9 ms·

Ask HN: Refusing all cookies, still targeted by ads. How?

81 points by 2rsf 3y ago

On a blank new work computer using Chrome but not logged in, I refuse all cookies but still see myself being tracked, for example by ads targeted to my surf history. I could think of sophisticated methods, but maybe the simple answer is that refusing cookies doesn't actually do anything?

htrp 3y ago
fingerprintjs has about a dozen separate techniques https://github.com/fingerprintjs/fingerprintjs https://github.com/fingerprintjs/fingerprintjs
Sundeepsharma01 3y ago
Refusing all cookies alone may not completely prevent you from being targeted by ads. While cookies play a significant role in tracking user behavior and serving targeted ads, there are other methods that advertisers and platforms can use to target users. Here are a few reasons why you might still see targeted ads even if you refuse all cookies: 1. Device Fingerprinting: Advertisers can use techniques such as device fingerprinting to gather information about your device, browser settings, operating system, and other characteristics. This information can be used to create a unique identifier for your device, allowing advertisers to target you with ads based on your device's attributes rather than relying on cookies. 2. IP Address Tracking: Your IP address is a unique identifier assigned to your device when connected to the internet. Advertisers can use your IP address to approximate your location and deliver ads based on your geographic location. 3. Behavioral Tracking: While cookies are commonly used for behavioral tracking, advertisers can also use other methods like pixel tags, web beacons, and JavaScript code to track your online activities across websites. These techniques allow advertisers to monitor your browsing behavior and serve targeted ads based on your interests and preferences. 4. Contextual Targeting: Advertisers may rely on contextual targeting, which involves analyzing the content of the web pages you visit or keywords used in search queries to determine relevant ads to display. This approach doesn't necessarily rely on cookies or personal data but focuses on the context of the content you engage with. 5. Data from Third-Party Sources: Advertisers may obtain data from third-party sources such as data brokers, social media platforms, or other online services. These data sources can provide information about your interests, demographics, or browsing history, enabling advertisers to target you with personalized ads even if you refuse cookies. It's important to note that different platforms and advertising networks have varying approaches to ad targeting and user tracking. While refusing cookies can reduce the effectiveness of certain tracking methods, it may not completely eliminate all targeted advertising. To enhance your privacy and reduce targeted ads, you can consider additional measures such as using browser extensions or privacy-focused browsers, enabling ad blockers, adjusting privacy settings on your devices and online accounts, and being cautious about the information you share online.
leephillips 3y ago
There are plenty of ways to fingerprint you aside from cookies, as you’ve probably surmised (“sophisticated methods”).
- bombcar 3y ago
  Such as your IP address hehehe. Super sophisticated. Most IPs don’t change that much. Browse on Tor if you really want to avoid tracking.
  - activiation 3y ago
    With Comcast, I can change my IP address on-demand by spoofing my router's MAC address.
  - digging 3y ago
    This is one reason I use a VPN for almost all my personal browsing. That and I don't want spectrum to see where I'm going, because they will sell it. Like, I know a VPN isn't super-spy stealth tech, but it handles a couple basics pretty well and I end up hitting sites from a very generic IP.
whywhywhywhy 3y ago
I've noticed Google now syphons data from my searches to feed my youtube recommendations, always felt like two separate systems until about a month ago.
- sp332 3y ago
  I was wondering about that, but I wasn't sure it was new. Are you using YouTube Premium?
  - whywhywhywhy 3y ago
    Nah just a google account I only use for YouTube but don’t log out of. No email or maps usage only google search and heavy YT subscription and watch data. Seeing things I search for on google, like very unrelated to normal YT viewing like specific tech queries show on YT.
brucethemoose2 3y ago
You need tracker blocking extensions, and/or a "degoogled" version of Chrome like Thorium or Brave. My usual loadout is Thorium + the EFF's Privacy Badger extension, and sometimes UBO.
- awinter-py 3y ago
  can you say why degoogled chromium matters for tracking, or link to a writeup?
  - brucethemoose2 3y ago
