5 ms·

I worked in the ad industry. Every web-browser including brave, tor,safari is uniquely identifiable even on same hardware. All the public computer researchers

I worked in the ad industry. Every web-browser including brave, tor,safari is uniquely identifiable even on same hardware. All the public computer researchers and browser vendors are years behind the techniques to fingerprint devices (probably 5+). Canvas, WebGl etc are techniques of the past. There are much more advanced ones, than can identify devices with completely uniquely (on both desktop and mobile) Also we know when users fake their fingerprints, and the algorithm respects the decision even though we know who the user is despite faking with all state of the art methods. Latest methods dont even use JavaScript. Just CSS is enough to identify every device uniquely but you'd need JS to send the data back. Every public researcher I've seen are given honeypot techniques that they consider state of the art even thought the industry is way ahead of the researchers.

senorjazz 7y ago
If this is the case, then the millions if not billions of adfraud is put through by the ad companies knowingly and defrauding the ad-buyers surely?
- kakkksaknmdm 7y ago
  Large companies have fixed ad spend budgets. If they dont spend they lose. Doesn't matter if its lost to fraud. Google, Facebook advertiser have more specific budgets, especially Facebook which has a large number of small advertisers. Large adnetworks however get large advertisers with advertising budgets in tens of millions on average. There is a larger pressure on Google and Facebook to be competitive then say smaller ad networks. Also the techniques that I mention of are not in use in wild after the POC on millions of devices few months ago. They're a backup plan. Also not every adtech company has them. Maybe 2 or 3 at the most are at the cutting edge of tracking. Google knows this very well. You really think Google couldn't counter fraud? Its a fake and manufactured outrage. No one wants to give away their "secret sauce" just yet. Also right now many adtech companies are going bankrupt. Many larger one are waiting for smaller ones to be gone after which the landscape changes.
  - soverance 7y ago
    > Also right now many adtech companies are going bankrupt. As someone currently working in IT for an adtech company, I can at least provide one data point in that the company I work for is slowly (but surely) dying.
flatb 7y ago
Not to be picky, because to be honest I completely believe that what you say is plausible, but that's a lot of outrageous claims with very little in the way of examples or evidence.
- kakkksaknmdm 7y ago
  This is what we knew of in 2015: https://boingboing.net/2019/05/22/unique-device-fingerprints.html https://boingboing.net/2019/05/22/unique-device-fingerprints... you can figure out where the industry is now yourself.
rypskar 7y ago
Thank you for this good argument for why we all should block ads. There is no reason for you to stalk users
user32556 7y ago
Are you talking about CSS-based fingerprinting? https://browserleaks.com/css#explanation https://browserleaks.com/css#explanation
- kakkksaknmdm 7y ago
  No, not this is some amateur work. State of the art techniques css fingerprinting can uniquely identify 1 device from billions. Also this is nothing but getting dimension of screen and other browser attributes which are useless now. The current state of the art cannot be mitigated unless you put a 95% penalty on performance on the CSS engine AFAIK.
  - pushcx 7y ago
    The old link you keep pasting does not support this or your other hyperbolic assertions. Stop dangling claims of secret superpowers or support them.
    - kakkksaknmdm 7y ago
      Have a read: https://www.ieee-security.org/TC/SP2019/papers/405.pdf https://www.ieee-security.org/TC/SP2019/papers/405.pdf
      - pragmatick 7y ago
        All the links you provided describe techniques that would only work on mobile devices with access to the sensors. On my desktop PC there's no GPS, no gyrometer, no webcam and no browser access to my microphone.
        pushcx 7y ago
        And no access to that on mobile without security dialogs. Dude originally claimed it worked via CSS. I guess he doesn't have secret superpowers.
TeMPOraL 7y ago
As a service to the public, could you please share the state-of-the-art techniques used currently by the industry?
- kakkksaknmdm 7y ago
  This was used publicly in around 2016, stopped using around 2017 when research showed even better ways that cannot be spoofed: https://boingboing.net/2019/05/22/unique-device-fingerprints.html https://boingboing.net/2019/05/22/unique-device-fingerprints... Ours was more advanced then this. As far as I've read the paper cited on the source above, they are like 30% of ours tech POC back in 2015.
Laaas 7y ago
Can you give any examples for the techniques used?
- kakkksaknmdm 7y ago
  This is one that we knew of in 2015, and the public researchers just found out in 2019: https://boingboing.net/2019/05/22/unique-device-fingerprints.html https://boingboing.net/2019/05/22/unique-device-fingerprints... Now we're waaay past this easy stuff to fake stuff. This now considered to be basic. Look into distill networks, but their public product is very far behind what we did. Not sure if they have better tech to be used in future.
emtel 7y ago
In order to believe what you're claiming here, we have to believe that 1. There is magic css/js that can not only tell different browsers and devices apart, but can tell two phones from the same manufacturing run with the same software apart. 2. Despite the fact that this magic code would have to run in the client browser where its content, execution, and the data it sends back are all plainly visible to anyone who can hit ctrl-shift-j, no "public researcher or browser vendor" knows anything about it. 3. This technology is not used to combat ad fraud because of some weird conspiracy at Google. It could be true, I suppose, but I don't see why anyone would believe this based on the evidence so far.
- kakkksaknmdm 7y ago
  Yes to all. Have a look if you want for a bit of evidence: This was one of the 10's of possible techniques that could identify devices uniquely among billions https://boingboing.net/2019/05/22/unique-device-fingerprints.html https://boingboing.net/2019/05/22/unique-device-fingerprints... However the author of the paper could not get it to work on low end devices, whereas we could. And we discovered this around 2015.
vbezhenar 7y ago
Just today I decided to switch to FF and try noscript experience. Works good enough so far. Funny that crippled experience is even better in some weird ways. I used to scroll reddit forums, now I can read just few first posts and that is good. I used to expand a lot of comments, now I can't expand them, but it saves time. Sure, self-control would be better, but that is good too :) It's good to know that without JavaScript I'll send less data to that anti-human industry.
- kakkksaknmdm 7y ago
  Wait for the new CSS version over which our team had a watch. Wont require JS after it comes out. ;D Also we know many exploits to bypass noscript if we wanted to (yes I know there are bounties for this, but we were paid much higher then any public bounty for this stuff)
  - SahAssar 7y ago
    As far as I understand the only way that it can work without without js is either by using @supports or similar feature/media queries (which would be the same for all users on the same hardware and browser) or by requiring user interaction (like a :hover state or clicking a link).
    - kakkksaknmdm 7y ago
      >Latest methods dont even use JavaScript. Just CSS is enough to identify every device uniquely but you'd need JS to send the data back.
      - SahAssar 7y ago
        You said: > Wait for the new CSS version over which our team had a watch. Wont require JS after it comes out. ;D So how does that work considering what I said above?
        kakkksaknmdm 7y ago

