13 ms·

The privacy nightmare of browser fingerprinting

• ArcHound 11mo ago
  You missed one of our best guarded secrets: ja3 hashes and their successors. Basically, we can identify browsers based on the supported ciphers in TLS handshake (order matters too AFAIK). Then when your declared identity is not matching the ja3 hash, you're automatically suspicious, if not blocked right away. I think that's the reason for so many Capchas.
  • 1over137 11mo ago
    What’s ja3?
    • ArcHound 11mo ago
      Here you go: https://developers.cloudflare.com/bots/additional-configurations/ja3-ja4-fingerprint/ https://developers.cloudflare.com/bots/additional-configurat... It's a better explanation that I can provide.
      • eurekin 11mo ago
        Oh! Now I wonder, if crowdsec could issue bans based on that
        • arbol 11mo ago
          I'm not sure about JA3, but JA4 is basically fixed for all recent Chrome versions across many platforms so you definitely would not want to ban that. JA3/4s are basically just good at detecting people using python who are pretenting to be Chrome. And even that's patchable with packages like curl_cffi
  • peetistaken 11mo ago
    I built a nice tool to visualize that: https://tls.peet.ws https://tls.peet.ws. Its not that secret anymore though, more and more libraries are starting to allow spoofing for browser tls configs. There isnt really a cat/mouse game here - once you match the latest chrome, there is nothing to fingerprint
    • johnisgood 11mo ago
      I do not think I understand that website. I see that JA3 always gets changed after refresh, but not sure what JA3 is. Why is it always different, and is it good or bad?
      • Retr0id 11mo ago
        Modern browsers randomise parts of the handshake, which results in an unstable ja3. ja4 and others normalize the relevant details to make the fingerprint constant again.
        • johnisgood 11mo ago
          How effective is it at "un-anonymizing" me? I value privacy. What do you think I can do about "any" of this?
          • Retr0id 11mo ago
            It tends to identify your platform/browser version, with relatively low granularity. Unless you have an unusually rare OS/browser config, it won't deanon you on on its own. But it can be combined with other fingerprinting vectors.
  • mike_d 11mo ago
    JA3/JA4 are useless now. At best they identify the family of browser, and spoofing it is table stakes for bad actors. https://github.com/lwthiker/curl-impersonate https://github.com/lwthiker/curl-impersonate
    • ArcHound 11mo ago
      Slight correction: Spoofing it is table stakes for ever so slightly capable actors. These will still help against the masses of dumb actors flooding your stuff.
• dringov 11mo ago
  > Worst of all, perhaps, it can extract a canvas fingerprint. Canvas fingerprinting works by having the browser run code that draws text (perhaps invisibly), and then retrieving the individual pixel data that it drew. This pixel data will differ subtly from one system to another, even drawing the same text, because of subtle differences in the graphics hardware and the operating system. I am concerned about the detail here: does this mean per hardware class (e.g. same model of GPU), or per each individual device? Is the implication that there are certain graphical operations that - perhaps unintentionally - end up becoming akin to a physically unclonable function in hardware?
  • Xelbair 11mo ago
    >I am concerned about the detail here: does this mean per hardware class (e.g. same model of GPU), or per each individual device? per combination of hardware(GPU, resolution of display) and software(exact drivers)
  • sfink 11mo ago
    I have heard of such things. The signal is not persistent over time, since it's dependent on eg heat and concurrent operations. But it's there, to some degree, and can be correlated over time somewhat. We've made our world a scary place.
• neuroelectron 11mo ago
  10 years too late.
• doug_durham 11mo ago
  I agree with the points in the article. Fingerprinting of any kind is a major risk for personal freedom. At the same time I want to make sure that content creators are compensated for their work. Ad firms that employ fingerprinting stand between me and the content creator. That said, I'm not going to pay $5/month for every blog that I occasionally read. The ad based model provides a more streamlined approach to compensation, but at the unacceptable price of privacy. I'm not quite sure what the answer is.
  • airstrike 11mo ago
    Pay $5/month to buy credits that let you read content behind that network. Every blog you read gets $0.10. Top up with credits if you run out. Sending emails costs $0.50.
    • CamperBob2 11mo ago
      Eh, that's too expensive unless the recipient can authorize refunds for non-spam emails. But yes, I always thought some form of network syndication would emerge on the Web, where creators could register for their share of aggregated periodic payments made by users. Still not sure why that's not a thing. I would pay $50/month to a syndicate in return for never having to deal with paywalls on any sites affiliated with them. But only as long as the vast majority of sites participated, and that is probably the showstopper, I guess. We'd end up paying 20 different 'syndicates' for absolutely no good reason, just as we now have to deal with 20 different streaming services.
    • ako 11mo ago
      I read from too many different sources through aggregators like hackernews. With a network you'd probably still have too many subscriptions. Also wonder if it will really work out, i open too many articles that are pretty bad when you start reading them. So i quit after 1 or 2 paragraphs. Now if you get the first 2 paragraphs for free, contents writers will start to optimize for good first 2 paragraphs, and afterwards quality will drop. Also, many blog posts or news articles don't have more than 2 paragraphs of good content.
  • 11mo ago
• balamatom 11mo ago
  >And even though my personal safety and liberty probably aren’t at stake, I don’t want to give any support to the global advertising behemoth, by allowing advertisers access to better information about me. Giving the surveillance economy access to your habits means making them slightly better informed about everyone. That won't directly endanger you; the SE will just become slightly better informed about how people like you function. This will enable it to increase the amount of risk faced by some other person that you will never hear of (and vice versa) if any of you is even suspected of endangering the SE, in proportion to the risk to the SE which people like you may hypothetically pose, as quantified by the methods of nepotism-powered pseudoscience.
• abigail95 11mo ago
  To extend the closing remarks from a SIGINT perspective, sure some fingerprints are non unique and short lived, have little data. But hang onto it long enough and sure enough some slower data from another band might eventually correlate it with something else. The last time I looked at this seriously I was trying to find out how much fidelity (if it was possible at all) was necessary to identify someone by their mouse and keyboard input. It's not just what you do but how you do it.
• prng2021 11mo ago
  How exactly do advertisers take fingerprints and translate that to targeted ads for each user?
  • xnx 11mo ago
    The browser history is collected across multiple sites to form a profile. If the user ever enters their email address or logs in, their entire history is deanonymized.
  • prasadjoglekar 11mo ago
    A combo of your IP, browser fingerprint plus the fact that you logged in somewhere and that links to your actual name etc. Identify you in isolation is not very useful. It's connecting that identity to another place that's valuable.