    The Ungoogled Chromium project itself is a pretty good summary. In a nutshell, Chromium (whether signed in or not) "phones home" to Google for a number of reasons, and the official Chrome builds do it even more (though in harder to observe ways since the changes are closed source). https://github.com/ungoogled-software/ungoogled-chromium https://github.com/ungoogled-software/ungoogled-chromium
    - awinter-py 3y ago
      whoa fascinating -- I tried ungoogled chromium a while ago and it has come a long way it looks like some of their patches are now built into debian? Like on this list: https://udd.debian.org/patches.cgi?src=chromium&version=114.0.5735.133-1 https://udd.debian.org/patches.cgi?src=chromium&version=114.... disable/signin.patch seems to reference the ungoogled chromium repo
- 2rsf 3y ago
  Extensions are blocked for "security and privacy concerns", and our internal systems don't work well with non standard browsers for some reason
  - deleted 3y ago
    [deleted]
  - brucethemoose2 3y ago
MS27 3y ago
It doesn't depend on cookies or any other site settings. just use an ad-blocker.
Gasp0de 3y ago
There are so many ways to track you. Think about the combination of ip address, user agent string, display resolution, supported apis on your browser version. They might already be unique among everyone who uses your ip.
_8j50 3y ago
Use a vpn and disposable VMs and then you can even allow cookies. If that isn't practical you will have to disable js to prevent fingerprinting. Although, while fingerprinting is a thing, most people get targeted because they use their home IP. This is one good reason why a good vpn provider is better than wireguard on a vps.
Kiala 3y ago
https://amiunique.org/ https://amiunique.org/ https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/
contingencies 3y ago
X-Forwarded-For, and/or unique IP, and/or client fingerprinting.
mabbo 3y ago
Fingerprinting. Everything about you that isn't identical to everyone else can be combined to guess who you likely are. Your exact browser version, OS, supported APIs, your IP address, your latency to Google servers... Anything that isn't a complete match to everyone else. You may have a new install, but your IP and latency match your old install. What are the odds you're not the same person? It's all probabilistic. But Google has a lot of incentive to get really good at making those guesses.
- ghusto 3y ago
  Probabilistic, to a staggeringly high certainty. I used to think "meh, how accurate could all that possibly be?". I now know it's close enough to 100% for the false positives to be negligible.
- mort96 3y ago
  But that's also a form of tracking. Are you saying it's a form of tracking which is exempt under the GDPR? Do you have a source on that?
  - mabbo 3y ago
    I doubt it's allowed under gdpr, but it's also hard to prove it's being done. Much of it can be done server side based purely on IP address.
  - IshKebab 3y ago
    It's not exempt but advertisers do it anyway.
- papruapap 3y ago
  Chrome stopped reporting chrome version because of this iirc.
- hospitalJail 3y ago
  Are we sure its Google? I have been fingerprinted on sites completely unrelated to serving Google Ads. Wait until the nsfw blackmail comes.
deleted 3y ago
[deleted]
jerf 3y ago
Cookies was a simple concept that politicians could glom on to and legislate around, but, yes, they're quite unimportant in the grand scale of things. In the end, you've got two things to work with: Things you can convince the browser to actively identify itself with, and the things you can track regardless. Cookies are in the first category, but they are not alone. You can get things as simple as presenting an entire site with customized URLs that track a user through querystrings being appended to everything with an identifier. You can track certain caching differences. You can program a website to use local storage and submit a token on every URL click with a fairly simple handler. This isn't even remotely a complete list. In the second category, you've got IP address, browser versions, various settings... see something like https://www.amiunique.org/ https://www.amiunique.org/ . In a nutshell, your rich browser experience leaks so much data along so many axes that it is essentially inconceivable that you could ever prevent yourself from being fingerprinted. What you can do is try to detach that fingerprint from a real person, to a certain extent rotate what you can, etc. But in reality you can't be shipping up kilobytes of header information on each web request and expect there isn't something in there that can track you. https://www.amiunique.org/fingerprint https://www.amiunique.org/fingerprint says I'm 100% unique; with all the red lighting up I'm not surprised.
- mnw21cam 3y ago
  The important bit is that the cookies not only are irrelevant from the point of view of allowing tracking to occur technically, they're also irrelevant from a legal point of view. A company must have your consent to hold and process your information for a specific purpose, regardless of whether or not that is done using cookies or fingerprinting. If you have been presented with a consent popup and have not consented, and the company is tracking you by other methods, then that is illegal. (It'd be illegal also if they hadn't given a consent popup at all.)
