12 ms·

Websites are tracking you via browser fingerprinting

365 points by gnabgib 1y ago

Izmaki 1y ago
The Tor Browser has been using predetermined window sizes for years for this reason exactly. It can hardly be "new research".
halb 1y ago
This is a problem because unlike cookies, that are tied to specific domains and isolated by security boundaries, fingerprints can be computed across any domain. It's easy to imagine how a website that tracks users and serves ads solely using fingerprints could be exploited to gain informations about a victim, simply by collecting their fingerprint.
legitster 1y ago
As someone who works in this tech space, nobody brings up how long fingerprints persist. And the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). A lot of the big ad networks right now instead rely heavily on geo-data. Which is why you are probably seeing lots of ads in your feeds that seemingly cross between devices or are relating to interests of your spouse/friends/etc. They just look at the geo on your IP and literally flood the zone. > They developed a measurement framework called FPTrace, which assesses fingerprinting-based user tracking by analyzing how ad systems respond to changes in browser fingerprints. I'm curious to know a bit more about their methodology. It's more likely to me that the ad networks are probably segmenting the ads based on device settings more than they are individually targeting based on fingerprints. For example, someone running new software versions on new hardware might be lumped into a hotter buyer category. Also, simple things like time of day have huge impacts on ad bidding, so knowing how they controlled would be everything.
- cosmic_cheese 1y ago
  Wouldn’t things like iCloud Private Relay and other VPN-ish things throw a wrench into IP-geo-based tracking? Seems like it’d make the targeting so broad as to be useless.
  - lucasban 1y ago
    Conveniently for them, iCloud private relay only really impacts browser usage, third party apps are only impacted when using unencrypted connections, which is unlikely.
  - legitster 1y ago
    I don't know a lot about iCloud in particular, but in general there are not enough active VPN users to make a noticeable difference in tracking. By its nature ad tracking does not have to be super accurate in the aggregate to beat a wild guess.
    - v5v3 1y ago
      If you look at app download charts, the main VPN companies dominate. So I suspect there are sufficient active users.
  - ztetranz 1y ago
    As an aside, we just spent a couple of weeks camping in our RV with a cellular router connected to a VPN at home. Now that we're back home, Google maps (on a non-GPS equipped device) and Roku still think we're at the campground several states away. I guess my GPS equipped tablet reported the new location of our home IP address. On past experience, it takes about a week to reset.
  - Gigachad 1y ago
    iCloud Private Relay has always kept the IP in the same city for me.
    - mediumsmart 1y ago
      Mine is also in a city 146 kilometers away.
- minitech 1y ago
  > And the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). A fingerprint that changes only by the increase of a browser version isn’t dead; it’s stronger.
  - legitster 1y ago
    I'm not sure if I understand this. If you show up on a website one day with one fingerprint, but on the next day it was a different fingerprint, there's no way to connect that it's the same device unless it wasn't a core trait of the fingerprint in the first place.
    - kemotep 1y ago
      If everything is the same but the browser version, a day later how is that not the same person?
    - deleted 1y ago
      [deleted]
    - orev 1y ago
      I think you’re thinking that the fingerprint is reported as a single hash (e.g. SHA512) of multiple attributes, which would of course change if a single bit was different. But there’s no reason they would be reported that way. It could be (and probably more likely) a big data structure of all the values. It would be easy to see that only a few things changed.
  - gruez 1y ago
    >it’s stronger. marginally given that most browsers auto-update.
- glaucon 1y ago
  >As someone who works in this tech space, nobody brings up how long fingerprints persist. And the reality is that even a really precise fingerprint has a half-life of only a few days I've just looked at my fingerprint and I'm told I'm unique (my mum always said that ;-) ). Unfortunately it's impossible, using https://www.amiunique.org/fingerprint https://www.amiunique.org/fingerprint, to determine what elements of the fingerprint, if changed, would make me significantly non-unique but when I look down the list 16/58 javascript attributes are red (the lowest category of similarity ratio) and only two of those are overtly dependent on a version number, another six refer to screen size/resolution. It seems to me that leaves quite a lot of information which isn't going to change all the quickly. While the precise value may change with time I feel like saying "has a half-life of only a few days" tends to understate the effectiveness of this technique.
  - ryukoposting 1y ago
    There are a few obvious ones I knew would be bad for me - the Linux user agent, for example. My canvas also came up unique and I'm betting Dark Reader had something to do with that. But then there's other things that don't make any sense. How is "NVIDIA Corporation" only 0.74% for "WebGL Vendor?" Why does navigator.hardwareConcurrency even exist?
    - bitmasher9 1y ago
      My vendor “Apple Computer, Inc” was less than 10% (I’m on iPhone) so I suspect HN crowd probably uses unusual hardware. While my timezone (in USA) and device vendor are both single digit rare, combining the two probably leaks less information than you’d expect because my timezone has a much higher density of Apple devices than global averages. It’s really not until you take into consideration a few other variables that you could really finger print me pretty decently.
    - robin_reala 1y ago
      0.74% does seem a bit low, but most people browse the web on mobile phones, so knock off 50-70% immediately, then of the remaining most will be integrated GPUs from Intel or AMD in laptops. Take away Macs and you’re basically just left with gaming PCs, and laptops where the browser decided the task was difficult enough to spin up a discrete nVidia GPU.
- DoctorOetker 1y ago
  > And the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). I don't follow, consider hardware interrupts and their handling delays depending say on the combination of apps installed, the exact gpu driver version, etc ... An occasional update could change the relevant timings, but would unlikely change all timing distributions (since perhaps the gpu driver wasn't updated, or the some other app wasn't)
  - gruez 1y ago
    >consider hardware interrupts and their handling delays depending say on the combination of apps installed There's zero chance that apps on iOS and Android have access to "hardware interrupts" (whatever that means), because both platforms are too sandboxed. Moreover timing resolution on javascript has been nerfed since several years ago because of fears of spectre attacks. >the exact gpu driver version, etc ... If you're just rendering simple polygons, it's highly implausible that timings would change in between drivers. You might be able to tell driver versions apart if you spend hundreds/thousands of man-hours reverse engineering each driver version for quirks to test against, but I doubt they're pouring that much effort into this.
    - qualeed 1y ago
      >"hardware interrupts" (whatever that means) Hardware interrupts are a standard part of computing. (see https://en.wikipedia.org/wiki/Interrupt#Hardware_interrupts https://en.wikipedia.org/wiki/Interrupt#Hardware_interrupts) "Android also inherits the interrupt mechanism from Linux, which is designed for the efficient communication between the CPU and external devices. When new hardware events (e.g., user touching the screen) come, the corresponding hardware device (e.g., touchscreen controller) sends a signal to ask OS for immediate processing" And, at least previously, the timing of interrupts have been used to facilitate information leakage. For example: "Through analyzing the interrupt time series produced from touchscreen controller, attacker’s chance of cracking user’s unlock pattern is increased substantially. The interrupt time series produced from Display Sub-System reveals unique UI refreshing patterns and could be leveraged as fingerprints to identify the app running in the foreground" https://staff.ie.cuhk.edu.hk/~khzhang/my-papers/2016-oakland-interrupt.pdf https://staff.ie.cuhk.edu.hk/~khzhang/my-papers/2016-oakland... It's been awhile since I've looked closely at anything related to phones, but for decades /proc/interrupts was globally readable. It may still be.
- kul_ 1y ago
  > A lot of the big ad networks right now instead rely heavily on geo-data How does this work in today's age where ISPs normally will have at least one level of NATing with ipv4. And given ipv6 with prefix delegation is still far away this should continue to be very imprecise?
  - fiddlerwoaroof 1y ago
    I’ve never had an unroutable IP in the US
    - wut42 1y ago
      CGNAT does not means unroutable IP, it just means you would only have assigned a small range of ports on a routable IP with others.
      - BenjiWiebe 1y ago
        If you have CGNAT, the IP on your router's external interface is unroutable. Just like how when you do NAT for your home network, your devices get assigned non-routable private use only address space. Unroutable meaning not publicly routable. Of course you can route traffic through your own LAN to your Internet gateway.
  - kulahan 1y ago
    Billboards are still among the most effective forms of advertising in terms of efficiency. You don’t need to be very close. I see myself popping up probably 10 miles from where I’m actually at, but the businesses aren’t that inaccessible.
  - djrj477dhsnv 1y ago
    > ISPs normally will have at least one level of NATing with ipv4. I don't think that's generally true for home DSL/cable/fiber service. I've only seen it on mobile internet.
    - kul_ 1y ago
- tjpnz 1y ago
  >A lot of the big ad networks right now instead rely heavily on geo-data. Which is why you are probably seeing lots of ads in your feeds that seemingly cross between devices or are relating to interests of your spouse/friends/etc. They just look at the geo on your IP and literally flood the zone. I don't see them and nor does my spouse. Ads aren't allowed in my house (to mangle the words of a famous adtech company).
- jgalt212 1y ago
  > As someone who works in this tech space, nobody brings up how long fingerprints persist. And the reality is that even a really precise fingerprint has a half-life of only a few days True that. We use cookies + fingerprints to monitor for license compliance (i.e. ensure users are not id/password sharing). Sometimes we can use a fingerprint to recover a deleted cookie, but not all that often. What would really help is a fingerprint transition matrix, so we could make some probabilistic guesses.
- fc417fc802 1y ago
  > the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). The size of a maximized window is unlikely to change unless either the desktop environment is updated in some way or the monitor (hardware) itself is swapped out. GPU hardware is unlikely to change frequently and various idiosyncrasies can be fingerprinted via either webgl or webgpu. Installed fonts probably don't change all that frequently. I'd expect TCP stack fingerprinting to be fairly stable. That's but a few examples off the top of my head. As long as only one characteristic changes at a time you can link the cluster together. Worse, if client side identifiers (ex cookies) aren't wiped simultaneously then you can link two entirely distinct fingerprints with full confidence.
  - everdrive 1y ago
    What is TCP stack fingerprinting?
    - rsync 1y ago
      It is what nmap does. In theory, this would be a rich landscape for an entirely different abstraction layer for fingerprinting… However, I am skeptical that the typical fingerprinting tool chains are receiving data that reaches that far down in the stack…
      - fc417fc802 1y ago
        Also TCP timestamp if the network stack doesn't apply a randomized offset. As of 4.10 Linux added randomization; no idea about others. Getting a bit farther out there, CPU clock skew can be derived from the (randomly offset) TCP timestamps. That varies with temperature and thus load so it can be used to pick out otherwise indistinguishable traffic streams originating on the same physical host. Back in the realm of commonly employed techniques, higher levels of the networking stack are fingerprinted in the wild. https://blog.cloudflare.com/ja4-signals/ https://blog.cloudflare.com/ja4-signals/ Moving even farther up, the human interaction streams themselves are commonly fingerprinted. I realize that's a bit of a tangent but OP had suggested that fingerprints had short half lives and this is a very strong counterexample that I failed to mention earlier. https://www.whonix.org/wiki/Keystroke_and_Mouse_Deanonymization https://www.whonix.org/wiki/Keystroke_and_Mouse_Deanonymizat...
