7 ms·

A couple of days ago there was a story on HN about fingerprinting https://news.ycombinator.com/item?id=35243355 https://news.ycombinator.com/item?id=35243355

A couple of days ago there was a story on HN about fingerprinting https://news.ycombinator.com/item?id=35243355 https://news.ycombinator.com/item?id=35243355 The take-away I got from this article is that, companies found a way to uniquely identify you anyhow, without cookies. Is this too little too late?

focusedone 4y ago
Firefox user but relatively ignorant on how tracking works. FF does some good things to work around fingerprinting, although simply using FF puts us in a pretty small (marketable) group in the first place.
- OkayPhysicist 4y ago
  Frankly, Firefox should take the nuclear option, and just start emulating Chrome with regard to website identifiable information. In particular, User-Agent strings are now a net-negative. I've never run into a website that doesn't work on Firefox. I do occasionally run into websites that claim to not work on Firefox. We software developers have shown that we can't be trusted with information pertaining to what browser someone is using, and as such should have the privilege taken away. If you're reading this, and you have access to a codebase that reads User-Agent strings for anything more than idle curiosity, just delete it and push to master.
  - MrJohz 4y ago
    I actually ran into a case for using UA strings yesterday, if you know of a better solution let me know! I have a canvas element where the user needs to be able to both scroll and zoom with the mouse wheel. Generally, zooming involves scrolling while also holding the ctrl button down - except on MacOS, where it's cmd. I obviously want to use the operating system conventions that my users will be expecting, but the best way of determining that, that I've found, is searching for the string 'Mac' in the user agent string. Like I say, if you know of a better way to detect whether I should be binding on ctrl or cmd, let me know! This is the first time I've used the user agent in a long time, and it feels like there should be a better system...
    - talkin 4y ago
      You mention 2 behaviors: With and without a modifier key. So just accept either key for zooming. :)
      - OkayPhysicist 4y ago
        Especially considering it is vanishingly unlikely for a Windows user to inadvertently send you a command key down, or the Mac to send you a ctrl down. It's not like you have behaviors to swap.
      - MrJohz 4y ago
        That's actually a really good idea. I just looked at how a few other sites handle this, and that seems like a common take. I have updated the code!
  - TazeTSchnitzel 4y ago
    UA string sniffing sucks, but if Firefox starts pretending to be Chrome, sites will start using even worse methods to figure out what browser they're dealing with, and it'll be much harder to work around those. Firefox is obviously not Chrome if you actually poke at it a bit… the saving grace of UA string checks is they're easy to fool.
teh_boulder 4y ago
The same article mentions that you can prevent fingerprinting in Firefox with privacy.resistFingerprinting = true https://www.bitestring.com/posts/2023-03-19-web-fingerprinting-is-worse-than-I-thought.html#:~:text=Firefox%20with-,privacy.resistFingerprinting%20%3D%20true,-Firefox%20has%20a https://www.bitestring.com/posts/2023-03-19-web-fingerprinti... But you are right, it's likely that there are other ways other than cookies and fingerprinting that companies can track you.
- jszymborski 4y ago
  Resist is a better word than prevent here. Also, there are some major drawbacks, like your browser setting UTC as the default timezone. That one has caused some mix ups when filling out Doodles.
  - clairity 4y ago
    this one really annoys me because proton mail uses the "spoofed" utc timezone to show when i sent/received emails, as if i live in the uk or west africa. they also refuse to add timezone as an app setting to correct this issue.
- red_trumpet 4y ago
  > t's likely that there are other ways other than cookies and fingerprinting that companies can track you. Any idea how they would do that?
  - mishu2 4y ago
    Using something like this, which I would personally make illegal: https://fingerprint.com/ https://fingerprint.com/ I also tried setting privacy.resistFingerprinting = true in Firefox, but it's sad to see that most websites become unusable (most sites using canvas just render a green/purple mess), zooming in Google Maps is basically broken (skips several levels at a time), and like others have mentioned dark mode and time zones also stop working. What a mess the (somewhat private) web is nowadays. The more I think about it, the more I am convinced legislating privacy is the only way out of this arms race we seem to be losing. EDIT: Sorry, the parent post already included fingerprinting, missed that. Rant still stands though :)
Riverheart 4y ago
Yes. Cookieless tracking is a thing.
brutusurp 4y ago
Brave has had this "new feature" as a default setting (i.e., block cross-site cookies). Glad Firefox has finally implemented a basic privacy feature such as this, though like you mention perhaps it's a little late. As far as fingerprinting issue, Brave again does a better job than most, again as a default: "If you need to use Chromium, then Brave browser is a good choice. It also randomizes fingerprint for each session, making it harder to link your browsing sessions."[1] [1]https://www.bitestring.com/posts/2023-03-19-web-fingerprinting-is-worse-than-I-thought.html https://www.bitestring.com/posts/2023-03-19-web-fingerprinti... Makes me wonder how much of this is real improvement vs. publicity.

focusedone 4y ago

Firefox user but relatively ignorant on how tracking works. FF does some good things to work around fingerprinting, although simply using FF puts us in a pretty small (marketable) group in the first place.

