5 ms·
Fingerprinting is a problem, and it's difficult to address. There's been some discussion around mechanisms for disabling features to make the browser signature
by mikewest 15y ago
Fingerprinting is a problem, and it's difficult to address. There's been some discussion around mechanisms for disabling features to make the browser signature less unique, but it's a very tough problem.
Take a look at https://trac.webkit.org/wiki/Fingerprinting https://trac.webkit.org/wiki/Fingerprinting for some discussion around what would be required. It's very, very nontrivial.
- gbog 15y agootoh, you need a browser signature if you want to avoid CSRF attacks.
- valiant 15y agoNo, to reliably protect your application from cross site request forgery attacks you usually use auth tokens in the request. So even if there might be a browser-signature based solution for CSRF protection, there is a very solid alternative, which I think is the best practice anyway.