  - misja111 3y ago
    Under which law is this illegal? I'm only aware of legislation that forces websites to ask for consent for storing cookies.
larata_media 3y ago
Cookie sharing networks never actually needed to use cookies to share information about you. It’s ironic, but true. The disclaimers about using cookies and the regulations about providing those disclaimers never actually did anything to protect your privacy.
- larata_media 3y ago
  All it did was make surfing the web more annoying because now you have to accept or decline cookies before you actually do anything on the page you landed on.
mercurialsolo 3y ago
The ad tracking industry has evolved to do server side fingerprinting (Network, device U/A, Address lookups), canvas based fingerprinting.
- digging 3y ago
  Firefox blocks canvas access for this reason, which is a real pain now because it has actual usefulness. I hate advertising so much. Like, advertising on its own is already disgusting. I've worked hard to prevent myself from seeing/hearing ads. But the fact that this industry has also turned into a nightmare panopticon is so stupid. I wish we could literally ban all advertising. Maybe an exception for coupons in newspapers.
princevegeta89 3y ago
This shit is so hard to control. The only way to control it is adblockers like uBlock and/or DNS-wide solutions like PiHole
leonidasv 3y ago
Recently, I discovered that SwiftKey keyboard (I assume) was leaking tracking data from Incognito on Android. I would open an Incognito tab in Chrome, the keyboard would show up in "anonymous" mode, but products I searched for still turned into ads in Facebook/Instagram and AdSense in a couple of minutes. I assume it was SwiftKey since it was the only piece of software that had access to those keywords besides Chrome itself (which I assume is not the leaker since it never leaked data from Incognito on desktop and because it also happened in Firefox Private Browsing). The "Am I Unique" fingerprint for an Incognito vs a regular tab is also different, so I assume it's not a matter of fingerprinting with server-side tracking. We are being tracked by the least suspicious pieces of software nowadays, it's becoming more and more difficult to know where the actual tracking came from as we add more and more layers of complexity into our computers. It's scary to think about.
- Aeolos 3y ago
  Chrome is tracking you by default. Check out chrome://settings/adPrivacy on the desktop - not sure if you have any control over this on the mobile version.
  - denverllc 3y ago
    This page doesn't exist in chrome for me and I can't find it by searching the settings. I wonder if it's a regional thing -- I'm in the US. Are you not in the US by chance?
- daniel_reetz 3y ago
  I had a similar experience with the Samsung keyboard. It's seemingly sending data to Facebook/Instagram, and also it had Grammarly embedded in it. I never knowingly consented to having my conversations sent to Grammarly and I was furious about it.
jsnell 3y ago
> I could think of sophisticated methods, but maybe the simple answer is that refusing cookies doesn't actually do anything? This is a great opportunity to conduct a double blind experiment! Set up three Chrome profiles: your current one, one that's totally fresh, and one that's connecting from a different IP over a Socks proxy. Write a script to randomly start Chrome with one of these profiles; every hour quit the browser, restart it with a random profile, and record the ads you see. Do they all get the same distribution of ads? Do they start out different, but eventually converge?
- 2rsf 3y ago
  Profile? not allowed here by IT
rubyn00bie 3y ago
Etags can be used to track you and likely are, especially at the network level. Additionally your network provider may be adding headers to your requests which enable you to be identified. Finally, your browser and device combination are probably configured in a way that gives you a fairly unique identifier.
k__ 3y ago
A proxy tracker can fingerprint without you even noticing. Cookies just scale better.
whalesalad 3y ago
You’re using Chrome.
- 2rsf 3y ago
  Best comment so far
feiszli 3y ago
Depending on your ISP you may be able to change the public IP tied to your router. I did this, and found it significantly reduced what websites were able to track about me...for a while at least, until they learned again. But also, use a VPN.
stanleydrew 3y ago
What do you mean exactly by "refuse all cookies?" The specific method you use will matter a lot. If the first thing you do when you open the browser on a new machine is go immediately to Chrome's content settings and switch on "Block all cookies" then I'd be very very surprised to see successful tracking and remarketing. If you just mean you're clicking "reject" on all of the cookie dialogs you see on various websites that's not going to do much.
