5 ms·

> “Fingerprinting has always been a concern in the privacy community, but until now, we had no hard proof that it was actually being used to track users,” said

by Sephr 1y ago

> “Fingerprinting has always been a concern in the privacy community, but until now, we had no hard proof that it was actually being used to track users,” said Dr. Nitesh Saxena, cybersecurity researcher, professor of computer science and engineering and associate director of the Global Cyber Research Institute at Texas A&M. “Our work helps close that gap.” Maybe if you live in a bubble where documentation published outside of academia doesn't exist. Tracking vendors themselves have claimed to be fingerprinting users' browsers in their privacy policies for over a decade.

archerx 1y ago
Some people live in bubbles. I have been aware of https://github.com/fingerprintjs/fingerprintjs https://github.com/fingerprintjs/fingerprintjs For almost 10 years now or some version of it. I stumbled on it when I wanted to keep track of spammy/abusive visitors on an old project.
- _Algernon_ 1y ago
  They consider me to have different visitor IDs when opening their demo page[1] in a regular window, and an incognito window on the same device. If this is state of the art I'm not too worried. [1]: https://fingerprintjs.github.io/fingerprintjs/ https://fingerprintjs.github.io/fingerprintjs/
  - deleted 1y ago
    [deleted]
  - deleted 1y ago
    [deleted]
  - kapildev 1y ago
    It tracked me on incognito but not across browsers though
dcow 1y ago
I’m not saying we should stop caring about online privacy, but the extent to which we fight fingerprinting while not actually solving the problem has made the web worse. It’s kinda like the argument for gun control: the unsavory folk will still fingerprint your browsing while the well-mannered sites suffer from lack of features due to aversion to any persistent handle on the users they might provide, like strong crypto because uh-oh a pub key would give your a “super-cookie” so we can’t have that.
- ethbr1 1y ago
  Sites need to realize that offering a public presentation means they're at the whim of user-agents. Most of the bullshit over the past couple decades has been them trying to pull control back to server-side.
  - dcow 1y ago
    That’s somewhat different from user-agents refusing to implement useful features because they might have privacy implications.
- coldtea 1y ago
  >while the well-mannered sites suffer from lack of features due to aversion to any persistent handle on the users they might provide Yeah, hard pass.
tpoacher 1y ago
This isn't about bubbles or ignorance of the "Real World (TM)". I think this reading shows own biases about academia vs industry more than anything else. They provide proof that fingerprinting is not only actively used, but also used effectively at that. That vendors claimed they could and would use this is still not proof, let alone gives any insight into its effectiveness or the magnitude of the problem. So this is useful work. Especially since the extent to which it is effective in "benign" ads is also indicative of the extent to which it would be successful for tracking by other agencies.
- Gud 1y ago
  Why wouldn’t admitting doing something be proof, and what else would TRACKING PIXELS be used for? It is clearly in these companies best interest to use these things for snooping on the world’s internet users.
  - vladvasiliu 1y ago
    Aren't the companies who say they're doing this actually selling these capabilities to others? So it's in their interest to pretend to be able to do more / better than what they actually can do. Especially when the clients have little capability to verify what actually happens. So no, their saying "we can do it" doesn't actually mean that they can. As a user who doesn't have a horse in this race (I work for a "captive clients" company, so ads don't help much, nor do we sell any ads), what I notice is that ads I'm served are absolutely absurd. It's either Google Maps trying to sell me some hotel 50 meters from my home (I live alone, so I fail to see any reason why I'd go for that), or Instagram which somehow figured I'd be interested in buying bras for pregnant women (I'm a male, and I'm single). More recently, Instagram tries to sell me Range Rovers. Where I live, there's a tax on "heavy vehicles", traffic is absolutely crazy, and we have usable public transit (which I use – while scrolling Instagram). Buying a big-ass car wouldn't help me in any conceivable way, and would be an all-round nuisance. What leaves me flabbergasted, is that my only interactions with Instagram are around photography. I only follow photographers, who shoot landscapes and similar, I always leave the app when I'm presented with naked girls or other "reels'. So I could maybe, possibly, be convinced to buy some new camera or photo gear. Guess what I never see advertised on Instagram?
harvey9 1y ago
The paper might have put this better by saying they can prove it without the need for disclosure.
bastawhiz 1y ago
It's been known in academia for at least half a decade as well. See: https://petsymposium.org/popets/2021/popets-2021-0004.pdf https://petsymposium.org/popets/2021/popets-2021-0004.pdf Hell, before that, we knew Flash was being used to get the list of fonts you have installed (for tracking purposes). You're right that these quotes are just plain wrong.
- jon-wood 1y ago
  This has suddenly made me wonder how often fingerprinting of installed fonts is used to find targets working for particular companies. Quite a lot of organisations now have their own font, or a particular uncommon font they favour for brand purposes at least.
  - pan69 1y ago
    Well, nobody has Flash installed anymore (I hope) and I don't believe there is a "modern" way to obtaining a font list (that works on all/majority of browsers). So, at face value, looking at installed fonts doesn't sound like a meaningful attack vector these days.
    - jon-wood 1y ago
      I believe you can do some stuff with CSS by providing a list of fonts to try and then comparing the size of a block of text, but yes, it is quite a bit harder now.
HexPhantom 1y ago
I think the nuance here is that academic research often wants concrete, measurable evidence that can't just be hand-waved away by "well, it was mentioned in a privacy policy."

by Sephr 1y ago

archerx 1y ago

Some people live in bubbles. I have been aware of https://github.com/fingerprintjs/fingerprintjs https://github.com/fingerprintjs/fingerprintjs For almost 10 years now or some version of it. I stumbled on it when I wanted to keep track of spammy/abusive visitors on an old project.

