5 ms·

I am unique through the useragent. Apparently Brave and Chrome both put the device model of your phone into the useragent string. It also contains your OS versi

I am unique through the useragent. Apparently Brave and Chrome both put the device model of your phone into the useragent string. It also contains your OS version and Chromium version. I guess those three points alone are able to very significantly narrow you down.

idclip 7y ago
Im unsure why all that data is needed when i simply visit a website to read stuff or watch stuff on youtube. Is it really necessary?
- cies 7y ago
  Nope. Not at all. There is a browser[1] that tries to hide this stuff for you (it's the FF-derived TOR browser w/o the TOR bit). That should be a good start. 1: https://www.whonix.org/wiki/SecBrowser https://www.whonix.org/wiki/SecBrowser
arkadiyt 7y ago
Chrome published an intent to freeze the user-agent string: https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/-2JIRNMWJ7s/yHe4tQNLCgAJ https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...
- lonelappde 7y ago
  And replace it by Client Hints. How does that prevent fingerprinting?
  - floatingatoll 7y ago
    In a nutshell, to my best understanding; User-Agent is divulged publicly with all requests to all sites, so no protections exist around using it, because it is freely offered up by the user without requiring consent. Client Hints have to be specifically requested by the remote website, which demonstrates intent to collect data, and thus falls under data collection laws.
    - thaumasiotes 7y ago
      > User-Agent is divulged publicly with all requests to all sites, so no protections exist around using it, because it is freely offered up by the user without requiring consent. This seems like an argument you'd lose if your website failed to respond to requests that were missing the User-Agent.
      - floatingatoll 7y ago
        Perhaps, but I know of no case law precedence one way or the other with respect to User-Agent.
  - jefftk 7y ago
    Forcing fingerprinters to switch from passive methods to active methods means you can apply a privacy budget: https://github.com/bslassey/privacy-budget https://github.com/bslassey/privacy-budget Then sites that need some information can get it, but won't be allowed to get so much identifying information that you're unique. (Disclosure: I work for Google)
asdfasgasdgasdg 7y ago
I am really skeptical about the UA uniqueness fraction. I am on the latest version of Chrome on Windows and it claims that 0.17% of the people visiting the site have the same UA string. Mine is: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 for what it's worth. Can it really be that only two in a thousand people visiting the site in the last seven days have the latest version of Chrome? Or does Chrome just update so often that very few people tend to have the same version at any one time. (If the latter, that suggests that maybe it's not a very strong tracking signal.) It seems more likely to me that the data is just stale but I guess I don't know much about the true distribution of Chrome useragents.
- zuppy 7y ago
  Same for me, it says <0.1% I’m using the current iPad mini, which is 10 months old, with the current os version. I highly doubt I’m that unique.

idclip 7y ago

Im unsure why all that data is needed when i simply visit a website to read stuff or watch stuff on youtube. Is it really necessary?

cies 7y ago
Nope. Not at all. There is a browser[1] that tries to hide this stuff for you (it's the FF-derived TOR browser w/o the TOR bit). That should be a good start. 1: https://www.whonix.org/wiki/SecBrowser https://www.whonix.org/wiki/SecBrowser

arkadiyt 7y ago

Chrome published an intent to freeze the user-agent string: https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/-2JIRNMWJ7s/yHe4tQNLCgAJ https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...

lonelappde 7y ago
And replace it by Client Hints. How does that prevent fingerprinting?
- floatingatoll 7y ago
  In a nutshell, to my best understanding; User-Agent is divulged publicly with all requests to all sites, so no protections exist around using it, because it is freely offered up by the user without requiring consent. Client Hints have to be specifically requested by the remote website, which demonstrates intent to collect data, and thus falls under data collection laws.
  - thaumasiotes 7y ago
    > User-Agent is divulged publicly with all requests to all sites, so no protections exist around using it, because it is freely offered up by the user without requiring consent. This seems like an argument you'd lose if your website failed to respond to requests that were missing the User-Agent.
    - floatingatoll 7y ago
      Perhaps, but I know of no case law precedence one way or the other with respect to User-Agent.
- jefftk 7y ago
  Forcing fingerprinters to switch from passive methods to active methods means you can apply a privacy budget: https://github.com/bslassey/privacy-budget https://github.com/bslassey/privacy-budget Then sites that need some information can get it, but won't be allowed to get so much identifying information that you're unique. (Disclosure: I work for Google)

asdfasgasdgasdg 7y ago

I am really skeptical about the UA uniqueness fraction. I am on the latest version of Chrome on Windows and it claims that 0.17% of the people visiting the site have the same UA string. Mine is: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 for what it's worth. Can it really be that only two in a thousand people visiting the site in the last seven days have the latest version of Chrome? Or does Chrome just update so often that very few people tend to have the same version at any one time. (If the latter, that suggests that maybe it's not a very strong tracking signal.) It seems more likely to me that the data is just stale but I guess I don't know much about the true distribution of Chrome useragents.

zuppy 7y ago
Same for me, it says <0.1% I’m using the current iPad mini, which is 10 months old, with the current os version. I highly doubt I’m that unique.