- NoahZuniga 1y ago
  fingerprint.com claims that they can fingerprint a user with >90% accuracy over 120 days. A half-life of a few days is awfully optimistic.
- WalterBright 1y ago
  I have no idea what ads they serve me because I have ad blindness. My brain just refuses to perceive them. Even when they float over the text I am trying to read, I do not see them.
  - erkt 1y ago
    This is a top tier super power. Ublock on Firefox and AdGuard on iPhone are pretty effective. When I actually see an ad it physically hurts.
    - godelski 1y ago
      On iPhone check out Orion browser. Blocks ads, even on YouTube. Though sometimes video quality goes low (manually set it higher to fix). Firefox focus also works, but only one tab If on Android, check out revanced. You can remove ads from lots of apps. Highly recommend Firefox as well.
      - _kidlike 1y ago
        Brave is also extremely effective at removing ads while keeping websites functional (including YouTube). It even has some fingerprinting protection. (and before someone complains, you can disable all the crypto stuff)
        godelski 1y ago
        Sure but personally I'm against recommending different flavors of chrome. Brave is a nice idea but it still gives undue power to Google because at the be of the day, they control chromium. It also makes a hard problem for chromium reskins as they keep finding things chromium can use to track their users...
  - hinterlands 1y ago
    Every person says this, but it's a massive industry for a reason. It's the same as with The North Face logo on jackets. You're never paying attention and you don't recall any specific person wearing the jacket. But somehow, when it's time to buy a jacket, you know about the brand, and know all the people in your socioeconomic circle seem to like it. Some online ads want to grab your attention, but most are just about building almost-subliminal connections like that.
- deleted 1y ago
  [deleted]
- deleted 1y ago
  [deleted]
- m000 1y ago
  I think you miss some key issues here: (a) Browser fingerprinting can be very robust if you select your data points correctly. E.g. installed plugins, content language, fonts. The used data points can be dynamically fine-tuned in retrospect and be different for each identified agent. (b) In the grand scheme of things, the browser fingerprint is only one data point. If you combine it with other data points (e.g. the geo-data you mentioned) you can overcome some of its limitations as well as intentional evasion attempts. E.g. a new fingerprint appears at my workplace IP that has 80% similarity with my old fingerprint. At the same time my old fingerprint goes dark. (c) The ad companies take the shotgun approach because it works for them: it is cost-effective and can be defended as a legit method. Entities that are interested in surveilance for purposes other than selling ads and already collect a trove of other data can do a lot better than ad companies.
  - 400thecat 1y ago
    > Browser fingerprinting can be very robust if you select your data points correctly. E.g. installed plugins can websites really see installed plugins?
    - peetistaken 1y ago
      Not really. They can‘t see a list, as navigator.plugins is dummy data in every major browser, but they might able to detect eg. Adblockers by other means
      - dubcanada 1y ago
        Adblocking is not rocket science, you block the DNS of the ads. Some also use JS to mess or remove ads. All of this is easily detected, can I ping X, can I see DOM Y, etc.
  - coldtea 1y ago
    >E.g. installed plugins, content language, fonts. Nobody installs plugins in 2025. Content language is basically like the geo-data the parent said, but coarser. And billions of people just have the same (default OS) fonts - plus iirc, there are broswer mitigations against font enumeration for fingerprinting.
- Swoerd123 1y ago
  Siteimprove Analytics appears to be confident enough about their cookieless tracking technology (compared to cookie based tracking) to claim: In general, Visitor Hash is expected to be more persistent, resulting in a drop in the number of unique visitors. Since cookies are known to have an increasingly short lifetime, leading to overestimated data about unique visitors, we consider the Visitor Hash technology to be more accurate at capturing information about unique and returning visitors When Cookieless tracking is enabled, it replaces the traditional use of cookies with a "Visitor Hash" made of non-personal information only. This information includes hashed IP and HTTP header values including browser type, browser version, browser language, and the user agent string. The Visitor Hash only consists of server-side attributes passed along by the website server. Note: Siteimprove analytics does not collect client-side attributes. The Visitor Hash is used for the same functionality as the cookie and nothing else. For some websites, like intranets, there is an increased likelihood that the visitors could end up getting the same Visitor Hash as they might all be accessing the site from the same IP and on the same device setups. In those cases all page views would appear to be coming from one, or a few, visits. That's why we recommend excluding those domains from using cookieless tracking. See the "How to exclude domains from having cookieless tracking enabled" section below for more information.
- bastawhiz 1y ago
  A fingerprint is composed of many signals. Even if a few of those signals change, the less-specific fingerprint made by the remaining signals can still be used to infer who a user is. And it doesn't need to be perfect: having a good idea that someone who almost looks like you from yesterday was interested in cat food is a good enough reason to auction ad space to cat food companies today.
leptons 1y ago
“Fingerprinting has always been a concern in the privacy community, but until now, we had no hard proof that it was actually being used to track users,” Huh? In 2025?? Fingerprinting has been around and actively used to track users for probably at least 20 years.
- martinky24 1y ago
  They said "hard proof". Can you point to openly available "hard proof"? Otherwise your reply is just snark that doesn't add much.
  - antonok 1y ago
    As someone who's been building an adblocker for the last 6 years: yes, there's plenty of proof in the devtools console on more websites than you'd think. Fingerprintjs [1] is a well known one that gets a lot of use. And if you check EasyPrivacy, you'll see the rules to block it [2] have been in place for a long time. [1] https://github.com/fingerprintjs/fingerprintjs https://github.com/fingerprintjs/fingerprintjs [2] https://github.com/easylist/easylist/blob/132813613d04b7228c3d43bd21f3fa13077edaec/easyprivacy/easyprivacy_general.txt#L908-L913 https://github.com/easylist/easylist/blob/132813613d04b7228c...
  - JimDabell 1y ago
    Why do you think a porn site was trying to access MIDI devices? To play some smooth jazz? https://www.obsessivefacts.com/images/blog/2020-04-04-the-javascript-black-hole/xhamster-cropped.png https://www.obsessivefacts.com/images/blog/2020-04-04-the-ja... https://news.ycombinator.com/item?id=23679063 https://news.ycombinator.com/item?id=23679063
  - mbrubeck 1y ago
    From over a decade ago, a paper on then-commercially-available browser fingerprinting tech, including a study of its deployment in the wild: https://dl.acm.org/doi/10.1109/SP.2013.43 https://dl.acm.org/doi/10.1109/SP.2013.43 Nick Nikiforakis, Alexandros Kapravelos, Wouter Joosen, Christopher Kruegel, Frank Piessens, and Giovanni Vigna. 2013. Cookieless Monster: Exploring the Ecosystem of Web-Based Device Fingerprinting. In Proceedings of the 2013 IEEE Symposium on Security and Privacy (SP ’13).
disambiguation 1y ago
https://www.amiunique.org/ https://www.amiunique.org/ > your browser shares a surprising amount of information, like your screen resolution, time zone, device model and more. When combined, these details create a “fingerprint” that’s often unique to your browser. Unlike cookies — which users can delete or block — fingerprinting is much harder to detect or prevent. Ironically, the more fine tuned and hardened your device, OS, and browser are for security and privacy, the worse your fingerprint liability becomes. more idle thoughts - it's strange and disappointing that in the vast space and history of FOSS tools, a proper open source browser never took off. I suppose monopolizing from the start was too lucrative to let it be free. Yet there really is little recourse for privacy enthusiasts. I've entertained the idea of using my own scraper, so I can access the web offline, though seems like more trouble than its worth.
- jcranmer 1y ago
  > it's strange and disappointing that in the vast space and history of FOSS tools, a proper open source browser never took off. What makes you disqualify Firefox from being a "proper open source browser"?
  - bronson 1y ago
    Firefox never took off.
    - diggan 1y ago
      At one point, Firefox (3.5 specifically) was #1, for a brief moment: > Between mid-December 2009 and February 2010, Firefox 3.5 was the most popular browser (when counting individual browser versions) according to StatCounter, and as of February 2010 was one of the top 3 browser versions according to Net Applications. Both milestones involved passing Internet Explorer 7, which previously held the No. 1 and No. 3 spots in popularity according to StatCounter and Net Applications, respectively - https://en.wikipedia.org/wiki/Firefox_3.5 https://en.wikipedia.org/wiki/Firefox_3.5 Then Chrome appeared and flattened both IE and Firefox.
diggan 1y ago
I guess we all knew this was happening, but it's hard to "prove" that they track you across devices without resorting to anecdotes. This seems to be a framework for performing studies + a large-scale study in order to get some more concrete proof that it is actually happening in practice, and the fingerprinting isn't just used for other things like anti-abuse. > Prior studies only measured whether fingerprinting-related scripts are being run on the websites but that in itself does not necessarily mean that fingerprinting is being used for the privacy-invasive purpose of online tracking because fingerprinting might be deployed for the defensive purposes of bot/fraud detection and user authentication. [...] a framework to assess fingerprinting-based user tracking by analyzing ad changes from browser fingerprinting adjustments - https://dl.acm.org/doi/10.1145/3696410.3714548 https://dl.acm.org/doi/10.1145/3696410.3714548 Unfortunately I don't have access to the paper myself, so not sure what details they share beyond that.
superkuh 1y ago
Luckily most of this is done by web devs using their normal tools which means if you just turn javascript off that gets rid of 99%. Sure, there are ad companies and related out there using actual webserver logs but more and more it's relying on you the user blindly executing their code on your machine. After all, everyone does it. Anyone not running javascript is weird, probably not monetizable, and therefore is a bot and doesn't exist.
- azangru 1y ago
  > if you just turn javascript off that gets rid of 99% Given how websites are built these days, if you just turn javascript off, half of them, if not more, will become unusable.
  - x-complexity 1y ago
    > > if you just turn javascript off that gets rid of 99% > Given how websites are built these days, if you just turn javascript off, half of them, if not more, will become unusable. Basically any webapp with any amount of processing being done on the device becomes unusable if JS is disabled. Photopea's a good example of this.
    - superkuh 1y ago
      Yep. Native applications are much faster, more reliable (can't change underneath you unless you let them), incomparibly more private, and generally longer lasting. Using the web for applications forces you into behavior and situations you wouldn't accept otherwise. Web sites are best made of web pages. Not executable code. And there are still more web sites made out of web pages out there than corporate web apps. The web is huge and there's a lot beyond the top 100 web apps everyone use. Turning off JS auto-execution helps one avoid falling into those traps as well as avoiding fingerprinting in general. And the vast majority of the non-commercial web still works just fine.
jpalawaga 1y ago
