11 ms·

I agree with the general sentiment in the comments that this is good -- fingerprinting in particular is something browser vendors should be trying to combat. I

I agree with the general sentiment in the comments that this is good -- fingerprinting in particular is something browser vendors should be trying to combat. I am concerned about the approach however; a simple blacklist of fingerprinting scripts may be insufficient, in that non-blocked scripts can still access the data that is used to accomplish fingerprinting. Personally, I would like to see more security around the data that is used for fingerprinting, such as user agent, screen size, window size, loaded plugins, and so on. If this type of information was either protected with permissions, or if bogus values were provided to non-user-whitelisted sites, then it would be far harder to fingerprint users, as there would be less identifiable information to go off of. A less aggressive approach might be to have some kind of notification to the user if a website is accessing many API calls that are commonly associated with fingerprinting. Maybe a site that just wants to know window size is fine, since it might want to render something or select a certain layout, but if a site wants to know a wide variety of different information all at once, that would be a red flag that could be signaled to the user in some way.

jacekm 8y ago
> like to see more security around the data that is used for fingerprinting, such as user agent I think this is already available, just not enabled by default. In about:config one need to set privacy.resistFingerprinting to true. (be aware however that this setting causes problems with google captcha - the number of challenges that you will need to solve will drastically increase)
- proxygeek 8y ago
  > this setting causes problems with google captcha - the number of challenges that you will need to solve will drastically increase No kidding. I'm talking about ~30-40 clicks (1 click per task in the captcha grid)
  - pinko 8y ago
    Why can't they just allow the user to whitelist recaptcha?
    - Spare_account 8y ago
      The people who're trying to avoid being fingerprinted are probably thinking of Google when they decided to go down this path. I'm willing to go through extensive captcha cycles if that's the cost of retaining some anonymity. I installed uMatrix a while back to recover some anonymity and it worked at first, my Captcha load spiked significantly which was a great indication that I'd succeeded but it has dropped over time. I guess I'm gradually being fingerprinted again. Google's captcha tests are my litmus paper test that what I'm doing is effective.
      - the-pigeon 8y ago
        At this point can I just pay for a certificate or something? Like for $1 give me a certificate that I can use to say "I'm not a spammer" and I can anonymously buy as many certificates as I want. And then if a certificate is used by a spammer it becomes invalid. Seems like it's expensive enough to be worth using for existing spammers but let normal people pay a $1 every year or two to not have to deal with captchas.
        aussieguy1234 8y ago
        Fingerprinting is designed to generate a unique identifier to track you. Certificates would be an even more accurate unique ID over what fingerprinting could provide
        hanniabu 8y ago
        > and I can anonymously buy as many certificates as I want
        acdha 8y ago
        Do you really think that statistically noticeable numbers of people would do that and have perfect opsec preventing those perfect unique identifiers from being linked? I mean, even software developers tend to whine about paying $5 for an app which has far more immediate rewards.
  - gcb0 8y ago
    not to mention when google puts you in captcha-hell-ban. often, after a few difficult ones, I realize I get stuck into the same 20 challenges. over and over. no matter if I get them rigth or not. We do run all browser in the office with figerprint protection on and run non-exit-tor-nodes in all offices. But those are hardly excuses. The hell bans happens more often on firefox for android, but I guess that is what you can expect when you go against goliath. It's literally google censoring me from talking (and sometimes reading) random sites on the web
    - elagost 8y ago
      I've had this happen frequently because my configuration really aggressively blocks this stuff. It's bad enough that I have a separate browser (Gnome Web aka Epiphany) just for logging into and using sites that have Captcha, like Pocket and Bandcamp, and I do everything else in Firefox. Captcha is horrible. I understand why sites use it, but putting a Google-wall in front of your content is a very bad idea.
      - Aeolun 8y ago
        The problem is not the wall itself, but that Google uses it’s de-facto monopoly position to enforce tracking.
        danieldk 8y ago
        Plus creating image recognition training data for them. I am not interested in working for Google. Not paid, let alone for free.
        comprev 8y ago
        Never thought about it from that perspective before
    - msla 8y ago
      And it's going to get worse if this whole "privacy" thing catches on. Google is an advertising company which does adtech, and adtech is inherently about tracking and profiling people. Anyone who messes with that is actively costing Google money, and Google will... you know... stop them from doing that, whether subtly or overtly. There's nothing else they can really do, and "congressional hearings" and "calls for reform" won't change that fundamental fact.
  - Tsubasachan 8y ago
    Yeah I use multiple browsers. One that is completely locked down and one for CAPTCHA. The internet is hostile to anonymity.
  - ahoka 8y ago
    This is why I immediately close any page with google's captcha.
- wongarsu 8y ago
  Even without resistFingerprinting Firefox takes some steps, like reducing the precision on event timestamps. But the most effective measures won't become standard anytime soon because of recaptcha. 0: https://developer.mozilla.org/en-US/docs/Web/API/Event/timeStamp#Reduced_time_precision https://developer.mozilla.org/en-US/docs/Web/API/Event/timeS...
  - Arbalest 8y ago
    I would have thought that had more to do with Meltdown
