6 ms·

I don't understand the test on this page. It says we should be worried because a fingerprinting website generates the same hash even after you clear your cache

I don't understand the test on this page. It says we should be worried because a fingerprinting website generates the same hash even after you clear your cache and site-data, and even if you go into a private tab. But I'm not overly concerned by this, provided I share that hash with other people. The worry would be that the hash is unique to me (i.e. a fingerprint), but I don't see the evidence that it is.

geysersam 4y ago
Sure, the advertisement graph only showed recall and not precision. Maybe everyone gets the same hash! That'd explain their excellent results. However, I doubt that's a problem in practice. I'd assume these finger printers know what they're doing. It certainly seems so. How could one make an experiment collecting lots of these finger prints and determine the false positive rate?
mejutoco 4y ago
Here is evidence that the hash can be unique, or narrow down a small group of people https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/
- jefc1111 4y ago
  This is a nice website.
suprjami 4y ago
The likelihood that you have the same hash as other people is exceedingly small. So if I fingerprint you on a site which is using my commercial fingerprint service, then I can sell your hash to other places and tell them all about your browsing habits. The more places run my fingerprinting service, the more data I can collect on you.
- momentoftop 4y ago
  I understand the principle. I'm saying that the test on this page isn't demonstrating uniqueness, and so isn't demonstrating fingerprinting. The first time I heard about fingerprinting was with EFF's panoptoclick, which stated how many hashes had been generated from visitors, and how many you shared with them.
  - than3 4y ago
    I agree with you about uniqueness, but being unique doesn't matter with respect to their claims. Any educated person with sufficient math knows the mathematical structure of a hash will never be unique. Its a Galois field, or 'finite field' after all. The core of this issue is the flawed but convincing belief promoted by an entire industry that if the probability is sufficiently low, its unique, and following these axioms if its unique its an individual person (eyeball). Under that assumption, all you need to do is collect fields of information that are variable, and group them together such that it yields to a sufficiently low threshold, I think currently that threshold is about 1 per million. Its a very clever way to defraud advertisers if you think about it. You create an exaggerated market, and charge for each advertisement view. In my opinion its just flawed thinking but there are some real fanatics out there that subscribe to this dogmatically. For example applied probability is used as part of the protocol design when accounting for binary erasure channels in things like cell phones. You shouldn't be able to have communications blocked in only one direction, or altered without it being noticeable, but stingrays may have the ability to do this according to the limited documentation that has been released so far. Probabilities in general have real problems fundamentally with validity. I think the most common approach today is the Axiomatic approach, or the Frequentist Approach, both have significant limitations and often devolve when self reference is indirectly introduced. So I guess I'll ask, are you a believer?
illiarian 4y ago
It's enough to narrow you down to a specific bucket. E.g. "affluent white young male in his 30s in a specific neighbourhood" and serve you ads and news. Collate with a few other sites (even airline checkouts and boarding pages have tracking), and you have a close enough match. The worst part of this? Trying to hide from fingerprinting makes your fingerprint more unique
- geysersam 4y ago
  > Trying to hide from fingerprinting makes your fingerprint more unique Didn't seem so in the experiment in the article. Sure they'll be able to place you in the bucket "tor user", but is that really more narrow than what you'd get without Tor?
  - TylerE 4y ago
    Probably. Tor is not something most people use unless they have something to hide. No, I don’t care about the one time you downloaded a gentoo iso over tor.
  - olabyne 4y ago
    Using Tor might stop them to track you in a unique way, but they can for sure put you in the basket of the 0.1% of Tor users
    - bauruine 4y ago
      You can easily do this by looking at the IP address. All exit node IPs are public, you don't need browser fingerprinting for that.
asdman123 4y ago
Unfortunately the many, many browser capabilities have given adtech enough entropy to actually create globally unique fingerprints. You can lookup yours with an estimation of uniqueness here: https://amiunique.org/fp https://amiunique.org/fp
aflag 4y ago
The site they use give you a visits counter. So, if that matches what you did, you didn't clash with any other user's hash.

geysersam 4y ago

Sure, the advertisement graph only showed recall and not precision. Maybe everyone gets the same hash! That'd explain their excellent results. However, I doubt that's a problem in practice. I'd assume these finger printers know what they're doing. It certainly seems so. How could one make an experiment collecting lots of these finger prints and determine the false positive rate?

mejutoco 4y ago

Here is evidence that the hash can be unique, or narrow down a small group of people https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/

jefc1111 4y ago
This is a nice website.

suprjami 4y ago

The likelihood that you have the same hash as other people is exceedingly small. So if I fingerprint you on a site which is using my commercial fingerprint service, then I can sell your hash to other places and tell them all about your browsing habits. The more places run my fingerprinting service, the more data I can collect on you.

momentoftop 4y ago
I understand the principle. I'm saying that the test on this page isn't demonstrating uniqueness, and so isn't demonstrating fingerprinting. The first time I heard about fingerprinting was with EFF's panoptoclick, which stated how many hashes had been generated from visitors, and how many you shared with them.
- than3 4y ago
  I agree with you about uniqueness, but being unique doesn't matter with respect to their claims. Any educated person with sufficient math knows the mathematical structure of a hash will never be unique. Its a Galois field, or 'finite field' after all. The core of this issue is the flawed but convincing belief promoted by an entire industry that if the probability is sufficiently low, its unique, and following these axioms if its unique its an individual person (eyeball). Under that assumption, all you need to do is collect fields of information that are variable, and group them together such that it yields to a sufficiently low threshold, I think currently that threshold is about 1 per million. Its a very clever way to defraud advertisers if you think about it. You create an exaggerated market, and charge for each advertisement view. In my opinion its just flawed thinking but there are some real fanatics out there that subscribe to this dogmatically. For example applied probability is used as part of the protocol design when accounting for binary erasure channels in things like cell phones. You shouldn't be able to have communications blocked in only one direction, or altered without it being noticeable, but stingrays may have the ability to do this according to the limited documentation that has been released so far. Probabilities in general have real problems fundamentally with validity. I think the most common approach today is the Axiomatic approach, or the Frequentist Approach, both have significant limitations and often devolve when self reference is indirectly introduced. So I guess I'll ask, are you a believer?

illiarian 4y ago

It's enough to narrow you down to a specific bucket. E.g. "affluent white young male in his 30s in a specific neighbourhood" and serve you ads and news. Collate with a few other sites (even airline checkouts and boarding pages have tracking), and you have a close enough match. The worst part of this? Trying to hide from fingerprinting makes your fingerprint more unique

geysersam 4y ago
> Trying to hide from fingerprinting makes your fingerprint more unique Didn't seem so in the experiment in the article. Sure they'll be able to place you in the bucket "tor user", but is that really more narrow than what you'd get without Tor?
- TylerE 4y ago
  Probably. Tor is not something most people use unless they have something to hide. No, I don’t care about the one time you downloaded a gentoo iso over tor.
- olabyne 4y ago
  Using Tor might stop them to track you in a unique way, but they can for sure put you in the basket of the 0.1% of Tor users
  - bauruine 4y ago
    You can easily do this by looking at the IP address. All exit node IPs are public, you don't need browser fingerprinting for that.

asdman123 4y ago

Unfortunately the many, many browser capabilities have given adtech enough entropy to actually create globally unique fingerprints. You can lookup yours with an estimation of uniqueness here: https://amiunique.org/fp https://amiunique.org/fp

aflag 4y ago

The site they use give you a visits counter. So, if that matches what you did, you didn't clash with any other user's hash.