Has anyone made a plugin that forces your browser to resize slightly to help avoid fingerprinting? I feel like this is an annoyance I could tolerate, even if over the course of a day or two it causes me to resize it manually to something larger.
- zeech 1y ago
  The name for that is letterboxing. The Tor Browser (and the Mullvad browser, based on the Tor one, and Firefox as of v. 67 with an about:config flag) all support it. There are also add-ons that perform the same basic function with some added customisability [0]. [0] https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/ https://addons.mozilla.org/en-US/firefox/addon/canvasblocker...
- paulryanrogers 1y ago
  They've been around a while. Here's the top Google Result: https://chromewebstore.google.com/detail/canvas-fingerprint-defend/lanfdkkpgfjfdikkncbnojekcppdebfp?hl=en https://chromewebstore.google.com/detail/canvas-fingerprint-... I think Privacy Badger may also do it.
- ohso4 1y ago
  Plugins are an issue themselves. They're used for fingerprinting too!
- handsclean 1y ago
  Firefox has this built in, about:config privacy.resistFingerprinting.letterboxing. It was contributed upstream by Tor, and off by default in Firefox. Edit: I think I misunderstood you, you’re looking for something that adds changing noise to the viewport size. Letterboxing isn’t that, but it is another, arguably better, approach to reducing the same fingerprinting vector.
ohso4 1y ago
check out https://coveryourtracks.eff.org https://coveryourtracks.eff.org There really is no way to combat fingerprinting, other than using Tor on the "safest" mode. <- which disables javascript and some other stuff. otherwise, you're fingerprintable. also, check out https://demo.fingerprint.com/playground https://demo.fingerprint.com/playground
- codedokode 1y ago
  There is a way - provide random garbage via browser APIs, for example, fake GPU name, fake core count, fake IP addresses for WebRTC. But browser vendors do not want to do it. You have to compile your own browser. Such browsers that allow you to masquerade as a different browser do exist but they are targeted at people doing social network marketing (spam and scam) from multiple accounts. Because social networks do not allow using multiple accounts from the same device. These browsers are called "anti-detect browsers" and you can find info about them on Russian underground forums.
  - kube-system 1y ago
    There's only so much you can fake without breaking sites. You may be able to fake the specific elements that a site is looking at today, but it'll always be a cat and mouse game.
soared 1y ago
It doesn’t look like I can access the paper - does it list what ad networks, SSPS, DSPs, advertisers, etc they analyzed?
diogenes_atx 1y ago
Mullvad Browser is designed to evade browser fingerprinting: https://mullvad.net/en/browser/browser-fingerprinting https://mullvad.net/en/browser/browser-fingerprinting https://mullvad.net/en/browser/mullvad-browser https://mullvad.net/en/browser/mullvad-browser
- gruez 1y ago
  AFAIK they're just using firefox with RFP enabled by default? Are they doing anything extra?
  - pixxel 1y ago
    [dead]
  - deleted 1y ago
    [deleted]
- ranger_danger 1y ago
  No browser can accurately evade modern fingerprinting techniques like JA3/JA4 or creepjs.
handsclean 1y ago
I’d like to see better fingerprinting tests than coveryourtracks.eff.org and amiunique.org. Both have the flaw that they test only uniqueness, not persistence, with the result that they’d flag a random number generator as a fingerprint, too. Real fingerprinting protection does often involve random, not binned, results, and this results in both websites flunking even the browsers that do pass their tests, like Tor, Safari, and LibreWolf.
- jiveturkey 1y ago
  fingerprint.com might have such a result-over-time test? they are tops in fingerprinting aaS AFAIK. meta and google are probably the only ones better.
- aniviacat 1y ago
  CreepJS[0] allows you to "add a signature" (basically give your fingerprint a name). If you re-open the page, and it can correlate your fingerprint, it will show you your signature. [0] https://abrahamjuliot.github.io/creepjs/ https://abrahamjuliot.github.io/creepjs/
pdonis 1y ago
My question is, why do browsers share all that information with websites in the first place?
- arp242 1y ago
  Because most of it is useful or even needed. There's perhaps one or two things that can be removed, but not that much. The rest is just measuring the differences between "doing stuff and seeing what happens". For example if I render a box with some text and many different "font-family: [..]" then the size will differ per platform depending on what fonts you have installed, and you can measure that.
  - pdonis 1y ago
    > momost of it is useful or even needed From the article, "your screen resolution, time zone, device model and more" are shared. Why? Why does a website need to know these things? I don't get it. My own device of course needs to know, but why does the website that's sending me HTML and CSS and Javascript need to know? > if I render a box with some text and many different "font-family: [..]" then the size will differ per platform depending on what fonts you have installed, and you can measure that. Why do you need to measure this? The whole point of HTML and CSS was supposed to be to let the user agent render the site in whatever way is best for the user. The website doesn't know what that is; the user does.
    - fc417fc802 1y ago
      The first point - there are usecases but it probably all ought to be user prompted. The vast majority of sites don't need any of it. For example when testing webgpu on chromium I had to globally enable it with a flag which prompted a security warning. A per-site prompt would have been much more secure - I was only using it on localhost. The second point - you don't need to measure it (that I'm aware) but you _can_ measure it because disparate features that all have legitimate usecases on their own can be leveraged in tandem to accomplish things that weren't intended by the authors of the specification.
    - 1y ago
ada1981 1y ago
If you want to see your fingerprint, I found this site: https://amiunique.org/fingerprint https://amiunique.org/fingerprint
- nickyco 1y ago
  My web browser is abrowser (firefox derivative) and I am not using Windows like it says. I do have my javascript restricted though. The site considers my computer unique.
tonyhart7 1y ago
now Imagine that instead of browser, its your phone that's why many companies tried to get you into their mobile Apps
- codedokode 1y ago
  Yes. Today you cannot register Vk, Google or Telegram account without scanning a QR code from smartphone or installing an app. I am surprised that there are people that agree to go through all these difficulties instead of going to a competitor.
  - kube-system 1y ago
    > installing an app > these difficulties Because most people do not find it difficult to install an app. And many people started with the mobile app anyway, and/or use their mobile device as their primary computer.
mediumsmart 1y ago
They don’t have mine but since they have everyone else’s they know who I am anyway.
28304283409234 1y ago
Okay, but what ads? All that energy wasted on fingerprinting me to serve me ads I block.
bofaGuy 1y ago
If I am unique every time I reload the page in a new private window, that means the fingerprint is not the same as the last time I visited right?
masteruvpuppetz 1y ago
so if i use Network Chuck's world's most secure browser, will it help? Link below https://www.youtube.com/watch?v=799uhYUxtvA&pp=ygUOI2NyZWF0ZWJyb3dzZXI%3D https://www.youtube.com/watch?v=799uhYUxtvA&pp=ygUOI2NyZWF0Z...
begueradj 1y ago
First evidence ? It had been there in use for quite a good time. Quoted: "Mid-2010s: Browser fingerprinting became more prevalent, with research indicating its use by various websites and advertising companies."
deleted 1y ago
[deleted]
bradley13 1y ago
Why do browsers share so much information? A standards-compliant website has no need to know which browser version I am using, which operating system I am running, etc..
- shakna 1y ago
  One of the more effective techniques is measuring the speed at which JS renders to your canvas. That's a sidechannel I don't think can be closed easily. As long as JS exists, there will be effective means to examine the sandbox. (I do agree they have unsafe defaults info. It's just removing it isn't enough.)
  - jaoane 1y ago
    Is this a reliable metric? One would think there would be lots of jitter. But if you combine with something else like IP address it may be useful.
    - shakna 1y ago
      There is some noise, but there are bounds. Everyone tends to have fairly common habits and periods of transition into new habits, that combined with IPs, or geolocation, or screen sizes, that you can fairly accurately pin individual devices.. Your processors, memory, and so on all have manufacturing quirks, and then workloads provide some more. The fuzzy circle of rendering times becomes easy to use. Various places have used it since before '14. But here's one random paper that goes into more depth. [0] [0] https://www.ndss-symposium.org/wp-content/uploads/2022-93-paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2022-93-pa...
- fellatio 1y ago
  You can avoid this by using curl. Half kidding.
  - kube-system 1y ago
    Curl, by default, tells sites exactly what version of Curl you are using.
southernplaces7 1y ago
I've got my serious questions about the methodology of these fingerprinting techniques.
usr1106 1y ago
That fingerprints exist is nothing new to someone who has visited https://amiunique.org https://amiunique.org whenever I get a new device or install a new distro for many years. (It also tells me that the project is not very alive, they had the same job offer for many years.) So what would have interested me is how and what kind of impact the researchers measured. The article seems to say pretty much zero about that. Disappointing.
taytus 1y ago
this is like a 15 years old thing
Sephr 1y ago
> “Fingerprinting has always been a concern in the privacy community, but until now, we had no hard proof that it was actually being used to track users,” said Dr. Nitesh Saxena, cybersecurity researcher, professor of computer science and engineering and associate director of the Global Cyber Research Institute at Texas A&M. “Our work helps close that gap.” Maybe if you live in a bubble where documentation published outside of academia doesn't exist. Tracking vendors themselves have claimed to be fingerprinting users' browsers in their privacy policies for over a decade.
- archerx 1y ago
  Some people live in bubbles. I have been aware of https://github.com/fingerprintjs/fingerprintjs https://github.com/fingerprintjs/fingerprintjs For almost 10 years now or some version of it. I stumbled on it when I wanted to keep track of spammy/abusive visitors on an old project.
  - _Algernon_ 1y ago
    They consider me to have different visitor IDs when opening their demo page[1] in a regular window, and an incognito window on the same device. If this is state of the art I'm not too worried. [1]: https://fingerprintjs.github.io/fingerprintjs/ https://fingerprintjs.github.io/fingerprintjs/
    - deleted 1y ago
      [deleted]
    - deleted 1y ago
      [deleted]
    - kapildev 1y ago
      It tracked me on incognito but not across browsers though
- dcow 1y ago
  I’m not saying we should stop caring about online privacy, but the extent to which we fight fingerprinting while not actually solving the problem has made the web worse. It’s kinda like the argument for gun control: the unsavory folk will still fingerprint your browsing while the well-mannered sites suffer from lack of features due to aversion to any persistent handle on the users they might provide, like strong crypto because uh-oh a pub key would give your a “super-cookie” so we can’t have that.
Leo-thorne 1y ago
I used to think incognito mode was enough, until I found out browser fingerprinting is even worse than cookies. It tracks so many tiny details that sometimes it can recognize you even after switching devices. These days, going online feels like being watched.
chistev 1y ago
Maybe this is why Reddit keeps suspending me?
codedokode 1y ago
It is noteworthy that there are browsers that resist fingerprinting much better than Chrome or Firefox. But these browsers are made not by a reputable companies but by shady Russian hackers, they are called "anti-detect browsers". Their purpose is to allow using multiple social network accounts from one machine and avoid getting banned for this.
Aeglaecia 1y ago
chat gpt works in incognito fullscreen but not resized in any way fyi
voidUpdate 1y ago
"And we were like, "We know but, hey" "
ChaoPrayaWave 1y ago
