4 ms·

I think the author might be misunderstanding the fingerprint test — having a unique fingerprint is bad, as it allows tracking of you by fingerprinting, without

I think the author might be misunderstanding the fingerprint test — having a unique fingerprint is bad, as it allows tracking of you by fingerprinting, without the need for cookies.

adamtaylor_13 2y ago
Okay, I came here to ask that. I figured it’s better if my browser appears like 200k other ones; not being unique is the goal in my mind.
- matanabudy 2y ago
  Hi! I'm the author, I have indeed misunderstood that (and updated the post text to reflect that better, thanks!), but also - can someone really avoid having a unique fingerprint? Or randomizing it is the only way to go? (Referencing something along the lines of this: https://www.reddit.com/r/browsers/comments/17mp39r/does_it_makes_your_browser_fingerprint_more/ https://www.reddit.com/r/browsers/comments/17mp39r/does_it_m...).
  - friedtofu 2y ago
    This would be a good read for you - https://tb-manual.torproject.org/anti-fingerprinting/ https://tb-manual.torproject.org/anti-fingerprinting/. There's also Linux distributions like my current daily driver - https://wiki.cachyos.org/support/faq/#rfp-resist-fingerprint-protection https://wiki.cachyos.org/support/faq/#rfp-resist-fingerprint... that implement their own forks of Firefox and may add additional sandboxing like bubblewrap or firejail on top of it. That being said I was a lifelong Windows user up until 5-6 years ago, and while everyone else in my family uses apple devices I was never interested in using one(since I like building my own PCs :p)
rafram 2y ago
Yup. I use a more generic setup (just AdGuard and Hush) and have a less unique fingerprint. At some point, adding more “privacy” extensions will just make you stand out more with very little tangible benefit.
- FirstLvR 2y ago
  installing nothing at all is far better, that’s why Orion and brave are better for privacy, at least in apple ecosystem
  - Etheryte 2y ago
    Is that your gut feel or is that actually measurable? How many bits of information do you get?
    - yzydserd 2y ago
      Not the poster, but for me MacOS Orion (without stop the madness or little snitch etc) or anything else scores 16.07 bits and 98% ad block. I had a look at Kagi official discord and Vlad (HN: @freediver) says they let the eff test run as non-malicious, i.e. other sites may not be able to see as much.
lapcat 2y ago
> having a unique fingerprint is bad, as it allows tracking of you by fingerprinting, without the need for cookies. Correct. FWIW (disclaimer: I'm the developer of StopTheMadness Pro, mentioned in the article) I just ran two tests in Mac Safari, with StopTheMadness Pro enabled and disabled, and the results were exactly the same each time: "at least 18.06 bits of identifying information". Alas, that's a unique fingerprint, but apparently my extension doesn't make anything worse. If you look at the detailed results, the identifiers are things like User-Agent, screen size, time zone, and language.
- Etheryte 2y ago
  That's the same amount of bits I got with every browser I tried (Safari, Chrome, Firefox). Not sure what the takeaway is, but at least for me, all browsers seem to leak roughly the same amount.
- selykg 2y ago
  StopTheMadness is my favorite extension. So awesome thanks for making it!
- drcongo 2y ago
  I got exactly 18.06 too, seems fishy. (also, thanks for StopTheMadness Pro!)
- cassianoleal 2y ago
  Thank you for the extension. I’ve been a Pro user for quite a while now. I wish it existed for Linux as well, as I really miss it when I’m not on the Mac. One relatively small complaint if you don’t mind me hijacking this thread. The update process could be a lot better! Especially on Firefox. I’m used to it now, so it’s become just a bit of an annoyance but the first few times were tense moments, and especially panic inducing a couple times when I was pressed for time and couldn’t use the browser before updating the extension. In any case, it’s an awesome extension and I recommend it to others frequently!
- saagarjha 2y ago
  I don't really trust the EFF site. I'm not trying to be an annoying contrarian but as far as I can tell it always reports a unique result and nobody has explained to me yet why a freshly set up iPhone should look unique to them. Everyone talks about canvas fingerprinting or whatever but I mean it is literally the same GPU and screen size and font stack and colorspace as a million other iPhones. What are they getting? My time zone, maybe? IP? What do I actually do to reduce the number of bits?
ezfe 2y ago
Unless it’s been edited, it acknowledges that.
- matanabudy 2y ago
  Yep I have edited it because of this comment :) https://news.ycombinator.com/item?id=43454038 https://news.ycombinator.com/item?id=43454038
- deleted 2y ago
  [deleted]
charcircuit 2y ago
The uniqueness if the fingerprint doesn't matter nearly as much as whether the fingerprint is stable or if it is constantly changing.
snackernews 2y ago
Yes, a unique fingerprint allows tracking. But which sites that most of us visit, without logging in, actually have and use that capability to build a unique profile? I assume ad networks and analytics are the main ones actually fingerprinting based on client-side factors. I could be totally wrong. Any reasonable adblocker that prevents requests to those services probably neuters 99% of any fingerprinting capability that anyone is going to encounter day to day.
- eddyg 2y ago
  https://fingerprint.com/ https://fingerprint.com/ seems to provide a very resilient way to identify repeat visitors
autoexec 2y ago
> having a unique fingerprint is bad, as it allows tracking of you by fingerprinting, without the need for cookies. Having a unique fingerprint is ideal, as long as it's unique every time. It's insane to think that you can successfully account for every data point that can be collected from a browser. Fingerprinting techniques are changed and new methods are being discovered even while browsers themselves keep adding new features that can be used (or abused) to identify people. Rather than praying that you (and some fingerprinting website) are 100% aware of every single technique that's ever been used anywhere and that nothing new will be discovered giving trackers even just a single unique data point which is all they need to tell you apart from everyone else, it's a lot safer to appear to be someone new with every request.

