3 ms·

If I open the website It says I have 99,9% uniqueness. So I'm trackable right ? Yet when I open it again in another window, it says 100% uniqueness but it's a

If I open the website It says I have 99,9% uniqueness. So I'm trackable right ? Yet when I open it again in another window, it says 100% uniqueness but it's a different Signature than previously. I think it's saying it can't track me, because signature would have to be the same for it to work yet I'm using regular Firefox, nothing fancy. Is that technique really effective or I'm just wrong about the signature not being the same ?

trod123 2y ago
This is just one of many aspects of fingerprinting. Canvas is only a single element. Each fingerprint component can be used to correlate other components, including TLS channel options which generally last the entire session the website is open for, or there's a network header that remains unchanged between NAT. Given tens of thousands of potentially fingerprintable elements, you only need 5 relatively unique elements between people for a 1 in 1million, each point thereafter exponentially increases that uniqueness.
- nerdponx 2y ago
  I don't work in ad tech, but I expect that there are strong diminishing returns on this kind of thing. Yes, it's theoretically possible to do all of this advanced stuff to correlate and identify the long tail of users who have obfuscated fingerprints. But if you are in the targeted advertising business, are those users really all that valuable to target? They are probably nerds who don't buy a lot of new stuff and block ads anyway. I expect that being unique, but distinct on each run of the fingerprint algorithm, is probably good enough, unless you are concerned about a very motivated attacker trying to stalk you. On the other hand, there is also the fact that things like spoofing web APIs only goes so far. There are other fingerprinting techniques, such as measuring properties of the GPU, which might still uniquely identify your machine (how many people have such-and-such GPU in your ZIP code?).
amelius 2y ago
Maybe your browser has fingerprint mitigation techniques?
figglestar 2y ago
In sounds like you have Firefox's fingerprint resist feature enabled. This confusion occurs every time this topic comes up because there are two different strategies used to attack the problem and people end up measuring them both the same way. You can try to be so generic that the attributes are meaningless, the meatspace version of this would be everyone wearing a Guy Fawkes mask so they all have the same face and you can't tell the difference between individuals. Or, you can wear a new generic face every single day so that nothing you did yesterday connects to you, an bland ephemeral identity. Tor uses the former method (or tries to), everyone is up to something but you can't tell them apart because they all have the same face/browser attributes. Firefox's fingerprint resist is the second method, normally identifying values are fuzzed repeatedly so that while each signature is identifiable you won't be using it for long enough to connect them to eachother. Both strategies have their merits.

trod123 2y ago

This is just one of many aspects of fingerprinting. Canvas is only a single element. Each fingerprint component can be used to correlate other components, including TLS channel options which generally last the entire session the website is open for, or there's a network header that remains unchanged between NAT. Given tens of thousands of potentially fingerprintable elements, you only need 5 relatively unique elements between people for a 1 in 1million, each point thereafter exponentially increases that uniqueness.

nerdponx 2y ago
I don't work in ad tech, but I expect that there are strong diminishing returns on this kind of thing. Yes, it's theoretically possible to do all of this advanced stuff to correlate and identify the long tail of users who have obfuscated fingerprints. But if you are in the targeted advertising business, are those users really all that valuable to target? They are probably nerds who don't buy a lot of new stuff and block ads anyway. I expect that being unique, but distinct on each run of the fingerprint algorithm, is probably good enough, unless you are concerned about a very motivated attacker trying to stalk you. On the other hand, there is also the fact that things like spoofing web APIs only goes so far. There are other fingerprinting techniques, such as measuring properties of the GPU, which might still uniquely identify your machine (how many people have such-and-such GPU in your ZIP code?).

amelius 2y ago

Maybe your browser has fingerprint mitigation techniques?

figglestar 2y ago

In sounds like you have Firefox's fingerprint resist feature enabled. This confusion occurs every time this topic comes up because there are two different strategies used to attack the problem and people end up measuring them both the same way. You can try to be so generic that the attributes are meaningless, the meatspace version of this would be everyone wearing a Guy Fawkes mask so they all have the same face and you can't tell the difference between individuals. Or, you can wear a new generic face every single day so that nothing you did yesterday connects to you, an bland ephemeral identity. Tor uses the former method (or tries to), everyone is up to something but you can't tell them apart because they all have the same face/browser attributes. Firefox's fingerprint resist is the second method, normally identifying values are fuzzed repeatedly so that while each signature is identifiable you won't be using it for long enough to connect them to eachother. Both strategies have their merits.