3 ms·

I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept

I wish the browser would classify the fingerprinting and not load the site and show a security risk warning like it does for http sites. Then Advanced > Accept risk to continue. @FireFoxDudes You need to be addressing fingerprinting

miki_oomiri 2mo ago
How? How would a browser "know" what classifies as finger printing? Literally every piece of the engine is used for finger printing. It can be mitigated, a bit, but I don't see how browsers can win that battle. Finger printing is a lost battle in my opinion, unless we drastically reduce what a web engine can do (like Tor does).
- lxgr 2mo ago
  I feel like there are two levels of fingerprinting here, and a lot of the confusion is downstream of not properly distinguishing them: There's the kind that tries to find out what browser vendor, OS, and sometimes hardware you use, and the kind that tries to identify you across visits, unrelated origins etc. I agree that the former is probably inherently impossible to avoid to a large extent, but the latter is both a bigger privacy issue and at least in theory possible to prevent.
  - Bjartr 2mo ago
    I've only encountered the latter described as fingerprinting. Which makes sense side, like fingerprints, the information is being used to uniquely identify an individual. The former is traditional analytics and is not enough to uniquely identify an individual. Not all analytics are as privacy invasive as fingerprinting.
    - john_strinlai 2mo ago
      >The former is traditional analytics and is not enough to uniquely identify an individual shockingly little information is required to uniquely identify someone. "traditional analytics" (lets just say os + browser + some hardware info) is likely to be uniquely identifying when combined with just one other sparse dataset. >Not all analytics are as privacy invasive as fingerprinting. fingerprinting isn't a separate category of analytics. every data point can be (and often is) used for fingerprinting.
- bigbuppo 2mo ago
  Just assume any site using javascript is using it for nefarious purposes.
- pajko 2mo ago
  Fingerprinting cannot be resisted. There are a zillion techniques to get bits of information which can provide a unique-ish identifier when combined. The only protection is to mix in some random data in all these bits to get a very unique combination that changes on each request. But this only works if at the same time cookie and local storage access is disabled for all sites and whitelisted per site:target combination.
john_strinlai 2mo ago
a lot of what is used for fingerprinting is also used legitimately, and a lot of sites fingerprint. so ~every site would be behind a security risk warning. we know from the boy who cried wolf that too many warnings quickly turns into legitimate warnings being ignored
- FuckButtons 2mo ago
  Presumably the intended outcome would be that sites would be pressured into not being malignant actors with regards to user privacy, rather than everyone just ignoring the security notice.
  - john_strinlai 2mo ago
    i understand the intention, and i offered my opinion on what the actual outcome would be. ~every piece of data can be used for fingerprinting. settings and preferences, browser, os, etc. fingerprinting is not its own category of data, it's the correlation of regular data. the "pressure" ends up being: stop receiving any data at all (which would obviously break ~everything), or put up a warning (leading to fatigue). consider accessibility settings: absolutely required for some people to browse the internet, but also extremely high-value data for fingerprinting a user. there is no technical method to know whether a site asking about a visitor's accessibility settings is doing it so that they can properly display content or so that they can fingerprint the visitor. (i.e. there is no "evil bit")
    - emctech 2mo ago
      I touched on this in my article, once the data has been collected and sent to their servers you have no idea what they do with the information. At least with GDPR it is supposed to be regulated but obviously that is not the case everywhere and websites can still lie.
    - sebastiennight 2mo ago
      > there is no "evil bit" There's always been one, but it's been defaulting to 1 ever since the Web 2.0 upgrade, and the API to set it back to 0 has been deprecated.
numpad0 2mo ago
Or just started removing features and debloating the Web standards. We don't need WebCoffeeBeansRoasterGrinder or WebElectricVehicleEmergencyBraking. We should be able to live with a LOT less without graphics, performance, or addictiveness degradation.
mozdeco 2mo ago
We already did, long ago, and this fingerprinting here does not work in Firefox. A colleague of mine made a recent post here: https://ritter.vg/blog-webaudio_alibaba.html https://ritter.vg/blog-webaudio_alibaba.html

miki_oomiri 2mo ago

How? How would a browser "know" what classifies as finger printing? Literally every piece of the engine is used for finger printing. It can be mitigated, a bit, but I don't see how browsers can win that battle. Finger printing is a lost battle in my opinion, unless we drastically reduce what a web engine can do (like Tor does).