I think the author might be misunderstanding the fingerprint test — having a unique fingerprint is bad, as it allows tracking of you by fingerprinting, without the need for cookies.

adamtaylor_13 2y ago

Okay, I came here to ask that. I figured it’s better if my browser appears like 200k other ones; not being unique is the goal in my mind.

matanabudy 2y ago
Hi! I'm the author, I have indeed misunderstood that (and updated the post text to reflect that better, thanks!), but also - can someone really avoid having a unique fingerprint? Or randomizing it is the only way to go? (Referencing something along the lines of this: https://www.reddit.com/r/browsers/comments/17mp39r/does_it_makes_your_browser_fingerprint_more/ https://www.reddit.com/r/browsers/comments/17mp39r/does_it_m...).
- friedtofu 2y ago
  This would be a good read for you - https://tb-manual.torproject.org/anti-fingerprinting/ https://tb-manual.torproject.org/anti-fingerprinting/. There's also Linux distributions like my current daily driver - https://wiki.cachyos.org/support/faq/#rfp-resist-fingerprint-protection https://wiki.cachyos.org/support/faq/#rfp-resist-fingerprint... that implement their own forks of Firefox and may add additional sandboxing like bubblewrap or firejail on top of it. That being said I was a lifelong Windows user up until 5-6 years ago, and while everyone else in my family uses apple devices I was never interested in using one(since I like building my own PCs :p)

rafram 2y ago

Yup. I use a more generic setup (just AdGuard and Hush) and have a less unique fingerprint. At some point, adding more “privacy” extensions will just make you stand out more with very little tangible benefit.

FirstLvR 2y ago
installing nothing at all is far better, that’s why Orion and brave are better for privacy, at least in apple ecosystem
- Etheryte 2y ago
  Is that your gut feel or is that actually measurable? How many bits of information do you get?
  - yzydserd 2y ago
    Not the poster, but for me MacOS Orion (without stop the madness or little snitch etc) or anything else scores 16.07 bits and 98% ad block. I had a look at Kagi official discord and Vlad (HN: @freediver) says they let the eff test run as non-malicious, i.e. other sites may not be able to see as much.

lapcat 2y ago

> having a unique fingerprint is bad, as it allows tracking of you by fingerprinting, without the need for cookies. Correct. FWIW (disclaimer: I'm the developer of StopTheMadness Pro, mentioned in the article) I just ran two tests in Mac Safari, with StopTheMadness Pro enabled and disabled, and the results were exactly the same each time: "at least 18.06 bits of identifying information". Alas, that's a unique fingerprint, but apparently my extension doesn't make anything worse. If you look at the detailed results, the identifiers are things like User-Agent, screen size, time zone, and language.

Etheryte 2y ago
That's the same amount of bits I got with every browser I tried (Safari, Chrome, Firefox). Not sure what the takeaway is, but at least for me, all browsers seem to leak roughly the same amount.
selykg 2y ago
StopTheMadness is my favorite extension. So awesome thanks for making it!
drcongo 2y ago
I got exactly 18.06 too, seems fishy. (also, thanks for StopTheMadness Pro!)
cassianoleal 2y ago
Thank you for the extension. I’ve been a Pro user for quite a while now. I wish it existed for Linux as well, as I really miss it when I’m not on the Mac. One relatively small complaint if you don’t mind me hijacking this thread. The update process could be a lot better! Especially on Firefox. I’m used to it now, so it’s become just a bit of an annoyance but the first few times were tense moments, and especially panic inducing a couple times when I was pressed for time and couldn’t use the browser before updating the extension. In any case, it’s an awesome extension and I recommend it to others frequently!
saagarjha 2y ago
I don't really trust the EFF site. I'm not trying to be an annoying contrarian but as far as I can tell it always reports a unique result and nobody has explained to me yet why a freshly set up iPhone should look unique to them. Everyone talks about canvas fingerprinting or whatever but I mean it is literally the same GPU and screen size and font stack and colorspace as a million other iPhones. What are they getting? My time zone, maybe? IP? What do I actually do to reduce the number of bits?

ezfe 2y ago

Unless it’s been edited, it acknowledges that.

matanabudy 2y ago
Yep I have edited it because of this comment :) https://news.ycombinator.com/item?id=43454038 https://news.ycombinator.com/item?id=43454038
deleted 2y ago
[deleted]

charcircuit 2y ago

The uniqueness if the fingerprint doesn't matter nearly as much as whether the fingerprint is stable or if it is constantly changing.

snackernews 2y ago

Yes, a unique fingerprint allows tracking. But which sites that most of us visit, without logging in, actually have and use that capability to build a unique profile? I assume ad networks and analytics are the main ones actually fingerprinting based on client-side factors. I could be totally wrong. Any reasonable adblocker that prevents requests to those services probably neuters 99% of any fingerprinting capability that anyone is going to encounter day to day.

eddyg 2y ago
https://fingerprint.com/ https://fingerprint.com/ seems to provide a very resilient way to identify repeat visitors

autoexec 2y ago

> having a unique fingerprint is bad, as it allows tracking of you by fingerprinting, without the need for cookies. Having a unique fingerprint is ideal, as long as it's unique every time. It's insane to think that you can successfully account for every data point that can be collected from a browser. Fingerprinting techniques are changed and new methods are being discovered even while browsers themselves keep adding new features that can be used (or abused) to identify people. Rather than praying that you (and some fingerprinting website) are 100% aware of every single technique that's ever been used anywhere and that nothing new will be discovered giving trackers even just a single unique data point which is all they need to tell you apart from everyone else, it's a lot safer to appear to be someone new with every request.