5 ms·

Apparently I have strong protection against tracking, but it’s also saying I have a unique fingerprint among all users that have used the app (220k)? I’m just r

Apparently I have strong protection against tracking, but it’s also saying I have a unique fingerprint among all users that have used the app (220k)? I’m just running IOS/safari (same UA as 1/113 users) It seems I’d be easy to track based on my unique fingerprint? Or is there some other factor not mentioned that means my fingerprint isn’t expected to be unique in a larger set? If so, how large?

SimeVidas 5y ago
AFAIK, the only un-fingerprintable browser is Brave (because it randomizes certain web API return values between navigations).
- Santosh83 5y ago
  Somewhat unrelated but the Brave website is broken under the latest Firefox 89 + uBlock Origin (I have no other extensions/themes installed). The entire site is just a blurred, acrylic like mess. If you open in Firefox's safe mode though, it works fine. Which suggests it is uBlock Origin, but curiously the site doesn't work even if I disable uBlock for the domain. PS. It seems Mozilla have removed the "report broken site" option from Firefox's Help menu. There is only report deceptive site.
  - SimeVidas 5y ago
    The recommended place to report such an issue is https://webcompat.com/ https://webcompat.com/
  - deleted 5y ago
    [deleted]
- ttprru 5y ago
  The Tor Browser is designed to be "un-fingerprintable" as well, though instead of randomizing return values it prefers to return the same thing for every user.
  - kamray23 5y ago
    I mean it sounds reasonable, right, but it just doesn't work that well. Brave's Tor windows might be a better way of using it. Fundamentally, trying to make everyone look exactly similar is going to leave a lot of chances because you can only ever try, and it'll leave a machine learning algorithm or even a statistician with diff with a lot of information about what is important. The worst offence is that it relies on everyone else doing the same thing. It doesn't really work. Randomising takes all that out. With no real way to predict it, no easy way of telling what's random and what isn't, and with no reliance on everyone else doing the same, you have just as many if not actually less bits of identifiable information, rely on no-one else, and feed garbage to algorithms which throws them off and possibly confuses you with many other people, protecting them at the same time. I really don't get why the biggest and most well-known Tor browser, the Tor browser, would keep using such a flawed method. Better than nothing though.
    - ttprru 5y ago
      If everyone looks similar you don't have to worry about trackers identifying individual sessions. In any case, if implemented correctly, both methods will achieve the same results. Sure, an incomplete implementation of the randomizing method is less trackable than one of the same fingerprint method, but in practice * even a non-perfect TBB method will protect you against pretty much all trackers * and the TBB is, as a matter of fact, not fingerprintable on any of these tracking test sites. Therefore I think saying that it "doesn't work very well" doesn't quite reflect reality (unless you have a good source on that, I might be mistaken here). And if your threat model requires 100% anonymity (which is an entire level above not being tracked by adtech), the only realistic way to achieve that is to disable JavaScript anyway.
riffraff 5y ago
I got the same result and I was testing it with chrome on android, with no extensions. I think something is pretty off.
- DangitBobby 5y ago
  They explain in detail the various characteristics that go into your unique fingerprint. When combined, almost everyone can be uniquely identified by it.
greggman3 5y ago
It's wrong and has been for ages. It will claim things like I'm 1 in 500k even though I'm on a recent iPhone on the west coast of the the USA. Simple math will tell you it's just plain wrong. The only settings that leak on an iPhone are possibly the model, time zone, and language. There are at last 70 million people in that time zone. Right now it claims for me my iPhone is 1 in 240k so it's effectively claiming there are 291 iPhones of the same model in 70 million people. Yea, no, that's clearly wrong. They don't care that it's wrong because the exaggerated numbers scare people into believing in their cause. Yes I get that it's possible that I'm the only iPhone in 70 million people that checked their site in the last 45 days but that's still exaggerating their point. Only a site that has lots of traffic would need to fingerprint you. So reporting that a site that gets almost no traffic and tell a couple of iPhones visited per day in the last month isn't remotely representative of a popular site that actually is trying to track
- quenix 5y ago
  You miss the point. Your iPhone make and model, time zone, and language are perhaps 20% of your fingerprint. After testing, you can scroll down to see different test metrics and see exactly which fingerprinting methods (WebGL hash, AudioContext, etc) all contribute to your unique fingerprint. It’s not just your phone model.
  - greggman3 5y ago
    no..you missed the point. there is nothing else unique about my iPhone. every one of those other techniques will show up with exaclty the same fingerprint for the same model of iPhone.

