4 ms·

The more you try to obfuscate your online sessions (eg: by disabling browser features, disabling JS, removing fonts, removing WebRTC, using the privacy-aware br

by vntok 8y ago

The more you try to obfuscate your online sessions (eg: by disabling browser features, disabling JS, removing fonts, removing WebRTC, using the privacy-aware browser-of-the-day, etc. thus making your fingerprint even more unique), the more you stand out from the regular users crowd, the more automated tracking machines/algos get interested in you as an abnormal datapoint, the more you are paradoxically at risk of being tracked.

Karunamon 8y ago
How exactly do they intend on fingerprinting me with no JS? They get my IP and referrer - that's it.
- vntok 8y ago
  Just one example of CSS-only tracking. Does not require JS: https://github.com/jbtronics/CrookedStyleSheets https://github.com/jbtronics/CrookedStyleSheets Other data that leak: User-Agent, Accept or Accept-Language, Accept-Encoding headers...
- Yizahi 8y ago
  Browser user agent. Mine is unique for example. With sufficiently vast DBs they can match you or anyone with anything. Also some 3rd party software may request to spy on you in the browser, e.g. Red Shell so called "analytics" used by many legitimate big video games on PC. It will spy on you in the browser and you agree to it in a kilometer long user agreement they shove in your face upon first launch.
Bartweiss 8y ago
I've never been sure what to make of this argument. There are definitely lots of 'tells' that someone is restricting their visibility, most obviously disabled JS. And I'm acutely aware that those things mark a person as interesting to corporate tracking, in the same way that searching for Tor and Tails flags people for government tracking. But it's hard for me to believe that the tradeoff isn't worth it. First, because automated surveillance happens in bulk: not standing out from the crowd is no longer proof against observation. (The Panopticon metaphor is if anything behind the times; that only created the fear of constant visibility, not the reality of it.) Second, because it's not clear to me that corporations take more interest in obfuscated users. Not only do they take more effort and overhead to fingerprint, they're quite likely to be worse business prospects. Using a VPN tells governments you're up to something interesting, but using uBlock tells ad networks that... I hate ads and am unlikely to click on them. In general, I expect that obfuscation signals that someone is a bad target for advertising and provides minimal information about their value as a customer service recipient. That said, I've been expecting for years now that somebody will get cute and start profiling privacy-aware users for separate targeting. If they've got JS disabled and Firefox up to date and sending DNT, maybe it'd be more profitable to replace tracked JS ads with text-only TripleByte ads or something?

by vntok 8y ago

Karunamon 8y ago

How exactly do they intend on fingerprinting me with no JS? They get my IP and referrer - that's it.

vntok 8y ago
Just one example of CSS-only tracking. Does not require JS: https://github.com/jbtronics/CrookedStyleSheets https://github.com/jbtronics/CrookedStyleSheets Other data that leak: User-Agent, Accept or Accept-Language, Accept-Encoding headers...
Yizahi 8y ago
Browser user agent. Mine is unique for example. With sufficiently vast DBs they can match you or anyone with anything. Also some 3rd party software may request to spy on you in the browser, e.g. Red Shell so called "analytics" used by many legitimate big video games on PC. It will spy on you in the browser and you agree to it in a kilometer long user agreement they shove in your face upon first launch.

Bartweiss 8y ago

I've never been sure what to make of this argument. There are definitely lots of 'tells' that someone is restricting their visibility, most obviously disabled JS. And I'm acutely aware that those things mark a person as interesting to corporate tracking, in the same way that searching for Tor and Tails flags people for government tracking. But it's hard for me to believe that the tradeoff isn't worth it. First, because automated surveillance happens in bulk: not standing out from the crowd is no longer proof against observation. (The Panopticon metaphor is if anything behind the times; that only created the fear of constant visibility, not the reality of it.) Second, because it's not clear to me that corporations take more interest in obfuscated users. Not only do they take more effort and overhead to fingerprint, they're quite likely to be worse business prospects. Using a VPN tells governments you're up to something interesting, but using uBlock tells ad networks that... I hate ads and am unlikely to click on them. In general, I expect that obfuscation signals that someone is a bad target for advertising and provides minimal information about their value as a customer service recipient. That said, I've been expecting for years now that somebody will get cute and start profiling privacy-aware users for separate targeting. If they've got JS disabled and Firefox up to date and sending DNT, maybe it'd be more profitable to replace tracked JS ads with text-only TripleByte ads or something?