8 ms·

As someone who works in this tech space, nobody brings up how long fingerprints persist. And the reality is that even a really precise fingerprint has a half-li

As someone who works in this tech space, nobody brings up how long fingerprints persist. And the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). A lot of the big ad networks right now instead rely heavily on geo-data. Which is why you are probably seeing lots of ads in your feeds that seemingly cross between devices or are relating to interests of your spouse/friends/etc. They just look at the geo on your IP and literally flood the zone. > They developed a measurement framework called FPTrace, which assesses fingerprinting-based user tracking by analyzing how ad systems respond to changes in browser fingerprints. I'm curious to know a bit more about their methodology. It's more likely to me that the ad networks are probably segmenting the ads based on device settings more than they are individually targeting based on fingerprints. For example, someone running new software versions on new hardware might be lumped into a hotter buyer category. Also, simple things like time of day have huge impacts on ad bidding, so knowing how they controlled would be everything.

cosmic_cheese 1y ago
Wouldn’t things like iCloud Private Relay and other VPN-ish things throw a wrench into IP-geo-based tracking? Seems like it’d make the targeting so broad as to be useless.
- lucasban 1y ago
  Conveniently for them, iCloud private relay only really impacts browser usage, third party apps are only impacted when using unencrypted connections, which is unlikely.
- legitster 1y ago
  I don't know a lot about iCloud in particular, but in general there are not enough active VPN users to make a noticeable difference in tracking. By its nature ad tracking does not have to be super accurate in the aggregate to beat a wild guess.
  - v5v3 1y ago
    If you look at app download charts, the main VPN companies dominate. So I suspect there are sufficient active users.
- ztetranz 1y ago
  As an aside, we just spent a couple of weeks camping in our RV with a cellular router connected to a VPN at home. Now that we're back home, Google maps (on a non-GPS equipped device) and Roku still think we're at the campground several states away. I guess my GPS equipped tablet reported the new location of our home IP address. On past experience, it takes about a week to reset.
- Gigachad 1y ago
  iCloud Private Relay has always kept the IP in the same city for me.
  - mediumsmart 1y ago
    Mine is also in a city 146 kilometers away.
- v5v3 1y ago
  VPN does. If I change to for example Hong Kong, all Spotify, YouTube etc are them for hk/Chinese products and spoken in Mandarin/Cantonese. I change country daily, it's good fun.
minitech 1y ago
> And the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). A fingerprint that changes only by the increase of a browser version isn’t dead; it’s stronger.
- legitster 1y ago
  I'm not sure if I understand this. If you show up on a website one day with one fingerprint, but on the next day it was a different fingerprint, there's no way to connect that it's the same device unless it wasn't a core trait of the fingerprint in the first place.
  - kemotep 1y ago
    If everything is the same but the browser version, a day later how is that not the same person?
  - deleted 1y ago
    [deleted]
  - orev 1y ago
    I think you’re thinking that the fingerprint is reported as a single hash (e.g. SHA512) of multiple attributes, which would of course change if a single bit was different. But there’s no reason they would be reported that way. It could be (and probably more likely) a big data structure of all the values. It would be easy to see that only a few things changed.
- gruez 1y ago
  >it’s stronger. marginally given that most browsers auto-update.
glaucon 1y ago
>As someone who works in this tech space, nobody brings up how long fingerprints persist. And the reality is that even a really precise fingerprint has a half-life of only a few days I've just looked at my fingerprint and I'm told I'm unique (my mum always said that ;-) ). Unfortunately it's impossible, using https://www.amiunique.org/fingerprint https://www.amiunique.org/fingerprint, to determine what elements of the fingerprint, if changed, would make me significantly non-unique but when I look down the list 16/58 javascript attributes are red (the lowest category of similarity ratio) and only two of those are overtly dependent on a version number, another six refer to screen size/resolution. It seems to me that leaves quite a lot of information which isn't going to change all the quickly. While the precise value may change with time I feel like saying "has a half-life of only a few days" tends to understate the effectiveness of this technique.
- ryukoposting 1y ago
  There are a few obvious ones I knew would be bad for me - the Linux user agent, for example. My canvas also came up unique and I'm betting Dark Reader had something to do with that. But then there's other things that don't make any sense. How is "NVIDIA Corporation" only 0.74% for "WebGL Vendor?" Why does navigator.hardwareConcurrency even exist?
  - bitmasher9 1y ago
    My vendor “Apple Computer, Inc” was less than 10% (I’m on iPhone) so I suspect HN crowd probably uses unusual hardware. While my timezone (in USA) and device vendor are both single digit rare, combining the two probably leaks less information than you’d expect because my timezone has a much higher density of Apple devices than global averages. It’s really not until you take into consideration a few other variables that you could really finger print me pretty decently.
  - robin_reala 1y ago
    0.74% does seem a bit low, but most people browse the web on mobile phones, so knock off 50-70% immediately, then of the remaining most will be integrated GPUs from Intel or AMD in laptops. Take away Macs and you’re basically just left with gaming PCs, and laptops where the browser decided the task was difficult enough to spin up a discrete nVidia GPU.
DoctorOetker 1y ago
