alt Hacker NewsFingerprints are the new cookies
Comments
The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis.
> The request already reveals information about you; what browser you use, the language it’s in, the OS that runs it and your IP address, which the server needs to send you the response. That often reveals your location.
If we control the servers the clients are connecting to, I don't see how there could be much hope of hiding. We can spoof things like latency toward an upper bound, but we can never ever defeat the lower bound. Physics is still quite insistent about that one.
If we control multiple servers, we know where they are, and we can periodically compel our clients to rotate between them (see: DNS), we can engage in latency-based multilateration to put them on a real-world map. Depending on the number of servers and samples over time, this can be remarkably accurate. Determining someone's actual postal code just from network timing information is feasible.
VPNs obviously confound this in first order terms, but if we aren't careful they can make it even easier to identify our activity in other ways. We are trading concealment in the woods for concealment in a crowd. Both have their advantages and disadvantages. The VPN might also have a side channel that we aren't aware of.
https://www.usenix.org/legacy/event/nsdi07/tech/full_papers/...
I've seen anti-fingerprinting plugins and browser configs, etc, but they all seem to make you more interesting for not being fingerprintable, or for turning off a lot of features used in fingerprinting.
Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
>Test your browser:
>coveryourtracks.eff.org shows you how unique your fingerprint is, with entropy for each measured data point.
Something to note - if a fingerprint is generic enough, that might be a _good_ thing!
Having worked with fingerprinting, anti-fingerprint browsers are very hard to properly identify. The ways to get around it are things like collecting more coarse fingerprints[0], as the overall one is fairly easy to change (e.g. make your browser lie about a collection of browser apis).
What's imo more difficult though is a fingerprint like:
- iPhone <new_version> - running os <latest_stable> - using default safari - bought and used in <common_location> (e.g. usa)
on a 5g mast in a decently sized city, you'll share a fingerprint with at least one other active user using a setup like ^
grapheneOS on the other hand stands out a bit more!
[0] - https://blog.castle.io/fingerprints-beyond-device-ids-engine...
Reddit definitely relies on this. I got banned from a subreddit ages ago (can't even remember which one), and ever since, any fresh account created from the same device gets shadowbanned almost immediately. Very annoying.
Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes.
90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months).
What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.
Theres only one solution, ban third party advertising. Everything else is a compromise that doesnt work anyway.
> Remember the big fuss about third-party cookies? It was so big that the EU had already rolled out one of its greatest inventions - consent banners.
It was never about cookies. Thats what the industry made you think. You don't need to show consent banners for cookies (like auth sessions). You need consent for tracking. This includes profiling. And it doesn't matter what you use, fingerprinting or tracking cookies, the consenst banner is required either way.
Doing this on GrapheneOS's built in Vanadium browser, I am concerned to see that the ID remains the same if I move to incognito tabs, or even a private space. Or perhaps Vanadium is doing such a magnificent job of reporting generic info that this ID would be the same for anyone using Vanadium on my model of Pixel, but I don't think so, since the site says it has a "clean read" on all the info it takes. I really do not know. Curious what other Graphene/Vanadium users are seeing.
My understanding of the EU "cookie law" is that it really concerns a broader category of tracking devices rather than cookies specifically. Referring specifically to cookies is probably a side effect of the way tracking was typically implemented at the time.
The fingerprints don't need to be long-time-stable to be harmful. Some companies have your stable datapoints (e.g., email) and your fingerprint. Other companies only have your fingerprint on the same day/week. Some companies have locations of edge devices and the fingerprints. And there are companies out there that will take all of those data streams, both from above board and not-so-above-board players and mix them for commercial benefit.
Per coveryourtracks.eff.org, just my HTTP headers leak 18.46 bits of information, which seems to be the most the tool can report? Presumably most of that entropy comes from my language settings (en-AU,en;q=0.9,de-CH;q=0.8,de;q=0.7), so the only way to be not fingerprintable is to give up on smart localisation.
If people have a problem with fingerprinting, they need to focus on making it illegal to trade data tied to fingerprints, not trying to make users all look the same (we aren't!).
How could this information be surfaced in a reasonable way in administration software?
Say I have a remote employee who is only able to access your internal systems via his yubikey. His fingerprint is "Genuine Antelope".
Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him. I create a new session for him on the provisioning portal (so he can enroll the new key) but now his fingerprint is "Interesting Elephant". What do I do with this information?
It might be better to log the exact forensics and show the administrator the differences, e.g, "User has a new font called "my_handwriting.ttf" since a week ago", or "appears to be a totally different processor, and the new system has Russian fonts installed".
Fingerprinting is a way to track you. Cookies is a way for you to keep your own configuration (a panel inside an app open or closed, theme choice, pre-filled calendar, etc). They are completely different.
"Fingerprints are new cookies"
What if "fingerprints" are contained in the values of Cookie: headers
Fingerprinting is really bad for privacy and the defenses against it are not there. See https://fingerprint.com. Tor Browser defeats it but I don't think there's a highly usable browser like Brave you can use and prevent being tracked by it.
These fingerprints now track us much more effectively than ever, not just for security but for real ad tracking and data selling. Instead of using cookies that are mostly vulnerable to ad blockers and other content blockers, these fingerprints can track us more precisely and can easily bypass our current data security systems like ad blockers. So I think the demand for sophisticated anti-detect browsers and proxy-level tracking prevention will increase. Hmm, let's see what will happen.
My reaction to this is always two fold; firstly cool tech, secondly horrifying invasion of privacy.
At {{job}} we did briefly consider rolling out fingerprint.com, but settled on ja3/ja4 at the CDN layer.