• lilsoso 11mo ago
  Thanks for the browser recommendations. I switched to the Mullvad browser. The other recommendation, LibreWolf, provides the following warning on install which scared me away: "Warning: librewolf has been deprecated because it does not pass the macOS Gatekeeper check! It will be disabled on 2026-09-01."
  • Y_Y 11mo ago
    Sounds like you need to switch OS
  • mike_d 11mo ago
    The article rants about how turning off JavaScript is actually harmful because it makes you more fingerprintable, then in the same breath recommend switching to an obscure browser nobody else uses? If you want to avoid being uniquely identifiable stick to Chrome, signed into a Google account, running on a PC from Best Buy.
  • undeveloper 11mo ago
    tldr -- it's fine. MacOS Gatekeeper will create warnings about products that are not signed via the apple developer program, which is $99/year librewolf is an open source product, that is very strictly a "community" libre / FOSS project. naturally, having an individual take up notarization assumedly, you are using brew -- brew recently decided to stop supporting / deprecate all casks that does not pass gatekeeper checks, for some reason I cannot fully determine.
    • cruffle_duffle 11mo ago
      Why would I trust any software that doesn’t pass the gatekeeper test? Even if it claims to be “open source” with links to some code repo there is no guarantee the binary blob you are running was built using only that code and nothing else. Sure even with the gatekeeper test you can’t be sure it’s built against only the claimed code but it does guarantee: 1) the binary hasn’t been modified since it was signed 2) the binary was signed by somebody in possession of the private key 3) there is some measure of identification via Apple on who or what signed the binary 4) somebody was willing to fork over $99 to sign the binary It’s not perfect security by any means but it is something. Otherwise the binary you are running might as well have come from some sketchy email attachment. And fuck that. Why would I want that on my machine? I get that the $99 might be a hurdle for “non-organized open source” (ie most open source… doesn’t have a non-profit entity to take up the expense and credential management, etc…)… and there are probably ways apple could make it easier for such “collectives”… but ultimately I’d argue that signed binaries are good for everybody. While imperfect, they provide some form of traceability and accountability. obviously it’s not a 100% guarantee of being fuckery-free. The private key might have been compromised, the appleid might have been hijacked and the developer program might have been enrolled with stolen credit cards… but it’s still a hurdle to filter out a large swath of low effort nonsense.
• ekjhgkejhgk 11mo ago
  I mean... I don't give a fuck about fonts, I don't give a fuck about drawing shit to some canvas. Can I not just opt out? Yes, I know that's ski-mask bla bla bla, but I still don't want my browser to be doing this nonsense.
  • myaccountonhn 11mo ago
    There's the gemini protocol and gopher. When I think of all the tracking that goes on, these are becoming more lucrative.
    • zzo38computer 11mo ago
      Gemini and Gopher are better than the existing WWW, (although there are others as well, such as Spartan (uses the same file format as Gemini, but it is a different protocol without TLS), Scorpion (my own format, intended to be between Gemini and "WWW as it should be if it was designed better"), and others). However, you might also want to access HTTP and HTML, and to do so without needing to load fonts, pictures, etc; you might use a web browser that omits many of these features. However, it also can result in some problems; there are a few ways to work around some of these, such as adding your own scripts to handle some services, adding proxy services for handling some services (although some of these can use other protocols such as Gemini), and/or using the HTML/CSS commands in other ways (e.g. using ARIA to decide the formatting rather than using CSS). However, there are other issues, e.g. if the web page you download includes more junk than the actual main text.
• rcpt 11mo ago
  All this and I still need to click on the cookie pop ups like they'll bring the cargo planes to the island.
• bparsons 11mo ago
  Browser fingerprinting has been a thing since at least 2008. Kissmetrics was the first company I heard of that was doing this.
• ekjhgkejhgk 11mo ago
  The core of the problem is that we've made this behavior of "run javascript that pulls more javascript and then run that too" the default. Stallman was right, as always.
  • IshKebab 11mo ago
    Does he have a strong stance of JS in the browser? In any case, I don't think many people would agree that the dubious extra privacy you gain from blocking that is really worth breaking half the web. Fingerprinting is not too hard even without JS.
    • delusional 11mo ago
      His stance is pretty simple. The JS on most pages is proprietary, and he doesn't like proprietary software.
    • bee_rider 11mo ago
      Blocking most JavaScript is fine, it mostly just breaks the silly pointless over-designed sites anyway. Just like everything else, most of the internet is garbage; blocking over-designed JavaScript sites isn’t a perfect filter but it is an ok first heuristic.
    • ekjhgkejhgk 11mo ago
      > Does he have a strong stance of JS in the browser? Lets see what he says on the subject. https://www.gnu.org/philosophy/javascript-trap.html https://www.gnu.org/philosophy/javascript-trap.html
      • IshKebab 11mo ago
        Ok so his issue is even more obtuse - he doesn't care about fingerprinting; he cares that not all JS code is GPL.
        • ekjhgkejhgk 11mo ago
• daft_pink 11mo ago
  I’m curious if there is a product like cloudflare’s remote browser isolation that obfuscates it in that way.
• tetha 11mo ago
  It reminds me of a game we played with students of data classification algorithms like ID3: How many yes/no questions do we need to uniquely identify everyone in this room? With like 12 students, that's 4 bits, and it often ends up with 2-3 questions. It starts off with the obvious ones - man/woman/diverse, but then a realization comes in: An answer usually contains more information than just that one bit. If you have long hair, you're most likely a woman and/or a metalhead for example. That part will get shaken out later on. And those thoughts make these browser fingerprinting techniques all the more scary: They contain a lot of information and that quickly cuts the possible amount of people down. Like, I'm a Linux Firefox user with a screen on the left. I wouldn't be suprised if that put me in a 5-6 digit bucket of people already.
  • mathgradthrow 11mo ago
    >An answer usually contains more information than just that one bit. Isn't the point to ask yes or no questions?
    • tetha 11mo ago
      Yes, but multiple yes or no questions in combination can easily yield more information than they should in a real dataset. That's the real educational point.
      • gweinberg 11mo ago
        You seem to be confused about the difference between "less" and "more". In general a yes-no question gives less than 1 bit of information if yes and no are not equally likely. There is no way it can be expected to give more.
        • AnthonyMouse 11mo ago
          > There is no way it can be expected to give more. It is indeed not possible for it to give more, because it only has a single bit answer, which by the pigeonhole principle can't give you more than one bit. The best yes/no questions are the ones which are independent of each other and bisect the group evenly. "Are you female" is typically good because it will be approximately half the population. Then you want independent questions that bisect the population again, like "does your first name have more than the median number of letters" which should be mostly independent of the first question. Another good one is conditional questions like "are you taller than the median for your sex" since a pure height question wouldn't be independent of sex but that one is. Whereas bad questions would be ones with highly disproportionate responses, like "do you have pink hair with black and green highlights" which might be true for someone somewhere but is going to have >99% of people answering no, or "were you born on the planet Mercury" which will be 100% no and provide zero bits of information.
