3 ms·

Browser fingerprinting is an unintended side-effect of things it's sorta-kinda reasonable for browsers to provide. A user agent that says the browser's version

Browser fingerprinting is an unintended side-effect of things it's sorta-kinda reasonable for browsers to provide. A user agent that says the browser's version? Reasonable enough. Being able to ask for fonts, if the system has them? Difficult to have font support without that. Getting the user's timezone, language and keyboard layout? Reasonable. The size of the screen, and the size of the browser window? Difficult to lay things out without that. Of course a video or audio player needs to know which video formats your browser supports - how else to provide the right video? Obviously javascript can get the time, and it's trivial to figure out the system's clock error by comparing that to the time on a server. Before you know it, almost every browser is uniquely identifiable.

sandworm101 6mo ago
The tor project seeks this bypass this by keeping such things standardized across users, even down to reported screen size. And there is nothing stopping the browser from fibbing as most settings dong matter all that much (ie UK v Canadian v American English).
- autoexec 6mo ago
  This is a bad idea though, because any newly discovered means to get even a single data point results in being able to ID every tor user. I'd be better to have every tor browser always generate a random fingerprint so that even if the unexpected happens people will never get anything but random results.
  - rendx 6mo ago
    > to have every tor browser always generate a random fingerprint Browsers do not "generate" fingerprints. They expose data that can be used to fingerprint users. You cannot "randomize" this; even if you were to return random values for, say, user screen size, with various visual side effects, it would just be another signal to fingerprint: "Oh, your browser is returning random values? Must be a Tor browser user".
    - IAmBroom 6mo ago
      > it would just be another signal to fingerprint: "Oh, your browser is returning random values? Must be a Tor browser user". You'd have to fingerprint the browser first to determine that the "random values" were indeed coming from it.
    - autoexec 6mo ago
      > it would just be another signal to fingerprint: "Oh, your browser is returning random values? Must be a Tor browser user". That's perfectly fine! As long as they can't tell which tor user you are they can't track your browsing activity or associate it to any one tor user. That's the goal. Currently tor browser sticks out like a sore thumb by trying to appear identical no matter who uses it, which is fragile because any one data point unaccounted for unmasks everyone.
BeetleB 6mo ago
I fantasize having a browser that I can use only for viewing content. No applications. No mail. No need for cookies. I can use a "regular" browser for more enhanced stuff. But for simple content consumption, we can just have a "dumb" browser that can't do much. > A user agent that says the browser's version? Reasonable enough. No user agent. I'm guessing it will need it for JavaScript or HTML features, and dynamically update if using an old browser, but let's just not supply a user agent and let it be the reader's burden to have a reasonably decent browser. > Being able to ask for fonts, if the system has them? Difficult to have font support without that. What's the fallback if the system doesn't have them? > Getting the user's timezone, language and keyboard layout? Reasonable. Keyboard layout is irrelevant for viewing content. For timezone and language: Yeah, I can see the use cases, but these are in a small minority. Let there be a popup when requested, and the user can specify the timezone/language as requested. > The size of the screen, and the size of the browser window? Difficult to lay things out without that. Let's let this new browser return only from a (small) discrete set of sizes. It will pick the size closest to the actual browser window size and send that. > Of course a video or audio player needs to know which video formats your browser supports - how else to provide the right video? Same answer as user agent. Either let the user pick from a selection of video formats, or just hard code a reasonable one and put the onus on the user to have a browser that supports it. > Obviously javascript can get the time, and it's trivial to figure out the system's clock error by comparing that to the time on a server. This hypothetical browser could just not send the time :-) For 99% of content consumption, this function is not needed. What I'm describing should be part of "Private mode". Or browsers should have an "Ultra-private" mode that is the above. If it's too complex/risky maintaining it all in one codebase ... fine. Just have a separate browser. Right now, if I built such a browser, I'm sure a lot of sites meant for content would break. But in my fantasy world, using "Ultra-private" would be the default, and people who make sites will target them first. I think much of the complexity in making a web browser is all the "other" stuff. Being able to run apps, cookie/privacy management, etc.
- 0x62 6mo ago
  Unfortunately you've now made an incredibly niche browser, and the lack of those metrics is a good fingerprint by itself. How browsers render SVGs can be used for fingerprinting (even the underlying OS affects this, and I assume you'll want to see those), combine with ISP from IP address, and unless theres hundreds users in every city you're now pretty easily trackable.