wafflemaker 3y ago
If you don't use DNS over HTTPS, (available in Firefox, maybe in some other browsers too) then all the pages you browse are leaked to your ISP, who is happy to sell that information to data aggregators. Since I started using DNS over HTTPS and uBlock Origin on mobile, I hardly ever get any relevant adds.
fool17462 3y ago
If you are at all concerned with privacy, why are you using Chrome? It should be no surprise that the browser built by one of the largest data-harvesting companies in the world is pretty good at harvesting your data... If this is a concern for you, maybe consider Firefox? Then grab some extra privacy-conserving extensions like ublock, adnauseam, privacy badger, privacy possum, ghostery, decentraleyes, clearURLs, IStillDontCareAboutCookies, etc. I get that this is a work machine and you may not have admin rights to install Firefox but any IT manager worth their salt won't refuse a request to change browser, especially if the motivation is personal security. If they really don't budge (or you are too welded to the Google ecosystem to part with their browser) then maybe you could look for some of the extensions I mentioned above on Chrome?
- 2rsf 3y ago
  Actually extensions are blocked for "security and privacy concerns", and our internal systems don't work well with non Chromium browsers
jefftk 3y ago
> maybe the simple answer is that refusing cookies doesn't actually do anything? I agree with all the other comments that are saying this is probably fingerprinting, but you can check whether refusing cookies is doing anything. Two ways: 1. On a page where you refused all cookies but are seeing targeted ads, open developer tools and go into the "Application" tab. Open up Storage > Cookies. Do you see anything listed? You should see nothing there. You also shouldn't see anything in the rest of storage, since "cookie" consent is really "client-local storage consent". 2. You can check whether cookies were sent on particular network requests, like the ones to the ad companies. Open a new tab, open devtools, open networking. Then paste the URL in the url bar. Find an ad request in the networking tab: do you see a "Cookies:" header? If so, it sent a cookie for you.
- dndn1 3y ago
  The truth about cookie behaviour can be found, as it's a browser-driven feature (unlike fingerprinting). But at least some analysis of the cookies will be needed, as I think essential cookies under some definition/interpretation are permitted? Now what exactly that means I'm not sure. But the first thing my cookie banner does when someone declines the banner is.... create a cookie. But I guess we can argue that's essential for the user experience - to keep the banner out of the way on follow-up page views. Not a lawyer or privacy expert though. Edit: above is behaviour I found with at least 2 cookie banners. I'm interested in suggestions if this isn't standard!
  - jefftk 3y ago
    Good point; you shouldn't see exactly zero cookies. But all cookies should be "strictly necessary" for fulfilling an explicit user request.
- 2rsf 3y ago
  Yes, I tried that with mostly inconclusive results, maybe I chose the wrong site, except for one or two sites that were either really impressively good or bad
Shendare 3y ago
In addition to the non-cookie fingerprinting mentioned by others that can happen, there is a loophole in the GDPR cookie control legislation that allows "legitimate interest" cookies to continue to be placed and tracked when you click Reject All. You have to edit your cookie preferences for the site (assuming they provide the option) and deselect Legitimate Interest cookies proactively in order to block them. This recent write-up on Reddit alerted me to this information: https://www.reddit.com/r/YouShouldKnow/comments/14ddk4u/ysk_choosing_reject_all_doesnt_reject_all_cookies/ https://www.reddit.com/r/YouShouldKnow/comments/14ddk4u/ysk_...
- cccbbbaaa 3y ago
  This is wrong. Cookies are covered by ePrivacy, article 5(3), not GDPR. There are two regimes for cookies: strictly necessary ones, and others, requiring consent. The fact that disabling “legitimate interest” cookies does not break the service should tell you that they are not strictly necessary. GDPR enters the picture when cookies are used to identify users. And using the “legitimate interest” basis for ad purposes is illegal, and instead will require consent. Adtech is just hoping that users won't notice and lodge a complaint.
  - Shendare 3y ago
    Thank you for the correction!
kongprofit 3y ago
you use chrome thats why
fulafel 3y ago
Do you mean you click reject in the analytics pop-up dialogs (or hide them with ad blocker), or that you disable cookies in the browser?
- 2rsf 3y ago
