3 ms·

It looks like the prevalence is low and it can easily be blocked with blocking the scripts in question. Nevertheless, what needs to happen is that all major br

It looks like the prevalence is low and it can easily be blocked with blocking the scripts in question. Nevertheless, what needs to happen is that all major browser makers come together and simply create a set of standard API values that do not harm daily browsing and make it possible for users to blend in with the masses, if they opt-in to activate It would be sufficient to create a couple of uniform user agents, list of fonts, list of plugins, canvas hash, platform and webgl data to bring the uniqueness down.

amelius 7y ago
I suspect it will always be possible to detect at least the brand of the browser, regardless of what the user-agent string says. It's just too damn hard to implement the entire web specification consistently, and malevolent actors can easily exploit any small deviations in the implementation. And of course things which are not in the web specification (such as timing) can be exploited.
- wongarsu 7y ago
  After you figured out the browser, it will also always be possible to find out the browser version, because newer versions implement features not present in older versions. Then you just need a hint to the OS (at least distuingishing Linux from Windows seems easy) and you have reconstructed the entire User Agent string.
  - amelius 7y ago
    > it will also always be possible to find out the browser version, because newer versions implement features not present in older versions True, but most browsers have an auto-update scheme, so basically everybody is on the same version at a given time (by approximation).
viseztrance 7y ago
There are SaSS companies that have their entire business model around creating databases of fingerprints - for example determining bots. These scripts track you over multiple websites and are very well concealed, so you won't find them on any ad blocker blacklist. Also, living in the EU won't protect you from getting fingerprinted.
- user17843 7y ago
  why do the studies referenced in the above study only show a very low <1% prevalence? Do they omitt the "good fingerprinters"?
  - viseztrance 7y ago
    I don't think so. A good fingerprinter will use a honeypot - an easy to detect fingerpriting script in addition to the real one.

amelius 7y ago

I suspect it will always be possible to detect at least the brand of the browser, regardless of what the user-agent string says. It's just too damn hard to implement the entire web specification consistently, and malevolent actors can easily exploit any small deviations in the implementation. And of course things which are not in the web specification (such as timing) can be exploited.

wongarsu 7y ago
After you figured out the browser, it will also always be possible to find out the browser version, because newer versions implement features not present in older versions. Then you just need a hint to the OS (at least distuingishing Linux from Windows seems easy) and you have reconstructed the entire User Agent string.
- amelius 7y ago
  > it will also always be possible to find out the browser version, because newer versions implement features not present in older versions True, but most browsers have an auto-update scheme, so basically everybody is on the same version at a given time (by approximation).

viseztrance 7y ago

There are SaSS companies that have their entire business model around creating databases of fingerprints - for example determining bots. These scripts track you over multiple websites and are very well concealed, so you won't find them on any ad blocker blacklist. Also, living in the EU won't protect you from getting fingerprinted.

user17843 7y ago
why do the studies referenced in the above study only show a very low <1% prevalence? Do they omitt the "good fingerprinters"?
- viseztrance 7y ago
  I don't think so. A good fingerprinter will use a honeypot - an easy to detect fingerpriting script in addition to the real one.