4 ms·

Ha! I followed the instructions and went to fingerprint.com and it all 'crashed' because I had JavaScript turned off—that's my normal default setting. I have

Ha! I followed the instructions and went to fingerprint.com and it all 'crashed' because I had JavaScript turned off—that's my normal default setting. I have five different browsers on my smartphone and three on the PC all sans JS and none of them are Chrome. Also, normal operation is to automatically delete all cookies at session's end. My smartphone and PCs are de-googleized and firewalled and I never see ads in my browsers nor in apps. The apps are mainly from F-Droid and sans ads and the few Playstore ones I use are via Aurora Store and are firewalled from the internet when in use. Honestly, I cannot remember when I last saw an app display an ad, it has to be years back. In the past I used to go to more extensive measures to stop the spying but I found it was unnecessary as the spy leakage was essentially negligible with much less stringent efforts. It's pretty easy to render one's online personal data essentially wothlesss if one wants to. On the other hand if you insist on using JS, Gmail, Google search, Facebook etc. then you're fair game and you only have yourself to blame if your personal data is stolen.

comboy 4y ago
The more you customize the more unique your session becomes.
- kuschku 4y ago
  Not if you disable JS, cause the website then can't see any of these customizations.
  - Dah00n 4y ago
    You are easily tracked without JS. It is much easier than tracking a default settings browser.
    - d-z-m 4y ago
      > It is much easier than tracking a default settings browser. Not true. Especially if you mean a default browser with Canvas/WebRTC APIs enabled. It is much more difficult for fingerprinting companies to get a high entropy fingerprint from a no-JS user.
    - anthk 4y ago
      Good luck with Lynx/Dillo with a fake UA.
  - sour-taste 4y ago
    Having JS off probably puts you in the < .1% of users bucket. Unless you additionally are: * Routinely moving between IPs * Modifying your headers to avoid giving away info (user agent, etc) * Defeating all the other non-JS things that fingerprinters probably look for then you are not safe by just turning off JS.
    - account42 4y ago
      Being in a 0.1% bucket is only ~10 bits of information - much less than what can be gathered with JS on. And of course its not enough, but the situation is even more hopeless with JS on.
  - zamnos 4y ago
    Except that disabling JavaScript is an anomaly all on its own. The dozens of users running without JavaScript might not be individually fingerprint able but it's still a small enough cohort that I don't know how much I'd lean on that. Figure in the user agent string and it's probably unique enough a subgroup to sell ads to.
    - giancarlostoro 4y ago
      > Figure in the user agent string and it's probably unique enough a subgroup to sell ads to. But if you never see ads how do you sell ads to them and how do you meaningfully discover enough about the person to feed them valuable ads?
    - zagrebian 4y ago
      > it's probably unique enough a subgroup to sell ads to I have been browsing with JavaScript disabled by default for the past 6 months. Based on my experience, no-JavaScript ads are rarer than four-leaf clover.
    - Throwaway62884 4y ago
      More common than you think https://amiunique.org/fpnojs https://amiunique.org/fpnojs
      - nerdponx 4y ago
        Probably not a representative sample though.
    - bawolff 4y ago
      Also that cuts down the group so much, i imagine other things that are usually too coarse grained to be useful suddenly become much more useful. E.g. geoip location or accept-language headers.
    - GoblinSlayer 4y ago
      But ads don't work without javascript.
  - withinboredom 4y ago
    It’s fun to put Easter eggs for people like you. https://once.getswytch.com https://once.getswytch.com
    - chrismorgan 4y ago
      I have no idea what you’re talking about. That URL only tries to load one piece of JavaScript, htmx, and all it does is unbreak the mobile navigation. (Aside: this mobile navigation is, incidentally, the worst implementation I have ever encountered: instead of twiddling some classes or such, which would happen instantly, it makes an HTTP request that responds with the new navbar. For me, this means at least half a second’s latency on clicking the button, more if time has passed so that the HTTP connection is no longer open (1.5–2 seconds). It also fails the no-JS test, as the unintercepted form-submit just serves the page with the closed mobile navbar again, not switching out the navbar as I expected it might, and which would have been enough to avoid an unconditional “worst implementation” award. Sorry if you made this and it hurts your feelings, but… ugh, this is just a baffling misapplication of hx-post and naive Tailwind use, and just unconditionally a bad approach.) Edit: better link which shows what I suppose you probably meant: https://once.getswytch.com/app https://once.getswytch.com/app
      - withinboredom 4y ago
        Haha. Yeah, it is pretty terrible and I made it. It’s mostly a tech demo, so the things it does are intentionally weird/strange.
  - reaperducer 4y ago
    Not if you disable JS, cause the website then can't see any of these customizations. That's adorable. I guess you're not old enough to remember when we used to track people with things like invisible pixels. Or todays equivalent: testing CSS parameters. Neither require JavaScript, and there are a hundred other non-JavaScript methods.
    - psychlops 4y ago