I've always found fingerprint tracking more disturbing than cookies. At least cookies give you a sense of control. You can clear them, block them, and even isolate them by site. Browser fingerprinting is like an ID card that you can't get rid of even if you don't apply for it.
badpenny 1y ago
https://arxiv.org/abs/2409.15656 https://arxiv.org/abs/2409.15656
antisceptic 1y ago
Have these people never heard of ReCaptcha v3?
Havoc 1y ago
Also there doesn't seem to be anything one can do about it. Traditional privacy countermeasures like privacy plugins just make you more unique not less
- create-username 1y ago
  When I discovered fingerprinting, I tried tinkering with every single bit of information possible, but it was hopeless. The error lies in the candid nature of software developers, who couldn’t imagine a world in which every human thought or interaction could be economically exploitable. Why does my browser have to give away so much information?
socalgal2 1y ago
You know what's tracking you more than websites? Apps! You know why sites want you to install an app and keep begging you to install one? Because all the protections a browser adds to make it hard to track disappear once you're in an app. They require you to login, then they share all your data with anyone and everyone.
- welder 1y ago
  My app doesn't do that. The reason I push the app is because we don't ask for your email address, so the only way I have to notify you of new messages or stuff is via an app. Apps are sticky, websites aren't.
- HexPhantom 1y ago
  On iOS now there's the "Ask App Not to Track" prompt. The problem is, that only covers certain types of tracking
renegat0x0 1y ago
I use RSS reader for most news consumption. I noticed that algorithm does not see what I looked via my client.
Huxley1 1y ago
I used to think blocking cookies was enough, but recently I’ve been learning about browser fingerprinting and realized it’s a whole other level of tracking. I’ve tried using Firefox with privacy settings cranked up, but I’m still not sure how much it actually helps. Has anyone found a good way to stop or reduce fingerprinting?
- aembleton 1y ago
  Resizing the window seems to work for me in Firefox
aa_is_op 1y ago
Wasn't this like... "common knowledge"? I'm so confused about this research... especially since there's JS scripts that do this on GitHub for almost a decade now.
Gareth321 1y ago
I spent a lot of time testing this recently and the only browser which consistently resists fingerprinting is Brave. Firefox has some plugins which enable spoofing fingerprints, but I haven't found one which randomises it.
- aembleton 1y ago
  I find that by resizing my window in Firefox, my fingerprint changes. At least that is from testing with https://abrahamjuliot.github.io/creepjs/ https://abrahamjuliot.github.io/creepjs/
  - nipperkinfeet 1y ago
    I guess it can't fingerprint me on 115.24.0esr? Its stuck on "Computing..."
jakupovic 1y ago
No shit. I was doing this, at internet scale, 10+ years ago. Guess what, then we calculated there were around 1.1 real humans on the internet.
ta1243 1y ago
Everytime I go to the EFF fingerprint page it tells me I have a unique fingerprint. If I revisit it an hour later it tells me I have a unique fingerprint. It would be great if it would give me a hash of that fingerprint so I could compare it in a few months time. I'm guessing that my "fingerprint" changes every time I load the page, which makes it somewhat harder to use for fingerprinting me.
malshe 1y ago
There is a lot of discussion in this thread about the novelty of this research. This is because TAMU's PR piece is not accurately describing what this research is about. The paper's abstract highlights a different contribution altogether. They show the evidence that fingerprinting is used for advertising (which might be violating GDPR in some cases) While advertising has become commonplace in today's online interactions, there is a notable dearth of research investigating the extent to which browser fingerprinting is harnessed for user tracking and targeted advertising. Prior studies only measured whether fingerprinting-related scripts are being run on the websites but that in itself does not necessarily mean that fingerprinting is being used for the privacy-invasive purpose of online tracking because fingerprinting might be deployed for the defensive purposes of bot/fraud detection and user authentication. It is imperative to address the mounting concerns regarding the utilization of browser fingerprinting in the realm of online advertising. This paper introduces "FPTrace" (fingerprinting-based tracking assessment and comprehensive evaluation framework), a framework to assess fingerprinting-based user tracking by analyzing ad changes from browser fingerprinting adjustments. Using FPTrace, we emulate user interactions, capture ad bid data, and monitor HTTP traffic. Our large-scale study reveals strong evidence of browser fingerprinting for ad tracking and targeting, shown by bid value disparities and reduced HTTP records after fingerprinting changes. We also show fingerprinting can bypass GDPR/CCPA opt-outs, enabling privacy-invasive tracking. In conclusion, our research unveils the widespread employment of browser fingerprinting in online advertising, prompting critical considerations regarding user privacy and data security within the digital advertising landscape. https://dl.acm.org/doi/10.1145/3696410.3714548 https://dl.acm.org/doi/10.1145/3696410.3714548
everdrive 1y ago
One thing I'm interested are the EFF demo sites which try to identify if you're "uniquely fingerprint-able." What I've seen a lot in the discourse is people attempting to increase the privacy of their browser (via add-ons, configurations, etc) only to see their browser become _more_ unique. They then conclude that you cannot get away from fingerprinting. I think there are a few potential problems with this approach. - A lot of browser-based mitigations (such as Firefox's "resist fingerprinting" settings) send dummy data to websites. So yes, you may have a unique fingerprint according to the EFF site. But, when you visit it later, you could in principle have a different unique fingerprint. I haven't seen much discourse which discusses whether this is a viable point of not. Yes, my Linux Firefox with a bunch of weird settings clearly stands out. But maybe I have a different fingerprint across visits? - Additionally, this strategy seems to say "don't be unique, blend in with the crowd. Look like Windows 10 and Chrome." I think there must be some validity to this. But clearly, advertiser fingerprinting is _most_ interested in the vast middle of the bell curve, ie that huge mass of users with Windows 10-11 & Chrome & Edge. If looking just like everyone else were somehow an effective mitigation, then the advertisers' tracking technology would not actually be effective for the vast majority of cases; the ones they care about the most. - I also wonder what the difference is between what security researches at EFF and other places can do in principle vs. what various websites are actually doing in practice. It's important to remember that advertising is now like a warrant; if an advertiser thinks you're a different person and serves you the wrong ad, no one will ever notice or care. They have no way to verify it, and whatever error exists won't ever show up in their promotional materials. Even if the fingerprinting technology is quite strong, I sincerely doubt the statistics we hear from advertisers (ie, "we can identify 90% of users") can be very accurate. I don't mean to suggest that my points are strictly correct -- however I also don't think the usual discourse around the realities of advertising and tracking really gets to the bottom of things in a very accurate or useful way.
HexPhantom 1y ago
I think we also need tighter regulation and better enforcement around these practices. Otherwise, it's an endless cat-and-mouse game.
1vuio0pswjnm7 1y ago
Evidence aside, it always seems impossible to have any serious discussion of (non-behavioural) fingerprinting online. There is a meme that always shows up about how anything someone does to avoid fingerpringting makes them stand out even more, like some sort of Catch-22. But this meme rests on an assumption that people must use, now and forever, certain software that sends many details that can be used to construct a fingerprint, namely, a software program that web developers call a "modern browser". If those are the conditions, if this is the only software web users are allowed to choose, then yes, I agree, web users have no chance against fingerprinting; they will be involuntarily sending copious details to websites, automatically. The small number of popular "modern" web browsers are generally distributed by surveillance advertising companies, companies increasing their surveillance advertising services or organisations that send data about users to such companies in return for payment. Using this complex software to attempt to "defeat browser fingerprinting" is, no surprise, a losing game. Ultimately, the goal of anti-fingerprinting should be to significantly reduce the number of details sent, which in effect reduces the number of details that can be used to construct a fingerprint. The reason this should be the goal is that when there are fewer details to copy then it is easier to make fingerprints so generic that they are not very useful for surveillance advertising. The Catch-22 meme often refers to the goal as "blending in", achieved by trying to duplicate popular but complex configurations reported to websites by the popular browsers. Truthfully, if the choice of software is smaller programs that have minimal configuration and send almost no details, then it is easier to "blend in", if that is the goal. If a user-modifiable string from an optional User-Agent HTTP header is one of only a few, or perhaps the only, detail in a fingerprint, e.g., if web users make HTTP requests using simpler software that does not run Javascript, then, _if web users wanted too look alike_, it is easier for them to do so. The alleged Catch-22 created by the complexity of "modern" browser can be resolved. As it happens, according to "web security" reports, over half of web traffic comes from simpler clients that do not display advertising. What are the (non-behavioural) "browser fingerprints" of these users. Generally, it is a user-modifiable string in a User-Agent HTTP header. If the header is omittted, or if different "bots" use the same string, then the "browser fingerprint" becomes even less distinguishable. Alas, web users who choose simpler software instead of the larger, more complex "modern" browsers often get mistaken for "bots" based on crude heuristics with high false positive rates. Alas, website operators often do not focus on behaviour, e.g., rate-limiting, when it's easier to simply label anything that is not sending many details and running Javascript as a "bot". The characteristic bad behaviour of "bots" is assumed. Even when it does not exist. A single, one-time HTTP request can trigger a heuristic-based block designed to stop repeated, excessive HTTP requests. The surveillance advertising ecosystem relies on web users all choosing the same few browsers that run Javascripts indiscriminantly without any user input. Even using an add-on/extension like uMatrix with a "modern" browser may trigger "bot" heuristics, because uMatrix lets the user run Javascript discrimantly. Fingerprinting may not be 100% dependant on Javascript. But the most useful fingerprints for advertising, not to mention serving the advertisements themselves, rely on Javascript.
jwatte 1y ago
There's a second side of this story, that nobody ever really talks about, because the cost is so diffuse. There are real, legit, uses for fingerprinting. One of the more common ones is anti-fraud for payments, as well as anti-abuse for social sites. I'm sure you've been to forums or other social sites where ban evading trolls, astroturfers, card checkers, and the like cause constant pain for both legitimate users and site operators. When I ran a large site with social interactions and payments/credits, I got deep insights into all the abusers who try to bilk the system for whatever they can. Because fingerprinting is so hard, bad users have an easy time to return with a zillion sock puppet accounts. As a normal user, my estimation is that I suffer more from the actions of those bad users who poison the well, than I would suffer from an internet that made everyone non-anonymous.
capyba 1y ago
Can’t a good privacy browser randomize some of the ‘nonessential’ elements it sends, thereby creating a new fingerprint for each website? Or change them all to the same one so everyone using that browser has an even more similar fingerprint? Its always struck me as odd that your browser just volunteers so much information every time you go to a site. Then again, my knowledge of how the web works is limited to HTML+CSS from the 00’s…

