3 ms·

Can't we make fingerprinting illegal, as in, jailtime illegal? Would not solve everything but still help a lot.

by amelius 4mo ago

chaboud 4mo ago
I'd rather penalize the application than the technique. Windows was rumored to long have "quirks" that would do better things for apps that had bugs that the OS ended up fixing instead of the app. Javascript systems have long had polyfills for varied browser feature comparability gaps. Whether you agree with these, making probing detection via fingerprinting illegal would take away this lever. Making surreptitious tracking via fingerprinting illegal? Even for state actors? Yeah, that's probably reasonable. If someone is going to wear a tracking collar in exchange for "free" services, a little disclosure makes sense.
- Terr_ 4mo ago
  Yeah, the problem is how the data is kept and abused afterwards.
akersten 4mo ago
Why should it be illegal for me to recognize the way you walk into my store, even though you're wearing a mask and a trenchcoat? Some vague sense of indignation? Yeah, tracking bad, I get it, but are whatever damages that kind of legislation would prevent (probably nothing measurable) really more important than fixing the easy, in our face social problems that politicians could instead be focusing on?
- altcognito 4mo ago
  Because you don't have a right to know everything about me, follow me to my home, my purchasing preferences, and so on and so forth.
  - simondotau 4mo ago
    Holy slippery slope, Batman. Just because you don't have a right to know everything about you, follow you home, and see what you bought elsewhere, doesn't mean I'm not allowed to observe how your [thing claiming to be a browser] behaves when it connects to my website. If you want to make it harder to guess whether you're human or a malicious bot, you're going to find yourself clicking on more than just traffic lights and bicycles in the near future.
- lorecore 4mo ago
  > Why should it be illegal for me to recognize the way you walk into my store, even though you're wearing a mask and a trenchcoat? If you have that right, the public should have the right to know you're doing this before they enter your store, so they can avoid it. Same with the websites, they should, legally, have to say they're about to fingerprint you so that you can close your browser tab and never come back.
  - simondotau 4mo ago
    There's nothing wrong with websites choosing to comply with particular privacy standards. This should be voluntary and used as a trust signal. A website that promises to follow certain standards should be legally accountable if it breaks that promise, but it should not be mandatory to make such promises.
- thepasch 4mo ago
  > Why should it be illegal for me to recognize the way you walk into my store If you did it in just your store, that wouldn't be a problem. The correct analogy, however, is "why should it be illegal for me to attach a perfectly traceable and invisible air-tag to you when you enter my store, without your explicit consent, and subsequently follow and document your every movement no matter where you go, as long as that location has a business relationship with my store, and also my store is the most popular chain on the planet that has business relationships with basically any relevant business that exists." And I don't think the answer to this one shouldn't be particularly difficult to arrive at.
  - akersten 4mo ago
    Well it's not really an airtag, I don't "attach" anything to your browser when I check what its GPU can do. That's just a description of you that I share with my other stores. Casinos, Target, Burger King, etc all do this when you get 86'd, for example.
- kaladin-jasnah 4mo ago
  Isn't fingerprinting used across many different websites? Then the analogy would be a number of stores colluding to recognize the same person across all stores? (I have no idea, I don't know too much about this)
  - charcircuit 4mo ago
    Which is famously done by casinos. But in practice many businesses big and small do share intelligence with each other about problematic customers who shoplift etc.
- chjj 4mo ago
  The analogy falls apart when "your store" is actually a handful of multi-billion dollar corporations that surveil a significant portion of the internet and covertly grant government agencies (and god knows who else) access to the data. It's passive surveillance on the order of billions of people. It's not a mom-and-pop shop.
  - amelius 4mo ago
    Yes, and we need a name for the fallacy of GP. It's a recurring theme.
  - simondotau 4mo ago
    [dead]
bloody-crow 4mo ago
I don't think it'd be possible to define fingerprinting narrowly enough to not also outlaw perfectly normal and legitimate usecases.
- chjj 4mo ago
  I'm not even sure I'd want to make it narrow. I'd start with: "Information gained via side-channel for the purpose of correlating individuals." But you'd have to add an enormous amount of legalese after that to make it ironclad. They'll start arguing "this isn't a side-channel", "we're targeting bots, not individuals", etc. You'd have to define every word in that sentence very carefully. I'd make it sweeping. "Individual" can mean "person", "bot", "suspected bot", "AI agent", "a piece of autonomous or non-autonomous software", basically anything. The "side-channel" definition might get trickier, but I'd rather legit use-cases get burned than privacy get burned. The OP was downvoted, but I agree. I think fingerprinting should be in the same criminal category as an illegal wiretap.
codedokode 4mo ago
Why don't you ask browser developers to stop adding features helping fingerprinting? Browsers even have some API for tracking ad clicks (attribution API or something) and user interests tracking API which nobody of the users needs.
- joahnn_s 4mo ago
  The thing is that's not done on purpose and too hard to figure out how this has an impact underneath, if you read the v8 commit https://chromium.googlesource.com/v8/v8/+/c1486295ae5bcb0f8fb078b7cf921802ccd75eaf https://chromium.googlesource.com/v8/v8/+/c1486295ae5bcb0f8f... it's on a complete good faith
  - userbinator 4mo ago
    With companies like these, "plausible deniability" is more likely.
  - codedokode 4mo ago
    But they added ad clicks tracking API ("Attribution Reporting API") and interests tracking API ("Topics API") into the browser which work behind user's back and against their interests.

