7 ms·
Protecting Against Browser-Language Fingerprinting
- chakrihacker 4y agoI feel it's a good thing as safari also does this and it hasn't broken web seriously
- sam_lowry_ 4y agoNot the Strict mode change that sends only English
- 2000UltraDeluxe 4y agoThat's going to be fun for users of web sites that set language based on that header...
- gwd 4y agoFrom TFA: > By default, Brave will only report your most preferred language. So, if your language preferences are “English (United States)” first, and Korean second, the browser will only report “en-US,en."1 Brave will also randomize the reported weight (i.e., “q”) within a certain range. > If fingerprinting protections have been set to Strict, Brave will instead always report the language preference as “English,” which ensures the largest available anonymity set2. And here, too, Brave will randomize the reported weight (i.e., “q”) within a certain range. > ...Brave users who wish to share more information about their language preferences with websites can easily configure Brave to do so. Users can disable the font / language protections by visiting brave://settings/shields and toggling off Reduce the identifiability of my language preferences.
- Gasp0de 4y agoI don't think you read more than the (misleading and unnecessarily editorialized) headline on hacker news.
- 2000UltraDeluxe 4y agoI did. It will still wreck sites that don't have the primary language available, but where the secondary might be.
- Symbiote 4y agoI wish we could rely on legal means to prevent tracking, rather than break useful functionality. It's already annoying that developers assume my language based on my location, with features like this my real preference will be harder to determine.
- brokenkebab2 4y agoIn this case that functionality is broken right from the start. There should be a visible lang switch on a website. All other solutions are too technical, and/or have unexpected consequences, and/or lack flexibility.
- layer8 4y agoThere should be both: picking a user-specified default on first visit to address the common case, but still provide a switch to change the language manually. As a user, what I actually miss is the ability to configure language preferences in the browser based on CCTLD.
- WesolyKubeczek 4y agoI have a hard time remembering the last time I’ve seen a site using that header for its intended purpose…
- manderley 4y agoPlenty of sites do, at least in Europe.
- kvdveer 4y agoAll public-facing sites I've ever worked on, used that header for its intended purpose. Europe has a lot of different languages in a relatively small area, so if you want to do ecommerce there, you'll really need it.
- Beltalowda 4y agoI've worked on and written a few sites like that too, but in my experience quite a few larger sites use the IP address for this. It's pretty annoying if you don't speak the local language well or just prefer the English version. Google is a major "offender" for example, but there are many others too. PornHub even machine translates stuff.
- ssl232 4y agoTell me about it, as a native English speaker living in Germany. This happens even when the website has an English language version. I don't understand how they think this is helpful. My browser literally told you the language I want to be served in its first header! Related gripe: Twitter will only offer the report form (for e.g. a harmful tweet) inside Germany, in German. I do understand conversational German but not German legalese; I will not bother to select which exact subparagraph of the communications legislation the tweet violates, I will just close the tab and let someone else report it.
- sockmeistr 4y agoRE:Twitter, I suspect that's because Germans get a different report form than other visitors - Germany has some specific laws (e.g. NetzDG) that apply to visitors from Germany, rather than visitors who speak German.
- gwd 4y agoThe HN title is unnecessarily editorialized; it should be replaced with the original title: "Protecting Against Browser-Language Fingerprinting". And regarding the editorial comment of the submitted title: - What it does is report only the most preferred language by default - You can turn it off (i.e., just the language obfuscation) if you want to report all language preferences
- deleted 4y ago[deleted]
- Liquid_Fire 4y agoIf you speak an uncommon language, this is effectively almost the same as disabling it completely, because so few websites will support your language. They will probably default to whatever the default language of that website is, which may or may not be a language you speak. I understand that it's easy to disable it, but it feels like a default that is strongly biased in favour of speakers of English and other widely spoken languages. Maybe there should be a way to request all languages together and let the client pick whichever one it wants (I'm sure the text on a typical page when compressed, even times 50, is still negligible compared to the 50 MB of JavaScript frameworks it is probably pulling in) That would not sacrifice usability for privacy.
- riedel 4y agoActually it would be good if the default would be that you can request language based on domain name and tld. Actually i normally would want German as default for all .de sites and would chose English for the rest. But here I see no added privacy in a normal setting if I do not use vpn, because 90% of IP addresses from Germany would report the same two languages. So only e.g. if I travel e.g. to Japan it makes me quite fingerprintable. So I think the ideal would be if some entropy score could be displayed/predicted based on context (e.g. source or target address as above) and I could dynamically chose the trade-off between a bit of privacy and convenience. The funny thing is that e.g. if you are in a country with a nonenglish speaking majority that has English as second language, just reporting either language assigns you to a smaller subgroup and makes no sense.
- celsoazevedo 4y agoThe setting that enables this appears to be causing some issues: https://github.com/brave/brave-browser/issues/23093 https://github.com/brave/brave-browser/issues/23093
- kzrdude 4y agoRandomizing q sounds like it will make the Brave browser stand out, but it probably already does (?)
- shakna 4y agoThere's two ways of appearing anonymous. In one approach, you can look like everyone else. This is hard to maintain, as any singular value can make you stand out from the crowd, making it easier to sift and isolate you. However, it is easier to implement, because you just need a bunch of constants in the software. The other approach, is that every single time, you look like someone completely unique. Whilst difficult to get right, this approach does mean you look unique and you do stand out. But every single connection has that feature, which makes it rather difficult to get two completely unique profiles and determine if they are the same person.
- deleted 4y ago[deleted]
- donatj 4y agoAm I wrong here that all the emphasis on fingerprint protection is largely moot when not using a proxy? The entire design of IP networking means you’re fingerprintable by IP, doubly so on IPv6?
