Hacker News

If it isn't an informed decision, it isn't really a decision at all. And the huge majority of people the huge majority of the time do not want to make an informed decision: they want what they came to the site for, news, games, family photos, etc.

You go to Facebook to see your cute nephew make spit bubbles. Do you care that they access your camera and canvas? What is a canvas? And sure access my camera, I want to upload photos!

It's fundamentally broken. They've studied the dark patterns, not to avoid them but to implement them best.

So long as it's once per API and site, it seems it doesn't need to be too bad?

If it's a site I trust, and I think it genuinely needs audio, I give it audio. If someone doesn't understand and just does allow all, they never see it again either (and their ads are suspiciously well targeted).

We already have these consent popups for camera and microphone. Reading back bytes from an audio buffer seems like such a rare thing to do that it hopefully just stops happening.

Also, people not in tech do not generally understand the implication of consent popups.

For example, on multiple instances, my spouse declined "location permissions" an app designed to work with a piece of Bluetooth-connected hardware, and would blame the hardware as being crappy.

"This smart lock app doesn't work."

"You need to enable this permission."

"Why do I need to give the smart lock app location permissions?"

It's not obvious to people that "Bluetooth can be used sneakily by big-enough companies as a makeshift GPS" even if the app needing Bluetooth access doesn't actually need a GPS location.

I think that ship sailed and I'm pragmatic enough to accept it. The web is an application platform, not a web of hypertext content. That's not going to change, and I've given up on the idea to even try to "go back" there. If it worked, you'd just have half of websites be "sites" that work without JS, and half would be "apps" which would require switching on JS? The whole reaosn the web took off as it has is because we removed the distinction between "web app" and "web site". There's no putting that genie back in the bottle.

> A web-site with mostly static content should not use user-side scripting (Javascript) at all

Then sites that want to track will just add some JS. Seems unlikely to help.

Sure, for the most static of static sites. But without JavaScript you can’t even do basic things client-side, such as having some variable-length list of fields in a form. Or customized field validation.

If such client-side behavior counts as “basically an application,” then “applications” is a larger set than seems useful.

The conflicting interest starts with the very idea of ads already. The entire point of ads is to manipulate you into doing things you wouldn't do otherwise.

That could also be a preference. Do you allow third party ads to begin with? But then I'd understand if people would just block visitors that don't agree to them. I think paying via showing ads is fine. Paying with my integrity isn't.

Exactly. And here's where regulators come in. What we need to do as a society is basically say "Unless you can make your ad-funded business work with this tiny bit of information, your ad-funded business should fail and shut down".

You could accept things once per API and site. It doesn't feel that terrible. We do it for camera and clipboard already.

And also without logging it. Even if I don’t want popups to give consent for every document.getEyeColor() call, it would be nice go back and see who’s doing which queries and/or have Firefox collect aggregate statistics. Naming and shaming the crooks won’t stop them but it might have an impact on curbing any bad behavior from big commercial retailers.

It's a UX trade off. For non-adversarial websites it's very convenient for users because things just work without having to go through loads of permissions pop ups for every website, but of course this then makes this info a juicy target if you're trying to fingerprint someone.

Is it though?

Google's business model has been ads from the beginning. Search, gmail, drive, office, chrome, everything they do is just to drive ad revenue further.

They don't care about the user. Never have, and never will.

And the outcome we are seeing is what happens when a defunct state isn't able to protect citizens from conglomerates. That's what the Kartellamt or the FTC is supposed to be for.

That's not a browser thing. Fingerprinting native apps is much easier.

My default is to run without JS and selectively enable it when absolutely necessary, so when I clicked on this story the page was prefaced with the following comment:

"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else.

From now on I’ll call you:…"

I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it. On rare occasions when I'm forced to use JS I'll cut-and-paste the URL into another browser.

I no longer use ad blockers as I just don't see ads with JS disabled. The other privacy precautions I take are the obvious ones such as no Google or social media accounts, flushing cookies at session's end, regularly randomize my IP and never let Chrome anywhere near my machines and make judicious use of multiple browsers (this is being written in Privacy Browser on Android).

Using NewPipe and sponsor block on PipePipe increases privacy and makes YouTube ad free.

Client-side scripting was a mistake which was obvious from the outset (or not severely limiting the reach of scripting engines).

What I find hard to understand is why alternative plugin JS engines haven't been developed that are under user control. Spoofing, randomizing and returning junk data to webservers would go a huge way towards stopping fingerprinting by websites.

