Fingerprints are the new cookies

I've seen anti-fingerprinting plugins and browser configs, etc, but they all seem to make you more interesting for not being fingerprintable, or for turning off a lot of features used in fingerprinting.Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load? reply: Random is often going to be indirectly fingerprintable too, since some values are always the same (or the same given each browser version). Some values can't be set to be random or otherwise non-fingerprintable data without affecting the user, like viewport size.Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.

The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis. reply: The scope and amount of information that browsers hand over without the slightest shred of consent from the user or indication it’s happening is crazy.

I'm skeptical of this magic trick, maybe add a counter with the amount of times I logged in to the website. Or let me save some data to read it from another session. Otherwise lots of people can be identified by that hash, there's no proof that it is unique

Theres only one solution, ban third party advertising. Everything else is a compromise that doesnt work anyway. reply: How would you enforce that? Who can be trusted with the ability to classify things as advertising and in so doing silence their critics?The solution is explicit trust. Not fingerprints for users, but digital signatures for content. If it's not signed by somebody the user trusts, don't render it.The user is the only one who can be approach that task without a conflict of interest. If somebody wants the user to run code that phones home about user behavior, make them gain the user's trust.

I'm skeptical of this magic trick, maybe add a counter with the amount of times I logged in to the website. Otherwise lots of people can be identified by that hash.

My reaction to this is always two fold; firstly cool tech, secondly horrifying invasion of privacy.At {{job}} we did briefly consider rolling out fingerprint.com, but settled on ja3/ja4 at the CDN layer.

Huh, it is different for me on every page refresh. No VPN, etc... just Firefox on Windows with uBlock, CanvasBlocker, and a PiHole. No persistent fingerprint for me! reply: firefox, ublock and canvasblocker seems to be enough for me. New identity every refresh

I have heard from some power users that Brave is one of the best browsers with regard to ad-blocking and privacy. But I think I have read elsewhere that it receives money from ad companies to display only certain ads, which does not make me trust it. Does anyone have facts or know where to find them? reply: As a general role, always be suspicious of very loud and vocal opinions about product and services. Specially for closed source products and paid services, they often invest in what is called Native Advertisement/Marketing which is basically paying people to lie and pretend it is organic content/opinion.Second, despite the dumpsterfire that Mozilla’s leadership has been in a decade or so, it is very robust with privacy and anti fingerprint features out of the box, the containers has also stabilised and works great.

Fingerprinting is really bad for privacy and the defenses against it are not there. See https://fingerprint.com. Tor Browser defeats it but I don't think there's a highly usable browser like Brave you can use and prevent being tracked by it.

So what is next in this cat and mouse game? Fake-slow browser to miss fingerprint? Declare revolution and declare all advertising illegal?

>and the solutions Google has developed (Privacy Sandbox) kinda suck and have raised antitrust concerns so nobody uses them.This is backwards. The antitrust concerns of removing 3rd party cookies led to them developing alternatives.

Cookies, in and of themselves, are not bad. Like any tool that can be misused, they're just being abused by a ton of really shitty people in an effort to try to enrich themselves at the expense of others. Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"

This is already illegal in the EU. The consent banners were never about cookies, they have always been about the tracking itself!Same thing the other way: no need to have a banner for a simple login cookie which isn't being used for privacy-invading tracking purposes.

I was the Gentle Owl. Then I connected to a VPN, opened a private window in the same browser, and didn't maximize the window. Now I'm the Nosy Toucan.The article's points still stand, but the trick didn't work this one time.

> See, the thing is, it’s not about you at all. It’s not really about the ads anymore either. Nobody cares about you. And if the police or your government happen to care, I’ll gladly take their money too.> I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.> And to the highest bidder it goes!> What does that make you then? A gear? An ox? A volunteer?This does absolutely nothing for me. If this resonates with you, can you explain?I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.

Fingerprints of one kind another have also been around for a very long time.

It’s a question of entropy. If your device is unusual in detectable ways, then the fingerprint has high entropy. But on my iPhone I suspect most of the things being fingerprinted are the same. How many other people get “smug koala”?