6 ms·
I did a little bit of research on browser fingerprinting years ago and even tried to write my own library to do it and ever since, I've always questioned how us
by superfrank 7y ago
I did a little bit of research on browser fingerprinting years ago and even tried to write my own library to do it and ever since, I've always questioned how useful it actually is.
Using the list of measurement points on https://amiunique.org https://amiunique.org as guide most of the things that are constant about my computer like platform, browser, or requested language are not really unique to me and are shared by a large percentage of the other users who have come to the site.
On the other hand, most of the data points that are unique to my machine change semi-frequently. User agent and version change on browser updates, timezone changes when I travel, screen size and resolution change when I plug into my external monitor, new fonts will slowly be installed over time, and even things like how the canvases are rendered can change slightly depending on how much strain my GPU is under at the time I get fingerprinted.
Just plugging in to my external monitor was enough to get amiunique to treat me as a different user. (if you want to try, be sure to clear your local storage and cookies in between visits as the site saves a uuid there and will serve you your previous results if it finds it).
I'm sure there's some magic formula that gives different weights to different data points that can give a decent guess at who you are, but I doubt it can say with 100% accuracy that you are who it thinks you are.
It seems to me all it would take to defeat fingerprinting is a browser extension that modifies the browser apis to randomly slightly alter the requested data (add a random font to the list, add some nonsense to the user agent, etc). Sure, the fingerprint would still be unique, but it would be unique on every visit which would defeat the ability to track a user across visits.
*I'm not an expert on this subject at all, so if I got something wrong, please correct me
- synsynack 7y agoA partial match can still be linked to a unique identify on the backend. Just think of how a fingerprint scanner works, or face / song matching algo's, just need a snippet of data.
- superfrank 7y agoI believe a partial match would only be useful if the partial match mapped to a unique record. My point was that the data points that seem to be the most unique to my computer seem to also be the easiest to change. If I get a fingerprint that contains some super unique font and is requesting the site in Mongolian then yeah, that can probably be mapped to a single record. If I get a fingerprint in which the only data points that match anything in my database are that the user is on a Mac using Chrome 76 and has cookies and local storage enabled, I don't see how that can be used to track a user. My point was that the data points that seem most unique to a user also seem like the ones that change the most frequently. If you're only changing one at a time like they would during normal use, then yeah, it's probably still trackable, but if you wrote something to change all of them on every page load, I don't see how you would be able to connect one partial match to another.
- ryacko 7y agoCookie + IP Address + Fingerprint + URL Referral + Social Media It’s possible to be anonymous if you only log into websites with proper privacy policies, delete cookies & cache every day, and hide behind carrier NAT. Adding a random font shouldn’t stop fingerprinting, people install new applications all the time. You make a lot of points, but ad tech can get around it. Ideally ad corporations would be forced to delete records on people after 30 days.
- auslander 7y ago> delete cookies & cache every day I'm browsing everywhere in Safari's Private mode by default, 3 years no problems.
- cm2187 7y agoIt is becoming increasingly difficult though. Google captchas everywhere. Authentication requesting 2 factor because it thinks it is a new browser. The web is progressively becoming unusable unless you are loaded with cookies and tracked. And the culprits are the likes of Amazon, Cloudflare, Google, etc. Not easy to move them.
- 7y ago
- babas 7y agoI have been wondering for some time if some kind of randomization of the fingerprinting parameters would be better than trying to be standard/anonymous. If the fingerprint changes often wouldn't it become completely useless?