4 ms·

Forgive a bit of ignorance on this, but I'm not 100% sure I know what browser fingerprinting actually is. I remember reading something by the DuckDuckGo founde

Forgive a bit of ignorance on this, but I'm not 100% sure I know what browser fingerprinting actually is. I remember reading something by the DuckDuckGo founder mentioning that it could be a problem even if you use a VPN and incognito mode, but I had some trouble actually figuring out what that actually meant.

bigdict 6y ago
My understanding is it's simply checking the level of support for different Web APIs. Since that is invariant with respect to the route between you and the website, a VPN wouldn't save you from this.
gfodor 6y ago
It's when a site is able to take a variety of Javascript-accessible state that in isolation is benign (such as your reported graphics driver, as the case here) but together form a unique identifier for a user given the high dimensionality involved. This allows identifying users without their consent and avoids some methods of anti-tracking.
meheleventyone 6y ago
Some of the web APIs expose information that in aggregate can give an almost unique fingerprint to that device. Using fingerprinting techniques you can then track what the device is doing.
dvfjsdhgfv 6y ago
Basically, each browser has an unique set of features so each device can be uniquely identified and profiled across different domains, regardless if you block cookies, use incognito mode and other techniques.
have_faith 6y ago
Using the way that your browser renders a page to uniquely identify you amongst other visitors. This can take the form of measuring how your computer generates random numbers, timing how long it takes to compute certain things, minute differences in how your your gpu renders some pixels via webgl etc. With enough signals you can pierce through the noise.
goalieca 6y ago
Imagine gathering screen size, installed fonts, graphics card, processor model, extensions, plugins, operating system, ... and so on. Perhaps you could gather enough system properties to actually identify someone uniquely. It’s like a fingerprint.
- dehrmann 6y ago
  Some of these are more interesting than others. OS is exposed through the user agent. I'm not sure if you can actually capture processor model an graphics card, and plugins were more interesting when people installed plugins like Flash and Java. WebGL fingerprinting usually works by rendering something off-screen that exposes GPU differences, then captures the rendered image as the fingerprint.
  - goalieca 6y ago
    If you’re really clever you can figure timings out using JavaScript.. to the point spectre was remotely exploitable. LOL.
- everdrive 6y ago
  Hmm, would disabling hardware acceleration in Firefox provide any privacy benefit, then?
  - srg0 6y ago
    if you're the only person in the world who has disabled hardware acceleration, you will be uniquely identified by not having hardware acceleration
    - everdrive 6y ago
      I’ll bet a lot of computers have it disabled: VMs, perhaps Tor Browser, kids who tweak settings for no good reason.
seaghost 6y ago
I do participate in research project at https://browser-fingerprint.cs.fau.de https://browser-fingerprint.cs.fau.de as a user. You can find more info about fingerprinting here https://browser-fingerprint.cs.fau.de/faq?lang=en https://browser-fingerprint.cs.fau.de/faq?lang=en
Gravyness 6y ago
This tracking method (WebGL) disregards VPNs, user agent changes and incognito mode. Browser fingerprinting is the ability of the website you are accessing to differentiate between you and other people because of a "fingerprint": A hash string that uniquely identifies your current browser, and since its using WebGL, your computer, because of its configuration and graphical capabilities.
Sayrus 6y ago
Browser fingerprinting allows you to identify uniquely a browser and thus the user. This usually means that VPN and incognito mode will not help you to "change you identity". One example I know well is AudioContext fingerprinting with a demo available here: https://audiofingerprint.openwpm.com/ https://audiofingerprint.openwpm.com/ There are also worse fingerprinting methods that work cross-browsers.
- deleted 6y ago
  [deleted]
- gruez 6y ago
  audiocontext fingerprinting is less identifying than you think. It pretty much boils down to "what's your browser complied with and what FPU implementation you're running" https://github.com/WebAudio/web-audio-api/issues/1500#issuecomment-384706867 https://github.com/WebAudio/web-audio-api/issues/1500#issuec... https://github.com/w3cping/tracking-issues/issues/53#issuecomment-653541639 https://github.com/w3cping/tracking-issues/issues/53#issueco...
SuchAnonMuchWow 6y ago
basically no two systems are the same, and if the website can gather enough information about your system, it can identify you, even through a VPN or in incognito mode. Popular information for fingerprinting include: your browser, the country you are in, your language(s), your graphic card (through webgl), the fonts installed on your computer, the size of your screen (or your browser window), ...

