4 ms·

Randomizing fingerprints is generally a bad idea. See: https://github.com/arkenfox/user.js/wiki/4.1-Extensions#small_orange_diamond-%EF%B8%8F-anti-fingerprinti

Randomizing fingerprints is generally a bad idea. See: https://github.com/arkenfox/user.js/wiki/4.1-Extensions#small_orange_diamond-%EF%B8%8F-anti-fingerprinting-extensions-fk-no https://github.com/arkenfox/user.js/wiki/4.1-Extensions#smal...

Wowfunhappy 6y ago
Sorry, I don't actually see in there why randomizing something like a canvas or webaudio fingerprint is a bad idea. I believe they know what they're talking about, but I'd still like to know why. Notably, to me this isn't necessarily about beating the resistFingerprints setting, because I can't use that setting. For good or for ill, it breaks too much of the web.
- gruez 6y ago
  >Sorry, I don't actually see in there why randomizing something like a canvas or webaudio fingerprint is a bad idea Literally the first bullet >It is trivial to detect RFP and when you change a RFP metric, you lose your "herd immunity"
  - Wowfunhappy 6y ago
    But that's referring to privacy.resistFingerprinting (RFP), not adding randomness. RFP isn't really an option, at least for me, because it breaks too many sites.
    - gruez 6y ago
      >But that's referring to privacy.resistFingerprinting (RFP), not adding randomness having a randomized fingerprint is a fingerprint value in and of itself. That may leak more entropy bits if you have a fairly common hardware configuration Also, regarding webaudio fingerprinting, afaik it's not a real threat. https://github.com/WebAudio/web-audio-api/pull/2224#discussion_r457167513 https://github.com/WebAudio/web-audio-api/pull/2224#discussi... https://github.com/w3cping/tracking-issues/issues/53#issuecomment-653541639 https://github.com/w3cping/tracking-issues/issues/53#issueco... >As I said, I can't use RFP, it breaks too many sites. Weird. I only know a few sites that break with RFP on, and I don't use them frequently.
kunfuu 6y ago
This reasoning is valid when randomization is not pre-configured and is done at the individual level. It doesn't hold when talking about changes that come with browsers etc and deployed at scale.

Wowfunhappy 6y ago

Sorry, I don't actually see in there why randomizing something like a canvas or webaudio fingerprint is a bad idea. I believe they know what they're talking about, but I'd still like to know why. Notably, to me this isn't necessarily about beating the resistFingerprints setting, because I can't use that setting. For good or for ill, it breaks too much of the web.

gruez 6y ago
>Sorry, I don't actually see in there why randomizing something like a canvas or webaudio fingerprint is a bad idea Literally the first bullet >It is trivial to detect RFP and when you change a RFP metric, you lose your "herd immunity"
- Wowfunhappy 6y ago
  But that's referring to privacy.resistFingerprinting (RFP), not adding randomness. RFP isn't really an option, at least for me, because it breaks too many sites.
  - gruez 6y ago
    >But that's referring to privacy.resistFingerprinting (RFP), not adding randomness having a randomized fingerprint is a fingerprint value in and of itself. That may leak more entropy bits if you have a fairly common hardware configuration Also, regarding webaudio fingerprinting, afaik it's not a real threat. https://github.com/WebAudio/web-audio-api/pull/2224#discussion_r457167513 https://github.com/WebAudio/web-audio-api/pull/2224#discussi... https://github.com/w3cping/tracking-issues/issues/53#issuecomment-653541639 https://github.com/w3cping/tracking-issues/issues/53#issueco... >As I said, I can't use RFP, it breaks too many sites. Weird. I only know a few sites that break with RFP on, and I don't use them frequently.

kunfuu 6y ago

This reasoning is valid when randomization is not pre-configured and is done at the individual level. It doesn't hold when talking about changes that come with browsers etc and deployed at scale.