365 points by gnabgib 1y ago

The Tor Browser has been using predetermined window sizes for years for this reason exactly. It can hardly be "new research".

halb 1y ago

This is a problem because unlike cookies, that are tied to specific domains and isolated by security boundaries, fingerprints can be computed across any domain. It's easy to imagine how a website that tracks users and serves ads solely using fingerprints could be exploited to gain informations about a victim, simply by collecting their fingerprint.

legitster 1y ago

As someone who works in this tech space, nobody brings up how long fingerprints persist. And the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). A lot of the big ad networks right now instead rely heavily on geo-data. Which is why you are probably seeing lots of ads in your feeds that seemingly cross between devices or are relating to interests of your spouse/friends/etc. They just look at the geo on your IP and literally flood the zone. > They developed a measurement framework called FPTrace, which assesses fingerprinting-based user tracking by analyzing how ad systems respond to changes in browser fingerprints. I'm curious to know a bit more about their methodology. It's more likely to me that the ad networks are probably segmenting the ads based on device settings more than they are individually targeting based on fingerprints. For example, someone running new software versions on new hardware might be lumped into a hotter buyer category. Also, simple things like time of day have huge impacts on ad bidding, so knowing how they controlled would be everything.

cosmic_cheese 1y ago
Wouldn’t things like iCloud Private Relay and other VPN-ish things throw a wrench into IP-geo-based tracking? Seems like it’d make the targeting so broad as to be useless.
- lucasban 1y ago
  Conveniently for them, iCloud private relay only really impacts browser usage, third party apps are only impacted when using unencrypted connections, which is unlikely.
- legitster 1y ago
  I don't know a lot about iCloud in particular, but in general there are not enough active VPN users to make a noticeable difference in tracking. By its nature ad tracking does not have to be super accurate in the aggregate to beat a wild guess.
  - v5v3 1y ago
    If you look at app download charts, the main VPN companies dominate. So I suspect there are sufficient active users.
- ztetranz 1y ago
  As an aside, we just spent a couple of weeks camping in our RV with a cellular router connected to a VPN at home. Now that we're back home, Google maps (on a non-GPS equipped device) and Roku still think we're at the campground several states away. I guess my GPS equipped tablet reported the new location of our home IP address. On past experience, it takes about a week to reset.
- Gigachad 1y ago
  iCloud Private Relay has always kept the IP in the same city for me.
  - mediumsmart 1y ago
    Mine is also in a city 146 kilometers away.
minitech 1y ago
> And the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). A fingerprint that changes only by the increase of a browser version isn’t dead; it’s stronger.
- legitster 1y ago
  I'm not sure if I understand this. If you show up on a website one day with one fingerprint, but on the next day it was a different fingerprint, there's no way to connect that it's the same device unless it wasn't a core trait of the fingerprint in the first place.
  - kemotep 1y ago
    If everything is the same but the browser version, a day later how is that not the same person?
  - deleted 1y ago
    [deleted]
  - orev 1y ago
    I think you’re thinking that the fingerprint is reported as a single hash (e.g. SHA512) of multiple attributes, which would of course change if a single bit was different. But there’s no reason they would be reported that way. It could be (and probably more likely) a big data structure of all the values. It would be easy to see that only a few things changed.
- gruez 1y ago
  >it’s stronger. marginally given that most browsers auto-update.
glaucon 1y ago
>As someone who works in this tech space, nobody brings up how long fingerprints persist. And the reality is that even a really precise fingerprint has a half-life of only a few days I've just looked at my fingerprint and I'm told I'm unique (my mum always said that ;-) ). Unfortunately it's impossible, using https://www.amiunique.org/fingerprint https://www.amiunique.org/fingerprint, to determine what elements of the fingerprint, if changed, would make me significantly non-unique but when I look down the list 16/58 javascript attributes are red (the lowest category of similarity ratio) and only two of those are overtly dependent on a version number, another six refer to screen size/resolution. It seems to me that leaves quite a lot of information which isn't going to change all the quickly. While the precise value may change with time I feel like saying "has a half-life of only a few days" tends to understate the effectiveness of this technique.
- ryukoposting 1y ago
  There are a few obvious ones I knew would be bad for me - the Linux user agent, for example. My canvas also came up unique and I'm betting Dark Reader had something to do with that. But then there's other things that don't make any sense. How is "NVIDIA Corporation" only 0.74% for "WebGL Vendor?" Why does navigator.hardwareConcurrency even exist?
  - bitmasher9 1y ago
    My vendor “Apple Computer, Inc” was less than 10% (I’m on iPhone) so I suspect HN crowd probably uses unusual hardware. While my timezone (in USA) and device vendor are both single digit rare, combining the two probably leaks less information than you’d expect because my timezone has a much higher density of Apple devices than global averages. It’s really not until you take into consideration a few other variables that you could really finger print me pretty decently.
  - robin_reala 1y ago
    0.74% does seem a bit low, but most people browse the web on mobile phones, so knock off 50-70% immediately, then of the remaining most will be integrated GPUs from Intel or AMD in laptops. Take away Macs and you’re basically just left with gaming PCs, and laptops where the browser decided the task was difficult enough to spin up a discrete nVidia GPU.
DoctorOetker 1y ago
> And the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). I don't follow, consider hardware interrupts and their handling delays depending say on the combination of apps installed, the exact gpu driver version, etc ... An occasional update could change the relevant timings, but would unlikely change all timing distributions (since perhaps the gpu driver wasn't updated, or the some other app wasn't)
- gruez 1y ago
  >consider hardware interrupts and their handling delays depending say on the combination of apps installed There's zero chance that apps on iOS and Android have access to "hardware interrupts" (whatever that means), because both platforms are too sandboxed. Moreover timing resolution on javascript has been nerfed since several years ago because of fears of spectre attacks. >the exact gpu driver version, etc ... If you're just rendering simple polygons, it's highly implausible that timings would change in between drivers. You might be able to tell driver versions apart if you spend hundreds/thousands of man-hours reverse engineering each driver version for quirks to test against, but I doubt they're pouring that much effort into this.
  - qualeed 1y ago
    >"hardware interrupts" (whatever that means) Hardware interrupts are a standard part of computing. (see https://en.wikipedia.org/wiki/Interrupt#Hardware_interrupts https://en.wikipedia.org/wiki/Interrupt#Hardware_interrupts) "Android also inherits the interrupt mechanism from Linux, which is designed for the efficient communication between the CPU and external devices. When new hardware events (e.g., user touching the screen) come, the corresponding hardware device (e.g., touchscreen controller) sends a signal to ask OS for immediate processing" And, at least previously, the timing of interrupts have been used to facilitate information leakage. For example: "Through analyzing the interrupt time series produced from touchscreen controller, attacker’s chance of cracking user’s unlock pattern is increased substantially. The interrupt time series produced from Display Sub-System reveals unique UI refreshing patterns and could be leveraged as fingerprints to identify the app running in the foreground" https://staff.ie.cuhk.edu.hk/~khzhang/my-papers/2016-oakland-interrupt.pdf https://staff.ie.cuhk.edu.hk/~khzhang/my-papers/2016-oakland... It's been awhile since I've looked closely at anything related to phones, but for decades /proc/interrupts was globally readable. It may still be.
kul_ 1y ago
> A lot of the big ad networks right now instead rely heavily on geo-data How does this work in today's age where ISPs normally will have at least one level of NATing with ipv4. And given ipv6 with prefix delegation is still far away this should continue to be very imprecise?
- fiddlerwoaroof 1y ago
  I’ve never had an unroutable IP in the US
  - wut42 1y ago
    CGNAT does not means unroutable IP, it just means you would only have assigned a small range of ports on a routable IP with others.
    - BenjiWiebe 1y ago
      If you have CGNAT, the IP on your router's external interface is unroutable. Just like how when you do NAT for your home network, your devices get assigned non-routable private use only address space. Unroutable meaning not publicly routable. Of course you can route traffic through your own LAN to your Internet gateway.
- kulahan 1y ago
  Billboards are still among the most effective forms of advertising in terms of efficiency. You don’t need to be very close. I see myself popping up probably 10 miles from where I’m actually at, but the businesses aren’t that inaccessible.
- djrj477dhsnv 1y ago
  > ISPs normally will have at least one level of NATing with ipv4. I don't think that's generally true for home DSL/cable/fiber service. I've only seen it on mobile internet.
  - kul_ 1y ago
tjpnz 1y ago
>A lot of the big ad networks right now instead rely heavily on geo-data. Which is why you are probably seeing lots of ads in your feeds that seemingly cross between devices or are relating to interests of your spouse/friends/etc. They just look at the geo on your IP and literally flood the zone. I don't see them and nor does my spouse. Ads aren't allowed in my house (to mangle the words of a famous adtech company).
jgalt212 1y ago
> As someone who works in this tech space, nobody brings up how long fingerprints persist. And the reality is that even a really precise fingerprint has a half-life of only a few days True that. We use cookies + fingerprints to monitor for license compliance (i.e. ensure users are not id/password sharing). Sometimes we can use a fingerprint to recover a deleted cookie, but not all that often. What would really help is a fingerprint transition matrix, so we could make some probabilistic guesses.
fc417fc802 1y ago
> the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). The size of a maximized window is unlikely to change unless either the desktop environment is updated in some way or the monitor (hardware) itself is swapped out. GPU hardware is unlikely to change frequently and various idiosyncrasies can be fingerprinted via either webgl or webgpu. Installed fonts probably don't change all that frequently. I'd expect TCP stack fingerprinting to be fairly stable. That's but a few examples off the top of my head. As long as only one characteristic changes at a time you can link the cluster together. Worse, if client side identifiers (ex cookies) aren't wiped simultaneously then you can link two entirely distinct fingerprints with full confidence.
- everdrive 1y ago
  What is TCP stack fingerprinting?
  - rsync 1y ago
    It is what nmap does. In theory, this would be a rich landscape for an entirely different abstraction layer for fingerprinting… However, I am skeptical that the typical fingerprinting tool chains are receiving data that reaches that far down in the stack…
    - fc417fc802 1y ago
      Also TCP timestamp if the network stack doesn't apply a randomized offset. As of 4.10 Linux added randomization; no idea about others. Getting a bit farther out there, CPU clock skew can be derived from the (randomly offset) TCP timestamps. That varies with temperature and thus load so it can be used to pick out otherwise indistinguishable traffic streams originating on the same physical host. Back in the realm of commonly employed techniques, higher levels of the networking stack are fingerprinted in the wild. https://blog.cloudflare.com/ja4-signals/ https://blog.cloudflare.com/ja4-signals/ Moving even farther up, the human interaction streams themselves are commonly fingerprinted. I realize that's a bit of a tangent but OP had suggested that fingerprints had short half lives and this is a very strong counterexample that I failed to mention earlier. https://www.whonix.org/wiki/Keystroke_and_Mouse_Deanonymization https://www.whonix.org/wiki/Keystroke_and_Mouse_Deanonymizat...
NoahZuniga 1y ago
fingerprint.com claims that they can fingerprint a user with >90% accuracy over 120 days. A half-life of a few days is awfully optimistic.
WalterBright 1y ago
I have no idea what ads they serve me because I have ad blindness. My brain just refuses to perceive them. Even when they float over the text I am trying to read, I do not see them.
- erkt 1y ago
  This is a top tier super power. Ublock on Firefox and AdGuard on iPhone are pretty effective. When I actually see an ad it physically hurts.
  - godelski 1y ago
    On iPhone check out Orion browser. Blocks ads, even on YouTube. Though sometimes video quality goes low (manually set it higher to fix). Firefox focus also works, but only one tab If on Android, check out revanced. You can remove ads from lots of apps. Highly recommend Firefox as well.
    - _kidlike 1y ago
      Brave is also extremely effective at removing ads while keeping websites functional (including YouTube). It even has some fingerprinting protection. (and before someone complains, you can disable all the crypto stuff)
      - godelski 1y ago
        Sure but personally I'm against recommending different flavors of chrome. Brave is a nice idea but it still gives undue power to Google because at the be of the day, they control chromium. It also makes a hard problem for chromium reskins as they keep finding things chromium can use to track their users...
- hinterlands 1y ago
  Every person says this, but it's a massive industry for a reason. It's the same as with The North Face logo on jackets. You're never paying attention and you don't recall any specific person wearing the jacket. But somehow, when it's time to buy a jacket, you know about the brand, and know all the people in your socioeconomic circle seem to like it. Some online ads want to grab your attention, but most are just about building almost-subliminal connections like that.
deleted 1y ago
[deleted]
deleted 1y ago
[deleted]
m000 1y ago
I think you miss some key issues here: (a) Browser fingerprinting can be very robust if you select your data points correctly. E.g. installed plugins, content language, fonts. The used data points can be dynamically fine-tuned in retrospect and be different for each identified agent. (b) In the grand scheme of things, the browser fingerprint is only one data point. If you combine it with other data points (e.g. the geo-data you mentioned) you can overcome some of its limitations as well as intentional evasion attempts. E.g. a new fingerprint appears at my workplace IP that has 80% similarity with my old fingerprint. At the same time my old fingerprint goes dark. (c) The ad companies take the shotgun approach because it works for them: it is cost-effective and can be defended as a legit method. Entities that are interested in surveilance for purposes other than selling ads and already collect a trove of other data can do a lot better than ad companies.
- 400thecat 1y ago
  > Browser fingerprinting can be very robust if you select your data points correctly. E.g. installed plugins can websites really see installed plugins?
  - peetistaken 1y ago
    Not really. They can‘t see a list, as navigator.plugins is dummy data in every major browser, but they might able to detect eg. Adblockers by other means
    - dubcanada 1y ago
      Adblocking is not rocket science, you block the DNS of the ads. Some also use JS to mess or remove ads. All of this is easily detected, can I ping X, can I see DOM Y, etc.
- coldtea 1y ago
  >E.g. installed plugins, content language, fonts. Nobody installs plugins in 2025. Content language is basically like the geo-data the parent said, but coarser. And billions of people just have the same (default OS) fonts - plus iirc, there are broswer mitigations against font enumeration for fingerprinting.
Swoerd123 1y ago
Siteimprove Analytics appears to be confident enough about their cookieless tracking technology (compared to cookie based tracking) to claim: In general, Visitor Hash is expected to be more persistent, resulting in a drop in the number of unique visitors. Since cookies are known to have an increasingly short lifetime, leading to overestimated data about unique visitors, we consider the Visitor Hash technology to be more accurate at capturing information about unique and returning visitors When Cookieless tracking is enabled, it replaces the traditional use of cookies with a "Visitor Hash" made of non-personal information only. This information includes hashed IP and HTTP header values including browser type, browser version, browser language, and the user agent string. The Visitor Hash only consists of server-side attributes passed along by the website server. Note: Siteimprove analytics does not collect client-side attributes. The Visitor Hash is used for the same functionality as the cookie and nothing else. For some websites, like intranets, there is an increased likelihood that the visitors could end up getting the same Visitor Hash as they might all be accessing the site from the same IP and on the same device setups. In those cases all page views would appear to be coming from one, or a few, visits. That's why we recommend excluding those domains from using cookieless tracking. See the "How to exclude domains from having cookieless tracking enabled" section below for more information.
bastawhiz 1y ago
A fingerprint is composed of many signals. Even if a few of those signals change, the less-specific fingerprint made by the remaining signals can still be used to infer who a user is. And it doesn't need to be perfect: having a good idea that someone who almost looks like you from yesterday was interested in cat food is a good enough reason to auction ad space to cat food companies today.