bigdict 6y ago

My understanding is it's simply checking the level of support for different Web APIs. Since that is invariant with respect to the route between you and the website, a VPN wouldn't save you from this.

gfodor 6y ago

It's when a site is able to take a variety of Javascript-accessible state that in isolation is benign (such as your reported graphics driver, as the case here) but together form a unique identifier for a user given the high dimensionality involved. This allows identifying users without their consent and avoids some methods of anti-tracking.

meheleventyone 6y ago

Some of the web APIs expose information that in aggregate can give an almost unique fingerprint to that device. Using fingerprinting techniques you can then track what the device is doing.

dvfjsdhgfv 6y ago

Basically, each browser has an unique set of features so each device can be uniquely identified and profiled across different domains, regardless if you block cookies, use incognito mode and other techniques.

have_faith 6y ago

Using the way that your browser renders a page to uniquely identify you amongst other visitors. This can take the form of measuring how your computer generates random numbers, timing how long it takes to compute certain things, minute differences in how your your gpu renders some pixels via webgl etc. With enough signals you can pierce through the noise.

goalieca 6y ago

Imagine gathering screen size, installed fonts, graphics card, processor model, extensions, plugins, operating system, ... and so on. Perhaps you could gather enough system properties to actually identify someone uniquely. It’s like a fingerprint.

dehrmann 6y ago
Some of these are more interesting than others. OS is exposed through the user agent. I'm not sure if you can actually capture processor model an graphics card, and plugins were more interesting when people installed plugins like Flash and Java. WebGL fingerprinting usually works by rendering something off-screen that exposes GPU differences, then captures the rendered image as the fingerprint.
- goalieca 6y ago
  If you’re really clever you can figure timings out using JavaScript.. to the point spectre was remotely exploitable. LOL.
everdrive 6y ago
Hmm, would disabling hardware acceleration in Firefox provide any privacy benefit, then?
- srg0 6y ago
  if you're the only person in the world who has disabled hardware acceleration, you will be uniquely identified by not having hardware acceleration
  - everdrive 6y ago
    I’ll bet a lot of computers have it disabled: VMs, perhaps Tor Browser, kids who tweak settings for no good reason.

seaghost 6y ago

I do participate in research project at https://browser-fingerprint.cs.fau.de https://browser-fingerprint.cs.fau.de as a user. You can find more info about fingerprinting here https://browser-fingerprint.cs.fau.de/faq?lang=en https://browser-fingerprint.cs.fau.de/faq?lang=en

Gravyness 6y ago

This tracking method (WebGL) disregards VPNs, user agent changes and incognito mode. Browser fingerprinting is the ability of the website you are accessing to differentiate between you and other people because of a "fingerprint": A hash string that uniquely identifies your current browser, and since its using WebGL, your computer, because of its configuration and graphical capabilities.

Sayrus 6y ago

Browser fingerprinting allows you to identify uniquely a browser and thus the user. This usually means that VPN and incognito mode will not help you to "change you identity". One example I know well is AudioContext fingerprinting with a demo available here: https://audiofingerprint.openwpm.com/ https://audiofingerprint.openwpm.com/ There are also worse fingerprinting methods that work cross-browsers.

deleted 6y ago
[deleted]
gruez 6y ago
audiocontext fingerprinting is less identifying than you think. It pretty much boils down to "what's your browser complied with and what FPU implementation you're running" https://github.com/WebAudio/web-audio-api/issues/1500#issuecomment-384706867 https://github.com/WebAudio/web-audio-api/issues/1500#issuec... https://github.com/w3cping/tracking-issues/issues/53#issuecomment-653541639 https://github.com/w3cping/tracking-issues/issues/53#issueco...

SuchAnonMuchWow 6y ago

basically no two systems are the same, and if the website can gather enough information about your system, it can identify you, even through a VPN or in incognito mode. Popular information for fingerprinting include: your browser, the country you are in, your language(s), your graphic card (through webgl), the fonts installed on your computer, the size of your screen (or your browser window), ...