5 ms·

> To appreciate the absurdity of this argument [about encouraging fingerprinting], imagine the local police saying, “We see that our town has a pickpocketing pr

> To appreciate the absurdity of this argument [about encouraging fingerprinting], imagine the local police saying, “We see that our town has a pickpocketing problem. But if we crack down on pickpocketing, the pickpocketers will just switch to muggings. That would be even worse. Surely you don’t want that, do you?” Actually, fingerprinting is not JUST used to track users for ads. Describing the characteristics of a device is used for lots of other purposes as well. For example canvas size etc etc useful for other reasons. Many / most web dev folks rely on fingerprints (user agent / screen size) when targeting layouts, adding / removing features etc. The whole analogy where police are cracking down on criminals is the same as cracking down on fingerprinting is what is "absurd" and "disingenuous". A better analogy is wanting to have a 10mph speed limit to reduce pedestrian deaths. It would (and I like car free planning so would support it). But it would ALSO make commutes etc slower.

kube-system 7y ago
Semantically speaking, the elements that could be used to compose a fingerprint is not the same as fingerprinting. If I write a page that uses user agent / resolution to serve up a layout -- that's not fingerprinting. Fingerprinting would be if I tried to identify a particular user with those elements. I think the problem you're trying to illustrate is that it is difficult for a browser to determine what the requesting site intends to do with those parameters. The browser doesn't know if you want canvas access to draw a pretty picture, or if you want canvas access to perform identification of the user.
cameronbrown 7y ago
Maybe a compromise would be to just build metrics reporting directly into browsers? I'm sure Apple/Mozilla/Google collect this data already, what's stopping them from just forwarding anonymised usage statistics to an HTTP endpoint for each website?
rwmurrayVT 7y ago
It's also heavily used in fraud prevention, blocking malicious actors, and on gambling websites.
- snazz 7y ago
  Is it actually effective at that kind of stuff though? Changing your user agent and screen size to get through a system like that seems very easy.
  - rwmurrayVT 7y ago
    There is more to it than user-agent and screen size. There are tools out there like fraudfox that are intended to provide a way of masking the information. Last I was involved/interested it could reveal quite a bit of specific information. Typically, advanced fraudsters are capable of beating the systems. There are just too many tools available. Even blocking the trackers with noscript/privacy plug-ins can result in a block. Whatever comes out on the anti-fraud side is commonly just a temporary roadblock. The balance between convenience and security for most companies leans towards convenience.
wbl 7y ago
Don't use user agent check for features. User agent detection doesnt keep pace with development.
- privateSFacct 7y ago
  I was providing a very basic example -> and yes, useragent can still be useful. But agreed, further feature detection, which the article calls "fingerprinting" is needed if you implement anything beyond the most basic patterns. But even basic patterns are helped by some minimal detection. Text only / braille readers etc can be targeted nicely as an example.
  - shkkmo 7y ago
    Feature detection is not fingerprinting, you can't just change the meaning of terms.
reaperducer 7y ago
Many / most web dev folks rely on fingerprints (user agent / screen size) when targeting layouts, adding / removing features etc. I've been building web sites commercially since 1997. I have never done any of those things. Unless the company you work for has the marketing or advertising department in charge of the IT department, this shouldn't happen. I'm sure that Facebook and a bunch of other terrible companies do it, but they shouldn't. The closest I ever came was during the era when you had to detect IE6 and work around that. But, no, "most" web devs don't do that. Maybe you do. Maybe the people in your company do. But that is not "most," or even "many." I'd say it's probably not even a plurality. To put it bluntly: If you think that's web development, you're doing it wrong.
- privateSFacct 7y ago
  I'd be curious if you were commercially successful. The shift from IE to chrome was told by user agent strings. Almost EVERY web developer was tracking this and figuring out what features would work reasonably and what would not during this shift for the websites they maintained. In other words, what parts of the standard HTML were widely supported among users visiting their sites. If you worked internationally you'll know that this was very different on a country by country basis. Surprised to hear the claims that only a few do this. It is CRITICAL to developing useful websites -> you need to know what version of HTML to target at a minimum. Screen size, mobile vs desktop all also matter. I'm now realizing why some web devs can charge so much - they might use these tools -> while others don't?
  - shkkmo 7y ago
    I find your tone innapropriate for HN User agent sniffing is a bad idea and fragile. Feature detection and shims work much better. CSS media queries are quite sufficient for screen size and resizing issues. Most importantly, none of this ican be fingerprinting unless you are sending these metrics back to your servers which is IMHO unethical.
    - privateSFacct 7y ago
      All these are fingerprinting. Almost all these are routinely logged by almost every web analytic product out there. The posters above, sorry for my tone, are lying when they claim that most websites don't do this and most developers don't. It's actually easy to expose their lies. Just visit some websites and check their tracking approach / tools. Literally, browse some of the top 100 websites, magazines, consumer directed product sites etc. In fact, the items may be logged by literally multiple systems on ONE site - the big players can't seem to pick one set of analytics. For example, a site I run turns out to be much more desktop heavy (84%) and have almost no firefox usage (3.XX). That's much different than the web as a whole (half mobile). It's a boring site - no entertainment, mostly folks slowly learning things. Mobile side is heavy iphone / samsung -> so we make sure we get site testing coverage through those. Knowing this and acting on it does not make me an idiot. "But, no, "most" web devs don't do that. Maybe you do. Maybe the people in your company do. But that is not "most," or even "many." I'd say it's probably not even a plurality." Please folks - form your own opinion - chrome dev tools let's you check out whats going on (or just get an extension) and at the end of the day browsing you can choose to believe me (you are heavily fingerprinted on almost all the sites you use) or these folks upset that I'm calling them out. Here are default mixpanel properties by the way - I picked one product at random. https://help.mixpanel.com/hc/en-us/articles/115004613766-Default-Properties-Collected-by-Mixpanel https://help.mixpanel.com/hc/en-us/articles/115004613766-Def... People are spending literally billions on analytics using this (and much more) in terms of trying to figure out how to make a bit more money.
sa1 7y ago
I think the problem can be solved using taint analysis in JavaScript. Variables that can be used to fingerprint are allowed to be used locally but not are not allowed to be sent back over the internet. Any variables that are derived from these fingerprintable variables should be considered tainted and be treated the same way.
- Simon_says 7y ago
  This is a very very hard problem. You can imagine a case where not tainting a variable implies something about the user.