> And the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). I don't follow, consider hardware interrupts and their handling delays depending say on the combination of apps installed, the exact gpu driver version, etc ... An occasional update could change the relevant timings, but would unlikely change all timing distributions (since perhaps the gpu driver wasn't updated, or the some other app wasn't)
- gruez 1y ago
  >consider hardware interrupts and their handling delays depending say on the combination of apps installed There's zero chance that apps on iOS and Android have access to "hardware interrupts" (whatever that means), because both platforms are too sandboxed. Moreover timing resolution on javascript has been nerfed since several years ago because of fears of spectre attacks. >the exact gpu driver version, etc ... If you're just rendering simple polygons, it's highly implausible that timings would change in between drivers. You might be able to tell driver versions apart if you spend hundreds/thousands of man-hours reverse engineering each driver version for quirks to test against, but I doubt they're pouring that much effort into this.
  - qualeed 1y ago
    >"hardware interrupts" (whatever that means) Hardware interrupts are a standard part of computing. (see https://en.wikipedia.org/wiki/Interrupt#Hardware_interrupts https://en.wikipedia.org/wiki/Interrupt#Hardware_interrupts) "Android also inherits the interrupt mechanism from Linux, which is designed for the efficient communication between the CPU and external devices. When new hardware events (e.g., user touching the screen) come, the corresponding hardware device (e.g., touchscreen controller) sends a signal to ask OS for immediate processing" And, at least previously, the timing of interrupts have been used to facilitate information leakage. For example: "Through analyzing the interrupt time series produced from touchscreen controller, attacker’s chance of cracking user’s unlock pattern is increased substantially. The interrupt time series produced from Display Sub-System reveals unique UI refreshing patterns and could be leveraged as fingerprints to identify the app running in the foreground" https://staff.ie.cuhk.edu.hk/~khzhang/my-papers/2016-oakland-interrupt.pdf https://staff.ie.cuhk.edu.hk/~khzhang/my-papers/2016-oakland... It's been awhile since I've looked closely at anything related to phones, but for decades /proc/interrupts was globally readable. It may still be.
kul_ 1y ago
> A lot of the big ad networks right now instead rely heavily on geo-data How does this work in today's age where ISPs normally will have at least one level of NATing with ipv4. And given ipv6 with prefix delegation is still far away this should continue to be very imprecise?
- fiddlerwoaroof 1y ago
  I’ve never had an unroutable IP in the US
  - wut42 1y ago
    CGNAT does not means unroutable IP, it just means you would only have assigned a small range of ports on a routable IP with others.
    - BenjiWiebe 1y ago
      If you have CGNAT, the IP on your router's external interface is unroutable. Just like how when you do NAT for your home network, your devices get assigned non-routable private use only address space. Unroutable meaning not publicly routable. Of course you can route traffic through your own LAN to your Internet gateway.
- kulahan 1y ago
  Billboards are still among the most effective forms of advertising in terms of efficiency. You don’t need to be very close. I see myself popping up probably 10 miles from where I’m actually at, but the businesses aren’t that inaccessible.
- djrj477dhsnv 1y ago
  > ISPs normally will have at least one level of NATing with ipv4. I don't think that's generally true for home DSL/cable/fiber service. I've only seen it on mobile internet.
  - kul_ 1y ago
tjpnz 1y ago
>A lot of the big ad networks right now instead rely heavily on geo-data. Which is why you are probably seeing lots of ads in your feeds that seemingly cross between devices or are relating to interests of your spouse/friends/etc. They just look at the geo on your IP and literally flood the zone. I don't see them and nor does my spouse. Ads aren't allowed in my house (to mangle the words of a famous adtech company).
jgalt212 1y ago
> As someone who works in this tech space, nobody brings up how long fingerprints persist. And the reality is that even a really precise fingerprint has a half-life of only a few days True that. We use cookies + fingerprints to monitor for license compliance (i.e. ensure users are not id/password sharing). Sometimes we can use a fingerprint to recover a deleted cookie, but not all that often. What would really help is a fingerprint transition matrix, so we could make some probabilistic guesses.
fc417fc802 1y ago
> the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). The size of a maximized window is unlikely to change unless either the desktop environment is updated in some way or the monitor (hardware) itself is swapped out. GPU hardware is unlikely to change frequently and various idiosyncrasies can be fingerprinted via either webgl or webgpu. Installed fonts probably don't change all that frequently. I'd expect TCP stack fingerprinting to be fairly stable. That's but a few examples off the top of my head. As long as only one characteristic changes at a time you can link the cluster together. Worse, if client side identifiers (ex cookies) aren't wiped simultaneously then you can link two entirely distinct fingerprints with full confidence.
- everdrive 1y ago
  What is TCP stack fingerprinting?
  - rsync 1y ago
    It is what nmap does. In theory, this would be a rich landscape for an entirely different abstraction layer for fingerprinting… However, I am skeptical that the typical fingerprinting tool chains are receiving data that reaches that far down in the stack…
    - fc417fc802 1y ago
