3 ms·

The short answer is no you can't block it because that identifies to the site owner that you are blocking it (as a negative match). You'd have to mask every in

• danbruc 4y ago
  This is confusing whether it can be blocked and whether it would be effective. Every time you do something unique, you of course become identifiable. But the idea is of course that you are not the only one blocking these scripts which will only make the entire group identifiable. You could for example try to block those scripts with a widely used ad blocker which would make you not stand out any more than any user of that specific ad blocker. It would probably not be too effective as URIs and file hashes or whatever ad blockers use are relatively easy to change, but in principle you do not have to become uniquely identifiable by blocking fingerprinting scripts if enough people are doing so.
  • than3 4y ago
    > This is confusing whether it can be blocked and whether it would be effective. It shouldn't be confusing because its really fairly simple. The gist is this... so long as determinism as a systems property holds true in a system, you can leak information by the absence of something when compared to another expected thing. This is how inference works in many respects, you have properties and you can deduce or infer from whether those are present additional information that is not necessarily given. Most gifted problem solvers probably couldn't tell you that is what they are doing because its unconscious often a result of years of observation. Computers fundamentally require certain system properties such as determinism to do work in the first place, and you can inject non-determinism into those processes in ways that won't break underlying subsystems as long as its within an expected range and that can make it indeterminate. An indeterminate fingerprint is useless. In the case of outright blocking the code from running, you leak information that you are blocking it by preventing it from running since they expect a range of values back and a null (the response when nothing gets sent back) is itself a value (or state if you want to be technical). The site then only has to test for this semi-unique case (i.e a null represents a single group of people who are blocking it) and then prevent the site from responding to you. They are the gatekeepers because they control their infrastructure. Incidentally this is how almost all the Are you human tests work. It collects an intrusive fingerprint, and if its within a range that corresponds to a known user spectrum of values then it allows you to continue to the site. This is a rough boiled down explanation, it can get quite a bit more abstract and technical when talking about whether determinism is present (i.e. how do you test for it). Ultimately, if you can understand determinism, you fundamentally understand the limits of computation and how computers work at a barebones level. It also gives you the ability to find whether certain types of problems are impossible (and thus you don't waste your time on them, or unproductive avenues).
    • danbruc 4y ago
      I meant you are confusing whether such scripts can be blocked and whether it would be effective to do so. That it can not be blocked would require some fundamental or practical obstruction like having to solve the halting problem or whatnot. You said that it can not be blocked because the act of blocking itself makes you identifiable which defeats the purpose, but that is not true, or only true if only you or a few people are blocking the fingerprinting. When enough people block it, then the act of blocking does not make you identifiable or at least to a much smaller extend than not blocking the scripts. In principle you could build a browser that - to a good approximation, you will, for example, realistically not be able to prevent timing leaks - does not leak any information about the system it is running on, just isolate it from the host system. With more effort you could let details about the host system leak into the browser but not out into the network. Well, some information has to flow from the host system into the browser and out over the network, for example key strokes and mouse movements, otherwise you could not do much with this browser. So you could still try to fingerprint users by their choice of words, typing patterns and things like that, maybe made a bit harder by filtering out high frequency timing information. But at least one could no longer simply fingerprint the host system. Which would again be a trade-off, your screen resolution is not only good for a few bits of a fingerprint but can also be legitimately used to serve content at a proper resolution.
      • than3 4y ago
        The practical obstruction is if you block the browser API access, they test for it, and then block you so you can't view their site, and they do that by using the information that you leaked. As for the effectiveness of blocking what they are doing, you can block them by giving them bogus but plausible data. There's a range of accepted values for those interfaces. If its within that range, they can't tell the difference, but their entire assumption is its determinate, when it can never be determinate because a hash is a finite field. Their assumption is based on applied probability which has validity issues in an adversarial environment. Neither requires solving the halting problem.