The alternative is to install a binary that has full access to the computer.

If anyone else has JavaScript turned off you're fine (as long as you can account for all the other stuff like IP address).

There are projects that do this already e.g. https://github.com/lwthiker/curl-impersonate

> Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard

It doesn't matter if it looks wrong as long as it looks differently wrong over time. Don't bother trying to blend in with the crowd because you can't ever expect to catch everything that can be used to fingerprint you. New techniques come out all the time. You can block a lot of information from even being collected. Limit what data you send at all, randomize what's left, change IP frequently (VPN) and you should be fine.

That's the thing, no web page, except for games, should ever need to know about your viewport size. So spoofing would be just fine, imho, with an override option/permission for individual sites.

Any idea how iOS’ private browsing impacts fingerprinting?

> "What JShelter configuration should I pick?

https://jshelter.org/faq/#what-jshelter-configuration-should... :

First, see our blog post. Consult also other blog posts and other questions in this FAQ.

If you want to have the same fingerprint as many users, We suggest going for Tor Browser (do not install JShelter in Tor Browser). If you want to make cross-site fingerprinting linkage hard, go for the Recommended JShelter level. If you want better protection for the real data at the cost of having the same fingerprint on different sites, go for the Strict JShelter level. Keep NBS active. If you want to detect and prevent fingerprinting attempts, use FPD.

Thanks. I tried this on Firefox for Android and each time I close the browser and load the page my fingerprint ID is different. So it seems to work. Have you had any sites break with this extension installed?

The problem with this is the biggest, most important, and sketchiest data brokering services (credit monitoring) are all but entrenched in law at this point.

It is illegal, if it's PII without explicit consent.

This fingerprint breaks every 2 weeks when Chrome auto updates. Or any other modern browser.

I think the idea here is that the details shouldn't be publicly known. (Or that if they were they would have to invent their details!)

I'm thinking that you just need one website where you can associate a given fingerprint to a specific user and then tracking its activity around the web becomes easy.

Let's say I'm logged in a famous search engine, they associate my fingerprint X to my account A. If they then encounter fingerprint X anywhere else, there is a good chance it was me, A, doing it. If the next day I get fingerprint Y, it gets attached to A as well and the tracking information follows it.

Does this make sense?

You mean, like a really popular web service or app that someone would log into every day/week/month...?

Even easier if, additionally, many of the smaller websites were syndicated into a tracking network?

I don't actually know how much this happens - software versioning is the biggest one. Chrome updates every two weeks, Microsoft updates once a month, your GPU drivers get updated semi regularly, etc. Any one of those would break the fingerprint.

Most people probably have completely default fonts, right? Doesn't seem like much of an identifier anyway

Hmm. I used to have to do that a lot, but I haven't in a few years now.

Perhaps, but that would also mean the cardinality is lower.

That is different though. That site is just creating a passkey and storing in your keychain (or windows equivalent). Windows hello unlocks the keychain. It can be your face, fingerprint, usb key, 4 digit pin anything. Chrome already uses this. You’re not sending your face to that website nor to microsoft, I hope.

Consequences are deeper than the immediate cause. Advertising is at the heart that gives a lot of value to data harvesting and similar scams.

Data harvesting gains most of its value because they sell some or all data to businesses which wish to leverage that data in advertising. If they cant advertise they wont need most of the data, which should at the least reduce the problem significantly...

Advertising and paid promotion in any form has never been ok. It has always been a cancer on society. That is what happens when you ignore a mild symptom until it metastasizes into something horrible. We need to ban it completely.

That's one perspective. Other are in different perspectives, like "anything that present something else than the very topic looked for is pure propaganda."

The spectre of possible interpretations is wide.

Some see only problems everywhere whatever the benefits might be, some see only new opportunities no matter the tragic outcomes, some see various blend of this and that.

How do you tell the difference between a regular human trying to not have a weird creepy perma-dossier collected on them... versus a bot set up to always look like a new visitor?

The only winning move is not to play--er, to somehow not to have this kind of game in the first place.

It doesn't actually work for that

Many countries ban cigarette advertising. Not saying its perfect but has helped reduce smoking.

And there was an initiative to include tracking preferences in browser HTTP headers, which never made it, as it was quite obvious that this would lead to a lot of people opting out.

Better to just harass them into a habit of dismissing the banner.