Can't we make fingerprinting illegal, as in, jailtime illegal? Would not solve everything but still help a lot.

by amelius 4mo ago

Can't we make fingerprinting illegal, as in, jailtime illegal? Would not solve everything but still help a lot.

I'd rather penalize the application than the technique. Windows was rumored to long have "quirks" that would do better things for apps that had bugs that the OS ended up fixing instead of the app. Javascript systems have long had polyfills for varied browser feature comparability gaps. Whether you agree with these, making probing detection via fingerprinting illegal would take away this lever. Making surreptitious tracking via fingerprinting illegal? Even for state actors? Yeah, that's probably reasonable. If someone is going to wear a tracking collar in exchange for "free" services, a little disclosure makes sense.

Terr_ 4mo ago
Yeah, the problem is how the data is kept and abused afterwards.

akersten 4mo ago

Why should it be illegal for me to recognize the way you walk into my store, even though you're wearing a mask and a trenchcoat? Some vague sense of indignation? Yeah, tracking bad, I get it, but are whatever damages that kind of legislation would prevent (probably nothing measurable) really more important than fixing the easy, in our face social problems that politicians could instead be focusing on?

altcognito 4mo ago
Because you don't have a right to know everything about me, follow me to my home, my purchasing preferences, and so on and so forth.
- simondotau 4mo ago
  Holy slippery slope, Batman. Just because you don't have a right to know everything about you, follow you home, and see what you bought elsewhere, doesn't mean I'm not allowed to observe how your [thing claiming to be a browser] behaves when it connects to my website. If you want to make it harder to guess whether you're human or a malicious bot, you're going to find yourself clicking on more than just traffic lights and bicycles in the near future.
lorecore 4mo ago
> Why should it be illegal for me to recognize the way you walk into my store, even though you're wearing a mask and a trenchcoat? If you have that right, the public should have the right to know you're doing this before they enter your store, so they can avoid it. Same with the websites, they should, legally, have to say they're about to fingerprint you so that you can close your browser tab and never come back.
- simondotau 4mo ago
  There's nothing wrong with websites choosing to comply with particular privacy standards. This should be voluntary and used as a trust signal. A website that promises to follow certain standards should be legally accountable if it breaks that promise, but it should not be mandatory to make such promises.
thepasch 4mo ago
> Why should it be illegal for me to recognize the way you walk into my store If you did it in just your store, that wouldn't be a problem. The correct analogy, however, is "why should it be illegal for me to attach a perfectly traceable and invisible air-tag to you when you enter my store, without your explicit consent, and subsequently follow and document your every movement no matter where you go, as long as that location has a business relationship with my store, and also my store is the most popular chain on the planet that has business relationships with basically any relevant business that exists." And I don't think the answer to this one shouldn't be particularly difficult to arrive at.
- akersten 4mo ago
  Well it's not really an airtag, I don't "attach" anything to your browser when I check what its GPU can do. That's just a description of you that I share with my other stores. Casinos, Target, Burger King, etc all do this when you get 86'd, for example.
kaladin-jasnah 4mo ago
Isn't fingerprinting used across many different websites? Then the analogy would be a number of stores colluding to recognize the same person across all stores? (I have no idea, I don't know too much about this)
- charcircuit 4mo ago
  Which is famously done by casinos. But in practice many businesses big and small do share intelligence with each other about problematic customers who shoplift etc.
chjj 4mo ago
The analogy falls apart when "your store" is actually a handful of multi-billion dollar corporations that surveil a significant portion of the internet and covertly grant government agencies (and god knows who else) access to the data. It's passive surveillance on the order of billions of people. It's not a mom-and-pop shop.
- amelius 4mo ago
  Yes, and we need a name for the fallacy of GP. It's a recurring theme.
- simondotau 4mo ago
  [dead]

bloody-crow 4mo ago

I don't think it'd be possible to define fingerprinting narrowly enough to not also outlaw perfectly normal and legitimate usecases.

chjj 4mo ago
I'm not even sure I'd want to make it narrow. I'd start with: "Information gained via side-channel for the purpose of correlating individuals." But you'd have to add an enormous amount of legalese after that to make it ironclad. They'll start arguing "this isn't a side-channel", "we're targeting bots, not individuals", etc. You'd have to define every word in that sentence very carefully. I'd make it sweeping. "Individual" can mean "person", "bot", "suspected bot", "AI agent", "a piece of autonomous or non-autonomous software", basically anything. The "side-channel" definition might get trickier, but I'd rather legit use-cases get burned than privacy get burned. The OP was downvoted, but I agree. I think fingerprinting should be in the same criminal category as an illegal wiretap.

codedokode 4mo ago

Why don't you ask browser developers to stop adding features helping fingerprinting? Browsers even have some API for tracking ad clicks (attribution API or something) and user interests tracking API which nobody of the users needs.

joahnn_s 4mo ago
The thing is that's not done on purpose and too hard to figure out how this has an impact underneath, if you read the v8 commit https://chromium.googlesource.com/v8/v8/+/c1486295ae5bcb0f8fb078b7cf921802ccd75eaf https://chromium.googlesource.com/v8/v8/+/c1486295ae5bcb0f8f... it's on a complete good faith
- userbinator 4mo ago
  With companies like these, "plausible deniability" is more likely.
- codedokode 4mo ago
  But they added ad clicks tracking API ("Attribution Reporting API") and interests tracking API ("Topics API") into the browser which work behind user's back and against their interests.