- williamscales 8y ago
  Not to mention that it renders websites that display dates and times inaccurate due to reporting your time zone as UTC. Chat programs, web mail, web calendars all become unusable for me.
- tinus_hn 8y ago
  If it becomes the default Google can’t get away with bullying people using recaptcha.
codezero 8y ago
I'm also concerned with the general blacklists that are showing up. Some of the analytics companies in the list they are using from github don't use any particular fingerprinting technologies outside of setting a cookie. Given that there are a wide array of more aggressive and seemingly more malicious ways to fingerprint, bundling up cookie usage with that seems like a recipe for throwing the baby out with the bathwater. This is happening throughout the browser world right now though. There's no way for a "good" analytics company that sells a service to a website owner, with no intent to share, sell, or aggregate that data with third parties to differentiate itself from a malicious ad network that is intent on cross-device fingerprinting, persisting your identity, and knowing who you are everywhere you go on the web. Until there is some kind of official agreed upon terms/privacy policy that can be adhered to/audited, this will keep happening. It will lead the already advanced bad actors to further their game of whack-a-mole, and push the "good" companies to do more and more questionable things to avoid going out of business as moves like this cripple them. To be clear, I'm not saying that the analytics industry hasn't been complicit in its own punishment, it's just come to a head in a way that I feel warrants more cooperative action than blacklists based on... what criteria?
- charlesdaniels 8y ago
  That would suggest that there is such a thing as a "good" analytics company. From my perspective as and end user, why would it be desirable for me to facilitate the "analytics companies" business model? Sure, far-reaching blacklists are probably bad for analytics companies across the board, regardless of their intent. But as an end user, why should I care?
  - codezero 8y ago
    As an end user it shouldn’t be a concern you have as long as the data isn’t used for things you would find surprising. Right now there’s no way for any analytics company to convince you they don’t do anything surprising. I want my customers to run successful businesses and to use the data we collect on their behalf to help them do that. Why should you care? Mostly hypotheticals, but as said above, it shouldn’t matter to you. If analytics works, we can drive down costs, and improve how companies spend money on marketing and product development. This should mean more affordable and or higher quality products and services.
millstone 8y ago
This is the approach that Safari is using, they call it "simplified system configuration."
johnp_ 8y ago
> more security around the data that is used for fingerprinting, such as [...] screen size, window size Available in Nightly under a hidden boolean preference `privacy.resistFingerprinting.letterboxing`.
alkonaut 8y ago
Agree. It's almost like google made their captcha to ensure browsers continued to allow fingerprinting rather than to tell bots from humans. As you say perhaps sites can get a kind of "entropy budget". If they ask for my screen size that's X bits of entropy. If they want to render things to a canvas and read back the result that's Y bits of entropy (Y >> X). Once sites reach a certain budget that users can set themselves, they get fake or invalid data. Worst case if I set the entropy budget too low is I get a captcha or an incorrect layout somewhere.
nukeop 8y ago
The more websites use Google's "captcha", the more pointless it is to resist fingerprinting. And since that "captcha" is built into Cloudflare's "spam protection", it blocks you from half of the internet already. Why the scare quotes? Because the purpose of recaptcha isn't to tell humans from bots, it's to punish users who do not wish to be tracked by giving them an endless stream of challenges to solve no matter if they keep getting them right or wrong. It is especially obvious when they intentionally delay the loading of subsequent images if you have too many privacy features enabled, because it does nothing to prevent bots from solving them. It's grouped into several tiers, depending on the amount of frustration they want to generate: 1. Invisible captcha - you have Chrome, you're logged into a Google account, your advertising ID has a profile full of useful data. You go in with no hassle. 2. 1 click - maybe you're on a new IP or a new device, but you're logged into a Google account and use Chrome. Click the checkbox and that's it. 3. Regular captcha - You're not logged in but you don't use any privacy enhancements, so through a combination of fingerprinting, cookies, and other tracking techniques you're uniquely identified anyway. You get 9 images, select 2 or 3 of them and you're good to go. 4. Annoying captcha - you're blocking third party cookies, you're not on Chrome, looks like you're not being a good cog in the machine. You get a captcha with 9 squares that load more images, or you have to "select squares containing X", and you get 2-5 of these in a row. 5. Infuriating captcha - you're blocking third party trackers, cookies, all other storage methods, you block or mitigate canvas fingerprinting, you're behind a VPN, your fingerprint is not recognized, there's no data in your profile. Google won't squeeze a cent out of you, so you don't get to use the internet. You're getting an endless stream of slowly loading squares, or 5-7 objects to recognize. Even if you do all of them correctly, it won't let you in. Maybe after 4-8 cycles, but that will still waste ~10 minutes per try. You're barred from any website that links to reCaptcha. These days websites using it are for all purposes dead to me. I can't visit them and I won't waste my time clicking their images or selecting squares or whatever.
mholt 8y ago
This is the very proposal that my thesis made, which I defended just this week. We even did research in this area, and showed that people find being notified about their risks as helpful and made them more confident in making trust decisions.