      Also TCP timestamp if the network stack doesn't apply a randomized offset. As of 4.10 Linux added randomization; no idea about others. Getting a bit farther out there, CPU clock skew can be derived from the (randomly offset) TCP timestamps. That varies with temperature and thus load so it can be used to pick out otherwise indistinguishable traffic streams originating on the same physical host. Back in the realm of commonly employed techniques, higher levels of the networking stack are fingerprinted in the wild. https://blog.cloudflare.com/ja4-signals/ https://blog.cloudflare.com/ja4-signals/ Moving even farther up, the human interaction streams themselves are commonly fingerprinted. I realize that's a bit of a tangent but OP had suggested that fingerprints had short half lives and this is a very strong counterexample that I failed to mention earlier. https://www.whonix.org/wiki/Keystroke_and_Mouse_Deanonymization https://www.whonix.org/wiki/Keystroke_and_Mouse_Deanonymizat...
NoahZuniga 1y ago
fingerprint.com claims that they can fingerprint a user with >90% accuracy over 120 days. A half-life of a few days is awfully optimistic.
WalterBright 1y ago
I have no idea what ads they serve me because I have ad blindness. My brain just refuses to perceive them. Even when they float over the text I am trying to read, I do not see them.
- erkt 1y ago
  This is a top tier super power. Ublock on Firefox and AdGuard on iPhone are pretty effective. When I actually see an ad it physically hurts.
  - godelski 1y ago
    On iPhone check out Orion browser. Blocks ads, even on YouTube. Though sometimes video quality goes low (manually set it higher to fix). Firefox focus also works, but only one tab If on Android, check out revanced. You can remove ads from lots of apps. Highly recommend Firefox as well.
    - _kidlike 1y ago
      Brave is also extremely effective at removing ads while keeping websites functional (including YouTube). It even has some fingerprinting protection. (and before someone complains, you can disable all the crypto stuff)
      - godelski 1y ago
        Sure but personally I'm against recommending different flavors of chrome. Brave is a nice idea but it still gives undue power to Google because at the be of the day, they control chromium. It also makes a hard problem for chromium reskins as they keep finding things chromium can use to track their users...
- hinterlands 1y ago
  Every person says this, but it's a massive industry for a reason. It's the same as with The North Face logo on jackets. You're never paying attention and you don't recall any specific person wearing the jacket. But somehow, when it's time to buy a jacket, you know about the brand, and know all the people in your socioeconomic circle seem to like it. Some online ads want to grab your attention, but most are just about building almost-subliminal connections like that.
deleted 1y ago
[deleted]
deleted 1y ago
[deleted]
m000 1y ago
I think you miss some key issues here: (a) Browser fingerprinting can be very robust if you select your data points correctly. E.g. installed plugins, content language, fonts. The used data points can be dynamically fine-tuned in retrospect and be different for each identified agent. (b) In the grand scheme of things, the browser fingerprint is only one data point. If you combine it with other data points (e.g. the geo-data you mentioned) you can overcome some of its limitations as well as intentional evasion attempts. E.g. a new fingerprint appears at my workplace IP that has 80% similarity with my old fingerprint. At the same time my old fingerprint goes dark. (c) The ad companies take the shotgun approach because it works for them: it is cost-effective and can be defended as a legit method. Entities that are interested in surveilance for purposes other than selling ads and already collect a trove of other data can do a lot better than ad companies.
- 400thecat 1y ago
  > Browser fingerprinting can be very robust if you select your data points correctly. E.g. installed plugins can websites really see installed plugins?
  - peetistaken 1y ago
    Not really. They can‘t see a list, as navigator.plugins is dummy data in every major browser, but they might able to detect eg. Adblockers by other means
    - dubcanada 1y ago
      Adblocking is not rocket science, you block the DNS of the ads. Some also use JS to mess or remove ads. All of this is easily detected, can I ping X, can I see DOM Y, etc.
- coldtea 1y ago
  >E.g. installed plugins, content language, fonts. Nobody installs plugins in 2025. Content language is basically like the geo-data the parent said, but coarser. And billions of people just have the same (default OS) fonts - plus iirc, there are broswer mitigations against font enumeration for fingerprinting.
Swoerd123 1y ago
Siteimprove Analytics appears to be confident enough about their cookieless tracking technology (compared to cookie based tracking) to claim: In general, Visitor Hash is expected to be more persistent, resulting in a drop in the number of unique visitors. Since cookies are known to have an increasingly short lifetime, leading to overestimated data about unique visitors, we consider the Visitor Hash technology to be more accurate at capturing information about unique and returning visitors When Cookieless tracking is enabled, it replaces the traditional use of cookies with a "Visitor Hash" made of non-personal information only. This information includes hashed IP and HTTP header values including browser type, browser version, browser language, and the user agent string. The Visitor Hash only consists of server-side attributes passed along by the website server. Note: Siteimprove analytics does not collect client-side attributes. The Visitor Hash is used for the same functionality as the cookie and nothing else. For some websites, like intranets, there is an increased likelihood that the visitors could end up getting the same Visitor Hash as they might all be accessing the site from the same IP and on the same device setups. In those cases all page views would appear to be coming from one, or a few, visits. That's why we recommend excluding those domains from using cookieless tracking. See the "How to exclude domains from having cookieless tracking enabled" section below for more information.
bastawhiz 1y ago
A fingerprint is composed of many signals. Even if a few of those signals change, the less-specific fingerprint made by the remaining signals can still be used to infer who a user is. And it doesn't need to be perfect: having a good idea that someone who almost looks like you from yesterday was interested in cat food is a good enough reason to auction ad space to cat food companies today.