kube-system 7y ago

Semantically speaking, the elements that could be used to compose a fingerprint is not the same as fingerprinting. If I write a page that uses user agent / resolution to serve up a layout -- that's not fingerprinting. Fingerprinting would be if I tried to identify a particular user with those elements. I think the problem you're trying to illustrate is that it is difficult for a browser to determine what the requesting site intends to do with those parameters. The browser doesn't know if you want canvas access to draw a pretty picture, or if you want canvas access to perform identification of the user.

cameronbrown 7y ago

Maybe a compromise would be to just build metrics reporting directly into browsers? I'm sure Apple/Mozilla/Google collect this data already, what's stopping them from just forwarding anonymised usage statistics to an HTTP endpoint for each website?

rwmurrayVT 7y ago

It's also heavily used in fraud prevention, blocking malicious actors, and on gambling websites.

snazz 7y ago
Is it actually effective at that kind of stuff though? Changing your user agent and screen size to get through a system like that seems very easy.
- rwmurrayVT 7y ago
  There is more to it than user-agent and screen size. There are tools out there like fraudfox that are intended to provide a way of masking the information. Last I was involved/interested it could reveal quite a bit of specific information. Typically, advanced fraudsters are capable of beating the systems. There are just too many tools available. Even blocking the trackers with noscript/privacy plug-ins can result in a block. Whatever comes out on the anti-fraud side is commonly just a temporary roadblock. The balance between convenience and security for most companies leans towards convenience.