francoi8 6mo ago
All of these could have a set of standard non identifiable answers (eg. firefox reports the same 20 fonts, couple video formats, one among a few standard window sizes etc.) and for anything more extensive/precise, it would require the user's authorization and the user should have the option of feeding fake info (eg. fake timezone)
- snailmailman 6mo ago
  Firefox's "Resist fingerprinting" does this. It sets timezone to UTC, standardizes the fonts, standardizes a whole bunch of other fingerprinting data, etc. It also has a "letterboxing" option to round screensize down to the nearest 100px and stuff too. Tor uses all of those settings by default, though they are also in standard firefox in about:config. When i use Resist Fingerprinting my main issue is the timezone being set to UTC. most of the other stuff it does never causes issues. I guess sometimes sites need to read the canvas, but theres a permission box that allows that when needed. I wish there was a similar permission box for timezone. The only other drawback to the "resist fingerprinting" option is you will encounter cloudflares' captcha checkbox everywhere and all of the time :(
- autoexec 6mo ago
  Ideally you'd have browsers randomizing what they send instead of reporting the same info every time. That way even a deviation from the "norm" can't be assumed to ID someone.
fc417fc802 6mo ago
Most of the things you've listed here don't actually seem all that reasonable to me. User agents as a concept are rather poorly thought out across the board and not all that useful but persist because that's just how technical cruft is. Fonts should be provided by the website; if not provided the choice should take the form of a spec sent by the website including line height, sarifs or not, monospace or not, etc. There's little to no excuse for the current font situation IMO beyond poor design decisions that became heavily entrenched. Timezone and other obviously private metadata should never be shared without the user explicitly granting permission on a case by case basis. The status quo here is completely inexcusable as is the continued failure to fix the problem. Size of the physical screen should never be exposed under any circumstances. The current size of the browser window is reasonable on its face but now that fingerprinting is understood to be an issue should always be heavily letterboxed unless the user consents to sharing the exact value. Video formats should be provided by the website as a list of offerings and the browser should respond with a choice; the user could optionally intervene. There's no reason to expose the full capabilities to a remote service. Querying the current time should be gated behind an explicit permission. There's almost never a need for it. However from a fingerprinting perspective you also have to worry about correlating the rate of clock skew across clients. That can be solved by gating access to high resolution time counters behind an explicit permission as (once again) the vast majority of services have no legitimate use for such functionality.
- db48x 6mo ago
  > Fonts should be provided by the website No way! I don’t ever use any font provided by the website. I don’t even let websites choose which fonts get used. Instead I choose a set of fonts (monospaced and proportional) that are readable and everything uses those. If you want to see what that looks like, go into the Firefox settings, find the Fonts section, click Advanced, and then uncheck “Allow pages to choose their own fonts, instead of your selections above”. Be sure to adjust the “Minimum font size” while you’re here so that nobody uses text sizes that you cannot read.
- BizarroLand 6mo ago
  > fonts should be provided by the website Yeah, because I love it when every website I go to downloads 10 megs of fonts to my computer before it starts rendering the page. Fonts should be suggested by the website, and a bog-standard "every computer has this" font should be listed as the fallback. > Timezone and other obviously private metadata should never be shared without the user explicitly granting permission on a case by case basis 100% agree. > Size of the physical screen should never be exposed under any circumstances I mostly agree, but with the understanding that this would cause issues with "modern" web pages having very difficult to format layouts. Responsive design requires a response, after all. > Video formats should be provided by the website as a list of offerings and the browser should respond with a choice You're still getting the same feedback with this, that the browser chose to use X format, so you're not increasing privacy with this, only difficulty. > Querying the current time should be gated behind an explicit permission 100% agree. If there is no active local processing of information that the server relies on, in the format of a game or some other interactivity, then there is no reason why the server needs to know your local time.
bblb 6mo ago
These are all relics from the innocent 90's Internet. We had our global village and everything was fine. A couple of bad actors spamming blue pills here and there and that was it. Now we have actual criminal organizations and other real bad actors. I'm sure we can come up with something better than advertise our whole local computing platform on every HTTP request.
goodpoint 6mo ago
It's not reasonable for a website to find out about my browser version, OS, keyboard layout and a zillion other things, fuck this. All these things should be opt-in and like blocked by GDPR.

