3 ms·

I'm quite torn that privacy protection tools, which I use liberally as a consumer, can foil fraud-detection tools that I also rely on in my business. Browser/d

by cal5k 7y ago

I'm quite torn that privacy protection tools, which I use liberally as a consumer, can foil fraud-detection tools that I also rely on in my business. Browser/device fingerprinting is one of these things... bad when used to track you for advertising purposes across the web, good when it can be used to prevent account hijacking ("Hey, it looks like you're signing in with a new device! Please enter the code we just sent you via email."). It seems to be a "this is why we can't have nice things" situation. That harder it is to identify someone, the harder it is to take proactive measures to defeat credential stuffing attacks and so forth.

salawat 7y ago
You really shouldn't be fingerprinting at all. As sexy as a risk department may find it. Imagine what the social interaction would be like if you implemented that functionality in the physical world, but replace the computer with the user's home, and the service as you. Before even so much as a how-Dee-do, you're running all over the house cataloging the exact position of everything in order to "decrease your risk exposure." This would get you shot in some locales. Is it truly a mystery why this type of intrusion going on makes people uncomfortable. It's one thing to explicitly ask to do so. Implicitly doing so without giving the client a chance to refuse is both rude and exploitive.
- cal5k 7y ago
  As much as I wish it was unnecessary, we run a cryptocurrency platform. There are constant attempts to sign up using fake/stolen credentials, and we have to make sure our users don't fall prey to various attacks that could lead to total loss of their assets. Fingerprinting isn't the be-all and end-all and it's not 100% reliable, but it's extremely useful as part of a broad set of signals for detecting bad actors. The comparison to a physical address is silly - the address is the fingerprint. If I can meet you at your house, and obtain a legal document demonstrating that you own the house, I don't need to do anything else. There is no such equivalent for most internet-connected devices, or at least not one that's obtainable outside of law enforcement applications.

by cal5k 7y ago

salawat 7y ago

You really shouldn't be fingerprinting at all. As sexy as a risk department may find it. Imagine what the social interaction would be like if you implemented that functionality in the physical world, but replace the computer with the user's home, and the service as you. Before even so much as a how-Dee-do, you're running all over the house cataloging the exact position of everything in order to "decrease your risk exposure." This would get you shot in some locales. Is it truly a mystery why this type of intrusion going on makes people uncomfortable. It's one thing to explicitly ask to do so. Implicitly doing so without giving the client a chance to refuse is both rude and exploitive.

cal5k 7y ago
As much as I wish it was unnecessary, we run a cryptocurrency platform. There are constant attempts to sign up using fake/stolen credentials, and we have to make sure our users don't fall prey to various attacks that could lead to total loss of their assets. Fingerprinting isn't the be-all and end-all and it's not 100% reliable, but it's extremely useful as part of a broad set of signals for detecting bad actors. The comparison to a physical address is silly - the address is the fingerprint. If I can meet you at your house, and obtain a legal document demonstrating that you own the house, I don't need to do anything else. There is no such equivalent for most internet-connected devices, or at least not one that's obtainable outside of law enforcement applications.