cosmic_cheese 1y ago

Wouldn’t things like iCloud Private Relay and other VPN-ish things throw a wrench into IP-geo-based tracking? Seems like it’d make the targeting so broad as to be useless.

lucasban 1y ago
Conveniently for them, iCloud private relay only really impacts browser usage, third party apps are only impacted when using unencrypted connections, which is unlikely.
legitster 1y ago
I don't know a lot about iCloud in particular, but in general there are not enough active VPN users to make a noticeable difference in tracking. By its nature ad tracking does not have to be super accurate in the aggregate to beat a wild guess.
- v5v3 1y ago
  If you look at app download charts, the main VPN companies dominate. So I suspect there are sufficient active users.
ztetranz 1y ago
As an aside, we just spent a couple of weeks camping in our RV with a cellular router connected to a VPN at home. Now that we're back home, Google maps (on a non-GPS equipped device) and Roku still think we're at the campground several states away. I guess my GPS equipped tablet reported the new location of our home IP address. On past experience, it takes about a week to reset.
Gigachad 1y ago
iCloud Private Relay has always kept the IP in the same city for me.
- mediumsmart 1y ago
  Mine is also in a city 146 kilometers away.
v5v3 1y ago
VPN does. If I change to for example Hong Kong, all Spotify, YouTube etc are them for hk/Chinese products and spoken in Mandarin/Cantonese. I change country daily, it's good fun.

minitech 1y ago

> And the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). A fingerprint that changes only by the increase of a browser version isn’t dead; it’s stronger.

