2 ms·

The overall attack surface of fingerprinting is so huge that even if some fantasy world in which all of WebGL, Canvas, Web Audio, WebRTC, etc., could be permane

The overall attack surface of fingerprinting is so huge that even if some fantasy world in which all of WebGL, Canvas, Web Audio, WebRTC, etc., could be permanently removed, you're still fingerprintable. The time of day you visit specific sites is enough to eventually fingerprint you. This data can and is collected on back-ends and then shared across data networks. It doesn't matter what you do in the client, you're fingerprintable.

gruez 4y ago
>The overall attack surface of fingerprinting is so huge that even if some fantasy world in which all of WebGL, Canvas, Web Audio, WebRTC, etc., could be permanently removed, you're still fingerprintable. I guess that's true in the abstract, but the more fingerprinting vectors there are, the easier it is to identify a specific person. The best case scenario is something like the iPhone, where each model behaves identically and there are limited amount of user-configurable settings, such that there are tens of thousands of people in your city alone that have the same model/settings (eg. timezone/dark mode on/off). You can do all the fingerprinting you want, but for a medium traffic site you're probably still going to get hundreds/thousands of users with the same fingerprint. >The time of day you visit specific sites is enough to eventually fingerprint you. How does this even work? If I'm on a VPN (ie. shared IP with hundreds of other users) and have total cookie protection (separate cookie jars for each site), it's effectively impossible to tell whether I'm one user visiting a dozen sites, or a dozen users viewing one site each.