3 ms·
I meant you are confusing whether such scripts can be blocked and whether it would be effective to do so. That it can not be blocked would require some fundamen
by danbruc 4y ago
I meant you are confusing whether such scripts can be blocked and whether it would be effective to do so. That it can not be blocked would require some fundamental or practical obstruction like having to solve the halting problem or whatnot. You said that it can not be blocked because the act of blocking itself makes you identifiable which defeats the purpose, but that is not true, or only true if only you or a few people are blocking the fingerprinting. When enough people block it, then the act of blocking does not make you identifiable or at least to a much smaller extend than not blocking the scripts.
In principle you could build a browser that - to a good approximation, you will, for example, realistically not be able to prevent timing leaks - does not leak any information about the system it is running on, just isolate it from the host system. With more effort you could let details about the host system leak into the browser but not out into the network. Well, some information has to flow from the host system into the browser and out over the network, for example key strokes and mouse movements, otherwise you could not do much with this browser.
So you could still try to fingerprint users by their choice of words, typing patterns and things like that, maybe made a bit harder by filtering out high frequency timing information. But at least one could no longer simply fingerprint the host system. Which would again be a trade-off, your screen resolution is not only good for a few bits of a fingerprint but can also be legitimately used to serve content at a proper resolution.
- than3 4y agoThe practical obstruction is if you block the browser API access, they test for it, and then block you so you can't view their site, and they do that by using the information that you leaked. As for the effectiveness of blocking what they are doing, you can block them by giving them bogus but plausible data. There's a range of accepted values for those interfaces. If its within that range, they can't tell the difference, but their entire assumption is its determinate, when it can never be determinate because a hash is a finite field. Their assumption is based on applied probability which has validity issues in an adversarial environment. Neither requires solving the halting problem.