4 ms·

At first I was like "Yeah buddy, preach on". Then came the next thought: Then what. Site providers will still will want to know and this likely results in a

At first I was like "Yeah buddy, preach on". Then came the next thought: Then what. Site providers will still will want to know and this likely results in a browser detection excalation arms race pushed to JavaScript. I still think servers shouldn't get to know so much about browser clients, certainly not PII-level details (PII-level being the norm as it exists today).

Hizonner 4y ago
You can't stop fingerprinting. I wish you could, but you can't. But you CAN make it enough of a pain to cut down on the number of half-qualified Web monkeys who try to use the information in ham-handed ways. You can stop just handing the information over for free to people who might want to casually exploit you. You might even make it harder for some more sophisticated and/or committed actors to do it; for example, if I'm an ISP running a middlebox and trying to fingerprint all the traffic that runs through me, I can't use JavaScript. And you can save some bandwidth in the process.
codetrotter 4y ago
> Won't this likely result in browser detection to be pushed to JavaScript and create an arms escalation race? NoScript. https://noscript.net/ https://noscript.net/
- heavyset_go 4y ago
  There are plenty of services that won't serve you data, neither web app nor data from API calls, if you aren't running a JS engine.
  - bee_rider 4y ago
    If they are important enough, add an exception.
    - heavyset_go 4y ago
      My point with my comment was addressing the GP's claim about fingerprinting being pushed to JavaScript in an arms race, which is what's happening and is something that NoScript can't really stop unless millions/billions of people start using it. NoScript is great, I use it, but isn't a solution to fingerprinting via JS if you actually want to talk to the servers that fingerprint that way.
- IIsi50MHz 4y ago
  Can we presume a premise that having Javascript disabled is the dominant condition, and therefore does not make a browser stand out from the herd? What if having it disabled is true of only a small percentage of browsers?. If we assume that the user-agent string is set to whatever is "most common", and Javascript is disabled, are there no other identifiable bits of information? What about CSS fingerprinting? Perhaps the expected adversaries are not sufficiently motivated to try to sort somebody into a cohort based on lack of Javascript, and the remaining observable data? (But not saying NoScript has no uses.)
MBCook 4y ago
But that should happen. Does the user’s browser support WebDoodle2? Why try to parse a weird history of nonsense and combine that with a table of what versions of what browser supports what? Just check if document.doodle2 is defined. Done. Reliable. Easy. FF pretends to be Chrome pretends to be Safari pretends to be IE pretends to be Netscape pretends to be Mosaic pretends to be god only knows. Actually asking via JS instead of guessing is a massive improvement.
- howinteresting 4y ago
  Problem is some versions of some browsers have bugs in some parts of doodle2, and the largest websites tend to care about things like that.
  - hsbauauvhabzb 4y ago
    Browser subversions were a problem in IE6 days, almost all modern browser usage is now on very recent browser versions.
  - MBCook 4y ago
    But you can make an API to expose the browser version. You don’t need to parse a cursed string.
wyager 4y ago
Good. I would rather incur costs for browser detection than make it easy.
kevin_thibedeau 4y ago
> results in a browser detection excalation arms race Countries should start enforcing their laws with regard to equal access for disabled users. Invoke hefty fines for denying service to people using assistive software that doesn't masquerade as a mainstream browser and the problem will disappear.

Hizonner 4y ago

You can't stop fingerprinting. I wish you could, but you can't. But you CAN make it enough of a pain to cut down on the number of half-qualified Web monkeys who try to use the information in ham-handed ways. You can stop just handing the information over for free to people who might want to casually exploit you. You might even make it harder for some more sophisticated and/or committed actors to do it; for example, if I'm an ISP running a middlebox and trying to fingerprint all the traffic that runs through me, I can't use JavaScript. And you can save some bandwidth in the process.

codetrotter 4y ago

> Won't this likely result in browser detection to be pushed to JavaScript and create an arms escalation race? NoScript. https://noscript.net/ https://noscript.net/

heavyset_go 4y ago
There are plenty of services that won't serve you data, neither web app nor data from API calls, if you aren't running a JS engine.
- bee_rider 4y ago
  If they are important enough, add an exception.
  - heavyset_go 4y ago
    My point with my comment was addressing the GP's claim about fingerprinting being pushed to JavaScript in an arms race, which is what's happening and is something that NoScript can't really stop unless millions/billions of people start using it. NoScript is great, I use it, but isn't a solution to fingerprinting via JS if you actually want to talk to the servers that fingerprint that way.
IIsi50MHz 4y ago
Can we presume a premise that having Javascript disabled is the dominant condition, and therefore does not make a browser stand out from the herd? What if having it disabled is true of only a small percentage of browsers?. If we assume that the user-agent string is set to whatever is "most common", and Javascript is disabled, are there no other identifiable bits of information? What about CSS fingerprinting? Perhaps the expected adversaries are not sufficiently motivated to try to sort somebody into a cohort based on lack of Javascript, and the remaining observable data? (But not saying NoScript has no uses.)

MBCook 4y ago

But that should happen. Does the user’s browser support WebDoodle2? Why try to parse a weird history of nonsense and combine that with a table of what versions of what browser supports what? Just check if document.doodle2 is defined. Done. Reliable. Easy. FF pretends to be Chrome pretends to be Safari pretends to be IE pretends to be Netscape pretends to be Mosaic pretends to be god only knows. Actually asking via JS instead of guessing is a massive improvement.

howinteresting 4y ago
Problem is some versions of some browsers have bugs in some parts of doodle2, and the largest websites tend to care about things like that.
- hsbauauvhabzb 4y ago
  Browser subversions were a problem in IE6 days, almost all modern browser usage is now on very recent browser versions.
- MBCook 4y ago
  But you can make an API to expose the browser version. You don’t need to parse a cursed string.

wyager 4y ago

Good. I would rather incur costs for browser detection than make it easy.

kevin_thibedeau 4y ago

> results in a browser detection excalation arms race Countries should start enforcing their laws with regard to equal access for disabled users. Invoke hefty fines for denying service to people using assistive software that doesn't masquerade as a mainstream browser and the problem will disappear.