5 ms·
The solution is to put unncesessary features like WebGL, programmatic Audio API, reading bits from canvas and WebRTC behind a permission.
by codedokode 4y ago
The solution is to put unncesessary features like WebGL, programmatic Audio API, reading bits from canvas and WebRTC behind a permission.
- azangru 4y agoWho decides what's unnecessary?
- codedokode 4y agoEverything that can be used for fingerprinting should be behind a permission. Almost all sites I use (like Google, Hacker News or Youtube) need none of those technologies.
- mastax 4y agoSo CSS should be behind a permission?
- codedokode 4y agoCSS should not leak fingerprinting information. After all this is just a set of rules to lay out blocks on the page.
- remexre 4y agohttps://css-tricks.com/css-based-fingerprinting/ https://css-tricks.com/css-based-fingerprinting/
- yamtaddle 4y agoMain thing that ought to be behind a permission is letting Javascript initiate connections or modify anything that might be sent in a request. Should be possible, but ought to require asking first. If the data can't be exfiltrated, who cares if they can fingerprint? Letting JS communicate with servers without the user's explicit consent was the original sin of web dev, that ruined everything. Turned it from a user-controlled experience to one giant spyware service.
- johntb86 4y agoIf javascript can modify the set of URLs the page can access (e.g. put an image tag on the page or tweak what images need to be downloaded using CSS) then it can signal information to the server. Without those basic capabilities, what's the point of using javascript?