SimeVidas 5y ago

AFAIK, the only un-fingerprintable browser is Brave (because it randomizes certain web API return values between navigations).

Santosh83 5y ago
Somewhat unrelated but the Brave website is broken under the latest Firefox 89 + uBlock Origin (I have no other extensions/themes installed). The entire site is just a blurred, acrylic like mess. If you open in Firefox's safe mode though, it works fine. Which suggests it is uBlock Origin, but curiously the site doesn't work even if I disable uBlock for the domain. PS. It seems Mozilla have removed the "report broken site" option from Firefox's Help menu. There is only report deceptive site.
- SimeVidas 5y ago
  The recommended place to report such an issue is https://webcompat.com/ https://webcompat.com/
- deleted 5y ago
  [deleted]
ttprru 5y ago
The Tor Browser is designed to be "un-fingerprintable" as well, though instead of randomizing return values it prefers to return the same thing for every user.
- kamray23 5y ago
  I mean it sounds reasonable, right, but it just doesn't work that well. Brave's Tor windows might be a better way of using it. Fundamentally, trying to make everyone look exactly similar is going to leave a lot of chances because you can only ever try, and it'll leave a machine learning algorithm or even a statistician with diff with a lot of information about what is important. The worst offence is that it relies on everyone else doing the same thing. It doesn't really work. Randomising takes all that out. With no real way to predict it, no easy way of telling what's random and what isn't, and with no reliance on everyone else doing the same, you have just as many if not actually less bits of identifiable information, rely on no-one else, and feed garbage to algorithms which throws them off and possibly confuses you with many other people, protecting them at the same time. I really don't get why the biggest and most well-known Tor browser, the Tor browser, would keep using such a flawed method. Better than nothing though.
  - ttprru 5y ago
    If everyone looks similar you don't have to worry about trackers identifying individual sessions. In any case, if implemented correctly, both methods will achieve the same results. Sure, an incomplete implementation of the randomizing method is less trackable than one of the same fingerprint method, but in practice * even a non-perfect TBB method will protect you against pretty much all trackers * and the TBB is, as a matter of fact, not fingerprintable on any of these tracking test sites. Therefore I think saying that it "doesn't work very well" doesn't quite reflect reality (unless you have a good source on that, I might be mistaken here). And if your threat model requires 100% anonymity (which is an entire level above not being tracked by adtech), the only realistic way to achieve that is to disable JavaScript anyway.

riffraff 5y ago

I got the same result and I was testing it with chrome on android, with no extensions. I think something is pretty off.

DangitBobby 5y ago
They explain in detail the various characteristics that go into your unique fingerprint. When combined, almost everyone can be uniquely identified by it.

greggman3 5y ago

It's wrong and has been for ages. It will claim things like I'm 1 in 500k even though I'm on a recent iPhone on the west coast of the the USA. Simple math will tell you it's just plain wrong. The only settings that leak on an iPhone are possibly the model, time zone, and language. There are at last 70 million people in that time zone. Right now it claims for me my iPhone is 1 in 240k so it's effectively claiming there are 291 iPhones of the same model in 70 million people. Yea, no, that's clearly wrong. They don't care that it's wrong because the exaggerated numbers scare people into believing in their cause. Yes I get that it's possible that I'm the only iPhone in 70 million people that checked their site in the last 45 days but that's still exaggerating their point. Only a site that has lots of traffic would need to fingerprint you. So reporting that a site that gets almost no traffic and tell a couple of iPhones visited per day in the last month isn't remotely representative of a popular site that actually is trying to track

quenix 5y ago
You miss the point. Your iPhone make and model, time zone, and language are perhaps 20% of your fingerprint. After testing, you can scroll down to see different test metrics and see exactly which fingerprinting methods (WebGL hash, AudioContext, etc) all contribute to your unique fingerprint. It’s not just your phone model.
- greggman3 5y ago
  no..you missed the point. there is nothing else unique about my iPhone. every one of those other techniques will show up with exaclty the same fingerprint for the same model of iPhone.