6 ms·

> End the arms race on fingerprinting Google is known to fingerprint you on their sites[0] and this practice will continue unless some sort of political action

> End the arms race on fingerprinting Google is known to fingerprint you on their sites[0] and this practice will continue unless some sort of political action is taken to make fingerprinting illegal. WebGL is not the only heuristic used to reliably determine it's a specific device accessing a site, but a whole slew of techniques can be used to reliably determine it is 'you' who is on a site (you can even detect if a browser is running in a virtual machine, among many other techniques to fingerprint). To mitigate this, I do most of my browsing with JS disabled by default, and if I really need JS turned on (for a site I trust like my bank), then I temporarily turn it on for that specific site. Also you can just disable WebGL in Firefox in about:config but keep in mind, there are many other techniques Google and `ADTech` in general can use to fingerprint you. [0] https://jonatron.github.io/webgl-fingerprinting/ https://jonatron.github.io/webgl-fingerprinting/

jffry 5y ago
Even the fact that WebGL is disabled contributes some entropy that can be used to identify you.
- ______- 5y ago
  You can't detect if WebGL's turned on/off if JS is turned off. You need JS turned on to detect WebGL's presence
approxim8ion 5y ago
Google turn every result on their search result page into a tracking URL if you have JS disabled. The solution is to allow JavaScript and install the Google Search Link Fix add-on, until they break that too I guess. Or use another search engine.
soared 5y ago
Fingerprinting on your own sites is pointless since only third party cookies are being removed. First party cookies still work like normal.
- tpxl 5y ago
  It gives you the ground truth with which you then correlate fingerprints from non-first-party domains.
- tedivm 5y ago
  The whole point of it is to correlate it to other data using the same fingerprinting method. Google is often a first party and a third party, so they need a way to line all that data up.
danShumway 5y ago
This is a complete sidenote, but I don't understand why Firefox's Canvas controls don't affect WebGL. Firefox has per-site settings for whether the canvas should be accessible which are very useful, but they don't have per-site settings for WebGL, it's either on or off for the entire profile. Which kind of defeats the point of Canvas blocking since (at least last time I checked) WebGL fingerprinting is possible regardless of whether Canvas can be read from. I'm sure there's some technical reason, but it really seems like turning Canvas reads off for a site should also turn off WebGL.
- cpeterso 5y ago
  Here is a Firefox bug report suggesting a per-site permission for WebGL: https://bugzilla.mozilla.org/show_bug.cgi?id=1694456 https://bugzilla.mozilla.org/show_bug.cgi?id=1694456 There's been no Mozilla comments on the bug yet. Perhaps so many sites use WebGL that the user would be pestered with too many permission prompts?
lima 5y ago
> Google is known to fingerprint you on their sites[0] To my understanding, Google (and many other sites) use WebGL and other fingerprinting techniques to distinguish real users from bots. This does not mean they use it to track individual users (if that were even legal in Europe under GDPR).
- Nextgrid 5y ago
  Google's tracking consent flow is already in breach of the GDPR, so it's not a problem for them.
hkai 5y ago
Why do you want to disable it? Isn't it nice to see ads that are interesting and useful to you rather than looking at some useless ads you're not interested in?
- chaosite 5y ago
  Seeing ads isn't nice.
- Spivak 5y ago
  The issue is buried in the premise of the question. “If you’re going to see an ad regardless, would you rather it be relevant to you or not?” The answer is and always has been “I don’t want to see an ad in the first place, I don’t want you collecting any information about me under any circumstances, and anything that makes ads spots worth less is a positive.” You know the cheeky “you won’t see fewer ads, they’ll just be leas relevant” line? The only long term solution to actually see fewer ads is to drive their value down to nothing. The fact that you can pay to remove ads on a lot of services kinda gives the game away that they’re a net negative. Why would you ever want them gone if they’re so useful and helpful? AdTech is such a garbage industry — drunk on their own delusions of facilitating commerce and helping businesses reach customers while being so annoying and vile that the only way their products to function is to insert themselves into every facet of life because nobody would ever seek them out on their own. Bleh.
  - doomslice 5y ago
    There's two sides to the equation though (I work on Supply Side ad tech). There's a huge amount of content that people are just not willing to pay for, but would gladly view ads. You may be willing to pay for Youtube Premium and Twitch Plus or whatever, but the vast majority of people do not. Do I feel like I'm a horrible person because I help make websites more money so they can stay in business? Heck no. It's the only reason 90% of these sites are able to exist in the first place.
    - Spivak 5y ago
      I feel like gladly is overstating it a bit but I take your point. Users will put up with ads with a lot less resistance than a paywall. But that logic still doesn't really follow unless you think that businesses making money by literally any means they can get away with is an end unto itself. If you have a service like YouTube that provides so much value and is such an economic multuplier that we can't possibly imagine society existing without it then why don't we just pay for it? The fact that we have no system to fund public goods that aren't ads and taxes is a huge failing. You're basically just describing a tax system that is paid in consumerism which sucks because it's inherently regressive. If you have a product which is genuinely useful to hundreds of millions of people but that the value only materializes when it's available for 'free' to everyone then we should have ways of getting you funded that isn't attention or convincing individuals to pay you a subscription fee. You're hitting on an important economic function that ads are currently doing but then twisting it around and saying that there's possibility for anything but ads to perform that function.
SiebenHeaven 5y ago
Won't turning js off make you one of the few people in the world that do this and hence easier to fingerprint?
- ______- 5y ago
  You're just added to a (very large pool) of people who browse with JS turned off. Turning JS off as a default is a common thing.
  - leesalminen 5y ago
    Amongst the top 1% of tech savvy users, maybe. In all my years of supporting 100,000s of “regular” users I’ve never encountered anyone with JS disabled.
- 1vuio0pswjnm7 5y ago
  I have seen this type of reasoning before in HN comments but from a user's perspective it does not make sense. Imagine every user is sending a maximum amount of information, which we can see keeps increasing over time, via HTTP headers (including cookies), browser capabilities, hardware capabilities, etc. This "run with the herd" reasoning seems to suggest the best way to avoid fingerprinting is to send the maximum amount of information, "like everyone else". That only results in ever more information being sent to the online advertising industry. The probability they can distinguish one user fingerprint from another goes up as the amount of information sent increases. The objective of the online advertising services company is to gather as much information as possible from users. The objective for the user should be to send as little information as possible. If a fingerprint shows the user is not running JS and is providing only a very minimal, generic set of information, how much value is there is trying to serve ads to that user. Users who want better privacy should be trying to reduce the amount of information they send. Maybe the first movers in that effort are "fingerprinted" as being privacy-conscious, tech-savvy, etc. That is probably going to result in less ads served to them, not more. Eventually, when most users, "the herd", is sending the minimal amount of information, the fingerprints all look similar. Think it through. Advertisers do not care about users who will not indiscriminantly run JS. They go for the low-hanging fruit.

