alt Hacker NewsEvery time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes.
90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months).
What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.
Replies
18 months ago Google publicly stated they were going to start using browser fingerprint data to track users, a reversal of their 2019 policy on it because it was considered too invasive.
https://www.malwarebytes.com/blog/news/2025/02/google-now-al...
There's a fingerprint demo on github called JSCreep (https://abrahamjuliot.github.io/creepjs/) that used to keep your fingerprint profile for 90 days and show you how many times you visited. Worked extremely well, and is still around, but no longer uses the API to retain fingerprint data, so you have to track your hash yourself. It would easily track most browsers across changes in IP address. Only Mullvad, Brave, or Tor would not leave an easily tracked fingerprint.
The demo presented in the royfish.dev link is easily foiled by browser extensions that scramble fingerprint data, the presence of which would itself be detected by more sophisticated profilers and used to define the fingerprint. I can refresh the page and get a new hash and adjective-animal name with the same IP. JSCreep sticks firm to the same hash for me, even with a new IP address and some spoofed browser data.
Overall correct, but you're kind of missing some of the cat-and-mouse details for fingerprinting centered around infosec and anti-fraud purposes rather than generic ad-related tracking. That stuff can get way more intense, and is constantly changing based on new techniques developed, countermeasures from cybercriminals, and mitigations from browser developers.
Is there any way to link this data over longer periods of time?
A lot of data can change over days, weeks, but if you can maintain an accurate fingerprint with tinier changes, and granted you have consistent visits from the user, could you just keep up?
Especially if one service is tapped into several websites, and can continually keep up with smaller data changes and distribute that info. Is this possible? In practice anywhere?
on what basis do you believe this about fonts? my guess would be that the average user doesn’t install or remove fonts often if ever, but it’s only a guess
I was thinking about the literal fingerprint sensor a device has. Imagine a "prove youre not a bot" challenge and the finger scanner pulls up. What a nightmare, reminds me when a website asked me if I want to login with windows hello (facescan)
One intereting part about installed fonts is that many enterprise companies buy specific fonts. Then they are rolled out to all their devices, and sometimes at least one of them will have the company name as part of it's name.
> Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days.
Indeed. I checked this website a few hours ago and got one fingerprint. Just rechecked and got another.
On the other hand, browsers don't need to share all this data at all. Sure, IP address can't be hidden, but from your example, installed fonts and volume settings? Why should that be shared at all? Sure, for example for a teams meeting, but you'd have to allow the use of microphones or that, youtube for example doesn't need to know how loud you're listening to a video.
[dead]
[flagged]
> Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Sorry, but that's simply not true. It's actually the default way of how people eg track people across installs in app stores ever since they started removing that feature.
IMO, data brokering is what should be illegal, not the cookie .