4 ms·

A couple of years back, I remember arguing with the moderators at Stack Overflow who wanted to implement this to combat sock-puppetry: http://meta.stackoverflow

A couple of years back, I remember arguing with the moderators at Stack Overflow who wanted to implement this to combat sock-puppetry: http://meta.stackoverflow.com/questions/113394/implement-some-form-of-browser-fingerprinting-to-help-suss-out-socks/113398#113398 http://meta.stackoverflow.com/questions/113394/implement-som... Back then, the proponents of that plan insisted the privacy concern was largely academic. I somewhat wonder what would've happened post-PRISM leak had they ever implemented it.

MartinCron 13y ago
What does something like PRISM have to do with an individual privately run site using information provided by the client software in order to prevent abuse? Expecting privacy-minded people to opt-out of using telephones or emails for fear of government monitoring isn't reasonable. Opting out of Stack Overflow is nowhere in the same league.
- itafroma 13y ago
  > What does something like PRISM have to do with an individual privately run site using information provided by the client software in order to prevent abuse? I feel like I explained the issue pretty clearly in the preceding sentence: > Back then, the proponents of that plan insisted the privacy concern was largely academic. We now know via the various leaks that have occurred recently, that government agencies will use any information available to them and that there is largely nothing the public can do to stop it or be made aware of it except through the occasional one-off leak like PRISM. That is to say, the privacy concerns related to any private company tracking PII to this degree aren't academic or abstract. Information kept to prevent abuse can just as easily be repurposed for surveillance. I suspect (and would hope) many of the same people pushing for this feature back in 2011 would reconsider their support for a feature like this knowing what we know now. > Expecting privacy-minded people to opt-out of using telephones or emails for fear of government monitoring isn't reasonable. I'm not sure what part of my comment lead you to believe I would think otherwise, but I don't. > Opting out of Stack Overflow is nowhere in the same league. In the comments of the post I linked, several people were insisting that there wouldn't need to be an additional disclosure because it's information that's either public, available to other third parties (like browser makers), or already available to Stack Overflow in a different form. Not knowing that a site like a hypothetical Stack Overflow—where a feature like this was implemented—is keeping records on this level and therefore not opting out isn't informed choice. Indeed, a significant portion of the outcry with respect to the NSA leaks is that nobody knew that the government had such a direct connection to the information stored by private companies that people could've easily opted out of using (e.g., Facebook, Apple, Google, or Paltalk). But all I was attempting to do here was mention a past experience with Panopticlick and muse how it might've went today. I guess I've been bitten by something pg once said[1], that "you can't be concise on forums because if you leave any possible room for misinterpretation, someone will reply with it". [1]: https://news.ycombinator.com/item?id=5365222 https://news.ycombinator.com/item?id=5365222
darth_aardvark 13y ago
Wouldn't switching browsers/adding a plugin get around the block really easily?
- X4 13y ago
  You will still have the same set of fonts, resolution, os, ip, etc.
- itafroma 13y ago
  The response to that concern at the time was that most of the people who would know how to get around it wouldn't need to sockpuppet[1]. I suspect, if it were ever implemented, there'd be some attempt to obfuscate or hide what was actually tracked like they do for their other fraud algorithms. But issues like that and the privacy issues were pretty indicative of its lack of value and it doesn't surprise me it was never implemented and didn't even warrant a response from an SE employee. [1]: http://meta.stackoverflow.com/questions/113394/implement-some-form-of-browser-fingerprinting-to-help-suss-out-socks/113398#comment294757_113394 http://meta.stackoverflow.com/questions/113394/implement-som...

MartinCron 13y ago

What does something like PRISM have to do with an individual privately run site using information provided by the client software in order to prevent abuse? Expecting privacy-minded people to opt-out of using telephones or emails for fear of government monitoring isn't reasonable. Opting out of Stack Overflow is nowhere in the same league.

itafroma 13y ago
> What does something like PRISM have to do with an individual privately run site using information provided by the client software in order to prevent abuse? I feel like I explained the issue pretty clearly in the preceding sentence: > Back then, the proponents of that plan insisted the privacy concern was largely academic. We now know via the various leaks that have occurred recently, that government agencies will use any information available to them and that there is largely nothing the public can do to stop it or be made aware of it except through the occasional one-off leak like PRISM. That is to say, the privacy concerns related to any private company tracking PII to this degree aren't academic or abstract. Information kept to prevent abuse can just as easily be repurposed for surveillance. I suspect (and would hope) many of the same people pushing for this feature back in 2011 would reconsider their support for a feature like this knowing what we know now. > Expecting privacy-minded people to opt-out of using telephones or emails for fear of government monitoring isn't reasonable. I'm not sure what part of my comment lead you to believe I would think otherwise, but I don't. > Opting out of Stack Overflow is nowhere in the same league. In the comments of the post I linked, several people were insisting that there wouldn't need to be an additional disclosure because it's information that's either public, available to other third parties (like browser makers), or already available to Stack Overflow in a different form. Not knowing that a site like a hypothetical Stack Overflow—where a feature like this was implemented—is keeping records on this level and therefore not opting out isn't informed choice. Indeed, a significant portion of the outcry with respect to the NSA leaks is that nobody knew that the government had such a direct connection to the information stored by private companies that people could've easily opted out of using (e.g., Facebook, Apple, Google, or Paltalk). But all I was attempting to do here was mention a past experience with Panopticlick and muse how it might've went today. I guess I've been bitten by something pg once said[1], that "you can't be concise on forums because if you leave any possible room for misinterpretation, someone will reply with it". [1]: https://news.ycombinator.com/item?id=5365222 https://news.ycombinator.com/item?id=5365222

darth_aardvark 13y ago

Wouldn't switching browsers/adding a plugin get around the block really easily?

X4 13y ago
You will still have the same set of fonts, resolution, os, ip, etc.
itafroma 13y ago
The response to that concern at the time was that most of the people who would know how to get around it wouldn't need to sockpuppet[1]. I suspect, if it were ever implemented, there'd be some attempt to obfuscate or hide what was actually tracked like they do for their other fraud algorithms. But issues like that and the privacy issues were pretty indicative of its lack of value and it doesn't surprise me it was never implemented and didn't even warrant a response from an SE employee. [1]: http://meta.stackoverflow.com/questions/113394/implement-some-form-of-browser-fingerprinting-to-help-suss-out-socks/113398#comment294757_113394 http://meta.stackoverflow.com/questions/113394/implement-som...