senorjazz 7y ago

If this is the case, then the millions if not billions of adfraud is put through by the ad companies knowingly and defrauding the ad-buyers surely?

kakkksaknmdm 7y ago
Large companies have fixed ad spend budgets. If they dont spend they lose. Doesn't matter if its lost to fraud. Google, Facebook advertiser have more specific budgets, especially Facebook which has a large number of small advertisers. Large adnetworks however get large advertisers with advertising budgets in tens of millions on average. There is a larger pressure on Google and Facebook to be competitive then say smaller ad networks. Also the techniques that I mention of are not in use in wild after the POC on millions of devices few months ago. They're a backup plan. Also not every adtech company has them. Maybe 2 or 3 at the most are at the cutting edge of tracking. Google knows this very well. You really think Google couldn't counter fraud? Its a fake and manufactured outrage. No one wants to give away their "secret sauce" just yet. Also right now many adtech companies are going bankrupt. Many larger one are waiting for smaller ones to be gone after which the landscape changes.
- soverance 7y ago
  > Also right now many adtech companies are going bankrupt. As someone currently working in IT for an adtech company, I can at least provide one data point in that the company I work for is slowly (but surely) dying.

flatb 7y ago

Not to be picky, because to be honest I completely believe that what you say is plausible, but that's a lot of outrageous claims with very little in the way of examples or evidence.

kakkksaknmdm 7y ago
This is what we knew of in 2015: https://boingboing.net/2019/05/22/unique-device-fingerprints.html https://boingboing.net/2019/05/22/unique-device-fingerprints... you can figure out where the industry is now yourself.

