Fingerprints are the new cookies

1a527dd5

My reaction to this is always two fold; firstly cool tech, secondly horrifying invasion of privacy. At {{job}} we did briefly consider rolling out fingerprint.com, but settled on ja3/ja4 at the CDN layer.

blooalien

Cookies, in and of themselves, are not bad. Like any tool that can be misused, they're just being abused by a ton of really shitty people in an effort to try to enrich themselves at the expense of others. Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?" Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"

crote

This is already illegal in the EU. The consent banners were never about cookies , they have always been about the tracking itself! Same thing the other way: no need to have a banner for a simple login cookie which isn't being used for privacy-invading tracking purposes.

iugtmkbdfil834

So what is next in this cat and mouse game? Fake-slow browser to miss fingerprint? Declare revolution and declare all advertising illegal?

howunfortunate

> See, the thing is, it’s not about you at all. It’s not really about the ads anymore either. Nobody cares about you. And if the police or your government happen to care, I’ll gladly take their money too. > I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product. > And to the highest bidder it goes! > What does that make you then? A gear? An ox? A volunteer? This does absolutely nothing for me. If this resonates with you, can you explain? I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.

Cider9986

Fingerprinting is really bad for privacy and the defenses against it are not there. See https://fingerprint.com . Tor Browser defeats it but I don't think there's a highly usable browser like Brave you can use and prevent being tracked by it.

oofbey

It’s a question of entropy. If your device is unusual in detectable ways, then the fingerprint has high entropy. But on my iPhone I suspect most of the things being fingerprinted are the same. How many other people get “smug koala”?

MiroslavPokorny

Theres only one solution, ban third party advertising. Everything else is a compromise that doesnt work anyway.

MathMonkeyMan

I was the Gentle Owl. Then I connected to a VPN, opened a private window in the same browser, and didn't maximize the window. Now I'm the Nosy Toucan. The article's points still stand, but the trick didn't work this one time.

davidjade

Huh, it is different for me on every page refresh. No VPN, etc... just Firefox on Windows with uBlock, CanvasBlocker, and a PiHole. No persistent fingerprint for me!

charcircuit

>and the solutions Google has developed (Privacy Sandbox) kinda suck and have raised antitrust concerns so nobody uses them. This is backwards. The antitrust concerns of removing 3rd party cookies led to them developing alternatives.

helterskelter2

I've seen anti-fingerprinting plugins and browser configs, etc, but they all seem to make you more interesting for not being fingerprintable, or for turning off a lot of features used in fingerprinting. Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?

byte_0

I have heard from some power users that Brave is one of the best browsers with regard to ad-blocking and privacy. But I think I have read elsewhere that it receives money from ad companies to display only certain ads, which does not make me trust it. Does anyone have facts or know where to find them?

drnick1

The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis.

j45

Fingerprints of one kind another have also been around for a very long time.

chaostheory

wow on chrome based browsers, the fingerprint survives even in incognito mode. On Safari, fingerprinting doesn't survive in incognito mode. Same with Firefox. Good thing I use different computers for different purposes, though it looks like using different browsers seems sufficient.

TZubiri

I'm skeptical of this magic trick, maybe add a counter with the amount of times I logged in to the website. Or let me save some data to read it from another session. Otherwise lots of people can be identified by that hash, there's no proof that it is unique

legitster

Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level. Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes. 90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months). What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.

pixel_popping

Fingerprints are used for over a decade already, nothing new, just users keep closing their eyes despite knowing, even advanced ones.

aenis

The fingerprints don't need to be long-time-stable to be harmful. Some companies have your stable datapoints (e.g., email) and your fingerprint. Other companies only have your fingerprint on the same day/week. Some companies have locations of edge devices and the fingerprints. And there are companies out there that will take all of those data streams, both from above board and not-so-above-board players and mix them for commercial benefit.