leptons 1y ago

“Fingerprinting has always been a concern in the privacy community, but until now, we had no hard proof that it was actually being used to track users,” Huh? In 2025?? Fingerprinting has been around and actively used to track users for probably at least 20 years.

martinky24 1y ago
They said "hard proof". Can you point to openly available "hard proof"? Otherwise your reply is just snark that doesn't add much.
- antonok 1y ago
  As someone who's been building an adblocker for the last 6 years: yes, there's plenty of proof in the devtools console on more websites than you'd think. Fingerprintjs [1] is a well known one that gets a lot of use. And if you check EasyPrivacy, you'll see the rules to block it [2] have been in place for a long time. [1] https://github.com/fingerprintjs/fingerprintjs https://github.com/fingerprintjs/fingerprintjs [2] https://github.com/easylist/easylist/blob/132813613d04b7228c3d43bd21f3fa13077edaec/easyprivacy/easyprivacy_general.txt#L908-L913 https://github.com/easylist/easylist/blob/132813613d04b7228c...
- JimDabell 1y ago
  Why do you think a porn site was trying to access MIDI devices? To play some smooth jazz? https://www.obsessivefacts.com/images/blog/2020-04-04-the-javascript-black-hole/xhamster-cropped.png https://www.obsessivefacts.com/images/blog/2020-04-04-the-ja... https://news.ycombinator.com/item?id=23679063 https://news.ycombinator.com/item?id=23679063
- mbrubeck 1y ago
  From over a decade ago, a paper on then-commercially-available browser fingerprinting tech, including a study of its deployment in the wild: https://dl.acm.org/doi/10.1109/SP.2013.43 https://dl.acm.org/doi/10.1109/SP.2013.43 Nick Nikiforakis, Alexandros Kapravelos, Wouter Joosen, Christopher Kruegel, Frank Piessens, and Giovanni Vigna. 2013. Cookieless Monster: Exploring the Ecosystem of Web-Based Device Fingerprinting. In Proceedings of the 2013 IEEE Symposium on Security and Privacy (SP ’13).

disambiguation 1y ago

https://www.amiunique.org/ https://www.amiunique.org/ > your browser shares a surprising amount of information, like your screen resolution, time zone, device model and more. When combined, these details create a “fingerprint” that’s often unique to your browser. Unlike cookies — which users can delete or block — fingerprinting is much harder to detect or prevent. Ironically, the more fine tuned and hardened your device, OS, and browser are for security and privacy, the worse your fingerprint liability becomes. more idle thoughts - it's strange and disappointing that in the vast space and history of FOSS tools, a proper open source browser never took off. I suppose monopolizing from the start was too lucrative to let it be free. Yet there really is little recourse for privacy enthusiasts. I've entertained the idea of using my own scraper, so I can access the web offline, though seems like more trouble than its worth.

jcranmer 1y ago
> it's strange and disappointing that in the vast space and history of FOSS tools, a proper open source browser never took off. What makes you disqualify Firefox from being a "proper open source browser"?
- bronson 1y ago
  Firefox never took off.
  - diggan 1y ago
    At one point, Firefox (3.5 specifically) was #1, for a brief moment: > Between mid-December 2009 and February 2010, Firefox 3.5 was the most popular browser (when counting individual browser versions) according to StatCounter, and as of February 2010 was one of the top 3 browser versions according to Net Applications. Both milestones involved passing Internet Explorer 7, which previously held the No. 1 and No. 3 spots in popularity according to StatCounter and Net Applications, respectively - https://en.wikipedia.org/wiki/Firefox_3.5 https://en.wikipedia.org/wiki/Firefox_3.5 Then Chrome appeared and flattened both IE and Firefox.

diggan 1y ago

I guess we all knew this was happening, but it's hard to "prove" that they track you across devices without resorting to anecdotes. This seems to be a framework for performing studies + a large-scale study in order to get some more concrete proof that it is actually happening in practice, and the fingerprinting isn't just used for other things like anti-abuse. > Prior studies only measured whether fingerprinting-related scripts are being run on the websites but that in itself does not necessarily mean that fingerprinting is being used for the privacy-invasive purpose of online tracking because fingerprinting might be deployed for the defensive purposes of bot/fraud detection and user authentication. [...] a framework to assess fingerprinting-based user tracking by analyzing ad changes from browser fingerprinting adjustments - https://dl.acm.org/doi/10.1145/3696410.3714548 https://dl.acm.org/doi/10.1145/3696410.3714548 Unfortunately I don't have access to the paper myself, so not sure what details they share beyond that.

superkuh 1y ago

Luckily most of this is done by web devs using their normal tools which means if you just turn javascript off that gets rid of 99%. Sure, there are ad companies and related out there using actual webserver logs but more and more it's relying on you the user blindly executing their code on your machine. After all, everyone does it. Anyone not running javascript is weird, probably not monetizable, and therefore is a bot and doesn't exist.

azangru 1y ago
> if you just turn javascript off that gets rid of 99% Given how websites are built these days, if you just turn javascript off, half of them, if not more, will become unusable.
- x-complexity 1y ago
  > > if you just turn javascript off that gets rid of 99% > Given how websites are built these days, if you just turn javascript off, half of them, if not more, will become unusable. Basically any webapp with any amount of processing being done on the device becomes unusable if JS is disabled. Photopea's a good example of this.
  - superkuh 1y ago
    Yep. Native applications are much faster, more reliable (can't change underneath you unless you let them), incomparibly more private, and generally longer lasting. Using the web for applications forces you into behavior and situations you wouldn't accept otherwise. Web sites are best made of web pages. Not executable code. And there are still more web sites made out of web pages out there than corporate web apps. The web is huge and there's a lot beyond the top 100 web apps everyone use. Turning off JS auto-execution helps one avoid falling into those traps as well as avoiding fingerprinting in general. And the vast majority of the non-commercial web still works just fine.