rypskar 7y ago

Thank you for this good argument for why we all should block ads. There is no reason for you to stalk users

user32556 7y ago

Are you talking about CSS-based fingerprinting? https://browserleaks.com/css#explanation https://browserleaks.com/css#explanation

kakkksaknmdm 7y ago
No, not this is some amateur work. State of the art techniques css fingerprinting can uniquely identify 1 device from billions. Also this is nothing but getting dimension of screen and other browser attributes which are useless now. The current state of the art cannot be mitigated unless you put a 95% penalty on performance on the CSS engine AFAIK.
- pushcx 7y ago
  The old link you keep pasting does not support this or your other hyperbolic assertions. Stop dangling claims of secret superpowers or support them.
  - kakkksaknmdm 7y ago
    Have a read: https://www.ieee-security.org/TC/SP2019/papers/405.pdf https://www.ieee-security.org/TC/SP2019/papers/405.pdf
    - pragmatick 7y ago
      All the links you provided describe techniques that would only work on mobile devices with access to the sensors. On my desktop PC there's no GPS, no gyrometer, no webcam and no browser access to my microphone.
      - pushcx 7y ago
        And no access to that on mobile without security dialogs. Dude originally claimed it worked via CSS. I guess he doesn't have secret superpowers.

TeMPOraL 7y ago

As a service to the public, could you please share the state-of-the-art techniques used currently by the industry?

kakkksaknmdm 7y ago
This was used publicly in around 2016, stopped using around 2017 when research showed even better ways that cannot be spoofed: https://boingboing.net/2019/05/22/unique-device-fingerprints.html https://boingboing.net/2019/05/22/unique-device-fingerprints... Ours was more advanced then this. As far as I've read the paper cited on the source above, they are like 30% of ours tech POC back in 2015.

Laaas 7y ago

Can you give any examples for the techniques used?

kakkksaknmdm 7y ago
This is one that we knew of in 2015, and the public researchers just found out in 2019: https://boingboing.net/2019/05/22/unique-device-fingerprints.html https://boingboing.net/2019/05/22/unique-device-fingerprints... Now we're waaay past this easy stuff to fake stuff. This now considered to be basic. Look into distill networks, but their public product is very far behind what we did. Not sure if they have better tech to be used in future.

emtel 7y ago

In order to believe what you're claiming here, we have to believe that 1. There is magic css/js that can not only tell different browsers and devices apart, but can tell two phones from the same manufacturing run with the same software apart. 2. Despite the fact that this magic code would have to run in the client browser where its content, execution, and the data it sends back are all plainly visible to anyone who can hit ctrl-shift-j, no "public researcher or browser vendor" knows anything about it. 3. This technology is not used to combat ad fraud because of some weird conspiracy at Google. It could be true, I suppose, but I don't see why anyone would believe this based on the evidence so far.

kakkksaknmdm 7y ago
Yes to all. Have a look if you want for a bit of evidence: This was one of the 10's of possible techniques that could identify devices uniquely among billions https://boingboing.net/2019/05/22/unique-device-fingerprints.html https://boingboing.net/2019/05/22/unique-device-fingerprints... However the author of the paper could not get it to work on low end devices, whereas we could. And we discovered this around 2015.

vbezhenar 7y ago

Just today I decided to switch to FF and try noscript experience. Works good enough so far. Funny that crippled experience is even better in some weird ways. I used to scroll reddit forums, now I can read just few first posts and that is good. I used to expand a lot of comments, now I can't expand them, but it saves time. Sure, self-control would be better, but that is good too :) It's good to know that without JavaScript I'll send less data to that anti-human industry.

kakkksaknmdm 7y ago
Wait for the new CSS version over which our team had a watch. Wont require JS after it comes out. ;D Also we know many exploits to bypass noscript if we wanted to (yes I know there are bounties for this, but we were paid much higher then any public bounty for this stuff)
- SahAssar 7y ago
  As far as I understand the only way that it can work without without js is either by using @supports or similar feature/media queries (which would be the same for all users on the same hardware and browser) or by requiring user interaction (like a :hover state or clicking a link).
  - kakkksaknmdm 7y ago
    >Latest methods dont even use JavaScript. Just CSS is enough to identify every device uniquely but you'd need JS to send the data back.
    - SahAssar 7y ago
      You said: > Wait for the new CSS version over which our team had a watch. Wont require JS after it comes out. ;D So how does that work considering what I said above?
      - kakkksaknmdm 7y ago