When there is "legitimate purpose" there isn't reason to as soon items are put in the shopping cart this has to be tracked (be it session in url, cookie, local storage, ...) and no consent is needed.

The exact definition of "legitimate purpose" is unspecific (which is important to be able to adapt to development of new services) which leads to some lawyers being careful.

I also claim that some lobby groups promote having too many and too big consent banners to move blame from tracking companies to the EU ("stupid EU forcing all those banners!") in order to reverse the policy on tracking, which seems to have some effect.

I know it's tempting to put this consent-banner anti-pattern all on toxic ad-driven platforms, because their motives are bad.

The problem with this view, though, is that even the very agencies propagating these rules do the exact same thing! You can go to any site from an EU arm and get the same banners.

At this point, you can't really blame it on bad-faith actors, you have to accept that it's a bad rule. Which is not to say I know a better one!

It's not even compliance. You're required to make consent and decline require equal effort. A large percentage of them make it much easier to consent.

Not to mention the large number of "legitimate interest" exceptions that are absolutely not justifiable.

The main problem with the legislation is its lack of teeth and enforcement.

Is too. They could have thought through the law they were writing and predicted malicious compliance. Or written a stronger law. Or revised the law when they spotted malicious compliance.

I don’t understand why that’s considered legal under GDPR. How can consent be express and informed when it would take 30 minutes just to identify each entity your data is being shared with?

In fact the law even specifies “no pre-ticked boxes” but every banner always has “accept all”. And it’s 50/50 to see “reject all” even though it is a requirement that denying must be as easy as accepting.

They should pay a bounty for reporting non-compliance.

> Global Privacy Control detected. Advertising cookies are turned OFF.

Yes, I love this. My browser is already sending "do not track" requests.

I'm getting a cookie popup floating thing myself with five options, "Accept all", "reject all", "cookie settings", "confirm my choices", and... "cookie settings" again.

My favorite cookie banner is on arstechnica.com:

> We Care About Your Privacy

> We, and our 228 partners use cookies and similar methods to recognize visitors [...]

228 partners should make anybody concious about the fact that something is wrong and you probably should not consent to that at all. Also, nobody cares about your privacy when they think sharing data with 228 parties is okay.

it's hard to make yourself heard when your opponents have trillions of dollars hinging on you not being heard and also control the biggest communication channels.

> does not affect fingerprinting

It does. The current version says "storing of information, or the gaining of access to information already stored, in the terminal equipment". Reading e.g. navigator.userAgent is information already stored in the terminal equipment. If you then use that in any way that gets communicated to remote server (e.g. directly or calculating some fingerprint) you read that information in manner ePD describes.

The directive itself has been transposed incorrectly in many jurisdictions. For example from what I understand the Dutch law added an exception (roughly "for obtaining information about the quality or effectiveness of a supplied information-society service, provided this has no or only minor consequences for the user's privacy.") which is not permitted under ePD. ePD exception list is exhaustive and the only other exception can be done via Article 15. The exceptions done via that are related to things like national security and certain criminal prevention/investigation.

Of course that then raises the issue on how you get invalid exception invalidated. I don't know Dutch procedural law well enough to answer that.

That would be pretty narrow analytics to not need GDPR consent. No IP addresses or any way to uniquely identify a person.

> You can't authenticate a person using their (public) fingerprint information.

Yes, but it's a signal! There's a cost to spoof it. A scammer could cheaply start a VM that clones your font profile, but at what cost could they replicate your CPU SKU and GPU combination to provide identical webGL timings?

Other signals include the ability of your employee to show their face on a video call, to sound like themselves on a voice call, the ability contact you from their home IP, to receive official mail at their listed address, to produce a second 2FA token you'd previously registered (but not activated) or repeat a code word you'd exchanged. Any of these things can be spoofed, bypassed, copied, or burgled, but each one imposes some cost on the attacker.

The question is how to surface this information in a way that equips help desk staff and doesn't deceive them into authorizing unnecessary risks.

The quality values here seem pretty generically tied to the order, so shaving them off probably wouldn't help? I presume they are there at all to let you express ties?

IMO The EFF test is very flawed because it only tests your uniqueness among the other visitors to that site, not the total possible uniqueness from all the bits of data.

I would bet money that Brave cannot defeat CreepJS. The only thing I've ever seen do it, ironically, is Safari in private mode.

Also just using your computer normally and visiting regular websites already tracks you regardless of your browser's privacy abilities, and I promise data brokers don't care what browser you use, your overall online behavior is still unique.