The solution has to come from law. I propose we handle privacy invasion the same as rape. Body and mind aren't up for grabs. That the average internet user is unconscious isn't a valid excuse.
It would be great if a wave of lawmaking started in the USA, because most tech behemots operate from there. I would expect EU to take the lead though IF such a wave would start. The EU has still a fair share of christian/conservative MP's that keeps doing the bidding for companies by pushing chat control, but on the other hand also has some progressive and knowledgeable representatives doing great work, so there might be a glimmer of hope. We need media campaigns and public education though. Political leaders are selected for their political abilities and as such rarely have leadership qualities. If the electorate moves, the leaders will follow it. So we have to start at the bottom.
It is offensive that browsers give away so much unnecessary info. What is necessary? Language preference, Javascript (yes/no), screen resolution. Optionally, latest supported html/css versions. That it, nothing else.
I understand Google having Chrome send way more info. Why do all other browsers go along with this?
Make it make sense...
Why can't a government simply ban all advertising and instead provide a good enough yellow pages service that just provides the specs of the product in a templated way?
Why would it be a good idea to expose unsuspecting citizens to false claims by the sellers?
Huh, it is different for me on every page refresh. No VPN, etc... just Firefox on Windows with uBlock, CanvasBlocker, and a PiHole. No persistent fingerprint for me!
I wonder if a browser extension could be made that inspects your fingerprint and informs you if you're too unique, then one-click to 'correct' those unique items (or at least list them), so you can conveniently go back to being ~anonymous if preferred.
If you use Firefox, do the following: Use the extension Chameleon (set it to rotate Random profile every minute), had strict mode with JShelter extension.
This royfish blog example, or anyother, including that fingerprint.com gets new value everytime.
Fingerprint.com charges around $0.004 per investigation, and really encourages you to set up a first party proxy - so iOS doesn't nuke storage after 7 days. And even there, unless its a cookie match; your ID usually carries a confidence number.
That should give some hint about how difficult it is to do in real life, at scale.
This site gave me the name “Greedy Bison”, but it didn’t say how many other “Greedy Bison” are out there. I’m guessing everyone using the very common device I’m using and using the very common browser that I’m using would get the same name as me
Lets hope AI coding agents will let us to modify browsers and OSes quickly. "Remove tracking from Chrome". "Privacy friendly Android, in particular, allow geo location spoofing"
Cookies, in and of themselves, are not bad. Like any tool that can be misused, they're just being abused by a ton of really shitty people in an effort to try to enrich themselves at the expense of others. Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"
It's creepy that we all have stalkers that want to know our intimate details.
Just think how are daily actions are someones data and how entire masses are manipulated by using this data.
I have heard from some power users that Brave is one of the best browsers with regard to ad-blocking and privacy. But I think I have read elsewhere that it receives money from ad companies to display only certain ads, which does not make me trust it. Does anyone have facts or know where to find them?
Iphone safari incognito gives different with every page load.
So what is next in this cat and mouse game? Fake-slow browser to miss fingerprint? Declare revolution and declare all advertising illegal?
Can anyone confirm that they are also "Gentle Llama" on Mullvad browser?
I just installed it, I want to know if everyone gets the same hash (same identity for everyone).
I think this app is broken. Every time it refreshes it calls me a different name.
Amazingly, Firefox incognito seems to defeat this
At least when tracking was unregulated, at least you knew who was by the cookie left in your browser, now I just assume everyone and everything is tracking me
Ok, but are they really all that new at this stage?
This is already illegal in the EU. The consent banners were never about cookies, they have always been about the tracking itself!
Same thing the other way: no need to have a banner for a simple login cookie which isn't being used for privacy-invading tracking purposes.
The regulation is not about cookies. It’s about tracking.
The whole cookie thing has always been bs
Mullvad browser. It's Tor browser minus connection to Tor.
the scary part is how little of this needs a third-party script anymore
opening in a different browser resulted in a different name
These are all a joke anyway
If you've ever worked at a startup, you're probably familiar with the fact that no one gives a crap about this type of stuff early on
The hell with pretty much anything, the only thing that matters is revenue
People only start to care about this after the fact if you've grown to large enough size
If you think stuff like this or right to be deleted stuff is moving the needle anywhere but at the biggest companies, you've been misled
That's the real painful truth of this stuff, most of the time it's just lip service anyway
Wth is anyone going to do anyway? Go through a resource-draining lawsuit against a 20 person company where it will take a year of discovery just to maybe-sort-of prove they've been mishandling your data?
It's going to take some pretty radical new laws for this type of stuff to ever have any meaningful impact
I can't wait for the new EU law for more useless fkin popups
I was the Gentle Owl. Then I connected to a VPN, opened a private window in the same browser, and didn't maximize the window. Now I'm the Nosy Toucan.
The article's points still stand, but the trick didn't work this one time.
We have over 10+ years of employing this tech, and we've found fingerprints for a browser are constantly changing. As such, they are far from being a silver bullet when used as a persistent identifier.
Furthermore, in corporate environments where boxes are set up the same for many users, there are often, or too often, two different users and two different boxes with the same exact fingerprint.
I still don't understand why the highest entropy APIs aren't gated behind browser consent.
A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
Broad geographical targeting shouldn't be an issue. In fact, it's so easy that I think we should invent an ad-targeting API people can opt in to. If I could tell advertisers my geographic location, gender, age cohort, languages, and 3 interests, I'd not feel that's an invasion of privacy when they use that to deliver ads. I'd just get lawnmower ads instead of shampoo ads and that's fine.
The problem is, they don't want to use that kind of targeting. They want to target me with ads for a travel destination that my coworker mentioned in a Messenger message to another coworker five minutes ago. But we should just not accept that.