OkayPhysicist 4y ago
Frankly, Firefox should take the nuclear option, and just start emulating Chrome with regard to website identifiable information. In particular, User-Agent strings are now a net-negative. I've never run into a website that doesn't work on Firefox. I do occasionally run into websites that claim to not work on Firefox. We software developers have shown that we can't be trusted with information pertaining to what browser someone is using, and as such should have the privilege taken away. If you're reading this, and you have access to a codebase that reads User-Agent strings for anything more than idle curiosity, just delete it and push to master.
- MrJohz 4y ago
  I actually ran into a case for using UA strings yesterday, if you know of a better solution let me know! I have a canvas element where the user needs to be able to both scroll and zoom with the mouse wheel. Generally, zooming involves scrolling while also holding the ctrl button down - except on MacOS, where it's cmd. I obviously want to use the operating system conventions that my users will be expecting, but the best way of determining that, that I've found, is searching for the string 'Mac' in the user agent string. Like I say, if you know of a better way to detect whether I should be binding on ctrl or cmd, let me know! This is the first time I've used the user agent in a long time, and it feels like there should be a better system...
  - talkin 4y ago
    You mention 2 behaviors: With and without a modifier key. So just accept either key for zooming. :)
    - OkayPhysicist 4y ago
      Especially considering it is vanishingly unlikely for a Windows user to inadvertently send you a command key down, or the Mac to send you a ctrl down. It's not like you have behaviors to swap.
    - MrJohz 4y ago
      That's actually a really good idea. I just looked at how a few other sites handle this, and that seems like a common take. I have updated the code!
- TazeTSchnitzel 4y ago
  UA string sniffing sucks, but if Firefox starts pretending to be Chrome, sites will start using even worse methods to figure out what browser they're dealing with, and it'll be much harder to work around those. Firefox is obviously not Chrome if you actually poke at it a bit… the saving grace of UA string checks is they're easy to fool.

teh_boulder 4y ago

The same article mentions that you can prevent fingerprinting in Firefox with privacy.resistFingerprinting = true https://www.bitestring.com/posts/2023-03-19-web-fingerprinting-is-worse-than-I-thought.html#:~:text=Firefox%20with-,privacy.resistFingerprinting%20%3D%20true,-Firefox%20has%20a https://www.bitestring.com/posts/2023-03-19-web-fingerprinti... But you are right, it's likely that there are other ways other than cookies and fingerprinting that companies can track you.

jszymborski 4y ago
Resist is a better word than prevent here. Also, there are some major drawbacks, like your browser setting UTC as the default timezone. That one has caused some mix ups when filling out Doodles.
- clairity 4y ago
  this one really annoys me because proton mail uses the "spoofed" utc timezone to show when i sent/received emails, as if i live in the uk or west africa. they also refuse to add timezone as an app setting to correct this issue.
red_trumpet 4y ago
> t's likely that there are other ways other than cookies and fingerprinting that companies can track you. Any idea how they would do that?
- mishu2 4y ago
  Using something like this, which I would personally make illegal: https://fingerprint.com/ https://fingerprint.com/ I also tried setting privacy.resistFingerprinting = true in Firefox, but it's sad to see that most websites become unusable (most sites using canvas just render a green/purple mess), zooming in Google Maps is basically broken (skips several levels at a time), and like others have mentioned dark mode and time zones also stop working. What a mess the (somewhat private) web is nowadays. The more I think about it, the more I am convinced legislating privacy is the only way out of this arms race we seem to be losing. EDIT: Sorry, the parent post already included fingerprinting, missed that. Rant still stands though :)

Riverheart 4y ago

Yes. Cookieless tracking is a thing.

brutusurp 4y ago

Brave has had this "new feature" as a default setting (i.e., block cross-site cookies). Glad Firefox has finally implemented a basic privacy feature such as this, though like you mention perhaps it's a little late. As far as fingerprinting issue, Brave again does a better job than most, again as a default: "If you need to use Chromium, then Brave browser is a good choice. It also randomizes fingerprint for each session, making it harder to link your browsing sessions."[1] [1]https://www.bitestring.com/posts/2023-03-19-web-fingerprinting-is-worse-than-I-thought.html https://www.bitestring.com/posts/2023-03-19-web-fingerprinti... Makes me wonder how much of this is real improvement vs. publicity.