• btilly 11mo ago
  I don't mind advertisers knowing more about me. If they can display ads that are relevant to me, this is a better experience on both sides. Unfortunately there is no way to tell advertisers, "No, I'm not interested in your product. I never will be. Don't waste your money." The top offender is Hims. No, I don't have hair loss. I don't want hair loss supplements. I also don't have ED, and I object strongly to ads for that showing up unexpectedly when I'm showing a YouTube video to someone else. The second top offender is whoever it is (they keep changing their name) who thinks that I need some kind of Christian motivational course to get control of "the P-word". (Their phrase, not mine.) No, I don't have a problem with pornography. I am very rarely interested in it. And when it comes up every few months, I don't feel any guilt about it afterwards. Furthermore I'm an atheist. A Christian motivational course isn't going to work well for me regardless. Yes, Google does offer a report function, and a block function, for ads. The report function seems to have gotten rid of the unwanted ED ads. The block really doesn't work when the ads are all very similar AI slop that is rotated frequently. Block this ad, and then next unwanted ad from the same source will be coming along soon enough. (The reason why I particularly dislike Hims is that they are more aggressively rotating their ads.)
  • blfr 11mo ago
    If you don't mind them knowing but resent the ads, you can just block the ads. You can do dns ad blocking[1], in-browser plugins/extensions[2], finally, patch the apps[3]. Or deploy all of them. [1] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#specifications https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#... [2] https://ublockorigin.com/ https://ublockorigin.com/ [3] https://revanced.app/patches?pkg=com.google.android.youtube https://revanced.app/patches?pkg=com.google.android.youtube
    • btilly 11mo ago
      Perhaps you missed that I am willing to deal with ads in general? I am perfectly willing to put up with the annoyance, and like knowing that I am bringing money to the channel that I'm watching. I only want specific advertisers turned off. A general "show me no ads" solution is not my preference.
• drnick1 11mo ago
  Firefox w/ the Arkenfox user.js is probably as good as it gets in terms of privacy. By default, this config burns cookies on exit, standardizes the time zone to UTC, spoofs the canvas fingerprint, and does other helpful things. Basically, it makes Firefox expose the same information as the Tor browser. In addition, I block most known advertizing/tracking domains at the DNS level (I run my own server, and use Hagezi's blacklists). Finally, another suggestion would be to block all third party content by default using uBlock Origin and/or uMatrix. This will break a lot of websites, but automatically rules out most forms of tracking through things such as fonts hosted by Google, Adobe and others. I manually whitelist required third party domains (CDNs) for websites I frequently visit.
  • alcide 11mo ago
    Orion Browser (Kagi Product) prevents fingerprinters from running by default. https://help.kagi.com/orion/privacy-and-security/preventing-fingerprinting.html https://help.kagi.com/orion/privacy-and-security/preventing-...
    • codedokode 11mo ago
      How do they reliably detect fingerprinting? Did they solve the Halting Problem? Sounds fishy.
      • gruez 11mo ago
        >The only efficient protection against fingerprinting is what Orion is doing — preventing any fingerprinter from running in the first place. Orion is the only browser on the market that comes with full first-party and third-party ad and tracking script blocking, built-in by default, making sure invasive fingerprinters never run on the page. sounds like they block "known" fingerprinting scripts and call it a day.
        • 0xy 11mo ago
          This makes you inherently trackable, ironically. No trace is a massive trackable attribute, since almost nobody is untraceable.
• udev4096 11mo ago
  JavaScript disabling helps a lot, regardless of what author says. It disables most of the tracking attempts, improves security and most of all pages load faster and hardly break if you're just browsing anyway. The whole article never mentions the gold standard of anti-fingerprinting, Tor Browser. It just shows how shallow the article is when it mentions Mullvad Browser, a fork of TBB, instead of TBB itself! There's also no mention of using an upto-date DNS block list to thwart fingerprinting attempts even more
  • msm_ 11mo ago
    Yeah, I don't get it. Tor browser alone, with no additional configuration and basic hygiene, is enough to stop any fingerprinting and tracking. The only problem is that it's too private, and tor traffic is often associated with crime, so it's sometimes blocked, notably by cloudflare. I don't use it for daily browsing, but when I want to search for something I don't want associated with me (for example, health concerns) I just use tor browser and don't worry about tracking.
    • armadyl 11mo ago
      The Tor Browser won’t effectively stop fingerprinting, if anything it makes you more unique due to the low amount of people worldwide using it, and then you add points of data by using different DNS providers, extensions etc. The Tor Browser as a privacy measure is likely no better than a normal browser with uBlock if you’re also using it like a “normal” browser, signing into the same accounts you always use etc. My opinion obviously but I dislike people recommending the Tor Browser as a lot of it’s primary benefits are lost if you’re just using it as a daily driver browser. I always point people to https://fingerprint.com/ https://fingerprint.com/ to see if their browser can defeat it. Most of the time you can’t without clearing cookies, changing device resolution, change VPN location etc. something the average person can’t/won’t do. Even JS aside there are a ton of different ways to track people based off even just getting server side data when a site’s stylesheet is fetched.
      • udev4096 11mo ago
• mixmastamyk 11mo ago
  We’re working on a comprehensive solution here (and could use your help), the Ethical Computing Initiative. https://aol.codeberg.page/eci/ https://aol.codeberg.page/eci/
• gweinberg 11mo ago
  For a fingerprint to be useful it must not only be unique but also persistent. If I have a process that randomly installs and deletes wacky fonts, I'm unique at any given time, but the me of today can't be linked to the me of tomorrow, right?
  • internetter 11mo ago
    Point still taken, however you can only really check if a given font is installed, not obtain a list of all fonts. Thus, installing a wacky font is pointless as the fingerprinter won’t bother to check that particular font. There is queryLocalFonts on chrome but this requires a permission popup.
  • gruez 11mo ago
    >If I have a process that randomly installs and deletes wacky fonts, I'm unique at any given time, but the me of today can't be linked to the me of tomorrow, right? See: https://xkcd.com/1105/ https://xkcd.com/1105/ Services with a large enough fingerprinting database can filter out implausible values and flag you as faking your fingerprint, which is itself fingerprintable.
    • NewsaHackO 11mo ago
      But they still wouldn't be able to confidently connect his different fingerprints to the same individual, just that he is one of a group of individuals who fake their fingerprints.
