5 ms·

Chrome team members have said that preventing modern web browsers from leaking enough entropy to uniquely identify users across sessions (fingerprinting) is imp

by Sephr 8y ago

Chrome team members have said that preventing modern web browsers from leaking enough entropy to uniquely identify users across sessions (fingerprinting) is impractical with all of the features that the modern web provides. This sentiment has probably lead to some at Google to think that it is justifiable impose pervasive tracking and surveillance technologies as a condition for using Google services. Look at the new ReCAPTCHA v3 to see how fingerprinting is trending at Google.

mrep 8y ago
Do you have a better solution for differentiating yourself as an actual user from a robot spammer?
- kibwen 8y ago
  Being allowed to pay for services with money, rather than being required to pay for services with your personal data. I browse the web via a proxy when I'm on public wifi, and Google is nigh unusable with how many captchas it forces you to solve to do a single Google search. Fortunately Bing and DDG still work, for now.
  - tzs 8y ago
    > Being allowed to pay for services with money, rather than being required to pay for services with your personal data One possible big disadvantage for a site owner in letting people pay with money instead of data is dealing with taxes. I'm not actually sure how most jurisdictions tend to classify it when someone comes to your site and you charge them to access your content. My guess would be it would be taxed the same way they tax digital goods such as downloadable software that does not include any physical components. For such goods most jurisdictions that tax them seem to base the tax on the buyer's location rather than the seller's location, so the seller has to deal with charging the appropriate tax and filing returns for potentially a large number of jurisdictions. If the seller is providing the content for "free" and making their money selling visitor data to advertisers then their income will probably only be subject to taxation in their own jurisdiction. It will simply be ordinary business income.
    - antt 8y ago
      My experience with taxation out side of the US, currently Australia, is that they are ridiculously reasonable and probably more on my, that is the business owners, side that I would like them to be. It would be a net benefit for everyone, including the US, if it's broken taxation system becomes a national emergency and finally gets fixed.
  - Dylan16807 8y ago
    And for the "this is a real person" service, they really don't have to charge much. I should be able to go to the store and pay a dollar for a PIN that gets anonymized on use and lasts a long time if not indefinitely when not abused.
  - anon1252 8y ago
    I would absolutely subscribe to a email service with a 5/10/15 dollars one time payment.
    - teddyfrozevelt 8y ago
      Email has recurring costs to run. They need to process every email you receive and send and therefore any email service that actually wants to continue running will need to charge a subscription fee.
  - discreditable 8y ago
    A paid account is just as vulnerable to password theft as a free one.
- esotericn 8y ago
  This is only truly necessary as a mechanism to prevent automated signups. It is less necessary, but can be useful, to prevent repeated login attempts (rate limiting works there). For accessing a website it's completely inexcusable.
  - yetanotherjosh 8y ago
    Rate limiting login attempts means I can prevent you from logging in indefinitely by pushing your account into the rate limited status.
    - esotericn 8y ago
      Only as long as you keep up the attack.
      - repiret 8y ago
        But an attack that keeps rate limits saturated doesn’t require much bandwidth (you know, because rate limits) and is therefore easy to keep up. Most services would consider it unacceptable if a script kiddie with a botnet and a generic list of usernames were able to prevent even 1% of their users from logging in.
      - wild_preference 8y ago
        So your solution is "sorry, come back later when the attacker hopefully stops"? I can keep you out of your account indefinitely with a curl loop and a rotation of proxies?
  - brunoTbear 8y ago
    Background: I spent years developing a product that currently defends F500 websites against automated attacks. If you live in the US you've more than likely used my software this week without knowing it. Rate limiting is completely ineffective in preventing credential stuffing attacks from determined adversaries. The challenge is not brute-forcing, but credential leaks and password reuse. Attackers have access to vast seas of IP addresses and in my past life doing the defending, we would see an IP address involved in automation twice, and then it would go away forever.
- lordcorvin1 8y ago
  Honeypots take care of most basic bots. If you need captcha, you can use Math Question like in http://random.irb.hr/signup.php http://random.irb.hr/signup.php You can also add extra security with time elapsed between loading the page and form submission, if it's less than 5 seconds it's most likely a bot.
- GLjEI4YbnGD27LB 8y ago
  There's a solution here that's being used in email. The user has to provide a proof of work.
  - wild_preference 8y ago
    Where is it being used? Because the reason why https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash wasn't useful for anti-spam after all is because attackers have access to the cheapest compute in the world: botnets and devices that aren't their own.
singularity2001 8y ago
That's why agent randomizers were invented

by Sephr 8y ago

mrep 8y ago

Do you have a better solution for differentiating yourself as an actual user from a robot spammer?

