4 ms·

Look, forget about threat models. It's relatively trivial these days to avoid fingerprinting attacks if you want to (as a private, web browsing individual). I

Look, forget about threat models. It's relatively trivial these days to avoid fingerprinting attacks if you want to (as a private, web browsing individual). I use fingerprinting actively in enterprise apps as a form of silent 3FA. It's a useful backstop. If I have a user who forgot their password but retrieves it via email, I'll usually let them pass if their fingerprint matches one of their priors; otherwise my software shoots off an email to their immediate superior to make that manager validate that the machine the employee is using is one they can vouch for. I've always viewed browser fingerprinting as something that can be leveraged as a security feature. It's far more useful for that than for some sort of distributed tracking. I'd never want to live in a world (ahem ... China) where submitting to such fingerprinting actively was mandatory, or politically punishable if you didn't. No society should be run like an employer/employee organization with that sort of lack of trust. No sane free person would allow their own browser to transmit a fingerprint. But for employer/employee systems management? It's a great tool in the box.

ashildr 4y ago
Dunning and Kruger agree.
rat9988 4y ago
"It's relatively trivial these days to avoid fingerprinting attacks". Why should it be on me to avoid them? And more importantly, it's NOT trivial.
- noduerme 4y ago
  really? it takes a minute to set up a VPN and do your web browsing through a virtual machine. I guess it's not "trivial" for the average American, but it definitely is for the average terrorist or child pornographer, so it's easy compared to surmounting most other threat models faced by people intending to evade detection. Therefore, "trivial". [edit] also, the less trivial it is, the better for corporate security.
  - defrost 4y ago
    The article describes "Fingerprinting as a Service. Some choice quotes: It doesn’t matter if you are using a VPN or Private Browsing mode, they can accurately identify you. Also note that VPNs does not help with fingerprinting. They only masks IP address.
    - noduerme 4y ago
      right. but using a VPN plus a fresh VM running Ubuntu can mostly do the trick. In a pinch, just keep a few different versions of various browsers around when you plan to surf a site that you don't want associated with you. Or change your screen resolution or turn off your fonts. My point was that fingerprinting is much more practical and useful as a positive form of identity verification than it is as a tracking device, as long as it isn't (and hopefully never will be) mandatory to lock into browsers.
      - bigfudge 4y ago
        one point is that I may not have any specific sites I care about disassociating myself with. I just don’t want an aggregate picture to be built and sold freely. Cliche example/ I want to be able to buy a pregnancy test online but don’t want that information shared and re marketed to me. There is plenty of stuff like this. The impact of privacy violation is small and often boring but on aggregate corrosive to public discourse and individual wellbeing.
        noduerme 4y ago
        Look... to this and other (sib) posts I have total sympathy, but much better tracking can be done with cookies and other forms of client side storage. Which the 90% of people do not notice, clear, or care about. Fingerprinting is by definition a lot more imprecise and vague. It's always going to be an issue if surveillance networks use it to pick out individual users. Whining about that is useless. It's also a valuable security tool and part of the landscape. Do with it what you can.
      - 4y ago
zelphirkalt 4y ago
(1) Users should not receive passwords via e-mail. (2) How very enterprisey of you to even be able to send passwords, which one also should not be able to do. (3) Users can change or modify their browser, either to another browser entirely or through installation of addons. The fingerprint is not guaranteed at all to stay the same or similar.
- noduerme 4y ago
  [flagged]
- praestigiare 4y ago
  This is an uncharitable reading of the comment. "Retrieve via email" can just as well be understood as reset using an email flow, as is common on most websites. And the comment does not claim they rely on fingerprints never changing, they say that if you do have a matching fingerprint, you can use that instead of another procedure.
- charcircuit 4y ago
  (1) There is nothing wrong with sending a password via email. Even if you send a reset link instead an email provider could steal that too. (2) The server gets sent your password every time you log in. You shouldn't rely on a server operator not knowing your password. (3) You can tune how sensative the system is in response to changes in the fingerprint. Even if their in a failure to match that just means authentication will be extra strict.
  - zelphirkalt 4y ago
    (1) Best that would be a one usage link though, so that a user can detect, whether the link was stolen from their inbox. I think you also did not get my point: The service should not know the password at all. Usually not even initial passwords for any account. It is simply a bad practice to ever have knowledge about user passwords, except for a salted hash. So I say you are wrong. (2) The server gets send the password via the default communication channel, the browser, TLS hopefully, not via e-mail, possibly into an inbox, that is third-party controlled (say some google mail inbox for example). (3) That does not make it right. Did they even ask the users for their consent? Did they learn anything from GDPR or in general discussions about consent? Or are they just a higher being, allowed to decide for their users, what data about them they track? Many things can be done using technology. The question is always: Should we do them? That is a question about ethics, not technological possibility. We already have far too many businesses not caring about ethics at all, we do not need any additional ones.
reportgunner 4y ago
I'm afraid your view is how the journey to the *"world where submitting to such fingerprinting actively was mandatory" starts. Something with frogs in very warm water.
- noduerme 4y ago
  I upvoted this because it's the only smart comment to my post here. This is the ultimate concern. That said, fingerprinting is only useful as a third security measure because most people don't understand its mechanics. The mechanics of avoiding being tracked are pretty basic. If our country required browsers or computers to transmit their fingerprint, people would find ways around it and it would stop being useful as a security metric. Put another way, the moment this becomes a feature of an oppressive regime, it's one of the easiest things to work around. The obscurity is what makes it remain somewhat useful.
xkcd1963 4y ago
You seem to have a conflict of interest here. How can you accept this for employee/employer but at the same time say it's not ok for a person to submit fingerprinting? Employees are also persons.
- noduerme 4y ago
  Because the software is only allowed to be used on company computers and a few personal devices which have to be approved by upper management. It isn't fingerprinting the person or the public. It's checking that the software is running on a known/approved machine.
  - xkcd1963 4y ago
    This technology could be used outside the company's garden one day. The current employer/employee picture could been seen as a miniature of society, e.g. The great firewall is only used for Chinese citizens and is controlled by the Government of the People's Republic of China. But I probably interpret too far here and it seems that in some industries e.g. secret agencies need to use unconventional methods.