  Click, I can have a safer setup but don't bother
jose-cl 3y ago
I remember there was a site that showed all the characteristics that could make you unique. In my case, what gave me away was the unique id of the canvas.
hosh 3y ago
The current techniques pushes as many signals as possible to get a device fingerprint, which is then correlated with activity. It uses the pre-LLM machine learning methods to get such a picture. Sources of these signals are often abuses of protocols used to enhance UX across devices. Examples include: - Fonts installed (https://gist.github.com/szepeviktor/d28dfcfc889fe61763f3 https://gist.github.com/szepeviktor/d28dfcfc889fe61763f3) - Power saving telemetry (https://developer.mozilla.org/en-US/docs/Web/API/Battery_Status_API https://developer.mozilla.org/en-US/docs/Web/API/Battery_Sta...) - Screen size - https://developer.mozilla.org/en-US/docs/Web/API/Screen https://developer.mozilla.org/en-US/docs/Web/API/Screen - Deep Packet Inspection — not just IP addresses anymore - https://en.m.wikipedia.org/wiki/Deep_packet_inspection https://en.m.wikipedia.org/wiki/Deep_packet_inspection These are all tools meant to help users, but they can be used for collecting signals for targeted ads. I am sure there are more techniques that are just not publicly talked about. I have been asked by extended family members about blocking transmissions from devices so they cannot be tracked. There really is an illusion that the device actively listens on the microphone in order to target ads. I told them that, some places don’t need to transmit microphone in order to collect signals for device fingerprinting, and that is scarier.
- Xen9 3y ago
  https://coveryourtracks.eff.org https://coveryourtracks.eff.org tells how many "identifying bits" you approximately have. Aggressive DNS blocking gets much better results. Bromite / similar beowser also helps.
- tredre3 3y ago
  Do you have a source that DPI is used for ads targeting?
  - hosh 3y ago
    I have no idea. But this article goes into some of the other signals. The more signals you have, the more you can uniquely identify a device. It also goes into how GDPR covers this (but you would then depend on the government enforcing compliance to legislation) https://cheq.ai/blog/what-is-browser-fingerprinting/ https://cheq.ai/blog/what-is-browser-fingerprinting/
epirogov 3y ago
balancer can do this with hash : https://plausible.io/data-policy#how-we-count-unique-users-without-cookies https://plausible.io/data-policy#how-we-count-unique-users-w...
hilbert42 3y ago
I allow cookies at least for the session or until the browser closes and I take simple steps to block ads and I never see them on either my PC or Android phone. I used to use stricter methods such as blocking cookies outright or having them automatically delete upon receipt and changing the browser's user agent but it's not necessary to go to those lengths. If one wants to see ads then fine, if you don't then you don't have to, even YouTube ads can easily be avoided. As this ad problem arises so frequently and as the solutions are so simple one has to ask why is it so difficult to get the point across that getting rid of ads is simple.
ParetoOptimal 3y ago
An easy fix is to use something like mullvad-browser: https://mullvad.net/en/browser/mullvad-browser https://mullvad.net/en/browser/mullvad-browser Though it's annoying having bars around browser to prevent display resolution fingerprinting. You'll also not be able to login to some sites like tiktok (and probably others) which I don't know the fix for without just disabling all tracking protection.
ezedv 3y ago
It's frustrating to see targeted ads even after refusing cookies. While I'm not an expert, I've read that other tracking methods like fingerprinting may still be at play.
cookiengineer 3y ago
- IPs are relevant - Your DNS server is relevant, especially if it's google's or cloudflare's or youe ISP's DNS - ETags can be used like fingerprints - LastModified can also be used for fingerprints - Pragma can be abused for long-living fingerprints in your Browser Cache - AdMob has ultrasonic support. Not kidding, ads can be delivered to your phone while you watch TV - via unhearable sound signals. [1] usually called uXDT or XDT. - Chrome has multicast DNS support to discover surrounding devices (and Browser instances). Check DNS-SD for details, and what can be discovered. - Also the data for Chrome's locally trained neural net (aka FLoC) is inside the profile folder but won't be cleared with Browser History. - (unlikely) TLS fingerprint is usually coupled with User-Agent on the server side, so rotating your User-Agent is pointless if you don't change the TLS fingerprint (which you can't without recompiling the Browser Engine). Welcome to the new world. I miss the good ol' HTTP/1.1 days. [1] (German) https://de.m.wikipedia.org/wiki/Cross-Device_Tracking https://de.m.wikipedia.org/wiki/Cross-Device_Tracking

