5 ms·

> allowing those [third party] cookies to fulfill their less invasive use cases (e.g. to provide accurate analytics Separate cookie jars don't prevent data bro

> allowing those [third party] cookies to fulfill their less invasive use cases (e.g. to provide accurate analytics Separate cookie jars don't prevent data brokers from correlating cookies from a common IP + user agent pair. The only solution is to block third parties altogether.

seizethegdgap 4y ago
Obviously doesn't help when using an app, but what about an extension that changes your user agent every single time you send a request to a website? Does such an extension even work, or exist?
- Nextgrid 4y ago
  Even if it did, it will be useless because fingerprinting (of various kinds - whether TCP or TLS stack, doesn't even have to be JS-based) will still tell which browser you're running on. Worse, it may actually make you more identifiable because a Chrome on Linux user agent with the TCP fingerprint of Windows and TLS fingerprint of Firefox is going to stick out like a sore thumb, even more than a rare-but-at-least-consistent fingerprint with no trickery.
  - jhoechtl 4y ago
    What if I browse using tor?
  - benmmurphy 4y ago
    I'm not sure TCP fingerprints are very reliable because a lot of ISPs and Mobile Carriers are doing proxying at the application level for HTTP/HTTPS ports so even if you are on an iPhone you might end up having a linux TCP fingerprint. This site allows you test your TCP fingerprint: http://witch.valdikss.org.ru http://witch.valdikss.org.ru
the_pwner224 4y ago
The long term workaround for data brokers is to become a first party... have the main website serve your 3rd party JS from their own server under their own domain. That makes it much harder to block. For your IP+UA hypothetical, the easy fix is to make everyone look the same. IP should be the only personally identifiable factor. Tor and desktop Firefox w/ privacy.resistFingerprinting turned on both do this. Open window not-maximized at 1000x1000 size, use the same UA regardless of what platform & browser version you're actually on, and a bunch of other stuff. That said, I don't know how effective it actually is against modern comprehensive fingerprinting libraries.
OkayPhysicist 4y ago
User-Agent strings are now net-negative in the web world. Their uses are slim, and their abuses are plentiful. They should probably be removed altogether, but in the meantime non-Chrome browsers should universally adopt Chrome's UA.
- MrRadar 4y ago
  User-Agent strings are still useful for identifying non-browser user agents but I agree that given the privacy issues they present all browsers should adopt a single standard UA string (one each for desktop and mobile). (Did you know that Chrome on Android puts your device model in the UA string? One of the many reasons to use Firefox for Android...)

seizethegdgap 4y ago

Obviously doesn't help when using an app, but what about an extension that changes your user agent every single time you send a request to a website? Does such an extension even work, or exist?

Nextgrid 4y ago
Even if it did, it will be useless because fingerprinting (of various kinds - whether TCP or TLS stack, doesn't even have to be JS-based) will still tell which browser you're running on. Worse, it may actually make you more identifiable because a Chrome on Linux user agent with the TCP fingerprint of Windows and TLS fingerprint of Firefox is going to stick out like a sore thumb, even more than a rare-but-at-least-consistent fingerprint with no trickery.
- jhoechtl 4y ago
  What if I browse using tor?
- benmmurphy 4y ago
  I'm not sure TCP fingerprints are very reliable because a lot of ISPs and Mobile Carriers are doing proxying at the application level for HTTP/HTTPS ports so even if you are on an iPhone you might end up having a linux TCP fingerprint. This site allows you test your TCP fingerprint: http://witch.valdikss.org.ru http://witch.valdikss.org.ru

the_pwner224 4y ago

The long term workaround for data brokers is to become a first party... have the main website serve your 3rd party JS from their own server under their own domain. That makes it much harder to block. For your IP+UA hypothetical, the easy fix is to make everyone look the same. IP should be the only personally identifiable factor. Tor and desktop Firefox w/ privacy.resistFingerprinting turned on both do this. Open window not-maximized at 1000x1000 size, use the same UA regardless of what platform & browser version you're actually on, and a bunch of other stuff. That said, I don't know how effective it actually is against modern comprehensive fingerprinting libraries.

OkayPhysicist 4y ago

User-Agent strings are now net-negative in the web world. Their uses are slim, and their abuses are plentiful. They should probably be removed altogether, but in the meantime non-Chrome browsers should universally adopt Chrome's UA.

MrRadar 4y ago
User-Agent strings are still useful for identifying non-browser user agents but I agree that given the privacy issues they present all browsers should adopt a single standard UA string (one each for desktop and mobile). (Did you know that Chrome on Android puts your device model in the UA string? One of the many reasons to use Firefox for Android...)