> unless you have a ton of sim cards you rotate through

And phones!

For years, I've been practicing good privacy-hygiene in public. At my doctor's office, I always wear a Groucho Marx moustache to keep them guessing. Before I walk into my bank for a withdrawal, I team up with two of my friends, set them on my shoulders, and throw a trenchcoat over us! I made a fake ID with my birthday on July 4th and my weight as 98 pounds, but my pharmacy is now refusing to fill my prescriptions!

So what sort of benefits are you reaping from your anti-fingerprinting measures?

> Wow, that is a seriously impressive demo

https://abrahamjuliot.github.io/creepjs/

The "PHPSESSID" thing is why many message boards couldn't be archived in wayback machine.

RFC 2109 predates anything that vaguely resembles PHP, and Netscape (thus, defacto, basically everyone using the internet), had cookies 3 years before the RFC. PHPSESSID wasn't added until PHP 4 in 2000.

If you're going to be a bitchy pedant, you'd damn well better be CORRECT.

Isn't Brave open source? https://github.com/brave/brave-core

I see so many misconceptions on HN about that coveryourtracks site. Neither of those results are ideal.

"randomized fingerprint" -> that's a bad result, it means the site can detect you're spoofing info

"unique fingerprint" -> this is good, ONLY IF you refresh and it still says "unique fingerprint", because it means the site sees you as a brand new visitor each visit, and doesn't detect any (what advertisers would call) nefarious behavior. however, if you visit again and the second time it says "nearly-unique fingerprint", that's a fail because your two visits were linked

The ideal result you should aim for is "non-unique fingerprint". That means your device is indistinguishable from countless others. Blending in to the crowd is what you want.

These tests aren't reliable - Brave does randomise values but it ultimately doesn't do much to prevent fingerprinting, as many values remain static. For example, Brave still exposes your GPU model and driver version.

See Fingerprint.com, despite Brave's protections you'll likely find it works reliably.

You might have a residential proxy running somewhere on the network. The latest in botnets is bundling a proxy in with some TV torrent streaming app or whatever else that can run in the background and proxy malicious traffic from your residential IP. Services like cloudflare and crowdsec will keep a constantly updating list of the IP addresses that are actively sending bot traffic and blacklist them. If you can work out where the traffic is coming from and shut it down you should have this issue go away.

I have experienced the same with Google and with PayPal, whenever I used Tor. When I afterwards visited those sites using my normal browser I got Captchas. They are actively fighting attempts to avoid fingerprinting. Also, I am pretty sure that no browser protects against getting fingerprinted. Test with https://fingerprint.com/.

Have you got a TV? Or a car?

if your IP is fixed, surely no further fingerprinting is necessary?

Yep, and somehow there's always someone who thinks that the "Ah, but this is not a cookie!" is a loophole. It is not, he is just undereducated.

The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)

Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).

Eh reads like a “civil war was about states rights not slavery” argument.

The thing the site is doing that isn’t “strictly necessary” is always tracking.

Right, and that wording is why fingerprinting doesn't get around it. The EDPB's Guidelines 2/2023 on the technical scope of Art. 5(3) (final version adopted October 2024) say that when a site's JavaScript instructs the browser to send information back, that is "gaining access" just like reading a cookie (paras 32-34). WP29 had already said in Opinion 9/2014 that device fingerprinting is in scope.

So a canvas/font/WebGL fingerprint used for tracking needs the same consent as a tracking cookie. The guidelines even suggest passively collected protocol signals can fall under it (para 43), though that's where it gets argued.

The weak point is enforcement. A cookie shows up in devtools and in every cookie-scanner audit. A fingerprinting script looks like any other analytics JS, so it's much harder for a DPA to spot and prove.

It's not a preference. It literally is the default requirement.

Guaranteed deidentified, as the quote above is talking implying?

It's truly totally ok with me, yes.

(I get the non-anonymized concerns, or risk of becoming non-anonymized, that's not what I'm confused about)

No. Almost everybody using an iPhone is on the latest release, plus or minus one while updates are rolling out. For a given iOS release and hardware type almost all of those probes are highly correlated. No way there’s 30 bits of entropy in that. I doubt there’s even 10.

Now on a desktop PC sure I believe these fingerprints are highly descriptive. And in android land they probably work okay because of the diversity of products and configurations. But iPhones resist fingerprinting just because they all give the same answers.