      Hah! I used to embed invisible pixels for our marketing department decades ago.
      - dylan604 4y ago
        This should automatically qualify one to lose their internet privileges. Not just the fact that you did it, but your cavalier attitude towards it with the lack of regret for having done it
        psychlops 4y ago
        I actually agree with you. However, I plead that it was novel at the time, used ineffectively by a tiny marketing department, and not anywhere near this spy level capacity achieved today.
    - kuschku 4y ago
      With that method, you won't be able to distinguish between the many different devices using the same browser at same resolution behind one IP. In the era of CGNAT that means you now only know which city I'm from and whether I use Chrome or Firefox. People mostly use browsers in maximized and resolutions are relatively standardized nowadays. Compared to the data you get from canvas and webgl, that's much less unique.
smirgel 4y ago
To me this seems extremely elitist. Non-technical people deserve to have their personal data stolen because they don't know about javascript for example?
- RalfWausE 4y ago
  I run a similar setup as the OP when browsing the modern web, but i think it is in a way our responsibility as professionals to help the less tech inclined to navigate the sea of monsters the modern web has become. For example: I have set up the systems of family members for whom i am some sort of digital janitor with a nice collection of firefox plugins to get rid of the worst offenders.
- orbisvicis 4y ago
  Technical defenses are never perfect. In a sense they provide security through obscurity, as evinced by the comments above regarding Stallman's use of wget. If everyone applied technical defenses equally then workarounds would quickly be found, and everyone would be equally vulnerable. So privacy is a scale, and being in the minority provides its own defense. If in aggregate each individual is equally valuable, then the value of breaching a minority's technical defenses is some inverse multiplier of the minority's size. Personally my threat model is to put in just enough work to never be the juiciest target.
- favaq 4y ago
  Yeah? If they don't know how to operate a computer then they shouldn't be operating one. The same I would feel if someone without a licence crashed their car.
  - dsQTbR7Y5mRHnZv 4y ago
    Using the web while being unfamiliar with Javascript is not analogous to driving without a license. It's closer to driving without being a mechanic.
    - dylan604 4y ago
psacawa 4y ago
Before you get all jubilant, note that they have fingerprinting techniques which don't use JS[0]. It was able to identity me. Contrary to popular opinion, disabling JS doesn't protect you from fingerprinting. They describe their approach[1]. They use HTTP headers and conditional request triggered by CSS conditional media queries to gather data. Something like @media(...) {background: url(/tracking/$clientid)}. But in principle, they could also try and fingerprint the TCP/IP stack or the TLS implementation. I'm not sure it would get them more data than OS+Browser, though. [0] https://noscriptfingerprint.com/ https://noscriptfingerprint.com/ [1] https://fingerprint.com/blog/disabling-javascript-wont-stop-fingerprinting/ https://fingerprint.com/blog/disabling-javascript-wont-stop-...
- worg 4y ago
  FF mobile gives be different IDs each time I run a new private session on both the JS an non-js demos (I run w/o JS usually AND have enabled the resistFingerprint setting)
- labcomputer 4y ago
  It’s one thing to generate the same hash for the same client, but it would be interesting to know how often the hashes collide, too. I also notice that the no-JS hash changes when I move the window to a different monitor.
- hilbert42 4y ago
  "Before you get all jubilant, note that they have fingerprinting techniques which don't use JS[0]. It was able to identity me." I didn't detail every protection I've put in place or the post would have been too long. However, I'd suggest that spreading my browsing over at least eight browsers (and I actually use more than two machines and do so at different locations and with different ISPs) effectively reduces my profile across the net. I also use randomized browser user agents and clean links, occasionally I'll even cut-and-paste links between multiple browsers in a single session. I often do this on HN not to hide from HN but for convenience when multitasking. (Having worked in surveillance professionally, this modus operandi just comes naturally, it's now second nature for me to work this way.) Working with multiple browsers and multiple machines also solves the problem when on rare occasions I have to use JS. That said, I never watch YouTube with a JS-enabled browser, instead I'll use NewPipe or similar. There are other measures I could list but you get the idea. Oh, and I never use the internet on a smartphone with a SIM enabled, instead the SIM resides in a separate portable router and my 'real' phone is a dumb feature phone, it's only capable of making phone calls. I really don't care if some stuff leaks but I've satisfied myself it's pretty trivial, as frankly, I've not had one indication over the past 20 or so years that I've been targeted as a result of fingerprinting. It's not necessary to make things completely watertight, I'm not trying to hide from the NSA or GCHQ, etc. (and it'd be unsuccessful and a complete waste of time to bother trying). Moreover, even if something were to leak, I'm simply not a revenue-making target—that means I never respond to any targeted marketing because I simply never receive any.