ashildr 4y ago

Dunning and Kruger agree.

rat9988 4y ago

"It's relatively trivial these days to avoid fingerprinting attacks". Why should it be on me to avoid them? And more importantly, it's NOT trivial.

noduerme 4y ago
really? it takes a minute to set up a VPN and do your web browsing through a virtual machine. I guess it's not "trivial" for the average American, but it definitely is for the average terrorist or child pornographer, so it's easy compared to surmounting most other threat models faced by people intending to evade detection. Therefore, "trivial". [edit] also, the less trivial it is, the better for corporate security.
- defrost 4y ago
  The article describes "Fingerprinting as a Service. Some choice quotes: It doesn’t matter if you are using a VPN or Private Browsing mode, they can accurately identify you. Also note that VPNs does not help with fingerprinting. They only masks IP address.
  - noduerme 4y ago
    right. but using a VPN plus a fresh VM running Ubuntu can mostly do the trick. In a pinch, just keep a few different versions of various browsers around when you plan to surf a site that you don't want associated with you. Or change your screen resolution or turn off your fonts. My point was that fingerprinting is much more practical and useful as a positive form of identity verification than it is as a tracking device, as long as it isn't (and hopefully never will be) mandatory to lock into browsers.
    - bigfudge 4y ago
      one point is that I may not have any specific sites I care about disassociating myself with. I just don’t want an aggregate picture to be built and sold freely. Cliche example/ I want to be able to buy a pregnancy test online but don’t want that information shared and re marketed to me. There is plenty of stuff like this. The impact of privacy violation is small and often boring but on aggregate corrosive to public discourse and individual wellbeing.
      - noduerme 4y ago
        Look... to this and other (sib) posts I have total sympathy, but much better tracking can be done with cookies and other forms of client side storage. Which the 90% of people do not notice, clear, or care about. Fingerprinting is by definition a lot more imprecise and vague. It's always going to be an issue if surveillance networks use it to pick out individual users. Whining about that is useless. It's also a valuable security tool and part of the landscape. Do with it what you can.
    - 4y ago

zelphirkalt 4y ago

(1) Users should not receive passwords via e-mail. (2) How very enterprisey of you to even be able to send passwords, which one also should not be able to do. (3) Users can change or modify their browser, either to another browser entirely or through installation of addons. The fingerprint is not guaranteed at all to stay the same or similar.

noduerme 4y ago
[flagged]
praestigiare 4y ago
This is an uncharitable reading of the comment. "Retrieve via email" can just as well be understood as reset using an email flow, as is common on most websites. And the comment does not claim they rely on fingerprints never changing, they say that if you do have a matching fingerprint, you can use that instead of another procedure.
charcircuit 4y ago
(1) There is nothing wrong with sending a password via email. Even if you send a reset link instead an email provider could steal that too. (2) The server gets sent your password every time you log in. You shouldn't rely on a server operator not knowing your password. (3) You can tune how sensative the system is in response to changes in the fingerprint. Even if their in a failure to match that just means authentication will be extra strict.
- zelphirkalt 4y ago
  (1) Best that would be a one usage link though, so that a user can detect, whether the link was stolen from their inbox. I think you also did not get my point: The service should not know the password at all. Usually not even initial passwords for any account. It is simply a bad practice to ever have knowledge about user passwords, except for a salted hash. So I say you are wrong. (2) The server gets send the password via the default communication channel, the browser, TLS hopefully, not via e-mail, possibly into an inbox, that is third-party controlled (say some google mail inbox for example). (3) That does not make it right. Did they even ask the users for their consent? Did they learn anything from GDPR or in general discussions about consent? Or are they just a higher being, allowed to decide for their users, what data about them they track? Many things can be done using technology. The question is always: Should we do them? That is a question about ethics, not technological possibility. We already have far too many businesses not caring about ethics at all, we do not need any additional ones.

reportgunner 4y ago

I'm afraid your view is how the journey to the *"world where submitting to such fingerprinting actively was mandatory" starts. Something with frogs in very warm water.

noduerme 4y ago
I upvoted this because it's the only smart comment to my post here. This is the ultimate concern. That said, fingerprinting is only useful as a third security measure because most people don't understand its mechanics. The mechanics of avoiding being tracked are pretty basic. If our country required browsers or computers to transmit their fingerprint, people would find ways around it and it would stop being useful as a security metric. Put another way, the moment this becomes a feature of an oppressive regime, it's one of the easiest things to work around. The obscurity is what makes it remain somewhat useful.

xkcd1963 4y ago

You seem to have a conflict of interest here. How can you accept this for employee/employer but at the same time say it's not ok for a person to submit fingerprinting? Employees are also persons.

noduerme 4y ago
Because the software is only allowed to be used on company computers and a few personal devices which have to be approved by upper management. It isn't fingerprinting the person or the public. It's checking that the software is running on a known/approved machine.
- xkcd1963 4y ago
  This technology could be used outside the company's garden one day. The current employer/employee picture could been seen as a miniature of society, e.g. The great firewall is only used for Chinese citizens and is controlled by the Government of the People's Republic of China. But I probably interpret too far here and it seems that in some industries e.g. secret agencies need to use unconventional methods.