4 ms·

If (2) was a huge issue for them, wouldn't removing the UA header help tremendously as well? (Sure, you'd know it was an apple device, but that's still less th

If (2) was a huge issue for them, wouldn't removing the UA header help tremendously as well? (Sure, you'd know it was an apple device, but that's still less than currently. It's also less if other browsers followed suit.)

gruez 8y ago
iOS user agents aren't very identifying. Despite having multiple version numbers in them, all they pretty much tell you is 1) what type of ios device it is (eg. iphone or ipad) and 2) what ios version it is (mobile safari is updated along with ios, so the version numbers are pretty much the same for the same ios release). Considering that most ios users are up to date, you'll be hard pressed to squeeze more than a few bits of entropy from it.
- maccard 8y ago
  >Considering that most ios users are up to date, That's what makes it so valuable really. You get little to no entropy for a large portion of users, but you get a huge amount of entropy about the people who aren't.
  - vegardx 8y ago
    So you get amazing entropy on my grandma, which is quite possibly not worth the processing time you spent to track her, in terms of ad revenue or marketing campaigns. Sure - that's probably not the case in most of the cases, but it sure pollutes your otherwise good dataset.
- youngtaff 8y ago
  I think part of the advantage of DNT for fingerprinting is that it's a user set signal. BTW you can query the WebGL render to identify CPU / GPU information for iOS devices which is slightly more useful than just the UA
sf_rob 8y ago
IMO 2) is a PR move. Removing 1 bit of data isn't going to do much for anti-fingerprinting.
- eridius 8y ago
  The number of people who enable DNT is relatively small, so having it enabled is worth a lot more than 1 bit.
- olliej 8y ago
  It’s vastly more than 1 bit - if I recall correctly the amount of bits of info you get is something like log(1/P(event)) so if P(dnt==true) is less than 0.5 you accede 1 bit of information. It’s logically probably closer to 10bits of uniqueness assuming .01% of the population have it enabled.
olliej 8y ago
The safari UA is fixed - there was a post or document at some point saying that it had basically become a tracking tool, so beyond the compatibility requirements it is no longer changing. Similarly queryable font and plugin apis are fixed. But DNT is simply a tracking metric - and was opposed by everyone with non-ad revenue (specifically it was offered up by the ad industry to avoid regulation).
kalleboo 8y ago
https://webkit.org/blog/8042/release-notes-for-safari-technology-preview-46/ https://webkit.org/blog/8042/release-notes-for-safari-techno... > Froze the user-agent string to reduce web compatibility risk and to prevent its use for fingerprinting https://github.com/WebKit/webkit/commit/4bc237458115ac916f396d7b570e925f0ca9975a https://github.com/WebKit/webkit/commit/4bc237458115ac916f39... > Freeze the version reported as User Agent to OS 10.13.4 (OS 11.3 on iOS) and WebKit 605.1.15 for User Agent purposes.

gruez 8y ago

iOS user agents aren't very identifying. Despite having multiple version numbers in them, all they pretty much tell you is 1) what type of ios device it is (eg. iphone or ipad) and 2) what ios version it is (mobile safari is updated along with ios, so the version numbers are pretty much the same for the same ios release). Considering that most ios users are up to date, you'll be hard pressed to squeeze more than a few bits of entropy from it.

maccard 8y ago
>Considering that most ios users are up to date, That's what makes it so valuable really. You get little to no entropy for a large portion of users, but you get a huge amount of entropy about the people who aren't.
- vegardx 8y ago
  So you get amazing entropy on my grandma, which is quite possibly not worth the processing time you spent to track her, in terms of ad revenue or marketing campaigns. Sure - that's probably not the case in most of the cases, but it sure pollutes your otherwise good dataset.
youngtaff 8y ago
I think part of the advantage of DNT for fingerprinting is that it's a user set signal. BTW you can query the WebGL render to identify CPU / GPU information for iOS devices which is slightly more useful than just the UA

sf_rob 8y ago

IMO 2) is a PR move. Removing 1 bit of data isn't going to do much for anti-fingerprinting.

eridius 8y ago
The number of people who enable DNT is relatively small, so having it enabled is worth a lot more than 1 bit.
olliej 8y ago
It’s vastly more than 1 bit - if I recall correctly the amount of bits of info you get is something like log(1/P(event)) so if P(dnt==true) is less than 0.5 you accede 1 bit of information. It’s logically probably closer to 10bits of uniqueness assuming .01% of the population have it enabled.

olliej 8y ago

The safari UA is fixed - there was a post or document at some point saying that it had basically become a tracking tool, so beyond the compatibility requirements it is no longer changing. Similarly queryable font and plugin apis are fixed. But DNT is simply a tracking metric - and was opposed by everyone with non-ad revenue (specifically it was offered up by the ad industry to avoid regulation).

kalleboo 8y ago

https://webkit.org/blog/8042/release-notes-for-safari-technology-preview-46/ https://webkit.org/blog/8042/release-notes-for-safari-techno... > Froze the user-agent string to reduce web compatibility risk and to prevent its use for fingerprinting https://github.com/WebKit/webkit/commit/4bc237458115ac916f396d7b570e925f0ca9975a https://github.com/WebKit/webkit/commit/4bc237458115ac916f39... > Freeze the version reported as User Agent to OS 10.13.4 (OS 11.3 on iOS) and WebKit 605.1.15 for User Agent purposes.