jacekm 8y ago

> like to see more security around the data that is used for fingerprinting, such as user agent I think this is already available, just not enabled by default. In about:config one need to set privacy.resistFingerprinting to true. (be aware however that this setting causes problems with google captcha - the number of challenges that you will need to solve will drastically increase)

proxygeek 8y ago
> this setting causes problems with google captcha - the number of challenges that you will need to solve will drastically increase No kidding. I'm talking about ~30-40 clicks (1 click per task in the captcha grid)
- pinko 8y ago
  Why can't they just allow the user to whitelist recaptcha?
  - Spare_account 8y ago
    The people who're trying to avoid being fingerprinted are probably thinking of Google when they decided to go down this path. I'm willing to go through extensive captcha cycles if that's the cost of retaining some anonymity. I installed uMatrix a while back to recover some anonymity and it worked at first, my Captcha load spiked significantly which was a great indication that I'd succeeded but it has dropped over time. I guess I'm gradually being fingerprinted again. Google's captcha tests are my litmus paper test that what I'm doing is effective.
    - the-pigeon 8y ago
      At this point can I just pay for a certificate or something? Like for $1 give me a certificate that I can use to say "I'm not a spammer" and I can anonymously buy as many certificates as I want. And then if a certificate is used by a spammer it becomes invalid. Seems like it's expensive enough to be worth using for existing spammers but let normal people pay a $1 every year or two to not have to deal with captchas.
      - aussieguy1234 8y ago
        Fingerprinting is designed to generate a unique identifier to track you. Certificates would be an even more accurate unique ID over what fingerprinting could provide
        hanniabu 8y ago
        > and I can anonymously buy as many certificates as I want
        acdha 8y ago
        Do you really think that statistically noticeable numbers of people would do that and have perfect opsec preventing those perfect unique identifiers from being linked? I mean, even software developers tend to whine about paying $5 for an app which has far more immediate rewards.
- gcb0 8y ago
  not to mention when google puts you in captcha-hell-ban. often, after a few difficult ones, I realize I get stuck into the same 20 challenges. over and over. no matter if I get them rigth or not. We do run all browser in the office with figerprint protection on and run non-exit-tor-nodes in all offices. But those are hardly excuses. The hell bans happens more often on firefox for android, but I guess that is what you can expect when you go against goliath. It's literally google censoring me from talking (and sometimes reading) random sites on the web
  - elagost 8y ago
    I've had this happen frequently because my configuration really aggressively blocks this stuff. It's bad enough that I have a separate browser (Gnome Web aka Epiphany) just for logging into and using sites that have Captcha, like Pocket and Bandcamp, and I do everything else in Firefox. Captcha is horrible. I understand why sites use it, but putting a Google-wall in front of your content is a very bad idea.
    - Aeolun 8y ago
      The problem is not the wall itself, but that Google uses it’s de-facto monopoly position to enforce tracking.
      - danieldk 8y ago
        Plus creating image recognition training data for them. I am not interested in working for Google. Not paid, let alone for free.
        comprev 8y ago
        Never thought about it from that perspective before
  - msla 8y ago
    And it's going to get worse if this whole "privacy" thing catches on. Google is an advertising company which does adtech, and adtech is inherently about tracking and profiling people. Anyone who messes with that is actively costing Google money, and Google will... you know... stop them from doing that, whether subtly or overtly. There's nothing else they can really do, and "congressional hearings" and "calls for reform" won't change that fundamental fact.
- Tsubasachan 8y ago
  Yeah I use multiple browsers. One that is completely locked down and one for CAPTCHA. The internet is hostile to anonymity.
- ahoka 8y ago
  This is why I immediately close any page with google's captcha.
wongarsu 8y ago
Even without resistFingerprinting Firefox takes some steps, like reducing the precision on event timestamps. But the most effective measures won't become standard anytime soon because of recaptcha. 0: https://developer.mozilla.org/en-US/docs/Web/API/Event/timeStamp#Reduced_time_precision https://developer.mozilla.org/en-US/docs/Web/API/Event/timeS...
- Arbalest 8y ago
  I would have thought that had more to do with Meltdown
williamscales 8y ago
Not to mention that it renders websites that display dates and times inaccurate due to reporting your time zone as UTC. Chat programs, web mail, web calendars all become unusable for me.
tinus_hn 8y ago
If it becomes the default Google can’t get away with bullying people using recaptcha.

