4 ms·

> While they deny the practice, these services have the ability of profiling your browser (using browser fingerprinting with your IP address and HTTP referer he

> While they deny the practice, these services have the ability of profiling your browser (using browser fingerprinting with your IP address and HTTP referer header) to track what sites you visit, building a valuable profile about you that they could sell to marketers. As a person who works in martech it's patently bizarre to read this stuff. There's a difference between something being provent theoretically possible in a laboratory environment and actually making it out in the real world. The entire browser profiling angle refers to something that does not currently exist, does not conceivably scale well, and chases after an infinitesimally small potential monetary gain. Can someone theoretically climb up the building and break into your apartment on the 6th floor? Sure. Does it need to be included in your risk assessment? Well it's me, your neighborhood burglar, and I'm saying not really. One underrated aspect of custom fonts on websites is that they actually enhance security for the average user. One of the first and often only things that lets someone know they are being MitM attacked or phished is when the corporate branding feels "off". So while you may not understand the value of "corporate identity" or all of that nonsense, in the days before corporate identity was such a big deal, people got hoodwinked by lookalikes all of the time.

megous 4y ago
> often only things that lets someone know they are being MitM attacked or phished is when the corporate branding feels "off" Why? Man in the middle can just snatch off the credentials on the way back to the backend, they don't need to change anything.
onion2k 4y ago
The entire browser profiling angle refers to something that does not currently exist, does not conceivably scale well, and chases after an infinitesimally small potential monetary gain This is where the tech industry is at though. All the low hanging fruit has been harvested long ago. The tens of thousands of devs in the Bay Area are building things that make "infinitesimally small potential monetary gain" because at web scale that's hundreds of millions of dollars. They might not be doing this particular thing, but they are doing something, so vigilance is necessary if you value your privacy.
ffpip 4y ago
> There's a difference between something being provent theoretically possible in a laboratory environment and actually making it out in the real world. Fingerprinting using IP address, running scripts, canvas fingerprinting, using installed fonts, and checking what resources are cached/blocked are all things that are being widely used in many websites, and are not just "theoretically possible". They are even being sold as a product and are used by many companies. Look at their customers - https://fingerprint.com/ https://fingerprint.com/ .
- post_below 4y ago
  To add to this, basic fingerprinting is trivial. And more advanced fingerprinting isn't much harder. I'm so confused by GP post. We were doing fingerprinting 15 years ago.
  - MarcoZavala 4y ago
- ikt 4y ago
  > Look at their customers - https://fingerprint.com/ https://fingerprint.com/ . Welp that's scary, can detect me when I'm on VPN, off it, in private browsing mode, different country in private browsing mode...
  - pas 4y ago
    that's nice claim, but for it to work you need to leak enough entropy, and you can check that on various sites.
    - ikt 4y ago
      there's a little widget on the site that can check that for you
  - legitster 4y ago
    Try it again with cookies disabled. It looks like they only do the browser fingerprinting if cookies are disabled.
Havoc 4y ago
>The entire browser profiling angle refers to something that does not currently exist, does not conceivably scale well You sure? Quick google suggests somewhere in the low single digits of big sites is applying some sort of fingerprinting - though unclear how much is for security vs tracking [0] https://webtransparency.cs.princeton.edu/webcensus/ https://webtransparency.cs.princeton.edu/webcensus/
masa331 4y ago
It's not bizarre if you realize that the decisions are not really in your hands. You are an engineer working in martech, you do what your company tells you to do and your company is motivated by profit, especially in martech. When your bosses decide it's time to start doing that, you will follow and if not, plenty of other engineers will. It's not like there are not dozens and dozens of examples of companies doing exactly that
manigandham 4y ago
I've spent 12 years in adtech and built 3 ad platforms from the ground up. Fingerprinting is used everywhere. It's a wide spectrum from basic metrics to very in-depth tracking, all depending on the scale, latency and functionality of each scenario. This can range from frequency capping to fraud detection to stopping bots, to uniquely identifying devices. I will say that it's mostly used to improve UX by increasing security and limiting spam/bots/fraud but that doesn't mean its not used to track devices and people, although it's sold as targeted ad campaigns rather than specifically following individuals.
- legitster 4y ago
  How does a fingerprint remain stable over any reasonable period of time? How do you distinguish between different user accounts on the same device? How do you tie a fingerprint to your database of existing customers? How do you keep cookie data from conflicting with fingerprint data? I have yet to ever see a database of fingerprints or what it even looks like. It could very well be that advertisers keep it as part of a secret black-box, but every vendor we have ever used has been entirely dependent on cookies and the only data we've ever collected has been cookie or session-based. I've been sold a lot of garbage adtech over the years, so my hunch was that this was another bit of industry vaporware.
  - manigandham 4y ago
    > "How does a fingerprint remain stable over any reasonable period of time?" Depends on how stable the signals being used are. Some can be very durable. > "How do you distinguish between different user accounts on the same device?" Fingerprints usually identify a device or specific user-agent. I'm not sure about the context for this but you can augment it with cookies to specify "user accounts". > "How do you tie a fingerprint to your database of existing customers?" How do you tie any random alphanumeric ID - whether stored as a cookie on device or recognized as a fingerprint - to a customer? Mappings still exist and work the same way. > "How do you keep cookie data from conflicting with fingerprint data?" What would be the conflict? Ideally only one is used as the primary identifier and takes precedence.
MarcoZavala 4y ago