jffry 5y ago

Even the fact that WebGL is disabled contributes some entropy that can be used to identify you.

______- 5y ago
You can't detect if WebGL's turned on/off if JS is turned off. You need JS turned on to detect WebGL's presence

approxim8ion 5y ago

Google turn every result on their search result page into a tracking URL if you have JS disabled. The solution is to allow JavaScript and install the Google Search Link Fix add-on, until they break that too I guess. Or use another search engine.

soared 5y ago

Fingerprinting on your own sites is pointless since only third party cookies are being removed. First party cookies still work like normal.

tpxl 5y ago
It gives you the ground truth with which you then correlate fingerprints from non-first-party domains.
tedivm 5y ago
The whole point of it is to correlate it to other data using the same fingerprinting method. Google is often a first party and a third party, so they need a way to line all that data up.

danShumway 5y ago

This is a complete sidenote, but I don't understand why Firefox's Canvas controls don't affect WebGL. Firefox has per-site settings for whether the canvas should be accessible which are very useful, but they don't have per-site settings for WebGL, it's either on or off for the entire profile. Which kind of defeats the point of Canvas blocking since (at least last time I checked) WebGL fingerprinting is possible regardless of whether Canvas can be read from. I'm sure there's some technical reason, but it really seems like turning Canvas reads off for a site should also turn off WebGL.

cpeterso 5y ago
Here is a Firefox bug report suggesting a per-site permission for WebGL: https://bugzilla.mozilla.org/show_bug.cgi?id=1694456 https://bugzilla.mozilla.org/show_bug.cgi?id=1694456 There's been no Mozilla comments on the bug yet. Perhaps so many sites use WebGL that the user would be pestered with too many permission prompts?

lima 5y ago

> Google is known to fingerprint you on their sites[0] To my understanding, Google (and many other sites) use WebGL and other fingerprinting techniques to distinguish real users from bots. This does not mean they use it to track individual users (if that were even legal in Europe under GDPR).

