4 ms·

> but when I look down the list 16/58 javascript attributes are red (the lowest category of similarity ratio) and only two of those are overtly dependent on a v

by gruez 1y ago

> but when I look down the list 16/58 javascript attributes are red (the lowest category of similarity ratio) and only two of those are overtly dependent on a version number, another six refer to screen size/resolution. It seems to me that leaves quite a lot of information which isn't going to change all the quickly. I disagree. Going through the list, the following attributes are basically 100% tied to the browser or browser version, because nobody is going to change them: * User agent * Accept * Content encoding * Upgrade Insecure Requests * User agent * Platform * Cookies enabled * Navigator properties * BuildID * Product * Product sub * Vendor * Vendor sub * Java enabled * List of plugins (note that plugins were deprecated by major browsers years ago) * Do Not Track (DNT has been deprecated in favor of GPC, and if you want to stay anonymous you should leave it as the default) * Audio formats * Audio context * Frequency analyser * Audio data * Video formats * Media devices The following are very correlated to your geo ip, so unless you're pretending to be a Mongolian with a US geo IP, it reveals very little. Content language Timezone Content language These are actually valuable for fingerprinting, but most of these basically boil down to "what device you're using". If you're using an iPhone 16 running iOS 18.5, chances are most of the device related attributes will be the same as everyone else with an iPhone 16 on iOS 18.5. Canvas * List of fonts (JS) * Use of Adblock * Hardware concurrency * Device memory * WebGL Vendor * WebGL Renderer * WebGL Data * WebGL Parameters * Keyboard layout These are basically screen dimensions but repeated several times: * Screen width * Screen height * Screen depth * Screen available top * Screen available Left * Screen available Height * Screen available width * Screen left * Screen top These are non-issues as long as you don't touch such settings, and are reset if you clear browsing data. * Permissions * Use of local storage * Use of session storage * Use of IndexedDB These basically boil down to "whether you're using a phone, laptop, or desktop" * Accelerometer * Gyroscope * Proximity sensor * Battery * Connection The last few seem related to flash but since that's been deprecated years ago they're non-issues.

1337biz 1y ago
Did not the EFF have a long time ago a fingerprint analysis that showed how unique a user profile is.
- gruez 1y ago
  You really can't put too much faith into the "you're unique!!" conclusions that fingerprinting sites give out. The sites don't receive much traffic, because only privacy nuts visit them, so any conclusions that you're "unique" (in the world?) is suspect at best. Most (all?) also take into account volatile attributes like the version number, which makes the previous problem worse by further reducing the actual sample size. Suppose a fingerprinting site used (user agent, timezone, user language, screen resolution) as an uniqueness key for its fingerprints, and those were the only fingerprintable attributes. User agent changes often, basically every month for firefox and chrome, so the version information is basically garbage. If you had two firefox users visit the site two months apart, but with the same timezone, language, and screen size, then for all intents and purposes they're indistinguishable. However most fingerprinting sites will happily say "you're unique out of 1 million visitors!". To make this even worse, people will inevitably revisit these sites and use "fingerprint blocking" extensions, which randomize various attributes. The fingerprinting sites aren't very sophisticated and can't tell attributes are being faked, so it'll record that as a new visitor, which has the effect of bumping the denominator even more. Instead of saying you're unique among 1 million users, it'll say you're unique among 10 million users, but that's a lie, because 9 million of those devices never existed.
  - kalleboo 1y ago
    > The sites don't receive much traffic, because only privacy nuts visit them, so any conclusions that you're "unique" (in the world?) is suspect at best Very much this. For example, according to that amiunique.org link, I am literally the only person on the planet who has their browser set to Japanese and that alone makes me unique.
  - glaucon 1y ago
    > so any conclusions that you're "unique" (in the world?) I don't think too many people are labouring under this idea, I think it's implicit that "unique" is in terms of those people those people who've volunteered for fingerprinting by this site. I was amused to see that my referer value of 'https://news.ycombinator.com/ https://news.ycombinator.com/' matched 1/1000th of "all" browsers, Hacker News is popular in certain circles but clearly this is self-selecting sample.

by gruez 1y ago

1337biz 1y ago

Did not the EFF have a long time ago a fingerprint analysis that showed how unique a user profile is.

gruez 1y ago
You really can't put too much faith into the "you're unique!!" conclusions that fingerprinting sites give out. The sites don't receive much traffic, because only privacy nuts visit them, so any conclusions that you're "unique" (in the world?) is suspect at best. Most (all?) also take into account volatile attributes like the version number, which makes the previous problem worse by further reducing the actual sample size. Suppose a fingerprinting site used (user agent, timezone, user language, screen resolution) as an uniqueness key for its fingerprints, and those were the only fingerprintable attributes. User agent changes often, basically every month for firefox and chrome, so the version information is basically garbage. If you had two firefox users visit the site two months apart, but with the same timezone, language, and screen size, then for all intents and purposes they're indistinguishable. However most fingerprinting sites will happily say "you're unique out of 1 million visitors!". To make this even worse, people will inevitably revisit these sites and use "fingerprint blocking" extensions, which randomize various attributes. The fingerprinting sites aren't very sophisticated and can't tell attributes are being faked, so it'll record that as a new visitor, which has the effect of bumping the denominator even more. Instead of saying you're unique among 1 million users, it'll say you're unique among 10 million users, but that's a lie, because 9 million of those devices never existed.
- kalleboo 1y ago
  > The sites don't receive much traffic, because only privacy nuts visit them, so any conclusions that you're "unique" (in the world?) is suspect at best Very much this. For example, according to that amiunique.org link, I am literally the only person on the planet who has their browser set to Japanese and that alone makes me unique.
- glaucon 1y ago
  > so any conclusions that you're "unique" (in the world?) I don't think too many people are labouring under this idea, I think it's implicit that "unique" is in terms of those people those people who've volunteered for fingerprinting by this site. I was amused to see that my referer value of 'https://news.ycombinator.com/ https://news.ycombinator.com/' matched 1/1000th of "all" browsers, Hacker News is popular in certain circles but clearly this is self-selecting sample.