sandworm101 6mo ago

The tor project seeks this bypass this by keeping such things standardized across users, even down to reported screen size. And there is nothing stopping the browser from fibbing as most settings dong matter all that much (ie UK v Canadian v American English).

autoexec 6mo ago
This is a bad idea though, because any newly discovered means to get even a single data point results in being able to ID every tor user. I'd be better to have every tor browser always generate a random fingerprint so that even if the unexpected happens people will never get anything but random results.
- rendx 6mo ago
  > to have every tor browser always generate a random fingerprint Browsers do not "generate" fingerprints. They expose data that can be used to fingerprint users. You cannot "randomize" this; even if you were to return random values for, say, user screen size, with various visual side effects, it would just be another signal to fingerprint: "Oh, your browser is returning random values? Must be a Tor browser user".
  - IAmBroom 6mo ago
    > it would just be another signal to fingerprint: "Oh, your browser is returning random values? Must be a Tor browser user". You'd have to fingerprint the browser first to determine that the "random values" were indeed coming from it.
  - autoexec 6mo ago
    > it would just be another signal to fingerprint: "Oh, your browser is returning random values? Must be a Tor browser user". That's perfectly fine! As long as they can't tell which tor user you are they can't track your browsing activity or associate it to any one tor user. That's the goal. Currently tor browser sticks out like a sore thumb by trying to appear identical no matter who uses it, which is fragile because any one data point unaccounted for unmasks everyone.

BeetleB 6mo ago

I fantasize having a browser that I can use only for viewing content. No applications. No mail. No need for cookies. I can use a "regular" browser for more enhanced stuff. But for simple content consumption, we can just have a "dumb" browser that can't do much. > A user agent that says the browser's version? Reasonable enough. No user agent. I'm guessing it will need it for JavaScript or HTML features, and dynamically update if using an old browser, but let's just not supply a user agent and let it be the reader's burden to have a reasonably decent browser. > Being able to ask for fonts, if the system has them? Difficult to have font support without that. What's the fallback if the system doesn't have them? > Getting the user's timezone, language and keyboard layout? Reasonable. Keyboard layout is irrelevant for viewing content. For timezone and language: Yeah, I can see the use cases, but these are in a small minority. Let there be a popup when requested, and the user can specify the timezone/language as requested. > The size of the screen, and the size of the browser window? Difficult to lay things out without that. Let's let this new browser return only from a (small) discrete set of sizes. It will pick the size closest to the actual browser window size and send that. > Of course a video or audio player needs to know which video formats your browser supports - how else to provide the right video? Same answer as user agent. Either let the user pick from a selection of video formats, or just hard code a reasonable one and put the onus on the user to have a browser that supports it. > Obviously javascript can get the time, and it's trivial to figure out the system's clock error by comparing that to the time on a server. This hypothetical browser could just not send the time :-) For 99% of content consumption, this function is not needed. What I'm describing should be part of "Private mode". Or browsers should have an "Ultra-private" mode that is the above. If it's too complex/risky maintaining it all in one codebase ... fine. Just have a separate browser. Right now, if I built such a browser, I'm sure a lot of sites meant for content would break. But in my fantasy world, using "Ultra-private" would be the default, and people who make sites will target them first. I think much of the complexity in making a web browser is all the "other" stuff. Being able to run apps, cookie/privacy management, etc.