wbl 7y ago

Don't use user agent check for features. User agent detection doesnt keep pace with development.

privateSFacct 7y ago
I was providing a very basic example -> and yes, useragent can still be useful. But agreed, further feature detection, which the article calls "fingerprinting" is needed if you implement anything beyond the most basic patterns. But even basic patterns are helped by some minimal detection. Text only / braille readers etc can be targeted nicely as an example.
- shkkmo 7y ago
  Feature detection is not fingerprinting, you can't just change the meaning of terms.

reaperducer 7y ago

Many / most web dev folks rely on fingerprints (user agent / screen size) when targeting layouts, adding / removing features etc. I've been building web sites commercially since 1997. I have never done any of those things. Unless the company you work for has the marketing or advertising department in charge of the IT department, this shouldn't happen. I'm sure that Facebook and a bunch of other terrible companies do it, but they shouldn't. The closest I ever came was during the era when you had to detect IE6 and work around that. But, no, "most" web devs don't do that. Maybe you do. Maybe the people in your company do. But that is not "most," or even "many." I'd say it's probably not even a plurality. To put it bluntly: If you think that's web development, you're doing it wrong.

privateSFacct 7y ago
I'd be curious if you were commercially successful. The shift from IE to chrome was told by user agent strings. Almost EVERY web developer was tracking this and figuring out what features would work reasonably and what would not during this shift for the websites they maintained. In other words, what parts of the standard HTML were widely supported among users visiting their sites. If you worked internationally you'll know that this was very different on a country by country basis. Surprised to hear the claims that only a few do this. It is CRITICAL to developing useful websites -> you need to know what version of HTML to target at a minimum. Screen size, mobile vs desktop all also matter. I'm now realizing why some web devs can charge so much - they might use these tools -> while others don't?
- shkkmo 7y ago
  I find your tone innapropriate for HN User agent sniffing is a bad idea and fragile. Feature detection and shims work much better. CSS media queries are quite sufficient for screen size and resizing issues. Most importantly, none of this ican be fingerprinting unless you are sending these metrics back to your servers which is IMHO unethical.
  - privateSFacct 7y ago
    All these are fingerprinting. Almost all these are routinely logged by almost every web analytic product out there. The posters above, sorry for my tone, are lying when they claim that most websites don't do this and most developers don't. It's actually easy to expose their lies. Just visit some websites and check their tracking approach / tools. Literally, browse some of the top 100 websites, magazines, consumer directed product sites etc. In fact, the items may be logged by literally multiple systems on ONE site - the big players can't seem to pick one set of analytics. For example, a site I run turns out to be much more desktop heavy (84%) and have almost no firefox usage (3.XX). That's much different than the web as a whole (half mobile). It's a boring site - no entertainment, mostly folks slowly learning things. Mobile side is heavy iphone / samsung -> so we make sure we get site testing coverage through those. Knowing this and acting on it does not make me an idiot. "But, no, "most" web devs don't do that. Maybe you do. Maybe the people in your company do. But that is not "most," or even "many." I'd say it's probably not even a plurality." Please folks - form your own opinion - chrome dev tools let's you check out whats going on (or just get an extension) and at the end of the day browsing you can choose to believe me (you are heavily fingerprinted on almost all the sites you use) or these folks upset that I'm calling them out. Here are default mixpanel properties by the way - I picked one product at random. https://help.mixpanel.com/hc/en-us/articles/115004613766-Default-Properties-Collected-by-Mixpanel https://help.mixpanel.com/hc/en-us/articles/115004613766-Def... People are spending literally billions on analytics using this (and much more) in terms of trying to figure out how to make a bit more money.

sa1 7y ago

I think the problem can be solved using taint analysis in JavaScript. Variables that can be used to fingerprint are allowed to be used locally but not are not allowed to be sent back over the internet. Any variables that are derived from these fingerprintable variables should be considered tainted and be treated the same way.

Simon_says 7y ago
This is a very very hard problem. You can imagine a case where not tainting a variable implies something about the user.