_Algernon_ 1y ago
They consider me to have different visitor IDs when opening their demo page[1] in a regular window, and an incognito window on the same device. If this is state of the art I'm not too worried. [1]: https://fingerprintjs.github.io/fingerprintjs/ https://fingerprintjs.github.io/fingerprintjs/
- deleted 1y ago
  [deleted]
- deleted 1y ago
  [deleted]
- kapildev 1y ago
  It tracked me on incognito but not across browsers though

dcow 1y ago

I’m not saying we should stop caring about online privacy, but the extent to which we fight fingerprinting while not actually solving the problem has made the web worse. It’s kinda like the argument for gun control: the unsavory folk will still fingerprint your browsing while the well-mannered sites suffer from lack of features due to aversion to any persistent handle on the users they might provide, like strong crypto because uh-oh a pub key would give your a “super-cookie” so we can’t have that.

ethbr1 1y ago
Sites need to realize that offering a public presentation means they're at the whim of user-agents. Most of the bullshit over the past couple decades has been them trying to pull control back to server-side.
- dcow 1y ago
  That’s somewhat different from user-agents refusing to implement useful features because they might have privacy implications.
coldtea 1y ago
>while the well-mannered sites suffer from lack of features due to aversion to any persistent handle on the users they might provide Yeah, hard pass.

tpoacher 1y ago

This isn't about bubbles or ignorance of the "Real World (TM)". I think this reading shows own biases about academia vs industry more than anything else. They provide proof that fingerprinting is not only actively used, but also used effectively at that. That vendors claimed they could and would use this is still not proof, let alone gives any insight into its effectiveness or the magnitude of the problem. So this is useful work. Especially since the extent to which it is effective in "benign" ads is also indicative of the extent to which it would be successful for tracking by other agencies.

Gud 1y ago
Why wouldn’t admitting doing something be proof, and what else would TRACKING PIXELS be used for? It is clearly in these companies best interest to use these things for snooping on the world’s internet users.
- vladvasiliu 1y ago
  Aren't the companies who say they're doing this actually selling these capabilities to others? So it's in their interest to pretend to be able to do more / better than what they actually can do. Especially when the clients have little capability to verify what actually happens. So no, their saying "we can do it" doesn't actually mean that they can. As a user who doesn't have a horse in this race (I work for a "captive clients" company, so ads don't help much, nor do we sell any ads), what I notice is that ads I'm served are absolutely absurd. It's either Google Maps trying to sell me some hotel 50 meters from my home (I live alone, so I fail to see any reason why I'd go for that), or Instagram which somehow figured I'd be interested in buying bras for pregnant women (I'm a male, and I'm single). More recently, Instagram tries to sell me Range Rovers. Where I live, there's a tax on "heavy vehicles", traffic is absolutely crazy, and we have usable public transit (which I use – while scrolling Instagram). Buying a big-ass car wouldn't help me in any conceivable way, and would be an all-round nuisance. What leaves me flabbergasted, is that my only interactions with Instagram are around photography. I only follow photographers, who shoot landscapes and similar, I always leave the app when I'm presented with naked girls or other "reels'. So I could maybe, possibly, be convinced to buy some new camera or photo gear. Guess what I never see advertised on Instagram?

harvey9 1y ago

The paper might have put this better by saying they can prove it without the need for disclosure.

bastawhiz 1y ago

It's been known in academia for at least half a decade as well. See: https://petsymposium.org/popets/2021/popets-2021-0004.pdf https://petsymposium.org/popets/2021/popets-2021-0004.pdf Hell, before that, we knew Flash was being used to get the list of fonts you have installed (for tracking purposes). You're right that these quotes are just plain wrong.

jon-wood 1y ago
This has suddenly made me wonder how often fingerprinting of installed fonts is used to find targets working for particular companies. Quite a lot of organisations now have their own font, or a particular uncommon font they favour for brand purposes at least.
- pan69 1y ago
  Well, nobody has Flash installed anymore (I hope) and I don't believe there is a "modern" way to obtaining a font list (that works on all/majority of browsers). So, at face value, looking at installed fonts doesn't sound like a meaningful attack vector these days.
  - jon-wood 1y ago
    I believe you can do some stuff with CSS by providing a list of fonts to try and then comparing the size of a block of text, but yes, it is quite a bit harder now.

HexPhantom 1y ago

I think the nuance here is that academic research often wants concrete, measurable evidence that can't just be hand-waved away by "well, it was mentioned in a privacy policy."