alt Hacker NewsThe problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis.
Replies
The scope and amount of information that browsers hand over without the slightest shred of consent from the user or indication it’s happening is crazy.
I can't help but keep thinking that client-side scripting was a mistake. Sure, the web would be a lot more primitive without it, but I'm not convinced that wouldn't be for the best.
You can do plenty (like view port size) via just CSS.
Even without JS, there is timing, HTTP headers, conditional CSS, etc.
If everyone else you know has JavaScript turned on, congrats, you're still fingerprinted.
> identifying hardware,
> language
I dont think js is needed for either of those things.
Great how this is currently the 2nd highest comment despite completely ignoring the numerous fingerprinting techniques based on CSS alone (including one of the most famous fingerprinting methods by testing font support). Simply thanks to reflexive "JS=bad" upvotes.
https://en.wikipedia.org/wiki/CSS_fingerprinting