4 ms·
> JS doesn't have any magic to it Canvas fingerprinting, WebGL fingerprinting, GPU, fonts etc etc etc. Please, stop arguing, JS is a nightmare for privacy. Pe
by user638251 6y ago
> JS doesn't have any magic to it
Canvas fingerprinting, WebGL fingerprinting, GPU, fonts etc etc etc.
Please, stop arguing, JS is a nightmare for privacy. Period
- LunaSea 6y agoSo are DNS and HTTP caches.
- gruez 6y ago>DNS most people don't run their own resolvers, so at best you're fingerprinting DNS server of the ISP. >http caches can be easily cleared, or mitigated entirely by extensions or browser (eg. multi account containers).
- eyelidlessness 6y ago> most people don't run their own resolvers, so at best you're fingerprinting DNS server of the ISP. That’s not how it’s tracked commonly. Similar to HTTP caches, you can fingerprint visitors by how quickly a domain request resolves for them. Sure, all of this can be mitigated. But you have to even know what to mitigate. And given the most fanatical privacy folks aren’t aware of basic timing fingerprints is a good indicator that no one is mitigating it nearly as well as they might think.
- smichel17 6y agoIf js were removed from the web tomorrow, the people currently working on tracking protection against js could instead focus on these other mechanisms. Because privacy is an arms race, reducing attack surface is not pointless even if the same tracking can be achieved by other means.
- eyelidlessness 6y agoI don’t think JS (or some other runtime) could plausibly be removed from the web on any time scale. People have a (reasonable) expectation that they can do app-like things on a network, and that surface area will find its way to manifest one way or another. At least having it on the web has somewhat of a limiting effect on the entrenchment of the biggest (and worst) privacy offenders, because the barrier to entry is lower than building a wide array of native apps.