6 ms·

While you make good points about mobile apps, don't be too spoiled by the privacy offered by destop browsers. Because of their configuration and various APIs, t

by blfr 8y ago

While you make good points about mobile apps, don't be too spoiled by the privacy offered by destop browsers. Because of their configuration and various APIs, they're almost as easy to fingerprint as mobile devices with advertising IDs. EFF has had a proof of concept online for quite a while https://panopticlick.eff.org/ https://panopticlick.eff.org/ And HN users are probably even more vulnerable since we will have customized our software making it stand out.

dvfjsdhgfv 8y ago
> And HN users are probably even more vulnerable since we will have customized our software making it stand out. On the other hand, among HN users you'll probably find a higher percentage of those who block JS by default and allow it only on selected websites. Most of these fingerprinting methods (and most web abuse in general) depends on JS being turned on.
- blfr 8y ago
  Maybe. OTOH, how many people who share your IP addresses use the same browser, OS, and block JS? Unless you're using a vanilla Tor Browser, you will probably stand out. And if you are, 'tptacek will tell you how it's a bad idea for other reasons.
nly 8y ago
I know you're not disagreeing with me, but the issue you raise only distracts and lends ammo to the defenders of these prolific tracking mechanisms. It's the Nirvana fallacy. I'm sure there's a Google rep somewhere that will tell you that their "advertising ID" is better than the status quo on the web because the user can rotate it and, because it's reliable and easy for app devs to use, they are discouraged from being more nefarious and sneaky in tracking users. This is all a bloody distraction from the point: it should not be an acceptable norm for this tracking to happen and it should be as hard as possible to pull off without informed user consent. The degree to which platforms are defensive against it is a different issue to whether or not they actively encourage it by design... which shouldn't even be open to debate.
- VRay 8y ago
  That's a good point. Depending on permissions, it would be hard to keep some malicious apps from stealing your nude photos too, but we don't take it for granted that "Of course the file explorer app looks for and surreptitiously uploads nudes! How else are they supposed to make money?" Our world is starting to looka lot like that of the Space Merchants..
- blfr 8y ago
  I didn't disagree with your original comment by I do disagree with the follow-up. It's neither a distraction, nor a fallacy. First, our computing devices do not protect our privacy and security sufficiently. It's a general problem, not limited or even particularly affecting Android. And you deal with general problems differently than with incidental ones. You don't tell people in an epidemic to "just go see a doctor." Second, I do more sensitive computing in the browser on my computer than I do on my phone. It's the bigger issue. Finally, the way we dealt with Internet worms and viruses was not by strongly stating how unacceptable infecting other people's computers is. We patched our software, kept it up to date, and even completely changed its design. Later shamed Microsoft into doing the same.
  - PavlovsCat 8y ago
    I upvoted you because while I disagree that browsers are the bigger issue (many people use mobile devices for important things, and the less tech literate, the higher the chance they do all their online stuff with them, I'll just claim that), you didn't bring browsers up, you just responded to that with a fair point... and the comment you responded to didn't mention browers to distract either, so it seems silly to me that there's now this hot potato of who distracted from what in play. Good points all around, that's what I'm seeing.
- lern_too_spel 8y ago
  The Android advertising ID is exactly the same as the iOS IDFA. Both companies enforce policies on using those identifiers for apps published on their app stores. https://support.google.com/googleplay/android-developer/answer/6048248?hl=en https://support.google.com/googleplay/android-developer/answ... https://www.businessinsider.com/ifa-apples-iphone-tracking-in-ios-6-2012-10 https://www.businessinsider.com/ifa-apples-iphone-tracking-i...
bagsvaerd70 8y ago
Do you have a recommended setup to tackle fingerprinting? I'm using a VPN + ublock origin + https everywhere + temporary containers + don't track me google + chameleon + canvas blocker + custom user.js (that disables e.g. webgl). It's pretty good to address many tracking methods (e.g. cookies, IP) but fingerprinting is remarkably hard to prevent.
- blfr 8y ago
  I don't. The only one I know is using Tor Browser without any customization, without even changing the windows size, because it makes you look like every other Tor Browser user. However, it comes with a fairly long list of downsides: less secure than Chrome, less secure than even Firefox it's based on because it's not updated as often and quickly, and you MITM yourself by default, and it's slow, it doesn't block ads... The price to pay is steep.
  - crtasm 8y ago
    It's fast enough to be my main browser and plays e.g. YouTube at lower resolutions fine. I chose to install ublock origin, makes me stand out more from other users but I'm on Linux which is now revealed directly in the useragent string so I decided it wasn't a concern for me as I'm already not in the larger group of Windows users.
- Santosh83 8y ago
  Disabling Javascript kills fingerprinting in the womb. Enable only for trusted sites as needed.
  - freedomben 8y ago
    This 100%. It will also make your web experience a lot better because so much of the javascript out there just does things you don't want anyway, such as loading ads and displaying popups. If you are a web developer or are familiar with web terminology like origins, domains, frames, XHR, etc on the web, and are willing to put in some time learning how to use it (15 mins for a seasoned web dev, maybe 30-60 mins otherwise) get uMatrix (https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix). It will change your life! If not, use ScriptBlock on Chrome or NoScript on Firefox. Block all scripts (and if using uMatrix, cookies, XHR, and frames) by default and whitelist as you go for sites you trust (or want to use bad enough to potentially open yourself up for tracking).
tokyodude 8y ago
I'm not totally convinced panopticlick is as real as they claim. Try you're on the west or east coast of the USA and own an 1 or 2 year old iphone try visiting. It will likely tell you you're identifible 1 out of 500k or so. But except for time zone all iPhones of the same model should have the same fingerprint. Pretty much any calcluation on how many iphones 1 or 2 years old in the same time zone will make it clear that 500k is several orders of magnitude off. I'm not saying you can't finger print, and like you pointed out it's easier on desktop. I'm only pointing out that panopticlick needs some work to be more accurate.