legitster 1y ago
I'm not sure if I understand this. If you show up on a website one day with one fingerprint, but on the next day it was a different fingerprint, there's no way to connect that it's the same device unless it wasn't a core trait of the fingerprint in the first place.
- kemotep 1y ago
  If everything is the same but the browser version, a day later how is that not the same person?
- deleted 1y ago
  [deleted]
- orev 1y ago
  I think you’re thinking that the fingerprint is reported as a single hash (e.g. SHA512) of multiple attributes, which would of course change if a single bit was different. But there’s no reason they would be reported that way. It could be (and probably more likely) a big data structure of all the values. It would be easy to see that only a few things changed.
gruez 1y ago
>it’s stronger. marginally given that most browsers auto-update.

glaucon 1y ago

>As someone who works in this tech space, nobody brings up how long fingerprints persist. And the reality is that even a really precise fingerprint has a half-life of only a few days I've just looked at my fingerprint and I'm told I'm unique (my mum always said that ;-) ). Unfortunately it's impossible, using https://www.amiunique.org/fingerprint https://www.amiunique.org/fingerprint, to determine what elements of the fingerprint, if changed, would make me significantly non-unique but when I look down the list 16/58 javascript attributes are red (the lowest category of similarity ratio) and only two of those are overtly dependent on a version number, another six refer to screen size/resolution. It seems to me that leaves quite a lot of information which isn't going to change all the quickly. While the precise value may change with time I feel like saying "has a half-life of only a few days" tends to understate the effectiveness of this technique.

ryukoposting 1y ago
There are a few obvious ones I knew would be bad for me - the Linux user agent, for example. My canvas also came up unique and I'm betting Dark Reader had something to do with that. But then there's other things that don't make any sense. How is "NVIDIA Corporation" only 0.74% for "WebGL Vendor?" Why does navigator.hardwareConcurrency even exist?
- bitmasher9 1y ago
  My vendor “Apple Computer, Inc” was less than 10% (I’m on iPhone) so I suspect HN crowd probably uses unusual hardware. While my timezone (in USA) and device vendor are both single digit rare, combining the two probably leaks less information than you’d expect because my timezone has a much higher density of Apple devices than global averages. It’s really not until you take into consideration a few other variables that you could really finger print me pretty decently.
- robin_reala 1y ago
  0.74% does seem a bit low, but most people browse the web on mobile phones, so knock off 50-70% immediately, then of the remaining most will be integrated GPUs from Intel or AMD in laptops. Take away Macs and you’re basically just left with gaming PCs, and laptops where the browser decided the task was difficult enough to spin up a discrete nVidia GPU.

DoctorOetker 1y ago

> And the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). I don't follow, consider hardware interrupts and their handling delays depending say on the combination of apps installed, the exact gpu driver version, etc ... An occasional update could change the relevant timings, but would unlikely change all timing distributions (since perhaps the gpu driver wasn't updated, or the some other app wasn't)

gruez 1y ago
>consider hardware interrupts and their handling delays depending say on the combination of apps installed There's zero chance that apps on iOS and Android have access to "hardware interrupts" (whatever that means), because both platforms are too sandboxed. Moreover timing resolution on javascript has been nerfed since several years ago because of fears of spectre attacks. >the exact gpu driver version, etc ... If you're just rendering simple polygons, it's highly implausible that timings would change in between drivers. You might be able to tell driver versions apart if you spend hundreds/thousands of man-hours reverse engineering each driver version for quirks to test against, but I doubt they're pouring that much effort into this.
- qualeed 1y ago
  >"hardware interrupts" (whatever that means) Hardware interrupts are a standard part of computing. (see https://en.wikipedia.org/wiki/Interrupt#Hardware_interrupts https://en.wikipedia.org/wiki/Interrupt#Hardware_interrupts) "Android also inherits the interrupt mechanism from Linux, which is designed for the efficient communication between the CPU and external devices. When new hardware events (e.g., user touching the screen) come, the corresponding hardware device (e.g., touchscreen controller) sends a signal to ask OS for immediate processing" And, at least previously, the timing of interrupts have been used to facilitate information leakage. For example: "Through analyzing the interrupt time series produced from touchscreen controller, attacker’s chance of cracking user’s unlock pattern is increased substantially. The interrupt time series produced from Display Sub-System reveals unique UI refreshing patterns and could be leveraged as fingerprints to identify the app running in the foreground" https://staff.ie.cuhk.edu.hk/~khzhang/my-papers/2016-oakland-interrupt.pdf https://staff.ie.cuhk.edu.hk/~khzhang/my-papers/2016-oakland... It's been awhile since I've looked closely at anything related to phones, but for decades /proc/interrupts was globally readable. It may still be.