jpalawaga 1y ago

Has anyone made a plugin that forces your browser to resize slightly to help avoid fingerprinting? I feel like this is an annoyance I could tolerate, even if over the course of a day or two it causes me to resize it manually to something larger.

zeech 1y ago
The name for that is letterboxing. The Tor Browser (and the Mullvad browser, based on the Tor one, and Firefox as of v. 67 with an about:config flag) all support it. There are also add-ons that perform the same basic function with some added customisability [0]. [0] https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/ https://addons.mozilla.org/en-US/firefox/addon/canvasblocker...
paulryanrogers 1y ago
They've been around a while. Here's the top Google Result: https://chromewebstore.google.com/detail/canvas-fingerprint-defend/lanfdkkpgfjfdikkncbnojekcppdebfp?hl=en https://chromewebstore.google.com/detail/canvas-fingerprint-... I think Privacy Badger may also do it.
ohso4 1y ago
Plugins are an issue themselves. They're used for fingerprinting too!
handsclean 1y ago
Firefox has this built in, about:config privacy.resistFingerprinting.letterboxing. It was contributed upstream by Tor, and off by default in Firefox. Edit: I think I misunderstood you, you’re looking for something that adds changing noise to the viewport size. Letterboxing isn’t that, but it is another, arguably better, approach to reducing the same fingerprinting vector.

ohso4 1y ago

check out https://coveryourtracks.eff.org https://coveryourtracks.eff.org There really is no way to combat fingerprinting, other than using Tor on the "safest" mode. <- which disables javascript and some other stuff. otherwise, you're fingerprintable. also, check out https://demo.fingerprint.com/playground https://demo.fingerprint.com/playground

codedokode 1y ago
There is a way - provide random garbage via browser APIs, for example, fake GPU name, fake core count, fake IP addresses for WebRTC. But browser vendors do not want to do it. You have to compile your own browser. Such browsers that allow you to masquerade as a different browser do exist but they are targeted at people doing social network marketing (spam and scam) from multiple accounts. Because social networks do not allow using multiple accounts from the same device. These browsers are called "anti-detect browsers" and you can find info about them on Russian underground forums.
- kube-system 1y ago
  There's only so much you can fake without breaking sites. You may be able to fake the specific elements that a site is looking at today, but it'll always be a cat and mouse game.

soared 1y ago

It doesn’t look like I can access the paper - does it list what ad networks, SSPS, DSPs, advertisers, etc they analyzed?

diogenes_atx 1y ago

Mullvad Browser is designed to evade browser fingerprinting: https://mullvad.net/en/browser/browser-fingerprinting https://mullvad.net/en/browser/browser-fingerprinting https://mullvad.net/en/browser/mullvad-browser https://mullvad.net/en/browser/mullvad-browser

gruez 1y ago
AFAIK they're just using firefox with RFP enabled by default? Are they doing anything extra?
- pixxel 1y ago
  [dead]
- deleted 1y ago
  [deleted]
ranger_danger 1y ago
No browser can accurately evade modern fingerprinting techniques like JA3/JA4 or creepjs.

handsclean 1y ago

I’d like to see better fingerprinting tests than coveryourtracks.eff.org and amiunique.org. Both have the flaw that they test only uniqueness, not persistence, with the result that they’d flag a random number generator as a fingerprint, too. Real fingerprinting protection does often involve random, not binned, results, and this results in both websites flunking even the browsers that do pass their tests, like Tor, Safari, and LibreWolf.

jiveturkey 1y ago
fingerprint.com might have such a result-over-time test? they are tops in fingerprinting aaS AFAIK. meta and google are probably the only ones better.
aniviacat 1y ago
CreepJS[0] allows you to "add a signature" (basically give your fingerprint a name). If you re-open the page, and it can correlate your fingerprint, it will show you your signature. [0] https://abrahamjuliot.github.io/creepjs/ https://abrahamjuliot.github.io/creepjs/

pdonis 1y ago

My question is, why do browsers share all that information with websites in the first place?

arp242 1y ago
Because most of it is useful or even needed. There's perhaps one or two things that can be removed, but not that much. The rest is just measuring the differences between "doing stuff and seeing what happens". For example if I render a box with some text and many different "font-family: [..]" then the size will differ per platform depending on what fonts you have installed, and you can measure that.
- pdonis 1y ago
  > momost of it is useful or even needed From the article, "your screen resolution, time zone, device model and more" are shared. Why? Why does a website need to know these things? I don't get it. My own device of course needs to know, but why does the website that's sending me HTML and CSS and Javascript need to know? > if I render a box with some text and many different "font-family: [..]" then the size will differ per platform depending on what fonts you have installed, and you can measure that. Why do you need to measure this? The whole point of HTML and CSS was supposed to be to let the user agent render the site in whatever way is best for the user. The website doesn't know what that is; the user does.
  - fc417fc802 1y ago
    The first point - there are usecases but it probably all ought to be user prompted. The vast majority of sites don't need any of it. For example when testing webgpu on chromium I had to globally enable it with a flag which prompted a security warning. A per-site prompt would have been much more secure - I was only using it on localhost. The second point - you don't need to measure it (that I'm aware) but you _can_ measure it because disparate features that all have legitimate usecases on their own can be leveraged in tandem to accomplish things that weren't intended by the authors of the specification.
  - 1y ago

ada1981 1y ago

If you want to see your fingerprint, I found this site: https://amiunique.org/fingerprint https://amiunique.org/fingerprint

nickyco 1y ago
My web browser is abrowser (firefox derivative) and I am not using Windows like it says. I do have my javascript restricted though. The site considers my computer unique.

tonyhart7 1y ago

now Imagine that instead of browser, its your phone that's why many companies tried to get you into their mobile Apps

codedokode 1y ago
Yes. Today you cannot register Vk, Google or Telegram account without scanning a QR code from smartphone or installing an app. I am surprised that there are people that agree to go through all these difficulties instead of going to a competitor.
- kube-system 1y ago
  > installing an app > these difficulties Because most people do not find it difficult to install an app. And many people started with the mobile app anyway, and/or use their mobile device as their primary computer.

mediumsmart 1y ago

They don’t have mine but since they have everyone else’s they know who I am anyway.

28304283409234 1y ago

Okay, but what ads? All that energy wasted on fingerprinting me to serve me ads I block.

bofaGuy 1y ago

If I am unique every time I reload the page in a new private window, that means the fingerprint is not the same as the last time I visited right?

masteruvpuppetz 1y ago

so if i use Network Chuck's world's most secure browser, will it help? Link below https://www.youtube.com/watch?v=799uhYUxtvA&pp=ygUOI2NyZWF0ZWJyb3dzZXI%3D https://www.youtube.com/watch?v=799uhYUxtvA&pp=ygUOI2NyZWF0Z...

begueradj 1y ago

First evidence ? It had been there in use for quite a good time. Quoted: "Mid-2010s: Browser fingerprinting became more prevalent, with research indicating its use by various websites and advertising companies."

deleted 1y ago

[deleted]

bradley13 1y ago

Why do browsers share so much information? A standards-compliant website has no need to know which browser version I am using, which operating system I am running, etc..

shakna 1y ago
One of the more effective techniques is measuring the speed at which JS renders to your canvas. That's a sidechannel I don't think can be closed easily. As long as JS exists, there will be effective means to examine the sandbox. (I do agree they have unsafe defaults info. It's just removing it isn't enough.)
- jaoane 1y ago
  Is this a reliable metric? One would think there would be lots of jitter. But if you combine with something else like IP address it may be useful.
  - shakna 1y ago
    There is some noise, but there are bounds. Everyone tends to have fairly common habits and periods of transition into new habits, that combined with IPs, or geolocation, or screen sizes, that you can fairly accurately pin individual devices.. Your processors, memory, and so on all have manufacturing quirks, and then workloads provide some more. The fuzzy circle of rendering times becomes easy to use. Various places have used it since before '14. But here's one random paper that goes into more depth. [0] [0] https://www.ndss-symposium.org/wp-content/uploads/2022-93-paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2022-93-pa...
fellatio 1y ago
You can avoid this by using curl. Half kidding.
- kube-system 1y ago
  Curl, by default, tells sites exactly what version of Curl you are using.

southernplaces7 1y ago

I've got my serious questions about the methodology of these fingerprinting techniques.

usr1106 1y ago

That fingerprints exist is nothing new to someone who has visited https://amiunique.org https://amiunique.org whenever I get a new device or install a new distro for many years. (It also tells me that the project is not very alive, they had the same job offer for many years.) So what would have interested me is how and what kind of impact the researchers measured. The article seems to say pretty much zero about that. Disappointing.

taytus 1y ago

this is like a 15 years old thing

Sephr 1y ago

> “Fingerprinting has always been a concern in the privacy community, but until now, we had no hard proof that it was actually being used to track users,” said Dr. Nitesh Saxena, cybersecurity researcher, professor of computer science and engineering and associate director of the Global Cyber Research Institute at Texas A&M. “Our work helps close that gap.” Maybe if you live in a bubble where documentation published outside of academia doesn't exist. Tracking vendors themselves have claimed to be fingerprinting users' browsers in their privacy policies for over a decade.

archerx 1y ago
Some people live in bubbles. I have been aware of https://github.com/fingerprintjs/fingerprintjs https://github.com/fingerprintjs/fingerprintjs For almost 10 years now or some version of it. I stumbled on it when I wanted to keep track of spammy/abusive visitors on an old project.
- _Algernon_ 1y ago
  They consider me to have different visitor IDs when opening their demo page[1] in a regular window, and an incognito window on the same device. If this is state of the art I'm not too worried. [1]: https://fingerprintjs.github.io/fingerprintjs/ https://fingerprintjs.github.io/fingerprintjs/
  - deleted 1y ago
    [deleted]
  - deleted 1y ago
    [deleted]
  - kapildev 1y ago
    It tracked me on incognito but not across browsers though
dcow 1y ago
I’m not saying we should stop caring about online privacy, but the extent to which we fight fingerprinting while not actually solving the problem has made the web worse. It’s kinda like the argument for gun control: the unsavory folk will still fingerprint your browsing while the well-mannered sites suffer from lack of features due to aversion to any persistent handle on the users they might provide, like strong crypto because uh-oh a pub key would give your a “super-cookie” so we can’t have that.

Leo-thorne 1y ago

I used to think incognito mode was enough, until I found out browser fingerprinting is even worse than cookies. It tracks so many tiny details that sometimes it can recognize you even after switching devices. These days, going online feels like being watched.

chistev 1y ago

Maybe this is why Reddit keeps suspending me?

codedokode 1y ago

It is noteworthy that there are browsers that resist fingerprinting much better than Chrome or Firefox. But these browsers are made not by a reputable companies but by shady Russian hackers, they are called "anti-detect browsers". Their purpose is to allow using multiple social network accounts from one machine and avoid getting banned for this.