      • gruez 11mo ago
        It would depend on what your existing fingerprint is. If you're using some sort of rare browser/OS/hardware combination (eg. pale moon/gentoo linux/IBM thinkpad) it might be worth spoofing, but if your configuration is relatively "normie" (eg. firefox/windows/relatively recent intel or amd cpu/igpu)you're probably making yourself stick out more by faking your fingerprint.
        • 11mo ago
• lipbetfox 11mo ago
  I still haven't found a method that can fingerprint simple Firefox containers. I use automatic temporary containers as a rule, and rules for specific sites where I want to keep persistent sessions. I don't understand how temporary containers are still not a built-in Firefox feature, it seems like such a no-brainer solution for privacy.
  • rob_c 11mo ago
    How to scream I'm behaving badly online...
    • nativeit 11mo ago
      How to scream, “I’m living a life of unalloyed privilege.”
      • rob_c 11mo ago
        > "I’m living a life of unalloyed privilege" How to scream I'm the worst of online discorse
  • mixmastamyk 11mo ago
    Isn't the semi-recent per-site cookie jar most of this functionality?
  • boxedemp 11mo ago
    Open question, If you're on a VPN and using Firefox containers, is the only way to identify me to look at my mouse movement and correlate it?
  • deleted 11mo ago
    [deleted]
  • arbol 11mo ago
    Do you have a repo for this?
    • 11mo ago
• hamonrye 11mo ago
  [dead]
• baalimago 11mo ago
  On the pros of fingerprinting: it's practically the only consistent tool to prevent malicious use in certain usecases, such as app hosting and similar bot protection. Email validation doesn't work. Ip blocking doesn't work. Captcha? Kind of. Fingerprinting? Very efficient.
  • arbol 11mo ago
    Its efficient until you get bots that rotate fingerprints with every request. Then you need to move to behavioural metrics to see if they look different to regular users of the site.
• stego-tech 11mo ago
  Sandboxing in containers and manually exempting specific security tokens is arguably one of the better steps we can take in the immediate term, as are random agent strings and returning fake data for common prompts. Of course that only works in the immediate, because this, like advertising in general, is an arms race at the moment. This feels like a regulatory question, not a technical one. We've repeatedly proven that with math and code alone, we can fingerprint and identify almost every unique person on the planet, given enough data points. The long-term solution seems like it should be severe consequences for data breaches (as in, corporation-destroying penalties for disclosure of PII, including fingerprint data) such that everyone only collects the data they need to provide the service in question and not a single bit more, deleting it as soon as it's no longer necessary. Right now there's no consequence if Google or Meta disclose huge swaths of user data, and thus no disincentive to collecting as much as they possibly can. Punish the leaking of data, and suddenly you've raised it's cost to the point that casual players will nope out entirely. From there, it's the eternal back and forth of governments waffling between business and electorate interests.
  • gruez 11mo ago
    >We've repeatedly proven that with math and code alone, we can fingerprint and identify almost every unique person on the planet, given enough data points. I'm very skeptical of this claim, especially in practice. Contrary to what many fingerprinting sites claim ("you're unique of everyone we fingerprinted!!"), browser fingerprinting can't possibly uniquely identify someone. Smartphones are pretty locked down and there's very few customization options that allow for fingerprinting. In the US Apple has around 50% market share in the US, and there are 30 iPhones models that are still in support. That means if you're an iPhone user in a city of 1 million, there are, on average, approximately 16.6k (500k / 30) other people with the same exact model of iPhone (and therefore fingerprint) as you. As long as you don't do anything to stick out (eg. living in the US but setting Denmark as your locale), you'll be reasonably anonymous.
  • dwg 11mo ago
    > ...severe consequences for data breaches... Often had the same thought, if not shared same opinion. On the other hand, stiffer penalties have the trade off of incentivizing cover-ups, i.e. disincentivize honest disclosure.
• alkonaut 11mo ago
  There is no good technical solution here. But the damage could be limited if browsers at least limited entropy somewhat. Stuff like reading back canvas contents should need user approval. Just make sure it’s sufficiently illegal to keep this info. Find and make big visible examples of fining companies that trade in this info. If a company sells a product that fetches ads based on an ”identifier” their little js snippet computed then just pay them a visit. Fine both them and their customers to the max extent of the gdpr (or equivalent).
• mlhpdx 11mo ago
  Don’t confuse privacy with anonymity. One is a right in the US, the other is not.
  • Rygian 11mo ago
    Not trying to be sarcastic; I may be unaware of some relevant legal framework for the US, could you please elaborate which one is a right and how is it enshrined and enforced?
    • dmacedo 11mo ago
      Not American here, but I'm aware of both privacy in mixed forms (privacy act 1974, HIPAA, COPPA, and CCPA in California); as well as anonimity in First Amendment et al since there's case law (IANAL) demonstrating the requirement of anonimity to avoid persecution of free speech. All of these have limitations and exceptions in a complex legal system. But to issue a blanket statement like the comment above is no really correct - just trying to make a point, I guess
      • mlhpdx 11mo ago
        Also not a lawyer but anonymity case law is a mixed bag to best, and more practically speaking very narrowly targeted compared to privacy.
    • mlhpdx 11mo ago
      Arguments for both are derived from, but not explicit in, the Bill of Rights. Privacy has broad points of support while anonymity is primarily attributed to the First Amendment, but only in narrow circumstances.
  • hinkley 11mo ago
    The only way to have privacy in a semi public location, like the Internet, is anonymity. Ask any celebrity how much privacy they have. They can’t even buy Starbucks without people commenting on how fat their comfy clothes make them look. Because they have no anonymity.
• maks198 11mo ago
  [dead]
• neilv 11mo ago
  > Since almost every web browser in the world now supports JavaScript, turning it off as a measure to protect privacy is like going to the shopping mall wearing a ski mask. I'm going to steal this nice analogy, for when I try to explain this point and some related points.
• beders 11mo ago
  when PayPal tells you that they already know you and don't require you to log in: that's fingerprint.com behind the scenes. There are pros/cons. It should be obvious by now that using any free service of scale is being paid for by your interactions which are made more valuable through fingerprinting. Trying to circumvent that just makes it more expensive for the rest of us.
  • Zarathustra30 11mo ago
    Paypal does what? I'm sometimes nervous I only need 2 factors of authentication. 0FA seems dangerous for financial anything.
  • slig 11mo ago
    >when PayPal tells you that they already know you and don't require you to log in: that's fingerprint.com behind the scenes. Why use a third party service when cookies can do exactly that? They load their .js from the same domain they set up a cookie and there's no limitation to read that cookie, correct?