kul_ 1y ago

> A lot of the big ad networks right now instead rely heavily on geo-data How does this work in today's age where ISPs normally will have at least one level of NATing with ipv4. And given ipv6 with prefix delegation is still far away this should continue to be very imprecise?

fiddlerwoaroof 1y ago
I’ve never had an unroutable IP in the US
- wut42 1y ago
  CGNAT does not means unroutable IP, it just means you would only have assigned a small range of ports on a routable IP with others.
  - BenjiWiebe 1y ago
    If you have CGNAT, the IP on your router's external interface is unroutable. Just like how when you do NAT for your home network, your devices get assigned non-routable private use only address space. Unroutable meaning not publicly routable. Of course you can route traffic through your own LAN to your Internet gateway.
kulahan 1y ago
Billboards are still among the most effective forms of advertising in terms of efficiency. You don’t need to be very close. I see myself popping up probably 10 miles from where I’m actually at, but the businesses aren’t that inaccessible.
djrj477dhsnv 1y ago
> ISPs normally will have at least one level of NATing with ipv4. I don't think that's generally true for home DSL/cable/fiber service. I've only seen it on mobile internet.
- kul_ 1y ago

tjpnz 1y ago

>A lot of the big ad networks right now instead rely heavily on geo-data. Which is why you are probably seeing lots of ads in your feeds that seemingly cross between devices or are relating to interests of your spouse/friends/etc. They just look at the geo on your IP and literally flood the zone. I don't see them and nor does my spouse. Ads aren't allowed in my house (to mangle the words of a famous adtech company).

jgalt212 1y ago

> As someone who works in this tech space, nobody brings up how long fingerprints persist. And the reality is that even a really precise fingerprint has a half-life of only a few days True that. We use cookies + fingerprints to monitor for license compliance (i.e. ensure users are not id/password sharing). Sometimes we can use a fingerprint to recover a deleted cookie, but not all that often. What would really help is a fingerprint transition matrix, so we could make some probabilistic guesses.

fc417fc802 1y ago

> the reality is that even a really precise fingerprint has a half-life of only a few days (especially if it's based on characteristics like window size or software versions). The size of a maximized window is unlikely to change unless either the desktop environment is updated in some way or the monitor (hardware) itself is swapped out. GPU hardware is unlikely to change frequently and various idiosyncrasies can be fingerprinted via either webgl or webgpu. Installed fonts probably don't change all that frequently. I'd expect TCP stack fingerprinting to be fairly stable. That's but a few examples off the top of my head. As long as only one characteristic changes at a time you can link the cluster together. Worse, if client side identifiers (ex cookies) aren't wiped simultaneously then you can link two entirely distinct fingerprints with full confidence.

everdrive 1y ago
What is TCP stack fingerprinting?
- rsync 1y ago
  It is what nmap does. In theory, this would be a rich landscape for an entirely different abstraction layer for fingerprinting… However, I am skeptical that the typical fingerprinting tool chains are receiving data that reaches that far down in the stack…
  - fc417fc802 1y ago
    Also TCP timestamp if the network stack doesn't apply a randomized offset. As of 4.10 Linux added randomization; no idea about others. Getting a bit farther out there, CPU clock skew can be derived from the (randomly offset) TCP timestamps. That varies with temperature and thus load so it can be used to pick out otherwise indistinguishable traffic streams originating on the same physical host. Back in the realm of commonly employed techniques, higher levels of the networking stack are fingerprinted in the wild. https://blog.cloudflare.com/ja4-signals/ https://blog.cloudflare.com/ja4-signals/ Moving even farther up, the human interaction streams themselves are commonly fingerprinted. I realize that's a bit of a tangent but OP had suggested that fingerprints had short half lives and this is a very strong counterexample that I failed to mention earlier. https://www.whonix.org/wiki/Keystroke_and_Mouse_Deanonymization https://www.whonix.org/wiki/Keystroke_and_Mouse_Deanonymizat...

NoahZuniga 1y ago

fingerprint.com claims that they can fingerprint a user with >90% accuracy over 120 days. A half-life of a few days is awfully optimistic.