robin_reala 3y ago

The ePrivacy Directive (collaqually Cookie Law) doesn’t actual specify only cookies. Section 66 of https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32009L0136 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... just talks about third parties storing information on equipment: Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities.

Thorrez 3y ago
That sounds like it applies to cookies and local storage, not all tracking. It doesn't sound like it applies to IP-based or device fingerprint-based tracking.
- cccbbbaaa 3y ago
  If you are able to identify a unique user from its browser fingerprint, then it's personal data: GDPR applies. And for ad purposes, consent is pretty much required.
  - Thorrez 3y ago
    Yes GDPR applies, but the part that I was replying to doesn't.
- pph 3y ago
  It's two different directives: - ePrivacy Directive which is about local storage - GDPR which is about information processing

dmattia 3y ago

This is a critical thing that so many miss. If somebody has a website that doesn't use any cookies, but does send a POST request to www.bigcompanyanalytics.com/send-user-info with a body containing user-identifying information, then that is still illegal if the user has not consented to analytics (if they are in an area that requires opt-in for analytics). Cookies aren't really mentioned in GDPR or other privacy laws, folks just latched onto cookies as one area that can track users. But really, all personal data is subject to most of the privacy laws, including outbound requests as well as stored data. IANAL. But for context from lawyers, see: https://ico.org.uk/for-organisations/direct-marketing-and-electronic-communications/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/how-do-the-cookie-rules-relate-to-the-gdpr/#GDPR2 https://ico.org.uk/for-organisations/direct-marketing-and-el...

derefr 3y ago
How does that work given that web servers have request logs that capture some identifying info? You already know some things about the user before you can even serve them the consent popup.
- kzzzznot 3y ago
  I’m not an expert on this, but perhaps it’s the usage of that data and linking to a person that crosses the line. A web server’s logs may include the IP and http request they’ve made, but once you start attaching that to an identity instead it might count as data processing.
  - cccbbbaaa 3y ago
    Storing counts as processing under the GDPR; the definition is in article 4. It's not hard to find. > ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e1489-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... One can use the “legitimate interest” basis (recital 49 may be relevant here) or “compliance with a legal obligation” for logging.
    - kzzzznot 3y ago
      Does an IP alongside a HTTP request count as personal data?
      - cccbbbaaa 3y ago
        An IP alone is personal data. Recital 30 should be enough, but it has been asserted time and time again by DPAs and courts. See also: https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...
- cccbbbaaa 3y ago
  Logs are acceptable under the “legitimate interest” basis if you need them to secure your service (GDPR recital 49 and https://www.cnil.fr/sites/default/files/atoms/files/recommandation_-_journalisation.pdf https://www.cnil.fr/sites/default/files/atoms/files/recomman...). In some countries, you may have to retain them for some time: “legal requirement” is applicable here.