0x62 6mo ago
Unfortunately you've now made an incredibly niche browser, and the lack of those metrics is a good fingerprint by itself. How browsers render SVGs can be used for fingerprinting (even the underlying OS affects this, and I assume you'll want to see those), combine with ISP from IP address, and unless theres hundreds users in every city you're now pretty easily trackable.

francoi8 6mo ago

All of these could have a set of standard non identifiable answers (eg. firefox reports the same 20 fonts, couple video formats, one among a few standard window sizes etc.) and for anything more extensive/precise, it would require the user's authorization and the user should have the option of feeding fake info (eg. fake timezone)

snailmailman 6mo ago
Firefox's "Resist fingerprinting" does this. It sets timezone to UTC, standardizes the fonts, standardizes a whole bunch of other fingerprinting data, etc. It also has a "letterboxing" option to round screensize down to the nearest 100px and stuff too. Tor uses all of those settings by default, though they are also in standard firefox in about:config. When i use Resist Fingerprinting my main issue is the timezone being set to UTC. most of the other stuff it does never causes issues. I guess sometimes sites need to read the canvas, but theres a permission box that allows that when needed. I wish there was a similar permission box for timezone. The only other drawback to the "resist fingerprinting" option is you will encounter cloudflares' captcha checkbox everywhere and all of the time :(
autoexec 6mo ago
Ideally you'd have browsers randomizing what they send instead of reporting the same info every time. That way even a deviation from the "norm" can't be assumed to ID someone.

fc417fc802 6mo ago

Most of the things you've listed here don't actually seem all that reasonable to me. User agents as a concept are rather poorly thought out across the board and not all that useful but persist because that's just how technical cruft is. Fonts should be provided by the website; if not provided the choice should take the form of a spec sent by the website including line height, sarifs or not, monospace or not, etc. There's little to no excuse for the current font situation IMO beyond poor design decisions that became heavily entrenched. Timezone and other obviously private metadata should never be shared without the user explicitly granting permission on a case by case basis. The status quo here is completely inexcusable as is the continued failure to fix the problem. Size of the physical screen should never be exposed under any circumstances. The current size of the browser window is reasonable on its face but now that fingerprinting is understood to be an issue should always be heavily letterboxed unless the user consents to sharing the exact value. Video formats should be provided by the website as a list of offerings and the browser should respond with a choice; the user could optionally intervene. There's no reason to expose the full capabilities to a remote service. Querying the current time should be gated behind an explicit permission. There's almost never a need for it. However from a fingerprinting perspective you also have to worry about correlating the rate of clock skew across clients. That can be solved by gating access to high resolution time counters behind an explicit permission as (once again) the vast majority of services have no legitimate use for such functionality.

db48x 6mo ago
> Fonts should be provided by the website No way! I don’t ever use any font provided by the website. I don’t even let websites choose which fonts get used. Instead I choose a set of fonts (monospaced and proportional) that are readable and everything uses those. If you want to see what that looks like, go into the Firefox settings, find the Fonts section, click Advanced, and then uncheck “Allow pages to choose their own fonts, instead of your selections above”. Be sure to adjust the “Minimum font size” while you’re here so that nobody uses text sizes that you cannot read.
BizarroLand 6mo ago
> fonts should be provided by the website Yeah, because I love it when every website I go to downloads 10 megs of fonts to my computer before it starts rendering the page. Fonts should be suggested by the website, and a bog-standard "every computer has this" font should be listed as the fallback. > Timezone and other obviously private metadata should never be shared without the user explicitly granting permission on a case by case basis 100% agree. > Size of the physical screen should never be exposed under any circumstances I mostly agree, but with the understanding that this would cause issues with "modern" web pages having very difficult to format layouts. Responsive design requires a response, after all. > Video formats should be provided by the website as a list of offerings and the browser should respond with a choice You're still getting the same feedback with this, that the browser chose to use X format, so you're not increasing privacy with this, only difficulty. > Querying the current time should be gated behind an explicit permission 100% agree. If there is no active local processing of information that the server relies on, in the format of a game or some other interactivity, then there is no reason why the server needs to know your local time.

bblb 6mo ago

These are all relics from the innocent 90's Internet. We had our global village and everything was fine. A couple of bad actors spamming blue pills here and there and that was it. Now we have actual criminal organizations and other real bad actors. I'm sure we can come up with something better than advertise our whole local computing platform on every HTTP request.

goodpoint 6mo ago

It's not reasonable for a website to find out about my browser version, OS, keyboard layout and a zillion other things, fuck this. All these things should be opt-in and like blocked by GDPR.