comboy 4y ago

The more you customize the more unique your session becomes.

kuschku 4y ago
Not if you disable JS, cause the website then can't see any of these customizations.
- Dah00n 4y ago
  You are easily tracked without JS. It is much easier than tracking a default settings browser.
  - d-z-m 4y ago
    > It is much easier than tracking a default settings browser. Not true. Especially if you mean a default browser with Canvas/WebRTC APIs enabled. It is much more difficult for fingerprinting companies to get a high entropy fingerprint from a no-JS user.
  - anthk 4y ago
    Good luck with Lynx/Dillo with a fake UA.
- sour-taste 4y ago
  Having JS off probably puts you in the < .1% of users bucket. Unless you additionally are: * Routinely moving between IPs * Modifying your headers to avoid giving away info (user agent, etc) * Defeating all the other non-JS things that fingerprinters probably look for then you are not safe by just turning off JS.
  - account42 4y ago
    Being in a 0.1% bucket is only ~10 bits of information - much less than what can be gathered with JS on. And of course its not enough, but the situation is even more hopeless with JS on.
- zamnos 4y ago
  Except that disabling JavaScript is an anomaly all on its own. The dozens of users running without JavaScript might not be individually fingerprint able but it's still a small enough cohort that I don't know how much I'd lean on that. Figure in the user agent string and it's probably unique enough a subgroup to sell ads to.
  - giancarlostoro 4y ago
    > Figure in the user agent string and it's probably unique enough a subgroup to sell ads to. But if you never see ads how do you sell ads to them and how do you meaningfully discover enough about the person to feed them valuable ads?
  - zagrebian 4y ago
    > it's probably unique enough a subgroup to sell ads to I have been browsing with JavaScript disabled by default for the past 6 months. Based on my experience, no-JavaScript ads are rarer than four-leaf clover.
  - Throwaway62884 4y ago
    More common than you think https://amiunique.org/fpnojs https://amiunique.org/fpnojs
    - nerdponx 4y ago
      Probably not a representative sample though.
  - bawolff 4y ago
    Also that cuts down the group so much, i imagine other things that are usually too coarse grained to be useful suddenly become much more useful. E.g. geoip location or accept-language headers.
  - GoblinSlayer 4y ago
    But ads don't work without javascript.
- withinboredom 4y ago
  It’s fun to put Easter eggs for people like you. https://once.getswytch.com https://once.getswytch.com
  - chrismorgan 4y ago
    I have no idea what you’re talking about. That URL only tries to load one piece of JavaScript, htmx, and all it does is unbreak the mobile navigation. (Aside: this mobile navigation is, incidentally, the worst implementation I have ever encountered: instead of twiddling some classes or such, which would happen instantly, it makes an HTTP request that responds with the new navbar. For me, this means at least half a second’s latency on clicking the button, more if time has passed so that the HTTP connection is no longer open (1.5–2 seconds). It also fails the no-JS test, as the unintercepted form-submit just serves the page with the closed mobile navbar again, not switching out the navbar as I expected it might, and which would have been enough to avoid an unconditional “worst implementation” award. Sorry if you made this and it hurts your feelings, but… ugh, this is just a baffling misapplication of hx-post and naive Tailwind use, and just unconditionally a bad approach.) Edit: better link which shows what I suppose you probably meant: https://once.getswytch.com/app https://once.getswytch.com/app
    - withinboredom 4y ago
      Haha. Yeah, it is pretty terrible and I made it. It’s mostly a tech demo, so the things it does are intentionally weird/strange.
- reaperducer 4y ago
  Not if you disable JS, cause the website then can't see any of these customizations. That's adorable. I guess you're not old enough to remember when we used to track people with things like invisible pixels. Or todays equivalent: testing CSS parameters. Neither require JavaScript, and there are a hundred other non-JavaScript methods.
  - psychlops 4y ago
    Hah! I used to embed invisible pixels for our marketing department decades ago.
    - dylan604 4y ago
      This should automatically qualify one to lose their internet privileges. Not just the fact that you did it, but your cavalier attitude towards it with the lack of regret for having done it
      - psychlops 4y ago
        I actually agree with you. However, I plead that it was novel at the time, used ineffectively by a tiny marketing department, and not anywhere near this spy level capacity achieved today.
  - kuschku 4y ago
    With that method, you won't be able to distinguish between the many different devices using the same browser at same resolution behind one IP. In the era of CGNAT that means you now only know which city I'm from and whether I use Chrome or Firefox. People mostly use browsers in maximized and resolutions are relatively standardized nowadays. Compared to the data you get from canvas and webgl, that's much less unique.