• ghxst 11mo ago
  Browser data points can make it easy to identify a browser or in some cases even a specific machine, but that doesn’t necessarily equate to identifying a user. What frustrates me is that it takes a service I trusted with my personal data to be the one that attaches an identifier to those metrics. The best practice for privacy is to always keep profiles and identities separated, rotate P.O. boxes, email addresses, phone numbers, and payment methods so that when someone identifies your browser or device, the accuracy of linking it to you stays low. Of course, this approach comes with its own problems...
• bolangi 11mo ago
  The article is missing links to one of the first fingerprint diagnostic tools, https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/ , formerly called something like panopticon.net.
  • TechDebtDevin 11mo ago
    or don't trust the EFF!
    • nativeit 11mo ago
      Beyond the notion that no org should be trusted implicitly, why would the EFF specifically be untrustworthy?
      • baxuz 11mo ago
        Was just about to ask the same.
• skaul 11mo ago
  Self-plug but if anyone is interested in learning more about how browser fingerprinting works and the different protections browser makers deploy against it, I wrote a longer post about this a few months ago: https://pitg.network/news/techdive/2025/08/15/browser-fingerprinting.html https://pitg.network/news/techdive/2025/08/15/browser-finger...
  • NoahZuniga 11mo ago
    its consistent cross site, so you get all the same privacy problems as with 3rd party cookies
• zkmon 11mo ago
  I'm sure it's a privacy issue. But how does this browser fingerprinting harm the user? Maybe it can work like a session cookie used for correlating across different requests from the same user. What's the damage here?
• aragonite 11mo ago
  Some time ago I noticed that in Chrome, every time you click "Never translate $language", $language quietly gets added to the Accept-Language header that Chrome sends to every website! My header ended up looking like a permuted version of this: en-US,en;q=0.9,zh-CN;q=0.8,de;q=0.7,ja;q=0.6 I never manually configured any of those extra languages in the browser settings. All I had done was tell Chrome not to translate a few pages on some foreign news sites. Chrome then turned those one-off choices into persistent signals attached to every request. I'd be surprised if anyone in my vicinity share my exact combination of languages in that exact order, so this seems like a pretty strong fingerprinting vector. There was even a proposal to reduce this surface area, but it wasn't adopted: https://github.com/explainers-by-googlers/reduce-accept-language https://github.com/explainers-by-googlers/reduce-accept-lang...
  • hoofedear 11mo ago
    Is Chrome trying to assume that, since you don’t want it to translate those pages/languages, that you can read them/want them in your header? Interesting
    • onion2k 11mo ago
      I'd read it more generously than that. I think Chrome trying to stop the server choosing the language for you. By sending an accepts-language header (which your browser does regardless of what you use; it's not a Chrome thing) the server should return the page in a language you've said you'll accept. By adding the language to what you've told Chrome not to translate, it's attempting to show you pages in languages you want. I imagine Chrome is really adding the language to your browser preferences when you choose not to translate a page, and the HTTP client in the browser is generating request headers based on your preferred languages. A small (and largely unimportant) semantic point, but it's possible that the Google translate team weren't aware of how adding a preferred language might impact user privacy. That isn't to excuse the behaviour; they should have checked.
  • fsflover 11mo ago
    Using Chrome and caring about privacy? I thought, after Google killed uBlock Origin, it had become beyond clear these two things were incompatible, https://news.ycombinator.com/item?id=41905368 https://news.ycombinator.com/item?id=41905368
• kkfx 11mo ago
  Has anyone ever thought that RSS doesn't have a fingerprint? Because the sites that still offer feeds, at least those for which a feed makes sense, well, you can read them comfortably via RSS.
  • arbol 11mo ago
    No JS fingerprint - your browser version and IP are still visible.
• baq 11mo ago
  The real problem: if you can’t be identified, the system assumes you’re a bot, untrustworthy, or both and instead of reading content you get to select squares with buses and traffic lights ad infinitum.
  • pphysch 11mo ago
    Yes, and the conspicuous lack of signal is itself a signal. "Get me all the individuals in this geo area that have atypical communication patterns..."
    • Terr_ 11mo ago
      https://xkcd.com/1105/ https://xkcd.com/1105/
• rncode 11mo ago
  you're all running chrome signed into google with 47 extensions and complaining about privacy. the call is coming from inside the house
• nobody42 11mo ago
  You could test with this: https://github.com/abrahamjuliot/creepjs https://github.com/abrahamjuliot/creepjs Does it store the data? Unknown. The best browser for protection is https://mullvad.net/en/browser https://mullvad.net/en/browser because it makes the connection uniform, to better blend in.
  • thetyster 11mo ago
    > best I guess that really depends on how you classify "best" Tor is pretty good for protection. Then there's always i2P as well… Saying one browser can protect the best is pretty hard to prove.
    • nobody42 11mo ago
      Best among existing. Anti-fingerprinting field is still in it's early stages. I wouldn't say Tor Browser is the best because it requires custom configuration to be usable conveniently, which will make the connection non-uniform (and the user will stand out). >Tor is pretty good for protection. Then there's always i2P as well… Tor and i2P does nothing for (anti)fingerprinting - the program which render the web pages does. >Saying one browser can protect the best is pretty hard to prove. Not a proof but things to consider: https://privacytests.org/ https://privacytests.org/
      • sfink 11mo ago
        I'd like a "Firefox + uBlock Origin" column on that page. (But then you'd have to consider filter lists enabled...)
    • coppsilgold 11mo ago
      Mullvad Browser is just Tor Browser without tor. Among all the available browsers, mullvad/tor browser is the best we have in terms of fingerprinting resistance.
• WorldPeas 11mo ago
  seeing projects like https://github.com/jonasstrehle/supercookie https://github.com/jonasstrehle/supercookie kind of fill me with a dread about just how many holes would need to be plugged in the web for "privacy" to be assured, and how that would degrade my experience as an end user
• notepad0x90 11mo ago
  When an individual stalks a person without their consent, it is considered unlawful. Why is it ok for websites to do this? Perhaps what is missing is a criminal law that forbids deliberate non-consensual tracking of a person's activity. Even in public. Recording someone as you happen to be recording something in public (including CCTV) is not deliberate or targeted towards an individual. But even in public, if someone followed you around tracking what you're doing (even without recording you), that shouldn't be lawful. Public figures and law enforcement activity based on probable cause being the exceptions. Can anyone think of any reasonable counter-arguments to this?
  • charcircuit 11mo ago
    A counter argument is that stalking in itself, in the US at least, is not unlawful. It becomes unlawful once someone starts threatening another person. So the digital analog would be to allow tracking as long as the site doing the tracking doesn't threaten the people that are being tracked.