- donkarma 4y agoMultiple people can share one IP
- donatj 4y agoI mean yes, with NAT, especially on IPv4 but fingerprinting at the household level still seems exceedingly valuable.
- spiderfarmer 4y agoMost people are on dynamic IP's.
- donatj 4y agoThey’re usually not actually that dynamic. I’m on Comcast and my IP hasn’t changed since before COVID/wfh started. I know because I have to update my works whitelist for the VPC every time it does. Even if it changed weekly, that’s valuable data. How many websites do you access in that time?
- mihaic 4y agoAs a non-English speaker, I find this pretty useless. I always want to get English version of any website, and not some poor translation, and honestly the fingerprinting entropy is negligible. This seems to be PR-driven development, just to score some points from the privacy aware community. Every time I see tech being proposed for privacy instead of legislation I wonder how the topic is kept so vague. There are a handful of companies that can track you across multiple websites, so any real solution has to start by enumerating and addressing those companies. It feels like were always discussing about curing "diseases" without explicitly saying that malaria, TB, etc are the targets.
- jefftk 4y ago> There are a handful of companies that can track you across multiple websites, so any real solution has to start by enumerating and addressing those companies. I think it's more like hundreds than handfuls. But they're all connecting your behavior across sites using the same few techniques: * Explicit methods: cookies, link decoration, and other browser-supported ways of adding entropy. Browsers are working on removing these, but if they move too aggressively here then adtech just moves to: * Fingerprinting: using existing browser entropy. Generally worse than explicit methods because the user doesn't have control (ex: shared fingerprint between successive private browsing sessions). Browsers are also working on reducing this, see the article, but it's very hard because the number of techniques is large and they generally use features users/sites depend on. * Timing attacks (pretty sure no one is doing this commercially yet) You might be interested in https://github.com/michaelkleber/privacy-model https://github.com/michaelkleber/privacy-model (Disclosure: I used to work on ads at Google)
- sam_lowry_ 4y agoI hope timing attacks will not be commercialized or we will see quite some performance degradation in Brave ;-)
- mihaic 4y ago> I think it's more like hundreds than handfuls. Could you be a bit more explicit here? I'd be curious how these entities coordinate themselves, since I don't have hundreds of cookies set by any website, so there must be few networks to correlate this data (FB, Google, some IAB groups, who else?). Going after those networks would seem like the obvious next step then. Thanks for the link. It seems like an honorable direction, but it's a bit nebulous on how browsers would be incentivized to implement with good intentions.
- elforce002 4y agoI started to use Brave after DDG went "rogue" and I have to say, it has been a good run so far.
- josephcsible 4y agoWhat did DuckDuckGo do exactly?
- bmarquez 4y agoTheir browser doesn't block Microsoft tracking scripts (but blocks everything else) due to a contractual agreement. IMO DDG did a poor job of explaining this, choosing to hide behind marketing buzzwords. https://news.ycombinator.com/item?id=31490515 https://news.ycombinator.com/item?id=31490515
- deleted 4y ago[deleted]
- egberts1 4y agoI’ve stopped using Brave on iOS since I can no longer log into Twitter, Reddit nor Hacker News.
- mp3geek 4y agoI'll take a look later today. What's the issues or errors preventing the logins on the sites?
- egberts1 4y agoLooks like the login is not “taking” in my valid username and password. You supply the username/password, click SUBMIT button and they all return back to the same login page, but still not logged in.
- egberts1 4y agoLog-ins works under Edge/iOS, Firefox iOS, Chrome/iOS, Safari, Firefox Focus, Tor+VPN/iOS, Aloha/iOS, DuckDuckGo/iOS, and Orion/iOS.
- egberts1 4y agoI’ve tried the log in effort under - Brave Shields Up - Shields Up, all 16 combination - Shields Down So because shield is down and login does not work, I’ve stopped all testing with Shield-related effort. Version 1.38 (22.5.13.17)
- chrismorgan 4y agoMeanwhile, I set intl.accept_languages in Firefox (via about:config) to en-AU,en-GB,en,en-US. I doubt being so specific has ever actually helped, but I’m stubborn. If you’ve ever seen that particular Accept-Languages sequence in your logs… it’s very probably me.
- ajvs 4y agoCongratulations, you've made yourself unique and thus easy to track. Use the resistFingerprinting preference in Firefox or just use Librewolf - they automatically enumerate a standardised set of accepted languages that a large userbase all share.
- i13e 4y agoIs it just me or is brave (especially on linux) getting slower and more power hungry than simply using chromium? If anyone has any fixes or tips on how to reduce resource usage they'd be much appreciated.
- paulcarroty 4y agoCool, just enabled it right now. Will be great to have similar stuff for timezone.
- 0daystock 4y agoControl-F for "canvas" - it's not discussed in the article. Canvas fingerprinting undoes all of these "protections" which Brave is talking up. Their mitigations are about as effective as changing your UA string these days - not at all. Most of Brave is like this - sounds technical and impressive, but it's mostly meaningless gibberish when viewed in full context. I mean, a "privacy browser" based on Chromium - I feel like I'm taking crazy pills.
- ajvs 4y agoThat's just one of many ways to fingerprint you. This blog post is only concerned with showing you how they are eliminating a different one.
- alibert 4y agoThey actually do handle canvas fingerprinting (I don't know to what extend): https://github.com/brave/brave-browser/wiki/Fingerprinting-Protections#fingerprinting-methods-randomized https://github.com/brave/brave-browser/wiki/Fingerprinting-P... and a bunch of others fingerprinting methods.