5 ms·

> Every new web API should guarantee that it doesn't provide more fingerprinting data or hides the data behind a permission. FWIW, it's practically impossible

> Every new web API should guarantee that it doesn't provide more fingerprinting data or hides the data behind a permission. FWIW, it's practically impossible to provide that guarantee because the API necessarily provides at least the data point of, "Did they select an option in the permission notification?" ("If yes, what option was selected?" etc.) It's often said that the only solution to this is regulation and there seems to be a good case for that perspective.

XlA5vEKsMISoIln 2y ago
> API necessarily provides at least the data point of, "Did they select an option in the permission notification?" If a bird app (or, heck, pancake recipe site) asked for WebRTC or GPU access I would be rightfully suspicious. It's a shame these things don't happen.
- chgs 2y ago
  They do ask for location data, and it tends to mostly work - sites like openstreetmap will ask for it when you press the right button for example, which makes sense. There is a risk that it ends up like cookie banners, and the adtech industry manages to brainwash the world into thinking that the government is the bad guy and they just want some harmless data to share with their 1,345 best friends and they are “forced” to show these. Despite there being no requirement at all to track data, and they break the law with it anyway so why bother.
  - USiBqidmOOkAqRb 2y ago
    This is a poorly explored avenue. I think a lot of these more advanced APIs ought to be permitted to "installed" PWAs. Maybe it could even look like permissions menu for apps in phone OSes. I was a bit dismayed when mozillians in the bugtracker dismissed the idea of requiring consent to initialize WebRTC. F'k it, scan the local network.
SpaghettiCthulu 2y ago
> FWIW, it's practically impossible to provide that guarantee because the API necessarily provides at least the data point of, "Did they select an option in the permission notification?" ("If yes, what option was selected?" etc.) Wrong. The status of permissions should not be visible to the page in most cases. Instead, fake data should be returned from them. That would be practical.
- paulryanrogers 2y ago
  I've heard that fake data, like from AdNausium, just becomes noise as the advertisers know the patterns to filter them out. Assuming that's true, it seems to waste everyone's time and bits to fake it instead of just not answering or a minimal denial.
  - autoexec 2y ago
    > I've heard that fake data, like from AdNausium, just becomes noise as the advertisers know the patterns to filter them out. It's actually much worse. That fake data is dangerous because data brokers don't really care how accurate their data is. Even the fake data AdNausium stuffs into your dossier will be used against you eventually, just like the real data will be. If you get turned down for a job, or your health insurance rates go up, or you have to pay more for something than you would have otherwise, you won't even be told that it was because of data someone collected/sold/bought. You sure won't be told if it was fake or real data and you won't be given any opportunity to correct it.
    - greiskul 2y ago
      > If you get turned down for a job, or your health insurance rates go up, or you have to pay more for something than you would have otherwise It must suck to live in a capitalist dystopia. Dunno why Americans put up with it.
      - zx8080 2y ago
        It's the democracy. The big capital one. /s
thescriptkiddie 2y ago
One solution to this is to have the option to feed the application fake but plausible data. Android (or maybe some Android fork I was using) used to have this option for dealing with apps that insist on asking for location permission for no reason.
codedokode 2y ago
> FWIW, it's practically impossible to provide that guarantee because the API necessarily provides at least the data point of, "Did they select an option in the permission notification?" ("If yes, what option was selected?" etc.) If 99% of users will have permission disabled then it has little value, and only those who enabled it can be tracked. I don't give permissions to sites so this will not apply to me. Also, the status of permission (1 bit) provides less information than API it protects (for example, list of installed fonts or GPU name) so it is a win.

XlA5vEKsMISoIln 2y ago

> API necessarily provides at least the data point of, "Did they select an option in the permission notification?" If a bird app (or, heck, pancake recipe site) asked for WebRTC or GPU access I would be rightfully suspicious. It's a shame these things don't happen.

chgs 2y ago
They do ask for location data, and it tends to mostly work - sites like openstreetmap will ask for it when you press the right button for example, which makes sense. There is a risk that it ends up like cookie banners, and the adtech industry manages to brainwash the world into thinking that the government is the bad guy and they just want some harmless data to share with their 1,345 best friends and they are “forced” to show these. Despite there being no requirement at all to track data, and they break the law with it anyway so why bother.
- USiBqidmOOkAqRb 2y ago
  This is a poorly explored avenue. I think a lot of these more advanced APIs ought to be permitted to "installed" PWAs. Maybe it could even look like permissions menu for apps in phone OSes. I was a bit dismayed when mozillians in the bugtracker dismissed the idea of requiring consent to initialize WebRTC. F'k it, scan the local network.

SpaghettiCthulu 2y ago

> FWIW, it's practically impossible to provide that guarantee because the API necessarily provides at least the data point of, "Did they select an option in the permission notification?" ("If yes, what option was selected?" etc.) Wrong. The status of permissions should not be visible to the page in most cases. Instead, fake data should be returned from them. That would be practical.

paulryanrogers 2y ago
I've heard that fake data, like from AdNausium, just becomes noise as the advertisers know the patterns to filter them out. Assuming that's true, it seems to waste everyone's time and bits to fake it instead of just not answering or a minimal denial.
- autoexec 2y ago
  > I've heard that fake data, like from AdNausium, just becomes noise as the advertisers know the patterns to filter them out. It's actually much worse. That fake data is dangerous because data brokers don't really care how accurate their data is. Even the fake data AdNausium stuffs into your dossier will be used against you eventually, just like the real data will be. If you get turned down for a job, or your health insurance rates go up, or you have to pay more for something than you would have otherwise, you won't even be told that it was because of data someone collected/sold/bought. You sure won't be told if it was fake or real data and you won't be given any opportunity to correct it.
  - greiskul 2y ago
    > If you get turned down for a job, or your health insurance rates go up, or you have to pay more for something than you would have otherwise It must suck to live in a capitalist dystopia. Dunno why Americans put up with it.
    - zx8080 2y ago
      It's the democracy. The big capital one. /s

thescriptkiddie 2y ago

One solution to this is to have the option to feed the application fake but plausible data. Android (or maybe some Android fork I was using) used to have this option for dealing with apps that insist on asking for location permission for no reason.

codedokode 2y ago

> FWIW, it's practically impossible to provide that guarantee because the API necessarily provides at least the data point of, "Did they select an option in the permission notification?" ("If yes, what option was selected?" etc.) If 99% of users will have permission disabled then it has little value, and only those who enabled it can be tracked. I don't give permissions to sites so this will not apply to me. Also, the status of permission (1 bit) provides less information than API it protects (for example, list of installed fonts or GPU name) so it is a win.