3 ms·

Fingerprinting is terrifying. That a device (and therefore a specific person) can be reliably identified across all sites and across time is a major failure of

by xnx 2y ago

Fingerprinting is terrifying. That a device (and therefore a specific person) can be reliably identified across all sites and across time is a major failure of browser design.

Klaster_1 2y ago
While I agree that browser vendors could potentially have handled this better, I am more incline to view this as a regulation failure - that fingerprinting is permitted in the first place. By acting in this manner, ad companies offload the cost of to browser vendors, general public and reduce overall societal trust. This is especially concerning when Google exploits its positions as an ad company and browser vendor, see the Menifest V3 situation for an example.
- Tade0 2y ago
  > I am more incline to view this as a regulation failure - that fingerprinting is permitted in the first place. In the EU it's not without explicit consent outside of a few, clearly defined cases. Of course compliance is not 100%.
- dale_glass 2y ago
  Regulation isn't universal, so it won't fix the issue. A company wanting to work around that can just contract with another running out of a country without such regulations. Browsers should do their best to make fingerprinting a non-viable approach.
  - StilesCrisis 2y ago
    I don't think fingerprinting can be stopped as long as JavaScript exists. There will always be some minor difference you can exploit or some cache you can misuse.
    - didntcheck 2y ago
      There is also the fact that there can be legitimate uses for APIs which expose information by design One of the few good ideas Google proposed is Privacy Budget [1], which now appears to be abandoned. In short the browser estimates how much information each risky API call discloses, and blocks further calls if the sum exceeds some threshold [1] https://developers.google.com/privacy-sandbox/protections/privacy-budget# https://developers.google.com/privacy-sandbox/protections/pr...
Rastonbury 2y ago
It seems so powerful, all I need is to have my browser have js with canvas enabled and I can be matched across websites? I know you can disable canvas in firefox, how does one do it in Chrome
- gruez 2y ago
  >It seems so powerful, all I need is to have my browser have js with canvas enabled and I can be matched across websites? Note the fingerprint isn't unique, it's basically a property of your graphics hardware + operating system. If you have a M4 macbook pro, in all likelihood you'll have the same fingerprint as all the other M4 macbook pro users. >I know you can disable canvas in firefox, how does one do it in Chrome Bad news. Disabling features is also a fingerprint vector, and having it disabled probably makes you more suspicious. Imagine you're at a border checkpoint that fingerprints you (many countries do that), and your fingerprints were burned off. How do you think the border guard will react?
  - Rastonbury 2y ago
    If a site deems me too suspicious that it blocks me because it cannot track me so be it, close tab
  - genewitch 2y ago
    > in all likelihood you'll have the same fingerprint as all the other M4 macbook pro users. er... maybe if they're using metamask or something with the viewport pixel WxH set arbitrarily. canvas size/window size, fonts installed (are you a graphic designer or typographer?), who knows what else. the EFF has a site that shows you all the nonsense we can be tracked with. open safari on a second monitor? at the same time? probably globally unique WxH between the two windows.
    - macki0 2y ago
      https://coveryourtracks.eff.org https://coveryourtracks.eff.org for those that are curious

by xnx 2y ago

Fingerprinting is terrifying. That a device (and therefore a specific person) can be reliably identified across all sites and across time is a major failure of browser design.

Klaster_1 2y ago

While I agree that browser vendors could potentially have handled this better, I am more incline to view this as a regulation failure - that fingerprinting is permitted in the first place. By acting in this manner, ad companies offload the cost of to browser vendors, general public and reduce overall societal trust. This is especially concerning when Google exploits its positions as an ad company and browser vendor, see the Menifest V3 situation for an example.

Tade0 2y ago
> I am more incline to view this as a regulation failure - that fingerprinting is permitted in the first place. In the EU it's not without explicit consent outside of a few, clearly defined cases. Of course compliance is not 100%.
dale_glass 2y ago
Regulation isn't universal, so it won't fix the issue. A company wanting to work around that can just contract with another running out of a country without such regulations. Browsers should do their best to make fingerprinting a non-viable approach.
- StilesCrisis 2y ago
  I don't think fingerprinting can be stopped as long as JavaScript exists. There will always be some minor difference you can exploit or some cache you can misuse.
  - didntcheck 2y ago
    There is also the fact that there can be legitimate uses for APIs which expose information by design One of the few good ideas Google proposed is Privacy Budget [1], which now appears to be abandoned. In short the browser estimates how much information each risky API call discloses, and blocks further calls if the sum exceeds some threshold [1] https://developers.google.com/privacy-sandbox/protections/privacy-budget# https://developers.google.com/privacy-sandbox/protections/pr...

Rastonbury 2y ago

It seems so powerful, all I need is to have my browser have js with canvas enabled and I can be matched across websites? I know you can disable canvas in firefox, how does one do it in Chrome

gruez 2y ago
>It seems so powerful, all I need is to have my browser have js with canvas enabled and I can be matched across websites? Note the fingerprint isn't unique, it's basically a property of your graphics hardware + operating system. If you have a M4 macbook pro, in all likelihood you'll have the same fingerprint as all the other M4 macbook pro users. >I know you can disable canvas in firefox, how does one do it in Chrome Bad news. Disabling features is also a fingerprint vector, and having it disabled probably makes you more suspicious. Imagine you're at a border checkpoint that fingerprints you (many countries do that), and your fingerprints were burned off. How do you think the border guard will react?
- Rastonbury 2y ago
  If a site deems me too suspicious that it blocks me because it cannot track me so be it, close tab
- genewitch 2y ago
  > in all likelihood you'll have the same fingerprint as all the other M4 macbook pro users. er... maybe if they're using metamask or something with the viewport pixel WxH set arbitrarily. canvas size/window size, fonts installed (are you a graphic designer or typographer?), who knows what else. the EFF has a site that shows you all the nonsense we can be tracked with. open safari on a second monitor? at the same time? probably globally unique WxH between the two windows.
  - macki0 2y ago
    https://coveryourtracks.eff.org https://coveryourtracks.eff.org for those that are curious