5 ms·

Browser plugins really need to go away. If it's not implementable normally then it shouldn't be on the web. In my opinion at least. GPU models also should not

by Jonnax 7y ago

Browser plugins really need to go away. If it's not implementable normally then it shouldn't be on the web. In my opinion at least. GPU models also should not be given, browsers need to abstract features and performance into something else. Like if I'm writing a WebGL app, I should just be able to test a few baselines configs. User agent is a tricky one, Chrome on Android gives too much info because it's built by an advertising company.

modzu 7y ago
thats like saying programs should go away if its not implementable by the OS. its just a different layer. browser plugins are tremendously useful edit: also your comment seems to imply that plugins are used for websites trying to do something the browser doesnt support (ex flash) -- while this is sometimes done, most plugins add additional functionality for the user, ex adblockers, usability improvements, etc
- kalleboo 7y ago
  Plugins and extensions are different things. The `navigator.plugins` used for fingerprinting is just for NPAPI/PPAPI stuff like Flash, Java, Silverlight. Just about all browsers are also in the process of deprecating support for them. (it can also be possible to fingerprint browser extensions, but that is a bit trickier as it's not served up directly by the browser as a handy array)
  - modzu 7y ago
    oh yes my bad, thanks. i was thinking extensions (maybe thanks to all the ff news!). wrt fingerpritning plugins, it seems to be the least of the issues and hopefully not an issue for long :)
ekianjo 7y ago
> Browser plugins really need to go away. If it's not implementable normally then it shouldn't be on the web. In my opinion at least. So no more ad blockers?
- saagarjha 7y ago
  There’s a difference between plugins and extensions. Plugins add support for new types of media (think Flash, Java) while extensions are your adblockers and userscripts.
  - Spivak 7y ago
    Plugins also provide support for new video codecs. Plugins are definitely the wrong place for it but I would be so happy to see codecs factored out of individual browsers.
    - AgentME 7y ago
      That would make the list of supported video codecs a better fingerprinting mechanism.
Ajedi32 7y ago
Is there any reason why we couldn't have all browsers on all platforms use the same user agent header? I realize some sites use the user agent as a crude form of feature detection, but it's my understanding that that's generally considered to be bad practice.
- wongarsu 7y ago
  Apart from the difficulty of obscuring this information from JavaScript, it's politically impossible. Chrome could change its header to the header of a competitor or a neural one, but has no reason to (Google's main business is delivering ads). For other big browsers like Firefox and Safari it would be a huge loss to change the header: they would vanish from browser market share statistics, and with that the business case to make websites work well with their browser dwindles. That in turn would reduce their actual market share. That only leaves the browser with a market share so tiny they are ignored by developers, and those browsers do often spoof the user agent header (or at least make it very convenient to do so).
- dumbmatter 7y ago
  Sometimes there are browser bugs that are impossible to do feature detection for, in which case have no better option than looking at the user agent. For instance, several versions of Firefox had a serious bug in shared workers, which appeared intermittently when users opened your site in multiple tabs https://stackoverflow.com/questions/51092596/feature-detection-for-firefox-57-shared-worker-bug https://stackoverflow.com/questions/51092596/feature-detecti... - I had to use the user agent to work around this.
  - EastSmith 7y ago
    Sure, this is a fair use case. But then can't the browser tell the end user that someone wants to read this browser data so the user has a chance to say "no"?
    - dredmorbius 7y ago
      Changing user-agent is virtually always possible, though a vanishingly small fraction of users will do so. Bundling into adblockers or browsers directly would help.
Abishek_Muthian 7y ago
Even Firefox, Firefox Privacy on Android gives away android version in the User Agent. New Tor browser (android) fakes it, I remember even old Orfox used to give away device name as well & there used to exist an open issue to address it in their issue tracker.
dwild 7y ago
> GPU models also should not be given You don't need the model to fingerprint it. It's performance is probably more than enough.
- dillondoyle 7y ago
  you can get both primitives values+settings in addition to entropy similar to canvas fingerprint using shaders which will render slightly different across different devices.

by Jonnax 7y ago

modzu 7y ago

thats like saying programs should go away if its not implementable by the OS. its just a different layer. browser plugins are tremendously useful edit: also your comment seems to imply that plugins are used for websites trying to do something the browser doesnt support (ex flash) -- while this is sometimes done, most plugins add additional functionality for the user, ex adblockers, usability improvements, etc

kalleboo 7y ago
Plugins and extensions are different things. The `navigator.plugins` used for fingerprinting is just for NPAPI/PPAPI stuff like Flash, Java, Silverlight. Just about all browsers are also in the process of deprecating support for them. (it can also be possible to fingerprint browser extensions, but that is a bit trickier as it's not served up directly by the browser as a handy array)
- modzu 7y ago
  oh yes my bad, thanks. i was thinking extensions (maybe thanks to all the ff news!). wrt fingerpritning plugins, it seems to be the least of the issues and hopefully not an issue for long :)

ekianjo 7y ago

> Browser plugins really need to go away. If it's not implementable normally then it shouldn't be on the web. In my opinion at least. So no more ad blockers?

saagarjha 7y ago
There’s a difference between plugins and extensions. Plugins add support for new types of media (think Flash, Java) while extensions are your adblockers and userscripts.
- Spivak 7y ago
  Plugins also provide support for new video codecs. Plugins are definitely the wrong place for it but I would be so happy to see codecs factored out of individual browsers.
  - AgentME 7y ago
    That would make the list of supported video codecs a better fingerprinting mechanism.

Ajedi32 7y ago

Is there any reason why we couldn't have all browsers on all platforms use the same user agent header? I realize some sites use the user agent as a crude form of feature detection, but it's my understanding that that's generally considered to be bad practice.

wongarsu 7y ago
Apart from the difficulty of obscuring this information from JavaScript, it's politically impossible. Chrome could change its header to the header of a competitor or a neural one, but has no reason to (Google's main business is delivering ads). For other big browsers like Firefox and Safari it would be a huge loss to change the header: they would vanish from browser market share statistics, and with that the business case to make websites work well with their browser dwindles. That in turn would reduce their actual market share. That only leaves the browser with a market share so tiny they are ignored by developers, and those browsers do often spoof the user agent header (or at least make it very convenient to do so).
dumbmatter 7y ago
Sometimes there are browser bugs that are impossible to do feature detection for, in which case have no better option than looking at the user agent. For instance, several versions of Firefox had a serious bug in shared workers, which appeared intermittently when users opened your site in multiple tabs https://stackoverflow.com/questions/51092596/feature-detection-for-firefox-57-shared-worker-bug https://stackoverflow.com/questions/51092596/feature-detecti... - I had to use the user agent to work around this.
- EastSmith 7y ago
  Sure, this is a fair use case. But then can't the browser tell the end user that someone wants to read this browser data so the user has a chance to say "no"?
  - dredmorbius 7y ago
    Changing user-agent is virtually always possible, though a vanishingly small fraction of users will do so. Bundling into adblockers or browsers directly would help.

Abishek_Muthian 7y ago

Even Firefox, Firefox Privacy on Android gives away android version in the User Agent. New Tor browser (android) fakes it, I remember even old Orfox used to give away device name as well & there used to exist an open issue to address it in their issue tracker.

dwild 7y ago

> GPU models also should not be given You don't need the model to fingerprint it. It's performance is probably more than enough.

dillondoyle 7y ago
you can get both primitives values+settings in addition to entropy similar to canvas fingerprint using shaders which will render slightly different across different devices.