gcoakes 3y ago

My favorite thing from that uniqueness website is that it shows cookies enabled as more common and thus more anonymizing. Not that they wouldn't just fingerprint you using those cookies if it was enabled. The other interesting thing is that it lists my plugins and "do not track" settings. They are both fairly unique. So, someone who attempts to anonimize themselves using plugins or browser features are just highlighting themselves. I wonder how unique `wget` would be.

comfypotato 3y ago

I’ve been on a team doing fingerprinting research (specifically entropy sources). It’s amusing that you’re 100% unique and browsing HN commenting about fingerprinting. (You’re exactly a demographic that would be unique.) Most people aren’t unique, far from it. Consider iPhone 14 Pro Max users browsing through a 5G connection. All the users in the same cell look exactly the same. If I had to guess, based on what I know about you (what I mentioned in the previous paragraph), I would guess that you built your own computer. This almost guarantees a unique fingerprint. With the deprecation of 3rd party cookies, we will definitely see an increase in fingerprint-based tracking. That being said, it’s going to look different than unique cookies (and it doesn’t explain OP’s situation. (Or it might actually be that simple. Your fingerprint might be unique between IP re-addressing, and that’s all it is.)

jerf 3y ago
I'm on Linux in Brave, so in general that I'm unique didn't surprise me. As you say, that part is expected. Stock Dell laptop, though. Quite a lot of the specific details did surprise me though, to the point of wondering if there's a bug somewhere in their code determining percentages. "Audio context": "sampleRate : 44100, state : suspended" 0.05%? Gyroscope is a green check (I don't even 100% know what that means) and that's 0.13%? "Battery": "charging : true, chargingTime : 0, level : 1", 0.08%? (And is that even useful for fingerprinting over any significant period of time anyhow?)
- iudqnolq 3y ago
  I suspect their database is very small and doesn't include many normal people. I also think they aren't taking into account the dimension of time: they say that the latest version of chrome is unusual.
AmericanChopper 3y ago
I’m pretty skeptical of this of this fingerprint test. I’m on a 5G connection, in a major city with a completely default current gen iPhone, and it seems to think I’m 100% unique. Which I don’t believe for a second.
- driscoll42 3y ago
  There's only 1.9 million samples in their database, and to be fair, the people who go to that site to test their fingerprint, are probably the kind of user who is going to have a unique fingerprint, notsomuch a common user. So a common user going there is likely a bit unique.
  - archiewood 3y ago
    Im in Firefox and it tells me 43% of the fingerprints are Firefox. So seems very skewed!
- comfypotato 3y ago
  I responded to a similar comment at https://news.ycombinator.com/item?id=36424919 https://news.ycombinator.com/item?id=36424919
nerdbert 3y ago
I tried the amiunique fingerprinter with my iPhone, software updated to the latest version, stock Safari browser, and it said I was unique among all however many users had tried before.
- comfypotato 3y ago
  If I remember correctly, that site was actually used to publish an early paper about fingerprinting. Their database is simply people who visit their site. You probably are unique among people who have visited! I doubt it sees much traffic anymore. This would explain the parent being unique also now that I think of it. There are a few studies that used sites like that and got lots of traffic (by advertising on sites like HN) from non-normal users. There was a landmark study done in France that measured fingerprints through a government website. The general population was much less unique. Edit: found the AmIUnique paper: https://scholar.google.com/scholar_lookup?journal=Proceedings+of+the+Proceedings—2016+IEEE+Symposium+on+Security+and+Privacy+(SP)&title=Beauty+and+the+Beast:+Diverting+Modern+Web+Browsers+to+Build+Unique+Browser+Fingerprints&author=P.+Laperdrix&author=W.+Rudametkin&author=B.+Baudry&pages=878-894&doi=10.1109/SP.2016.57&#d=gs_qabs&t=1687383556046&u=%23p%3DDYTAHCgCYpUJ https://scholar.google.com/scholar_lookup?journal=Proceeding...