4 ms·

> And while we're at it the container should just spit out random shit like different resolution, audio api, user agent, once in a while (unless the user turns

> And while we're at it the container should just spit out random shit like different resolution, audio api, user agent, once in a while (unless the user turns it off) to thwart such attempts. Wouldn't that break the legitimate feature-detection uses for these APIs? Asking the user to identify and whitelist each call is impractical, especially since the fail-case in this scenario would be subtle (you'd still see the page but it might randomly be in the wrong mode, or images might be scaled incorrectly, etc). At that point you might as well just turn Javascript off.

superasn 7y ago
Yes I thought about it that's why "unless the user turns it off" comment in parens. I think out of 100 sites I visit everyday no website needs to access the audio api without my consent maybe except one or two which i can whitelist. Same for user agent, I don't think it should break if the container says I'm running firefox v65 or v67, etc.
- saagarjha 7y ago
  Changing the resolution sounds like it would break a lot of websites, though.
  - enriquto 7y ago
    and these websites certainly deserve to be broken!
    - saagarjha 7y ago
      Uh, I’m not sure I agree. Any website that needs to do nontrivial layout will query the browser viewport size.
- shawnz 7y ago
  If websites had to ask permission to enable responsive features like screen size detection, then nobody would use them
  - dmitrygr 7y ago
    Good! Then maybe they'll go back to writing normal html and let my user agent present it to me how I like and how my device best does
    - shawnz 7y ago
      If that's how you feel, why not disable CSS?
      - progval 7y ago
        It was already possible to write CSS that adapts to various screen sizes before CSS became a privacy issue (ie. before CSS 3); except it was called regular CSS, not responsive. My guess is the difference between "regular CSS that adapts to screen size" and "responsive CSS" is that the former only has a single set of rules while the latter has different CSS rules that get enabled/disabled based on screen size. Conditional rules -> different content gets loaded -> server gets notified of what rules are enabled -> fingerprinting
    - patrick5415 7y ago
      Agree. I wish the entire internet looked like GNU documentation page.
  - NikolaNovak 7y ago
    AWESOME. Things went downhill once we started writing HTML which required knowing screen size ;-<
nerdponx 7y ago
That, and it should be pretty easy to filter out this kind of fake "chaff" data.
vokep 7y ago
Maybe, but that seems better than the current mess. I'd rather no features than features which act against my interests.
- deleted 7y ago
  [deleted]
patrick5415 7y ago
I’d prefer legitimate api usage be broken than suffer through all the abuses.
laughinghan 7y ago
Have you heard of those projects trying to defeat behavioral tracking where, whenever you visit a page, it simultaneously opens a bunch of other random pages in the background, hidden from you, and simulates activity on them, the idea being that Facebook has no idea what actual websites you like to visit because it's lost in the noise? What if instead, whenever you visit a page, your browser or a plugin or a proxy server or whatever opened the same page simultaneously in a bunch of hidden background windows, with a random configuration of audio enabled/disabled, user agent, screen resolution etc fingerprinted characteristics? That way, the page displays correctly for you, but the server has no idea your actual fingerprint. There's some trickiness to get this to work right; the collection of fake fingerprints would have to have a certain amount of persistence, because if it was regenerated every pageload, the server could probably tell that only one fingerprint kept showing up repeatedly. Maybe each fake fingerprint should have a completely realistic-seeming browsing session, happening in parallel with your real one, with half the collection continuing on browsing even after you're done? Except wait, ads could just separately target every fingerprint, and it doesn't matter if 99% of them are fake as long as its accuracy for your real one is still good. To defeat that you need the randomized activity using your real fingerprint. The ideal would be if this was done through a proxy server, which would then know every fingerprint ever sent to a website. It could then provide you with a random collection of past fingerprints that have actually visited the same website, so every visitor gets a collection of fingerprints randomly drawn from the same "bag", rendering visitors indistinguishable.

superasn 7y ago

Yes I thought about it that's why "unless the user turns it off" comment in parens. I think out of 100 sites I visit everyday no website needs to access the audio api without my consent maybe except one or two which i can whitelist. Same for user agent, I don't think it should break if the container says I'm running firefox v65 or v67, etc.

saagarjha 7y ago
Changing the resolution sounds like it would break a lot of websites, though.
- enriquto 7y ago
  and these websites certainly deserve to be broken!
  - saagarjha 7y ago
    Uh, I’m not sure I agree. Any website that needs to do nontrivial layout will query the browser viewport size.
shawnz 7y ago
If websites had to ask permission to enable responsive features like screen size detection, then nobody would use them
- dmitrygr 7y ago
  Good! Then maybe they'll go back to writing normal html and let my user agent present it to me how I like and how my device best does
  - shawnz 7y ago
    If that's how you feel, why not disable CSS?
    - progval 7y ago
      It was already possible to write CSS that adapts to various screen sizes before CSS became a privacy issue (ie. before CSS 3); except it was called regular CSS, not responsive. My guess is the difference between "regular CSS that adapts to screen size" and "responsive CSS" is that the former only has a single set of rules while the latter has different CSS rules that get enabled/disabled based on screen size. Conditional rules -> different content gets loaded -> server gets notified of what rules are enabled -> fingerprinting
  - patrick5415 7y ago
    Agree. I wish the entire internet looked like GNU documentation page.
- NikolaNovak 7y ago
  AWESOME. Things went downhill once we started writing HTML which required knowing screen size ;-<

nerdponx 7y ago

That, and it should be pretty easy to filter out this kind of fake "chaff" data.

vokep 7y ago

Maybe, but that seems better than the current mess. I'd rather no features than features which act against my interests.

deleted 7y ago
[deleted]

patrick5415 7y ago

I’d prefer legitimate api usage be broken than suffer through all the abuses.

laughinghan 7y ago

Have you heard of those projects trying to defeat behavioral tracking where, whenever you visit a page, it simultaneously opens a bunch of other random pages in the background, hidden from you, and simulates activity on them, the idea being that Facebook has no idea what actual websites you like to visit because it's lost in the noise? What if instead, whenever you visit a page, your browser or a plugin or a proxy server or whatever opened the same page simultaneously in a bunch of hidden background windows, with a random configuration of audio enabled/disabled, user agent, screen resolution etc fingerprinted characteristics? That way, the page displays correctly for you, but the server has no idea your actual fingerprint. There's some trickiness to get this to work right; the collection of fake fingerprints would have to have a certain amount of persistence, because if it was regenerated every pageload, the server could probably tell that only one fingerprint kept showing up repeatedly. Maybe each fake fingerprint should have a completely realistic-seeming browsing session, happening in parallel with your real one, with half the collection continuing on browsing even after you're done? Except wait, ads could just separately target every fingerprint, and it doesn't matter if 99% of them are fake as long as its accuracy for your real one is still good. To defeat that you need the randomized activity using your real fingerprint. The ideal would be if this was done through a proxy server, which would then know every fingerprint ever sent to a website. It could then provide you with a random collection of past fingerprints that have actually visited the same website, so every visitor gets a collection of fingerprints randomly drawn from the same "bag", rendering visitors indistinguishable.