Aeglaecia 1y ago

chat gpt works in incognito fullscreen but not resized in any way fyi

voidUpdate 1y ago

"And we were like, "We know but, hey" "

ChaoPrayaWave 1y ago

I've always found fingerprint tracking more disturbing than cookies. At least cookies give you a sense of control. You can clear them, block them, and even isolate them by site. Browser fingerprinting is like an ID card that you can't get rid of even if you don't apply for it.

badpenny 1y ago

https://arxiv.org/abs/2409.15656 https://arxiv.org/abs/2409.15656

antisceptic 1y ago

Have these people never heard of ReCaptcha v3?

Havoc 1y ago

Also there doesn't seem to be anything one can do about it. Traditional privacy countermeasures like privacy plugins just make you more unique not less

create-username 1y ago
When I discovered fingerprinting, I tried tinkering with every single bit of information possible, but it was hopeless. The error lies in the candid nature of software developers, who couldn’t imagine a world in which every human thought or interaction could be economically exploitable. Why does my browser have to give away so much information?

socalgal2 1y ago

You know what's tracking you more than websites? Apps! You know why sites want you to install an app and keep begging you to install one? Because all the protections a browser adds to make it hard to track disappear once you're in an app. They require you to login, then they share all your data with anyone and everyone.

welder 1y ago
My app doesn't do that. The reason I push the app is because we don't ask for your email address, so the only way I have to notify you of new messages or stuff is via an app. Apps are sticky, websites aren't.
HexPhantom 1y ago
On iOS now there's the "Ask App Not to Track" prompt. The problem is, that only covers certain types of tracking

renegat0x0 1y ago

I use RSS reader for most news consumption. I noticed that algorithm does not see what I looked via my client.

Huxley1 1y ago

I used to think blocking cookies was enough, but recently I’ve been learning about browser fingerprinting and realized it’s a whole other level of tracking. I’ve tried using Firefox with privacy settings cranked up, but I’m still not sure how much it actually helps. Has anyone found a good way to stop or reduce fingerprinting?

aembleton 1y ago
Resizing the window seems to work for me in Firefox

aa_is_op 1y ago

Wasn't this like... "common knowledge"? I'm so confused about this research... especially since there's JS scripts that do this on GitHub for almost a decade now.

Gareth321 1y ago

I spent a lot of time testing this recently and the only browser which consistently resists fingerprinting is Brave. Firefox has some plugins which enable spoofing fingerprints, but I haven't found one which randomises it.

aembleton 1y ago
I find that by resizing my window in Firefox, my fingerprint changes. At least that is from testing with https://abrahamjuliot.github.io/creepjs/ https://abrahamjuliot.github.io/creepjs/
- nipperkinfeet 1y ago
  I guess it can't fingerprint me on 115.24.0esr? Its stuck on "Computing..."

jakupovic 1y ago

No shit. I was doing this, at internet scale, 10+ years ago. Guess what, then we calculated there were around 1.1 real humans on the internet.

ta1243 1y ago

Everytime I go to the EFF fingerprint page it tells me I have a unique fingerprint. If I revisit it an hour later it tells me I have a unique fingerprint. It would be great if it would give me a hash of that fingerprint so I could compare it in a few months time. I'm guessing that my "fingerprint" changes every time I load the page, which makes it somewhat harder to use for fingerprinting me.

malshe 1y ago

There is a lot of discussion in this thread about the novelty of this research. This is because TAMU's PR piece is not accurately describing what this research is about. The paper's abstract highlights a different contribution altogether. They show the evidence that fingerprinting is used for advertising (which might be violating GDPR in some cases) While advertising has become commonplace in today's online interactions, there is a notable dearth of research investigating the extent to which browser fingerprinting is harnessed for user tracking and targeted advertising. Prior studies only measured whether fingerprinting-related scripts are being run on the websites but that in itself does not necessarily mean that fingerprinting is being used for the privacy-invasive purpose of online tracking because fingerprinting might be deployed for the defensive purposes of bot/fraud detection and user authentication. It is imperative to address the mounting concerns regarding the utilization of browser fingerprinting in the realm of online advertising. This paper introduces "FPTrace" (fingerprinting-based tracking assessment and comprehensive evaluation framework), a framework to assess fingerprinting-based user tracking by analyzing ad changes from browser fingerprinting adjustments. Using FPTrace, we emulate user interactions, capture ad bid data, and monitor HTTP traffic. Our large-scale study reveals strong evidence of browser fingerprinting for ad tracking and targeting, shown by bid value disparities and reduced HTTP records after fingerprinting changes. We also show fingerprinting can bypass GDPR/CCPA opt-outs, enabling privacy-invasive tracking. In conclusion, our research unveils the widespread employment of browser fingerprinting in online advertising, prompting critical considerations regarding user privacy and data security within the digital advertising landscape. https://dl.acm.org/doi/10.1145/3696410.3714548 https://dl.acm.org/doi/10.1145/3696410.3714548

everdrive 1y ago

One thing I'm interested are the EFF demo sites which try to identify if you're "uniquely fingerprint-able." What I've seen a lot in the discourse is people attempting to increase the privacy of their browser (via add-ons, configurations, etc) only to see their browser become _more_ unique. They then conclude that you cannot get away from fingerprinting. I think there are a few potential problems with this approach. - A lot of browser-based mitigations (such as Firefox's "resist fingerprinting" settings) send dummy data to websites. So yes, you may have a unique fingerprint according to the EFF site. But, when you visit it later, you could in principle have a different unique fingerprint. I haven't seen much discourse which discusses whether this is a viable point of not. Yes, my Linux Firefox with a bunch of weird settings clearly stands out. But maybe I have a different fingerprint across visits? - Additionally, this strategy seems to say "don't be unique, blend in with the crowd. Look like Windows 10 and Chrome." I think there must be some validity to this. But clearly, advertiser fingerprinting is _most_ interested in the vast middle of the bell curve, ie that huge mass of users with Windows 10-11 & Chrome & Edge. If looking just like everyone else were somehow an effective mitigation, then the advertisers' tracking technology would not actually be effective for the vast majority of cases; the ones they care about the most. - I also wonder what the difference is between what security researches at EFF and other places can do in principle vs. what various websites are actually doing in practice. It's important to remember that advertising is now like a warrant; if an advertiser thinks you're a different person and serves you the wrong ad, no one will ever notice or care. They have no way to verify it, and whatever error exists won't ever show up in their promotional materials. Even if the fingerprinting technology is quite strong, I sincerely doubt the statistics we hear from advertisers (ie, "we can identify 90% of users") can be very accurate. I don't mean to suggest that my points are strictly correct -- however I also don't think the usual discourse around the realities of advertising and tracking really gets to the bottom of things in a very accurate or useful way.

HexPhantom 1y ago

I think we also need tighter regulation and better enforcement around these practices. Otherwise, it's an endless cat-and-mouse game.

1vuio0pswjnm7 1y ago

Evidence aside, it always seems impossible to have any serious discussion of (non-behavioural) fingerprinting online. There is a meme that always shows up about how anything someone does to avoid fingerpringting makes them stand out even more, like some sort of Catch-22. But this meme rests on an assumption that people must use, now and forever, certain software that sends many details that can be used to construct a fingerprint, namely, a software program that web developers call a "modern browser". If those are the conditions, if this is the only software web users are allowed to choose, then yes, I agree, web users have no chance against fingerprinting; they will be involuntarily sending copious details to websites, automatically. The small number of popular "modern" web browsers are generally distributed by surveillance advertising companies, companies increasing their surveillance advertising services or organisations that send data about users to such companies in return for payment. Using this complex software to attempt to "defeat browser fingerprinting" is, no surprise, a losing game. Ultimately, the goal of anti-fingerprinting should be to significantly reduce the number of details sent, which in effect reduces the number of details that can be used to construct a fingerprint. The reason this should be the goal is that when there are fewer details to copy then it is easier to make fingerprints so generic that they are not very useful for surveillance advertising. The Catch-22 meme often refers to the goal as "blending in", achieved by trying to duplicate popular but complex configurations reported to websites by the popular browsers. Truthfully, if the choice of software is smaller programs that have minimal configuration and send almost no details, then it is easier to "blend in", if that is the goal. If a user-modifiable string from an optional User-Agent HTTP header is one of only a few, or perhaps the only, detail in a fingerprint, e.g., if web users make HTTP requests using simpler software that does not run Javascript, then, _if web users wanted too look alike_, it is easier for them to do so. The alleged Catch-22 created by the complexity of "modern" browser can be resolved. As it happens, according to "web security" reports, over half of web traffic comes from simpler clients that do not display advertising. What are the (non-behavioural) "browser fingerprints" of these users. Generally, it is a user-modifiable string in a User-Agent HTTP header. If the header is omittted, or if different "bots" use the same string, then the "browser fingerprint" becomes even less distinguishable. Alas, web users who choose simpler software instead of the larger, more complex "modern" browsers often get mistaken for "bots" based on crude heuristics with high false positive rates. Alas, website operators often do not focus on behaviour, e.g., rate-limiting, when it's easier to simply label anything that is not sending many details and running Javascript as a "bot". The characteristic bad behaviour of "bots" is assumed. Even when it does not exist. A single, one-time HTTP request can trigger a heuristic-based block designed to stop repeated, excessive HTTP requests. The surveillance advertising ecosystem relies on web users all choosing the same few browsers that run Javascripts indiscriminantly without any user input. Even using an add-on/extension like uMatrix with a "modern" browser may trigger "bot" heuristics, because uMatrix lets the user run Javascript discrimantly. Fingerprinting may not be 100% dependant on Javascript. But the most useful fingerprints for advertising, not to mention serving the advertisements themselves, rely on Javascript.

jwatte 1y ago

There's a second side of this story, that nobody ever really talks about, because the cost is so diffuse. There are real, legit, uses for fingerprinting. One of the more common ones is anti-fraud for payments, as well as anti-abuse for social sites. I'm sure you've been to forums or other social sites where ban evading trolls, astroturfers, card checkers, and the like cause constant pain for both legitimate users and site operators. When I ran a large site with social interactions and payments/credits, I got deep insights into all the abusers who try to bilk the system for whatever they can. Because fingerprinting is so hard, bad users have an easy time to return with a zillion sock puppet accounts. As a normal user, my estimation is that I suffer more from the actions of those bad users who poison the well, than I would suffer from an internet that made everyone non-anonymous.

capyba 1y ago

Can’t a good privacy browser randomize some of the ‘nonessential’ elements it sends, thereby creating a new fingerprint for each website? Or change them all to the same one so everyone using that browser has an even more similar fingerprint? Its always struck me as odd that your browser just volunteers so much information every time you go to a site. Then again, my knowledge of how the web works is limited to HTML+CSS from the 00’s…