lxgr 2mo ago
I feel like there are two levels of fingerprinting here, and a lot of the confusion is downstream of not properly distinguishing them: There's the kind that tries to find out what browser vendor, OS, and sometimes hardware you use, and the kind that tries to identify you across visits, unrelated origins etc. I agree that the former is probably inherently impossible to avoid to a large extent, but the latter is both a bigger privacy issue and at least in theory possible to prevent.
- Bjartr 2mo ago
  I've only encountered the latter described as fingerprinting. Which makes sense side, like fingerprints, the information is being used to uniquely identify an individual. The former is traditional analytics and is not enough to uniquely identify an individual. Not all analytics are as privacy invasive as fingerprinting.
  - john_strinlai 2mo ago
    >The former is traditional analytics and is not enough to uniquely identify an individual shockingly little information is required to uniquely identify someone. "traditional analytics" (lets just say os + browser + some hardware info) is likely to be uniquely identifying when combined with just one other sparse dataset. >Not all analytics are as privacy invasive as fingerprinting. fingerprinting isn't a separate category of analytics. every data point can be (and often is) used for fingerprinting.
bigbuppo 2mo ago
Just assume any site using javascript is using it for nefarious purposes.
pajko 2mo ago
Fingerprinting cannot be resisted. There are a zillion techniques to get bits of information which can provide a unique-ish identifier when combined. The only protection is to mix in some random data in all these bits to get a very unique combination that changes on each request. But this only works if at the same time cookie and local storage access is disabled for all sites and whitelisted per site:target combination.

john_strinlai 2mo ago

a lot of what is used for fingerprinting is also used legitimately, and a lot of sites fingerprint. so ~every site would be behind a security risk warning. we know from the boy who cried wolf that too many warnings quickly turns into legitimate warnings being ignored

FuckButtons 2mo ago
Presumably the intended outcome would be that sites would be pressured into not being malignant actors with regards to user privacy, rather than everyone just ignoring the security notice.
- john_strinlai 2mo ago
  i understand the intention, and i offered my opinion on what the actual outcome would be. ~every piece of data can be used for fingerprinting. settings and preferences, browser, os, etc. fingerprinting is not its own category of data, it's the correlation of regular data. the "pressure" ends up being: stop receiving any data at all (which would obviously break ~everything), or put up a warning (leading to fatigue). consider accessibility settings: absolutely required for some people to browse the internet, but also extremely high-value data for fingerprinting a user. there is no technical method to know whether a site asking about a visitor's accessibility settings is doing it so that they can properly display content or so that they can fingerprint the visitor. (i.e. there is no "evil bit")
  - emctech 2mo ago
    I touched on this in my article, once the data has been collected and sent to their servers you have no idea what they do with the information. At least with GDPR it is supposed to be regulated but obviously that is not the case everywhere and websites can still lie.
  - sebastiennight 2mo ago
    > there is no "evil bit" There's always been one, but it's been defaulting to 1 ever since the Web 2.0 upgrade, and the API to set it back to 0 has been deprecated.

numpad0 2mo ago

Or just started removing features and debloating the Web standards. We don't need WebCoffeeBeansRoasterGrinder or WebElectricVehicleEmergencyBraking. We should be able to live with a LOT less without graphics, performance, or addictiveness degradation.

mozdeco 2mo ago

We already did, long ago, and this fingerprinting here does not work in Firefox. A colleague of mine made a recent post here: https://ritter.vg/blog-webaudio_alibaba.html https://ritter.vg/blog-webaudio_alibaba.html