    • notepad0x90 11mo ago
      You're talking about the law today, and I concede. Why don't we change it so it becomes lawful. No one wants to be stalked, and notwithstanding the exceptions I mentioned, no one should have to endure the harassment. There is no scenario where one person would legitimately have a right or a need to stalk another person (unless financial gain is a legitimate reason).
• t_mann 11mo ago
  What I don't get, all this data is reported by your machine - why isn't there a tool/browser fork that allows spoofing a (fairly) complete realistic profile, with some sane presets like Edge/W11/Thinkpad or Safari/macOS/M4? Is it too complex, would it break too much, or am I just unaware?
  • nativeit 11mo ago
    Most privacy-thumping browsers do this, to some degree, but it’s not a panacea. The article gets into it.
    • t_mann 11mo ago
      The article mentions some complications and browsers like LibreWolf that address some of them. But that's not really what I have in mind - I'm thinking more of a dashboard with editable fields for everything that might get queried, populated with what currently gets sent, and a drop-down that lets you select among preset/saved custom profiles.
  • arbol 11mo ago
    There are browsers that people use for multi accounting that switch fingerprints for you. See octobrowser and other similar ones. They're generally paid products and need to work in conjunction with proxies
• kxrm 11mo ago
  So there seems to be some confusion around fingerprinting related to identifying characteristics and tracking. These are two different things. Setting your timezone to UTC, masks that one characteristic of your "identity". But there are better signals for location than timezone, like GeoIP. Same with hiding capabilities. All this does is make the web harder for you but it doesn't make your untrackable. Trackability comes from a combination of factors both within and out of your browser's control. If you share your IP with a family of 4, and you go changing your request headers you are only making yourself MORE trackable. The fact that one request comes across with UTC as a timezone and others come back with EST or other timezones, means I now can track a single user on this single IP. This is made worse if you and your family are using different browsers or different devices. So what do we care about? If you care about being untrackable, then you have a couple of options, rotate VPNs, or cycle your public facing IP often. Additionally, every request you make MUST change up the request headers. You could cycle between 50 different sets of headers. Combine these two and you will likely be very hard to fingerprint. If you only care about being identified, use Tor + the Tor browser which makes A LOT of traffic look identical.
• Refreeze5224 11mo ago
  The real problem here is not technical, it's political. None of this should be legal, let alone the basis of companies worth hundreds of billions. This is surveillance capitalism, and is incredibly harmful to society in a multitude of ways. And as long as the owning class is able to dictate what's legal, this injustice will continue.
• ifh-hn 11mo ago
  Stupid question but what happens to fingerprinting if you just disabled JavaScript? Sure it breaks websites, but that's what I do with ubo advanced, which I also use to block webrtc, etc. (I really miss umatrix for this purpose). Am I fingerprinted because a site can't run JavaScript? If I use a VPN too?
  • dempedempe 11mo ago
    Yeah. You are fingerprinted if you disable JS and/or use a VPN. Read the article for more info.
    • ifh-hn 11mo ago
      I did but I don't think I understand how it's that bad, random IP address with JavaScript disabled is 2 data points that can't, as far as I can see, be really helpful in identifying me. Seems like you're fingerprinted anyway so the less you give the better...
      • dempedempe 11mo ago
        Just having JS disabled narrows you down by a lot. Yeah, fingerprinters can't use a lot of their more sophisticated techniques, but they still have a lot to work with as I understand it. I'm no expert though.
• diogenes_atx 11mo ago
  Useful site to see what info your browser is giving out: https://amiunique.org/ https://amiunique.org/
• xp84 11mo ago
  On articles like this always I see a lot of people bragging about how they’ve pimped out their browser(s) to make themselves “untrackable” (or proposals to make new ways of tracking impossible) but nobody ever brags about how lack of “tracking” has positively impacted their lives. I do block ads on the web with UBlock Origin because there’s no pay option to opt-out of it and ads ruin the experience. But I don’t give a fig about tracking. Change my mind. Why would the average person enjoy a better life if they became untrackable on the Web?
  • fggabb 11mo ago
    Whether or not they would enjoy a better life doesn’t matter if there’s no way to avoid your assumed preferences being tied to your devices, and for it to know the preferences of those you spend time with, those you work with, where you go, etc. Though, from what I understand, overall the fingerprinting success rate is only about 30%.
    • sroussey 11mo ago
      One time fingerprinting, sure. But if you collate tracking info from a hundred sources or so, you pretty much have person, name, email, and location.
  • WillAdams 11mo ago
    People being untrackable in general ensures that folks who need to be untrackable are more easily able to achieve that goal --- the world is a much darker place if journalists are hindered in researching stories.
  • mac-attack 11mo ago
    > nobody ever brags about how lack of “tracking” has positively impacted their lives This reminds me of the anti-vax logic a tad in that they lack the imagination on the seemingly obvious effects of their ideal world. Being indifferent to companies and political parties (which becomes your Gov't when voted into power) indirectly states that you are indifferent to others attempts to influence you and/or foolhardy enough to believe that all of your beliefs consistently originates from objective personal experience.
• stickfigure 11mo ago
  We can start by getting rid of (freezing) the User-Agent header. No need to make it easy.
• kuon 11mo ago
  It is not really fingerprinting but I realized that ipinfo can place my IP on my house. I guess some stupid phone sent the GPS location. Isn't that supposedly under GDPR in Europe? Can I delete it somehow?
  • reincoder 11mo ago
    I work for IPinfo. If you're on a residential connection, the geolocation of that IP address is likely to be accurate up to the ZIP code area. We have generalized hints of location information from over 70 different sources. Then we aggregate them and we map this information based on population density in the geographic region. Sure, our data is becoming more granular, but it's not granular enough to detect individual houses from residential connections. However, our data is improving for POI (Points of Interest). For example, with data centers, we're working on identifying the exact data center from IP addresses. Similar accuracy applies to airports, hotels, and conference halls, as they tend to have a large concentration of IP addresses in a very small area. We do publish a lot of information on our research page: https://ipinfo.io/data-research https://ipinfo.io/data-research
    • kuon 11mo ago
      I have my own IP range and the data is accurate to the meter, which is what worries me.
      • reincoder 11mo ago
        That is surprising. I am not sure what is going on. This type of accuracy can only work if you are operating like a literal data center. Even in that case, I think meter level accuracy will involve hosting one of our ProbeNet PoPs. For example, we know where our ProbeNet PoPs are located. If hops to your ranges are through private IPs or sub 1 MS RTT, we can pretty much confidently tell the name of the data center. However, considering that there are data centers that span thousands of square meters, we can point to the data center building, rather than the rack or the room. To me, it is likely a coincidence.