megous 4y ago

> often only things that lets someone know they are being MitM attacked or phished is when the corporate branding feels "off" Why? Man in the middle can just snatch off the credentials on the way back to the backend, they don't need to change anything.

onion2k 4y ago

The entire browser profiling angle refers to something that does not currently exist, does not conceivably scale well, and chases after an infinitesimally small potential monetary gain This is where the tech industry is at though. All the low hanging fruit has been harvested long ago. The tens of thousands of devs in the Bay Area are building things that make "infinitesimally small potential monetary gain" because at web scale that's hundreds of millions of dollars. They might not be doing this particular thing, but they are doing something, so vigilance is necessary if you value your privacy.

ffpip 4y ago

> There's a difference between something being provent theoretically possible in a laboratory environment and actually making it out in the real world. Fingerprinting using IP address, running scripts, canvas fingerprinting, using installed fonts, and checking what resources are cached/blocked are all things that are being widely used in many websites, and are not just "theoretically possible". They are even being sold as a product and are used by many companies. Look at their customers - https://fingerprint.com/ https://fingerprint.com/ .

post_below 4y ago
To add to this, basic fingerprinting is trivial. And more advanced fingerprinting isn't much harder. I'm so confused by GP post. We were doing fingerprinting 15 years ago.
- MarcoZavala 4y ago
ikt 4y ago
> Look at their customers - https://fingerprint.com/ https://fingerprint.com/ . Welp that's scary, can detect me when I'm on VPN, off it, in private browsing mode, different country in private browsing mode...
- pas 4y ago
  that's nice claim, but for it to work you need to leak enough entropy, and you can check that on various sites.
  - ikt 4y ago
    there's a little widget on the site that can check that for you
- legitster 4y ago
  Try it again with cookies disabled. It looks like they only do the browser fingerprinting if cookies are disabled.

Havoc 4y ago

>The entire browser profiling angle refers to something that does not currently exist, does not conceivably scale well You sure? Quick google suggests somewhere in the low single digits of big sites is applying some sort of fingerprinting - though unclear how much is for security vs tracking [0] https://webtransparency.cs.princeton.edu/webcensus/ https://webtransparency.cs.princeton.edu/webcensus/

masa331 4y ago

It's not bizarre if you realize that the decisions are not really in your hands. You are an engineer working in martech, you do what your company tells you to do and your company is motivated by profit, especially in martech. When your bosses decide it's time to start doing that, you will follow and if not, plenty of other engineers will. It's not like there are not dozens and dozens of examples of companies doing exactly that

manigandham 4y ago

I've spent 12 years in adtech and built 3 ad platforms from the ground up. Fingerprinting is used everywhere. It's a wide spectrum from basic metrics to very in-depth tracking, all depending on the scale, latency and functionality of each scenario. This can range from frequency capping to fraud detection to stopping bots, to uniquely identifying devices. I will say that it's mostly used to improve UX by increasing security and limiting spam/bots/fraud but that doesn't mean its not used to track devices and people, although it's sold as targeted ad campaigns rather than specifically following individuals.

legitster 4y ago
How does a fingerprint remain stable over any reasonable period of time? How do you distinguish between different user accounts on the same device? How do you tie a fingerprint to your database of existing customers? How do you keep cookie data from conflicting with fingerprint data? I have yet to ever see a database of fingerprints or what it even looks like. It could very well be that advertisers keep it as part of a secret black-box, but every vendor we have ever used has been entirely dependent on cookies and the only data we've ever collected has been cookie or session-based. I've been sold a lot of garbage adtech over the years, so my hunch was that this was another bit of industry vaporware.
- manigandham 4y ago
  > "How does a fingerprint remain stable over any reasonable period of time?" Depends on how stable the signals being used are. Some can be very durable. > "How do you distinguish between different user accounts on the same device?" Fingerprints usually identify a device or specific user-agent. I'm not sure about the context for this but you can augment it with cookies to specify "user accounts". > "How do you tie a fingerprint to your database of existing customers?" How do you tie any random alphanumeric ID - whether stored as a cookie on device or recognized as a fingerprint - to a customer? Mappings still exist and work the same way. > "How do you keep cookie data from conflicting with fingerprint data?" What would be the conflict? Ideally only one is used as the primary identifier and takes precedence.

MarcoZavala 4y ago