Nextgrid 5y ago
Google's tracking consent flow is already in breach of the GDPR, so it's not a problem for them.

hkai 5y ago

Why do you want to disable it? Isn't it nice to see ads that are interesting and useful to you rather than looking at some useless ads you're not interested in?

chaosite 5y ago
Seeing ads isn't nice.
Spivak 5y ago
The issue is buried in the premise of the question. “If you’re going to see an ad regardless, would you rather it be relevant to you or not?” The answer is and always has been “I don’t want to see an ad in the first place, I don’t want you collecting any information about me under any circumstances, and anything that makes ads spots worth less is a positive.” You know the cheeky “you won’t see fewer ads, they’ll just be leas relevant” line? The only long term solution to actually see fewer ads is to drive their value down to nothing. The fact that you can pay to remove ads on a lot of services kinda gives the game away that they’re a net negative. Why would you ever want them gone if they’re so useful and helpful? AdTech is such a garbage industry — drunk on their own delusions of facilitating commerce and helping businesses reach customers while being so annoying and vile that the only way their products to function is to insert themselves into every facet of life because nobody would ever seek them out on their own. Bleh.
- doomslice 5y ago
  There's two sides to the equation though (I work on Supply Side ad tech). There's a huge amount of content that people are just not willing to pay for, but would gladly view ads. You may be willing to pay for Youtube Premium and Twitch Plus or whatever, but the vast majority of people do not. Do I feel like I'm a horrible person because I help make websites more money so they can stay in business? Heck no. It's the only reason 90% of these sites are able to exist in the first place.
  - Spivak 5y ago
    I feel like gladly is overstating it a bit but I take your point. Users will put up with ads with a lot less resistance than a paywall. But that logic still doesn't really follow unless you think that businesses making money by literally any means they can get away with is an end unto itself. If you have a service like YouTube that provides so much value and is such an economic multuplier that we can't possibly imagine society existing without it then why don't we just pay for it? The fact that we have no system to fund public goods that aren't ads and taxes is a huge failing. You're basically just describing a tax system that is paid in consumerism which sucks because it's inherently regressive. If you have a product which is genuinely useful to hundreds of millions of people but that the value only materializes when it's available for 'free' to everyone then we should have ways of getting you funded that isn't attention or convincing individuals to pay you a subscription fee. You're hitting on an important economic function that ads are currently doing but then twisting it around and saying that there's possibility for anything but ads to perform that function.

SiebenHeaven 5y ago

Won't turning js off make you one of the few people in the world that do this and hence easier to fingerprint?

______- 5y ago
You're just added to a (very large pool) of people who browse with JS turned off. Turning JS off as a default is a common thing.
- leesalminen 5y ago
  Amongst the top 1% of tech savvy users, maybe. In all my years of supporting 100,000s of “regular” users I’ve never encountered anyone with JS disabled.
1vuio0pswjnm7 5y ago
I have seen this type of reasoning before in HN comments but from a user's perspective it does not make sense. Imagine every user is sending a maximum amount of information, which we can see keeps increasing over time, via HTTP headers (including cookies), browser capabilities, hardware capabilities, etc. This "run with the herd" reasoning seems to suggest the best way to avoid fingerprinting is to send the maximum amount of information, "like everyone else". That only results in ever more information being sent to the online advertising industry. The probability they can distinguish one user fingerprint from another goes up as the amount of information sent increases. The objective of the online advertising services company is to gather as much information as possible from users. The objective for the user should be to send as little information as possible. If a fingerprint shows the user is not running JS and is providing only a very minimal, generic set of information, how much value is there is trying to serve ads to that user. Users who want better privacy should be trying to reduce the amount of information they send. Maybe the first movers in that effort are "fingerprinted" as being privacy-conscious, tech-savvy, etc. That is probably going to result in less ads served to them, not more. Eventually, when most users, "the herd", is sending the minimal amount of information, the fingerprints all look similar. Think it through. Advertisers do not care about users who will not indiscriminantly run JS. They go for the low-hanging fruit.