5 ms·
Ironically, making changes like this makes you far, far more fingerprintable, as the vast majority of users don't make changes like this. Thus, the users that d
by fzzzy 7y ago
Ironically, making changes like this makes you far, far more fingerprintable, as the vast majority of users don't make changes like this. Thus, the users that do stick out like a sore thumb. The article does mention this.
- user9361 7y agoThat's true. I use as many default options I can. But there are good points in the article
- danShumway 7y agoA lot of Firefox's fingerprinting protection is genuinely helpful because the stuff it's blocking can be used to very, very precisely target you. Canvas/WebGL fingerprinting is a good example of this. Yes, very few people block it, but the fingerprinting for canvas is so individualized to each device that there is no hiding in the crowd if you leave it enabled. You're hiding in a crowd of size 1. Think of it like wearing gloves during the summer. Yes, that's unusual. But a human fingerprint (except in rare-ish cases) will usually be good enough to track an individual person. In a world where people are regularly collecting fingerprints or tracking them around town to figure out who's been in what stores, being unusual is preferable to being unique. There are a few settings (normalizing screen sizes) where the benefits aren't so clear-cut. But at the very, very least, you should be doing stuff like turning off webRTC/webGL/canvas. The majority of changes being listed here are strict improvements to privacy.
- rwmurrayVT 7y agoI have only just taken an interest in the canvas fingerprinting. My understanding is that it relies on a unique hash of an "image" created using HTML5, including the time it takes to draw. Is it not possible to alter this hash by throttling or slightly modifying some GPU settings? I know this is a weird and most likely highly technical question. I'm just curious.
- danShumway 7y agoShort answer, I don't know, but probably not? Long answer, I'm also curious about this. I feel like the future of fingerprinting resistance isn't refusing to give up information (since sites can block you or force you to turn the settings back on) -- it's lying. Don't block microphone access, just feed it white noise. Don't block the location, just spoof it. BUT, a bunch of people who are smarter than me have decided that zeroing out the canvas is better than making it return random values, so for the moment, I assume there's something they know that I don't.
- Santosh83 7y agoThe CanvasBlocker extension which has been around for longer than Firefox started implementing anti-fingerprinting measures does exactly this: spoof canvas readout values. Since blocking Javascript is no longer an option for most people, blocking fingerprintable APIs simply breaks many sites. What we need is frictionless ways to spoof values for these APIs unless the user trusts the site in which case real values can be sent (example the site needs to work and fake values will not be useful to the user).
- rwmurrayVT 7y agoThe existence of software such as fraudfox and antidetect makes me believe there are certainly effective ways to "just lie".
- jdashg 7y agoMuch of canvas 2d fingerprinting relied on system fonts, which browsers have started to restrict access to these days. WebGL fingerprinting, in my investigation, seems to be identifiable by gpu vendor, and potentially by generation, but not individual GPU. So there's still bits of info, but not as bad as they used to be, or as bad as people generally fear.
- penguinalgebra 7y ago> which browsers have started to restrict access to these days Any chance you could point me to a source on this?
- oil25 7y ago> making changes like this makes you far, far more fingerprintable, as the vast majority of users don't make changes like this. You're confusing privacy and anonymity. They can be mutually exclusive.
- fzzzy 7y agoHmm, interesting. Care to explain more?
- oil25 7y agoImproving privacy is reducing the quantity and quality of data collected about you. Making changes to Firefox improves privacy because web sites can collect less data about you. Improving anonymity is reducing the odds that data can uniquely identify you. Making changes to Firefox harms anonymity because very few people deviate from defaults. For example, turning off Javascript prevents a site from knowing much at all except header information like User-Agent. So it can't draw a canvas fingerprint nor measure your screen resolution, but it can still record the fact Javascript was disabled - a rare event. OP is correct: the changes make one 'stick out like a sore thumb'; but incorrect in asserting users are 'more fingerprintable'. Improving privacy may reduce anonymity, but losing anonymity does not necessarily affect privacy.
- kube-system 7y agoLosing anonymity absolutely does affect privacy, that's the entire point to fingerprinting. While anonymity and privacy are theoretically separate concepts, many current techniques used to compromise privacy on the internet are dependent on de-anonymization. None of the data your browser leaks is being used to directly compromise privacy. Your screen resolution, user-agent, canvas fingerprints, etc aren't private information. Their only utility is to support de-anonymization, which in turn allows a compromise in privacy by aggregating your behavior.