codezero 8y ago

I'm also concerned with the general blacklists that are showing up. Some of the analytics companies in the list they are using from github don't use any particular fingerprinting technologies outside of setting a cookie. Given that there are a wide array of more aggressive and seemingly more malicious ways to fingerprint, bundling up cookie usage with that seems like a recipe for throwing the baby out with the bathwater. This is happening throughout the browser world right now though. There's no way for a "good" analytics company that sells a service to a website owner, with no intent to share, sell, or aggregate that data with third parties to differentiate itself from a malicious ad network that is intent on cross-device fingerprinting, persisting your identity, and knowing who you are everywhere you go on the web. Until there is some kind of official agreed upon terms/privacy policy that can be adhered to/audited, this will keep happening. It will lead the already advanced bad actors to further their game of whack-a-mole, and push the "good" companies to do more and more questionable things to avoid going out of business as moves like this cripple them. To be clear, I'm not saying that the analytics industry hasn't been complicit in its own punishment, it's just come to a head in a way that I feel warrants more cooperative action than blacklists based on... what criteria?

charlesdaniels 8y ago
That would suggest that there is such a thing as a "good" analytics company. From my perspective as and end user, why would it be desirable for me to facilitate the "analytics companies" business model? Sure, far-reaching blacklists are probably bad for analytics companies across the board, regardless of their intent. But as an end user, why should I care?
- codezero 8y ago
  As an end user it shouldn’t be a concern you have as long as the data isn’t used for things you would find surprising. Right now there’s no way for any analytics company to convince you they don’t do anything surprising. I want my customers to run successful businesses and to use the data we collect on their behalf to help them do that. Why should you care? Mostly hypotheticals, but as said above, it shouldn’t matter to you. If analytics works, we can drive down costs, and improve how companies spend money on marketing and product development. This should mean more affordable and or higher quality products and services.

millstone 8y ago

This is the approach that Safari is using, they call it "simplified system configuration."

johnp_ 8y ago

> more security around the data that is used for fingerprinting, such as [...] screen size, window size Available in Nightly under a hidden boolean preference `privacy.resistFingerprinting.letterboxing`.

alkonaut 8y ago

Agree. It's almost like google made their captcha to ensure browsers continued to allow fingerprinting rather than to tell bots from humans. As you say perhaps sites can get a kind of "entropy budget". If they ask for my screen size that's X bits of entropy. If they want to render things to a canvas and read back the result that's Y bits of entropy (Y >> X). Once sites reach a certain budget that users can set themselves, they get fake or invalid data. Worst case if I set the entropy budget too low is I get a captcha or an incorrect layout somewhere.

nukeop 8y ago

The more websites use Google's "captcha", the more pointless it is to resist fingerprinting. And since that "captcha" is built into Cloudflare's "spam protection", it blocks you from half of the internet already. Why the scare quotes? Because the purpose of recaptcha isn't to tell humans from bots, it's to punish users who do not wish to be tracked by giving them an endless stream of challenges to solve no matter if they keep getting them right or wrong. It is especially obvious when they intentionally delay the loading of subsequent images if you have too many privacy features enabled, because it does nothing to prevent bots from solving them. It's grouped into several tiers, depending on the amount of frustration they want to generate: 1. Invisible captcha - you have Chrome, you're logged into a Google account, your advertising ID has a profile full of useful data. You go in with no hassle. 2. 1 click - maybe you're on a new IP or a new device, but you're logged into a Google account and use Chrome. Click the checkbox and that's it. 3. Regular captcha - You're not logged in but you don't use any privacy enhancements, so through a combination of fingerprinting, cookies, and other tracking techniques you're uniquely identified anyway. You get 9 images, select 2 or 3 of them and you're good to go. 4. Annoying captcha - you're blocking third party cookies, you're not on Chrome, looks like you're not being a good cog in the machine. You get a captcha with 9 squares that load more images, or you have to "select squares containing X", and you get 2-5 of these in a row. 5. Infuriating captcha - you're blocking third party trackers, cookies, all other storage methods, you block or mitigate canvas fingerprinting, you're behind a VPN, your fingerprint is not recognized, there's no data in your profile. Google won't squeeze a cent out of you, so you don't get to use the internet. You're getting an endless stream of slowly loading squares, or 5-7 objects to recognize. Even if you do all of them correctly, it won't let you in. Maybe after 4-8 cycles, but that will still waste ~10 minutes per try. You're barred from any website that links to reCaptcha. These days websites using it are for all purposes dead to me. I can't visit them and I won't waste my time clicking their images or selecting squares or whatever.

mholt 8y ago

This is the very proposal that my thesis made, which I defended just this week. We even did research in this area, and showed that people find being notified about their risks as helpful and made them more confident in making trust decisions.