• gausswho 11mo ago
  I want a spoofing tool. How would one go about sending all my browser's traffic through a proxy that swapped out fingerprintable aspects with those of selectable presets of the most common browser configurations? It'd help to be able to bypass certain details for a whitelist domains that actually needed granular exceptions. Most websites don't need this data for serving you.
• beefnugs 11mo ago
  There was just a youtube video of a penetration tester showing a screencap of some hacker: they used something called "octo browser" to act like their target as they used stolen cookies to login as hacked targets. Seems like we all need to come together and use the same technique to "we are borg, we are browsing your internet as one, tracking is futile"
• tcfhgj 11mo ago
  Isn't it forbidden on the EU anyways - thanks to GDPR?
  • arbol 11mo ago
    Somewhat. Opt-in is required for marketing purposes. Fingerprinting counts as PII due to its potential to personally identify an individual. Other legitimate uses, such as fraud detection, do not require opt-in.
• metek 11mo ago
  I've recently started going full send and using Ad-Nauseaum instead of simply using an ad-blocker. I've even started seriously boning up on Javascript to see if I can come up with some horribly hacky :click:hover:focus smokescreen sideload. I'm sick to death of companies thinking they have any right to keep tabs on me because they think it'll make them a buck.
• uoaei 11mo ago
  It's moderately inconvenient to
  • uoaei 11mo ago
    oops!
• tzury 11mo ago
  The OP argues that fingerprinting is a "privacy nightmare," but we need to look at why it exists. From a pragmatic perspective, we are forcing two very different networks to run on the same protocols: The Business Internet: Banking, SaaS, and VC-funded content (Meta/Google). The Fun Internet: Hobby blogs, Lego fan sites, and the "GeoCities" spirit. You cannot have a functioning "Business Internet" without identity verification. If you try to perform a transaction (or even just use a subsidized "free" tool like Gmail) while hiding behind a generic, non-unique fingerprint, you look indistinguishable from a bot or a fraudster. Fingerprinting is often just the immune system of the commercial web trying to verify you are human. The friction arises because we expect the "Fun Internet" to play by different rules. A Lego fan site shouldn't need to know who I am. But because we access both the Lego site and our Bank using the same browser, the same IP, and the same free tools (Chrome/Search), the "Fun Internet" becomes collateral damage of the "Business Internet's" need for security and monetization. We can't have it both ways. We accepted the SLA for the "Business Internet" in exchange for free, billion-dollar tools. If you want 100% anonymity, you are effectively asking to use the commercial web's infrastructure without providing the identity signal it runs on. As the OP notes, mitigation is hard. But that’s not just because advertisers are "evil"—it's because on the modern web, anonymity looks exactly like a security threat.
  • domenicd 11mo ago
    This is an excellent insight. I think there is still some hope that technical solutions could be developed so that only the "Business Internet" gets access to verified identity, with the user somehow understanding this, while the "Fun Internet" doesn't have such capabilities. This is what stood behind, e.g., Google's proposed WEI [1] that got such huge backlash, or Apple's Private Access Tokens [2] which are essentially the same thing but quietly slipped under the community radar. Other proposals are Google's in-limbo Private State Tokens [3], or the various digital-wallet/age verification proposals (I think Apple and Google both have stuff in that space). But even basic stuff, like IP protection, can really throw off the anti-fraud and anti-botnet mechanisms. Your Lego fan site wants to be behind a CDN for speed and protection from DDOS? Well, people using VPNs or in Incognito mode might end up inconvenienced, because the CDN thinks it's dealing with bots. Rough stuff. [1]: https://en.wikipedia.org/wiki/Web_Environment_Integrity https://en.wikipedia.org/wiki/Web_Environment_Integrity [2]: https://developer.apple.com/news/?id=huqjyh7k https://developer.apple.com/news/?id=huqjyh7k [3]: https://privacysandbox.google.com/protections/private-state-tokens https://privacysandbox.google.com/protections/private-state-...
• ihucos 11mo ago
  yeahh. For me technically it does not make sense for "privacy friendly" web analytics to rely on fingerprinting techniques because the common sentiment seems to be that cookies are bad. At least cookies are easily controllable. Now shameless adverting: of course I present the solution: https://counter.dev https://counter.dev
• domenicd 11mo ago
  As someone who used to work on Chrome, I can confirm that browser fingerprinting is indeed a nightmare. Back in the early days of Privacy Sandbox, before that crashed and burned against the UK CMA not even letting Google remove third-party cookie support [0], there was a lot of optimism about how we were going to completely solve cross-site tracking, even in the face of determined adversaries. This had several ingredients; the biggest ones I can remember are: 1. Remove third-party cookie support 2. Remove unpartitioned storage support 3. IP protection at scale 4. Solving fingerprinting In the end, well... at least we got 2, which has some security benefits, even if Chrome gave up on 1, 3, and 4, and thus on privacy. Anyway, everyone could tell that 4 was going to be the hardest. The closest I saw to an overarching plan was the "privacy budget" proposal [1], which would catalogue all the APIs that could be used for fingerprinting, and start breaking them (or hiding them behind a permission prompt, maybe?) if a site used too many of them in a row. I think most people were pretty skeptical of this, and the main person driving it moved off of Chrome in 2022. Mozilla has an analysis suggesting it's impractical at [2]. Some code seems to still exist! [3] A key prerequisite of the privacy budget proposal was trying to remove passive fingerprinting surfaces in favor of active ones. That involved removing data that is sent to the server automatically, or freezing APIs like `navigator.userAgent` which are assumed infallible, and then trying to replace them with flows like client hints where the server needed to request data, or promise-based APIs which could more clearly fail or even generate a permissions prompt. This was quite an uphill battle, as web developers (both in ad tech and outside) would fight us every step of the way, because it made various APIs less convenient. Elsewhere people have cited one example, of reducing Accept-Language [4]. The other big one was the user agent client hints headers/API [5], which generated whole new genres of trolls on the W3C forums. As Privacy Sandbox slumped more and more towards its current defeated state, people backed off from the original vision of a brilliant technical solution that worked even in the face of determined adversaries. Instead they retreated to stances like "if we just make it hard enough to fingerprint, it'll be obvious that fingerprinting scripts are doing something wrong, and we can block those scripts"; see e.g. [6]. Maybe that would have worked, I don't know, but it becomes much more of a cat-and-mouse game, e.g. needing to detect bundled or obfuscated scripts. And now of course it's all over; the ad tech industry, backed by the UK CMA, has won and forced Google to keep third-party cookies forever, and with those in place, there's not really any point in funding the anti-fingerprinting work, so it's getting wound down [7]. The individual engineers and teams are probably still passionate about launching opt-in or Incognito-only privacy protections, but I doubt that align with product plans. I'm sure Google doesn't mind the end result all that much either, as having to migrate the world to privacy-preserving ad tech was going to be a big lift. Now all that eng power can instead focus on AI instead of privacy. [0]: https://privacysandbox.com/news/privacy-sandbox-next-steps/ https://privacysandbox.com/news/privacy-sandbox-next-steps/ [1]: https://github.com/mikewest/privacy-budget https://github.com/mikewest/privacy-budget [2]: https://mozilla.github.io/ppa-docs/privacy-budget.pdf https://mozilla.github.io/ppa-docs/privacy-budget.pdf [3]: https://chromium.googlesource.com/chromium/src/+/36dc3642bee361b856c83be8b2b614a2581c1ad4/docs/privacy_budget/privacy_budget_code_locations.md https://chromium.googlesource.com/chromium/src/+/36dc3642bee... [4]: https://github.com/explainers-by-googlers/reduce-accept-language https://github.com/explainers-by-googlers/reduce-accept-lang... [5]: https://developer.mozilla.org/en-US/docs/Web/API/User-Agent_Client_Hints_API https://developer.mozilla.org/en-US/docs/Web/API/User-Agent_... [6]: https://privacysandbox.google.com/protections/script-blocking https://privacysandbox.google.com/protections/script-blockin... [7]: https://privacysandbox.com/news/update-on-plans-for-privacy-sandbox-technologies/ https://privacysandbox.com/news/update-on-plans-for-privacy-...