WalterBright 1y ago

I have no idea what ads they serve me because I have ad blindness. My brain just refuses to perceive them. Even when they float over the text I am trying to read, I do not see them.

erkt 1y ago
This is a top tier super power. Ublock on Firefox and AdGuard on iPhone are pretty effective. When I actually see an ad it physically hurts.
- godelski 1y ago
  On iPhone check out Orion browser. Blocks ads, even on YouTube. Though sometimes video quality goes low (manually set it higher to fix). Firefox focus also works, but only one tab If on Android, check out revanced. You can remove ads from lots of apps. Highly recommend Firefox as well.
  - _kidlike 1y ago
    Brave is also extremely effective at removing ads while keeping websites functional (including YouTube). It even has some fingerprinting protection. (and before someone complains, you can disable all the crypto stuff)
    - godelski 1y ago
      Sure but personally I'm against recommending different flavors of chrome. Brave is a nice idea but it still gives undue power to Google because at the be of the day, they control chromium. It also makes a hard problem for chromium reskins as they keep finding things chromium can use to track their users...
hinterlands 1y ago
Every person says this, but it's a massive industry for a reason. It's the same as with The North Face logo on jackets. You're never paying attention and you don't recall any specific person wearing the jacket. But somehow, when it's time to buy a jacket, you know about the brand, and know all the people in your socioeconomic circle seem to like it. Some online ads want to grab your attention, but most are just about building almost-subliminal connections like that.

deleted 1y ago

[deleted]

deleted 1y ago

[deleted]

m000 1y ago

I think you miss some key issues here: (a) Browser fingerprinting can be very robust if you select your data points correctly. E.g. installed plugins, content language, fonts. The used data points can be dynamically fine-tuned in retrospect and be different for each identified agent. (b) In the grand scheme of things, the browser fingerprint is only one data point. If you combine it with other data points (e.g. the geo-data you mentioned) you can overcome some of its limitations as well as intentional evasion attempts. E.g. a new fingerprint appears at my workplace IP that has 80% similarity with my old fingerprint. At the same time my old fingerprint goes dark. (c) The ad companies take the shotgun approach because it works for them: it is cost-effective and can be defended as a legit method. Entities that are interested in surveilance for purposes other than selling ads and already collect a trove of other data can do a lot better than ad companies.

400thecat 1y ago
> Browser fingerprinting can be very robust if you select your data points correctly. E.g. installed plugins can websites really see installed plugins?
- peetistaken 1y ago
  Not really. They can‘t see a list, as navigator.plugins is dummy data in every major browser, but they might able to detect eg. Adblockers by other means
  - dubcanada 1y ago
    Adblocking is not rocket science, you block the DNS of the ads. Some also use JS to mess or remove ads. All of this is easily detected, can I ping X, can I see DOM Y, etc.
coldtea 1y ago
>E.g. installed plugins, content language, fonts. Nobody installs plugins in 2025. Content language is basically like the geo-data the parent said, but coarser. And billions of people just have the same (default OS) fonts - plus iirc, there are broswer mitigations against font enumeration for fingerprinting.

Swoerd123 1y ago

Siteimprove Analytics appears to be confident enough about their cookieless tracking technology (compared to cookie based tracking) to claim: In general, Visitor Hash is expected to be more persistent, resulting in a drop in the number of unique visitors. Since cookies are known to have an increasingly short lifetime, leading to overestimated data about unique visitors, we consider the Visitor Hash technology to be more accurate at capturing information about unique and returning visitors When Cookieless tracking is enabled, it replaces the traditional use of cookies with a "Visitor Hash" made of non-personal information only. This information includes hashed IP and HTTP header values including browser type, browser version, browser language, and the user agent string. The Visitor Hash only consists of server-side attributes passed along by the website server. Note: Siteimprove analytics does not collect client-side attributes. The Visitor Hash is used for the same functionality as the cookie and nothing else. For some websites, like intranets, there is an increased likelihood that the visitors could end up getting the same Visitor Hash as they might all be accessing the site from the same IP and on the same device setups. In those cases all page views would appear to be coming from one, or a few, visits. That's why we recommend excluding those domains from using cookieless tracking. See the "How to exclude domains from having cookieless tracking enabled" section below for more information.

bastawhiz 1y ago

A fingerprint is composed of many signals. Even if a few of those signals change, the less-specific fingerprint made by the remaining signals can still be used to infer who a user is. And it doesn't need to be perfect: having a good idea that someone who almost looks like you from yesterday was interested in cat food is a good enough reason to auction ad space to cat food companies today.