additional 12 can be retrieved by sending a decoy SNI name that does not match the Host header.

mikedilger 8y ago

There are two ways to defeat fingerprinting: 1) Be common: have your data match what others are sending 2) Be unique on every page request: scramble your data Browsers in category (2) are not trackable, even though they appear to be fingerprintable. Each page request is a different fingerprint. What is unclear from the article is whether the studies mentioned (EFF, INRIA) considered that and tested that. Does anyone know? Because privacy does not require non-unique fingerprints, it just requires untrackability.

incompatible 8y ago
Are there any readily-available browser plugins (or whatever) that implement (2)?
- propogandist 8y ago
  this is close https://multiloginapp.com/canvasdefender-browser-extension/ https://multiloginapp.com/canvasdefender-browser-extension/
- beagle3 8y ago
  Firefox has two about:Config settings, one stops canvas fingerprinting, the other notifies. Other settings stop giving out a list of plugins or fonts. And e.g. unlock or umatriz can rotate your user agent. It’s not perfect, but with a few tweaks Firefox is much much harder to fingerprint - though IPv6 tends to undo all of that because many providers assign a prefix per customer which will never change and can be used by anyone to correlate.
  - gsnedders 8y ago
    How common is the setup those settings put you in, though? Are you more or less unique in that bin?

mirimir 8y ago

There's generally a tradeoff between usability and performance, and resistance to fingerprinting. If your browser has WebGL enabled, the machine (not just the browser) can be fingerprinted. If it caches resources, adversaries can discover browsing history.

amelius 8y ago
> If your browser has WebGL enabled, the machine (not just the browser) can be fingerprinted. Curious, how would that work exactly? (I've never used WebGL yet in any code). > If it caches resources, adversaries can discover browsing history. Same question. I was under the impression that cached resources can be accessed only by the domain that introduces them.
- mirimir 8y ago
  Re WebGL, I gather that canvas fingerprints are based on graphics hardware and drivers. So all browsers on a given machine have the same canvas fingerprint. I've used https://browserleaks.com/webgl https://browserleaks.com/webgl for testing. And with VMs, it's even worse. I found that all Debian-family VMs on a given host have the same canvas fingerprint. But Windows, macOS, CentOS, Arch and TrueOS (aka PC-BSD) VMs each have distinct fingerprints. About cached resources, it's my impression that adversaries can exploit XSS vulnerabilities for detection. Most simply, you just measure load time.
  - yjftsjthsd-h 8y ago
    If drivers are involved, then it would follow that updating changes your fingerprint? Still bad, but mitigated by being time-fenced.
    - mirimir 8y ago
      I don't know. In my testing, I don't recall that I even used related Debian and Ubuntu releases. So I doubt that just updating the graphics driver would change the fingerprint. However, I was using VirtualBox VMs, so it's possible that my results were artifacts caused by restricted choice in virtual graphics drivers. Testing that would be rather tedious, and I'd appreciate correction.

gasull 8y ago

There is Privacy Possum, a Firefox and Chrome extension that works better against fingerprinting than Privacy Badger: https://github.com/cowlicks/privacypossum https://github.com/cowlicks/privacypossum

aendruk 8y ago
How does it differ from Privacy Badger? (In goals, threat model, implementation, etc.?) I found the readme to be a little incomprehensible.

jstewartmobile 8y ago

Sets up a straw man of "privacy defeatism", then knocks it down with an analysis of some French website's logs--as though any of this were a technological problem in the first place. This is not a case of "defense in depth" or "something is better than nothing." This is the case of a surveillance capitalism asset performing to spec. Privacy in the browser is/was f-ed, plain and simple. Patch one hole, make two more. That's how it's been for at least 20 years now. I see no reason for that to change until the browser is obsolesced by something even better at fleecing the peasants.

auslander 8y ago

It starts saying all the right things, I was, like, expecting real tech stuff, after intro, and ... post ends. Where is per browser stats, correlations, data points and features? Canvas vs IP vs User-agents?

ComodoHacker 8y ago
That's what hypertext is for. Follow the links.

TekMol 8y ago

The whole article seems to be based on this study: https://www.doc.ic.ac.uk/~maffeis/331/EffectivenessOfFingerprinting.pdf https://www.doc.ic.ac.uk/~maffeis/331/EffectivenessOfFingerp... And sees it as an indicator that preventing fingerprinting is possible: Only a third of users had unique fingerprints, despite the researchers’ use of a comprehensive set of 17 fingerprinting attributes. To me, the 17 attributes do not seem comprehensive at all. For example they don't make use of the users IP. So much can be derived from the IP. Carrier, approximate location etc. They also don't use the local IP, which is leaked via WebRTC: https://browserleaks.com/webrtc https://browserleaks.com/webrtc They also don't seem to measure the performance of CPU, RAM and GPU when performing different tasks. But yes: Browsers should do more to prevent fingerprinting. But it seems they have no inclination to do so. That they don't plug the WebRTC hole that leaks the local IP is a strong indicator for me that privacy is low on the list of the browser vendors. Or maybe not on the list at all.

raven11 8y ago

What is needed is a community written and funded privacy browser. Mozilla the billion dollar non profit and Firefox their so called privacy first brwoser is the biggest exfiltrator of user data. Their default 5000 user settings are all geared towards feeding them and Google real time user activity feed. They have moved from being Google data bi.ch to a major data collection thug themselves. As such fingerprinting becomes at best a tangential issue.

xg15 8y ago

The irony seems to be this: > But there’s another pill that’s harder to swallow: the recent study was able to test users in the wild only because the researchers didn’t ask or notify the users. [2] With Internet experiments, there is a tension between traditional informed consent and validity of findings, and we need new ethical norms to resolve this. So the result of their privacy-advocating study was itself only obtainable by breaching the privacy of their participants. (I.e. making them participants without them knowing or consenting to it)