• motbus3 11mo ago
  Visiting a store does not give it the right for someone to stalk you. I don't see any reasons why (apart from the obvious $) this sort of business is not considered illegal. It wouldn't solve all the problems but would drastically reduce the incentives. I know one particular online car store that shares user data with insurance companies and they use that in their models to compute a "willingness" to pay more for insurance as well as of establishing the user profile. Let's say you look a sports car but you end up buying a family van, they charge you more for that. The very interesting part is that they create a "customer profile score" they is just a number and sell that number to other companies. So, by pipping your habits they aggregate data and technically do not violate some local laws.8
• michaelbuckbee 11mo ago
  Something missed in the continual tracking/privacy discussion is the primary motivations for doing so, with the assumption that it's about advertisers trying to sell you more stuff. I'm 100% in the need for personal privacy camp, but mention this only because without addressing the underlying issues, it's hard to come up with larger solutions. And the big issues really come down to fraud and cyber attacks: - Years ago, the NYTimes was found to be doing some kind of homegrown fingerprinting with canvas. They have plenty of ways of doing analytics and tracking subscribers, they were trying to root out ad fraud. - When Spotify has people every day putting up AI-generated streams and attempting to "listen" to them with bot networks, they start to look at things like fingerprinting. - Massive credential stuffing attacks on sites are often thwarted at the technical level by fingerprinting. - Bot traffic (and in particular AI indexing bots not respecting robots.txt) has shot up dramatically in the last year, and fingerprinting is one of the strongest ways of bot identification. Again, want the personal privacy, but think we need to fix the professional problems to get there.
  • rglynn 11mo ago
    I have little sympathy for the ad business failing to properly track ad fraud. I don't think the world is fundamentally better off for advertising. On the bot traffic, do we not have better ways to do this that don't involve violating privacy of free human beings? Proof-of-work captchas provide minor friction to an end-user but massively restrict the types of high-volume + low-compute attacks that would be doing this. That's just one example, I'm sure there are other ways too.
• hedgeho 11mo ago
  I am planning to write my MSc thesis about the currently broad topic "Future of Open Web. Since I work at a contextual targeting company, I have also aggregated data about traffic to some news sites & contacts in the industry for interviews. Any particularly interesting angles to this that you wished there was research on?
• egeozcan 11mo ago
  I don't agree the search for a technical solution. Fingerprinting is not useful for the small personal website, and when it's useful and abused, there's a 99% chance that there's a network behind. You can audit and control the networks using the law. Why not do that? It's been obvious for a decade and a half that technical solutions won't be practical to implement.
• DarkmSparks 11mo ago
  there are a few more angles to this. Firstly, on the counter argument side, when you visit a website, you are using their hardware, they have every right to make any requirements they want to use their hardware, they are not public spaces. But more importantly, the fix is actually easy, use more than one browser, use private browsing sessions, use more than one device, only log in to services you dont mind tracking you, use ad blocking. everywhere. Dont use sites that dont behave. All things you should be doing anyway. However, I also think the whole concept of browser fingerprinting is exaggerated. None of the things that can be used for fingerprinting are long lived, meaning any fingerprint probably has a shorter life span than the average cookie, and also far less reliable than say an IP address, which absolutely doesnt personally identify you. meanwhile, it is quite rediculous to log in to all these services with 2FA, then expect any kind of technical or legal measure to prevent them from knowing exactly who you are with 100% accuracy. Mostly thinking out loud, truly anonymous browsing is a tor node away, but a long time since I used that, there wasn't anything there I was interested in after intel exchange went down.
• shevy-java 11mo ago
  We really need a browser (or several) that aren't effectively controlled by private interests (such as corporations). Basically they are used as spy-tools. Many anti-features are pushed into them - a simple example is the disable-right-click functionality. I do understand that some of this have a useful functionality (for instance during an exam on-campus-site, to restrict what the students may do), but I always hate that I need e. g. a browser extension just to disable this antifeature. That's a super-simple example; there are many more severe examples such as fingerprint spy-sniffing here.
  • ivanjermakov 11mo ago
    > a simple example is the disable-right-click functionality This is a part of a W3C browser spec and every web browser has to implement it. But you're right that people writing the spec work for companies selling web browsers.
    • godshatter 11mo ago
      Every browser has to implement it but there's nothing saying they can't let the user disable that functionality, either.
• anticristi 11mo ago
  How about trying out legal solutions against browser fingerprinting? The European Data Protection Board -- i.e., the union of "GDPR Police" in each EU Member State -- made it clear the fingerprinting violates the ePrivacy Directive.
• packetslave 11mo ago
  I have a bit of a different take on browser fingerprinting: I don't want to uniquely identify you as a person so I can serve you ads, or whatever. I want to identify your traffic when you're scraping my content from 2,000 different IP's and 1,000 different user accounts, I can block you or rate limit you without hurting anyone else. Given the scale of scrapers these days (AI companies with VC money have no problem spinning up thousands of VMs running Chrome), fingerprinting at the browser level is the only realistic option. (obligatory: my personal opinion, not necessarily my employer's)