kibwen 8y ago
Being allowed to pay for services with money, rather than being required to pay for services with your personal data. I browse the web via a proxy when I'm on public wifi, and Google is nigh unusable with how many captchas it forces you to solve to do a single Google search. Fortunately Bing and DDG still work, for now.
- tzs 8y ago
  > Being allowed to pay for services with money, rather than being required to pay for services with your personal data One possible big disadvantage for a site owner in letting people pay with money instead of data is dealing with taxes. I'm not actually sure how most jurisdictions tend to classify it when someone comes to your site and you charge them to access your content. My guess would be it would be taxed the same way they tax digital goods such as downloadable software that does not include any physical components. For such goods most jurisdictions that tax them seem to base the tax on the buyer's location rather than the seller's location, so the seller has to deal with charging the appropriate tax and filing returns for potentially a large number of jurisdictions. If the seller is providing the content for "free" and making their money selling visitor data to advertisers then their income will probably only be subject to taxation in their own jurisdiction. It will simply be ordinary business income.
  - antt 8y ago
    My experience with taxation out side of the US, currently Australia, is that they are ridiculously reasonable and probably more on my, that is the business owners, side that I would like them to be. It would be a net benefit for everyone, including the US, if it's broken taxation system becomes a national emergency and finally gets fixed.
- Dylan16807 8y ago
  And for the "this is a real person" service, they really don't have to charge much. I should be able to go to the store and pay a dollar for a PIN that gets anonymized on use and lasts a long time if not indefinitely when not abused.
- anon1252 8y ago
  I would absolutely subscribe to a email service with a 5/10/15 dollars one time payment.
  - teddyfrozevelt 8y ago
    Email has recurring costs to run. They need to process every email you receive and send and therefore any email service that actually wants to continue running will need to charge a subscription fee.
- discreditable 8y ago
  A paid account is just as vulnerable to password theft as a free one.
esotericn 8y ago
This is only truly necessary as a mechanism to prevent automated signups. It is less necessary, but can be useful, to prevent repeated login attempts (rate limiting works there). For accessing a website it's completely inexcusable.
- yetanotherjosh 8y ago
  Rate limiting login attempts means I can prevent you from logging in indefinitely by pushing your account into the rate limited status.
  - esotericn 8y ago
    Only as long as you keep up the attack.
    - repiret 8y ago
      But an attack that keeps rate limits saturated doesn’t require much bandwidth (you know, because rate limits) and is therefore easy to keep up. Most services would consider it unacceptable if a script kiddie with a botnet and a generic list of usernames were able to prevent even 1% of their users from logging in.
    - wild_preference 8y ago
      So your solution is "sorry, come back later when the attacker hopefully stops"? I can keep you out of your account indefinitely with a curl loop and a rotation of proxies?
- brunoTbear 8y ago
  Background: I spent years developing a product that currently defends F500 websites against automated attacks. If you live in the US you've more than likely used my software this week without knowing it. Rate limiting is completely ineffective in preventing credential stuffing attacks from determined adversaries. The challenge is not brute-forcing, but credential leaks and password reuse. Attackers have access to vast seas of IP addresses and in my past life doing the defending, we would see an IP address involved in automation twice, and then it would go away forever.
lordcorvin1 8y ago
Honeypots take care of most basic bots. If you need captcha, you can use Math Question like in http://random.irb.hr/signup.php http://random.irb.hr/signup.php You can also add extra security with time elapsed between loading the page and form submission, if it's less than 5 seconds it's most likely a bot.
GLjEI4YbnGD27LB 8y ago
There's a solution here that's being used in email. The user has to provide a proof of work.
- wild_preference 8y ago
  Where is it being used? Because the reason why https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash wasn't useful for anti-spam after all is because attackers have access to the cheapest compute in the world: botnets and devices that aren't their own.

singularity2001 8y ago

That's why agent randomizers were invented