3 ms·

I found this: https://9to5mac.com/2020/09/04/ad-industry-tracking/ https://9to5mac.com/2020/09/04/ad-industry-tracking/ "my iPhone 11 Pro was also unique amon

I found this: https://9to5mac.com/2020/09/04/ad-industry-tracking/ https://9to5mac.com/2020/09/04/ad-industry-tracking/ "my iPhone 11 Pro was also unique among the more than 2.5 million devices they have tested." Time zone is one possible fingerprint data point.

zinekeller 6y ago
> Time zone is one possible fingerprint data point. Totally forget that. Oops. Now for the meat of your comment ...and how many have tested their protections so that their testing site recognize that your device is not unique? A very good counterclaim was posted in the comments: I strongly disagree with your findings, Ben. Namely, you list fingerprinting techniques available to browsers, and fail to mention how Safari (and Firefox to some extent) make those methods less precise. Instead, you say Note that this isn’t a comprehensive list, it’s just examples. When a website analyses all of the data available to it, things get very specific, very fast. So let me point out where you were wrong about Safari in particular: • Fonts installed. Safari reports very limited subset of fonts, which does not vary. it is the same for every Safari users. • Plugins installed. Unsurprisingly, Safari lists just one: PDF reader. Native plugins are not reported. • Codecs supported for video. The uniqueness checking site reported just H.264 and FLAC. Audio format are not reported at all. There's no mention of H.265 and VP9 which work in my Safari beta version, and no mention of the whole plethora of audio formats which are supported. • Screen resolution is not the real screen resolution. I'm on 27'' 5K iMac and the screen is reported as 2048 x 1152. • Media devices attached reported as "audioinput" and "videoinput". It has nothing to do with the actual available media devices. And incorrect reporting goes on. As you can see, fingerprinting through browser leaves Safari users very poorly segregated. As long as you running latest OS with latest version of Safari, you are a part of a very broad chunk. You can't be identified through browser fingerprinting along. This means that the only unique data that you can get are: a) Language settings. There is no way to work-around this (unless you consistently lie that you solely use English) b) Time zone. There is no way to work-around this (unless you consistently lie that you solely use UTC) These things can be predicted anyway with IP address, so it is not perceptibly meaningful in any way. In other words, advertisers can literally give up on detecting when Safari are the browser and rely instead on IP addresses (which can tie into a family (or in some IPv6 cases) a device.
- chromaton 6y ago
  Thanks for the response. It looks like just because the fingerprint is unique doesn't mean that it's accurate or stable.
- kedikedi 6y ago
  I've got a question; if it is ok to lie in these reports, why do they even exist? I thought these reports were there as a way to introduce client capabilities so that the server can serve the right content. Disclaimer: This is a genuine question. I'm a hardware guy and I don't know how web works nowadays.
  - chromaton 6y ago
    You're correct as to why they exist, but then it turns out that this is a privacy leak. Software is hard.
    - zinekeller 6y ago
      Very true. Seriously, if everyone is honest we will be in a much better state now :)

zinekeller 6y ago

> Time zone is one possible fingerprint data point. Totally forget that. Oops. Now for the meat of your comment ...and how many have tested their protections so that their testing site recognize that your device is not unique? A very good counterclaim was posted in the comments: I strongly disagree with your findings, Ben. Namely, you list fingerprinting techniques available to browsers, and fail to mention how Safari (and Firefox to some extent) make those methods less precise. Instead, you say Note that this isn’t a comprehensive list, it’s just examples. When a website analyses all of the data available to it, things get very specific, very fast. So let me point out where you were wrong about Safari in particular: • Fonts installed. Safari reports very limited subset of fonts, which does not vary. it is the same for every Safari users. • Plugins installed. Unsurprisingly, Safari lists just one: PDF reader. Native plugins are not reported. • Codecs supported for video. The uniqueness checking site reported just H.264 and FLAC. Audio format are not reported at all. There's no mention of H.265 and VP9 which work in my Safari beta version, and no mention of the whole plethora of audio formats which are supported. • Screen resolution is not the real screen resolution. I'm on 27'' 5K iMac and the screen is reported as 2048 x 1152. • Media devices attached reported as "audioinput" and "videoinput". It has nothing to do with the actual available media devices. And incorrect reporting goes on. As you can see, fingerprinting through browser leaves Safari users very poorly segregated. As long as you running latest OS with latest version of Safari, you are a part of a very broad chunk. You can't be identified through browser fingerprinting along. This means that the only unique data that you can get are: a) Language settings. There is no way to work-around this (unless you consistently lie that you solely use English) b) Time zone. There is no way to work-around this (unless you consistently lie that you solely use UTC) These things can be predicted anyway with IP address, so it is not perceptibly meaningful in any way. In other words, advertisers can literally give up on detecting when Safari are the browser and rely instead on IP addresses (which can tie into a family (or in some IPv6 cases) a device.

chromaton 6y ago
Thanks for the response. It looks like just because the fingerprint is unique doesn't mean that it's accurate or stable.
kedikedi 6y ago
I've got a question; if it is ok to lie in these reports, why do they even exist? I thought these reports were there as a way to introduce client capabilities so that the server can serve the right content. Disclaimer: This is a genuine question. I'm a hardware guy and I don't know how web works nowadays.
- chromaton 6y ago
  You're correct as to why they exist, but then it turns out that this is a privacy leak. Software is hard.
  - zinekeller 6y ago
    Very true. Seriously, if everyone is honest we will be in a much better state now :)