smirgel 4y ago

To me this seems extremely elitist. Non-technical people deserve to have their personal data stolen because they don't know about javascript for example?

RalfWausE 4y ago
I run a similar setup as the OP when browsing the modern web, but i think it is in a way our responsibility as professionals to help the less tech inclined to navigate the sea of monsters the modern web has become. For example: I have set up the systems of family members for whom i am some sort of digital janitor with a nice collection of firefox plugins to get rid of the worst offenders.
orbisvicis 4y ago
Technical defenses are never perfect. In a sense they provide security through obscurity, as evinced by the comments above regarding Stallman's use of wget. If everyone applied technical defenses equally then workarounds would quickly be found, and everyone would be equally vulnerable. So privacy is a scale, and being in the minority provides its own defense. If in aggregate each individual is equally valuable, then the value of breaching a minority's technical defenses is some inverse multiplier of the minority's size. Personally my threat model is to put in just enough work to never be the juiciest target.
favaq 4y ago
Yeah? If they don't know how to operate a computer then they shouldn't be operating one. The same I would feel if someone without a licence crashed their car.
- dsQTbR7Y5mRHnZv 4y ago
  Using the web while being unfamiliar with Javascript is not analogous to driving without a license. It's closer to driving without being a mechanic.
  - dylan604 4y ago

psacawa 4y ago

Before you get all jubilant, note that they have fingerprinting techniques which don't use JS[0]. It was able to identity me. Contrary to popular opinion, disabling JS doesn't protect you from fingerprinting. They describe their approach[1]. They use HTTP headers and conditional request triggered by CSS conditional media queries to gather data. Something like @media(...) {background: url(/tracking/$clientid)}. But in principle, they could also try and fingerprint the TCP/IP stack or the TLS implementation. I'm not sure it would get them more data than OS+Browser, though. [0] https://noscriptfingerprint.com/ https://noscriptfingerprint.com/ [1] https://fingerprint.com/blog/disabling-javascript-wont-stop-fingerprinting/ https://fingerprint.com/blog/disabling-javascript-wont-stop-...

worg 4y ago
FF mobile gives be different IDs each time I run a new private session on both the JS an non-js demos (I run w/o JS usually AND have enabled the resistFingerprint setting)
labcomputer 4y ago
It’s one thing to generate the same hash for the same client, but it would be interesting to know how often the hashes collide, too. I also notice that the no-JS hash changes when I move the window to a different monitor.
hilbert42 4y ago
"Before you get all jubilant, note that they have fingerprinting techniques which don't use JS[0]. It was able to identity me." I didn't detail every protection I've put in place or the post would have been too long. However, I'd suggest that spreading my browsing over at least eight browsers (and I actually use more than two machines and do so at different locations and with different ISPs) effectively reduces my profile across the net. I also use randomized browser user agents and clean links, occasionally I'll even cut-and-paste links between multiple browsers in a single session. I often do this on HN not to hide from HN but for convenience when multitasking. (Having worked in surveillance professionally, this modus operandi just comes naturally, it's now second nature for me to work this way.) Working with multiple browsers and multiple machines also solves the problem when on rare occasions I have to use JS. That said, I never watch YouTube with a JS-enabled browser, instead I'll use NewPipe or similar. There are other measures I could list but you get the idea. Oh, and I never use the internet on a smartphone with a SIM enabled, instead the SIM resides in a separate portable router and my 'real' phone is a dumb feature phone, it's only capable of making phone calls. I really don't care if some stuff leaks but I've satisfied myself it's pretty trivial, as frankly, I've not had one indication over the past 20 or so years that I've been targeted as a result of fingerprinting. It's not necessary to make things completely watertight, I'm not trying to hide from the NSA or GCHQ, etc. (and it'd be unsuccessful and a complete waste of time to bother trying). Moreover, even if something were to leak, I'm simply not a revenue-making target—that means I never respond to any targeted marketing because I simply never receive any.