by blfr 8y ago

dvfjsdhgfv 8y ago

> And HN users are probably even more vulnerable since we will have customized our software making it stand out. On the other hand, among HN users you'll probably find a higher percentage of those who block JS by default and allow it only on selected websites. Most of these fingerprinting methods (and most web abuse in general) depends on JS being turned on.

blfr 8y ago
Maybe. OTOH, how many people who share your IP addresses use the same browser, OS, and block JS? Unless you're using a vanilla Tor Browser, you will probably stand out. And if you are, 'tptacek will tell you how it's a bad idea for other reasons.

nly 8y ago

I know you're not disagreeing with me, but the issue you raise only distracts and lends ammo to the defenders of these prolific tracking mechanisms. It's the Nirvana fallacy. I'm sure there's a Google rep somewhere that will tell you that their "advertising ID" is better than the status quo on the web because the user can rotate it and, because it's reliable and easy for app devs to use, they are discouraged from being more nefarious and sneaky in tracking users. This is all a bloody distraction from the point: it should not be an acceptable norm for this tracking to happen and it should be as hard as possible to pull off without informed user consent. The degree to which platforms are defensive against it is a different issue to whether or not they actively encourage it by design... which shouldn't even be open to debate.

VRay 8y ago
That's a good point. Depending on permissions, it would be hard to keep some malicious apps from stealing your nude photos too, but we don't take it for granted that "Of course the file explorer app looks for and surreptitiously uploads nudes! How else are they supposed to make money?" Our world is starting to looka lot like that of the Space Merchants..
blfr 8y ago
I didn't disagree with your original comment by I do disagree with the follow-up. It's neither a distraction, nor a fallacy. First, our computing devices do not protect our privacy and security sufficiently. It's a general problem, not limited or even particularly affecting Android. And you deal with general problems differently than with incidental ones. You don't tell people in an epidemic to "just go see a doctor." Second, I do more sensitive computing in the browser on my computer than I do on my phone. It's the bigger issue. Finally, the way we dealt with Internet worms and viruses was not by strongly stating how unacceptable infecting other people's computers is. We patched our software, kept it up to date, and even completely changed its design. Later shamed Microsoft into doing the same.
- PavlovsCat 8y ago
  I upvoted you because while I disagree that browsers are the bigger issue (many people use mobile devices for important things, and the less tech literate, the higher the chance they do all their online stuff with them, I'll just claim that), you didn't bring browsers up, you just responded to that with a fair point... and the comment you responded to didn't mention browers to distract either, so it seems silly to me that there's now this hot potato of who distracted from what in play. Good points all around, that's what I'm seeing.
lern_too_spel 8y ago
The Android advertising ID is exactly the same as the iOS IDFA. Both companies enforce policies on using those identifiers for apps published on their app stores. https://support.google.com/googleplay/android-developer/answer/6048248?hl=en https://support.google.com/googleplay/android-developer/answ... https://www.businessinsider.com/ifa-apples-iphone-tracking-in-ios-6-2012-10 https://www.businessinsider.com/ifa-apples-iphone-tracking-i...

bagsvaerd70 8y ago

Do you have a recommended setup to tackle fingerprinting? I'm using a VPN + ublock origin + https everywhere + temporary containers + don't track me google + chameleon + canvas blocker + custom user.js (that disables e.g. webgl). It's pretty good to address many tracking methods (e.g. cookies, IP) but fingerprinting is remarkably hard to prevent.

blfr 8y ago
I don't. The only one I know is using Tor Browser without any customization, without even changing the windows size, because it makes you look like every other Tor Browser user. However, it comes with a fairly long list of downsides: less secure than Chrome, less secure than even Firefox it's based on because it's not updated as often and quickly, and you MITM yourself by default, and it's slow, it doesn't block ads... The price to pay is steep.
- crtasm 8y ago
  It's fast enough to be my main browser and plays e.g. YouTube at lower resolutions fine. I chose to install ublock origin, makes me stand out more from other users but I'm on Linux which is now revealed directly in the useragent string so I decided it wasn't a concern for me as I'm already not in the larger group of Windows users.
Santosh83 8y ago
Disabling Javascript kills fingerprinting in the womb. Enable only for trusted sites as needed.
- freedomben 8y ago
  This 100%. It will also make your web experience a lot better because so much of the javascript out there just does things you don't want anyway, such as loading ads and displaying popups. If you are a web developer or are familiar with web terminology like origins, domains, frames, XHR, etc on the web, and are willing to put in some time learning how to use it (15 mins for a seasoned web dev, maybe 30-60 mins otherwise) get uMatrix (https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix). It will change your life! If not, use ScriptBlock on Chrome or NoScript on Firefox. Block all scripts (and if using uMatrix, cookies, XHR, and frames) by default and whitelist as you go for sites you trust (or want to use bad enough to potentially open yourself up for tracking).

tokyodude 8y ago

I'm not totally convinced panopticlick is as real as they claim. Try you're on the west or east coast of the USA and own an 1 or 2 year old iphone try visiting. It will likely tell you you're identifible 1 out of 500k or so. But except for time zone all iPhones of the same model should have the same fingerprint. Pretty much any calcluation on how many iphones 1 or 2 years old in the same time zone will make it clear that 500k is several orders of magnitude off. I'm not saying you can't finger print, and like you pointed out it's easier on desktop. I'm only pointing out that panopticlick needs some work to be more accurate.