7 ms·

All so all the fingerprinter/css/font/gpu identification. That ought to be illegal, and any provider caught using it ought to be punished.

asimpletune 5y ago
I'm all for this, but, um, how?
- tommek4077 5y ago
  One could just outlaw it. Like theft. It would not hinder you in the first place, but you would could be prosecuted.
  - mellavora 5y ago
    and unlike theft, much easier to establish and prove guilt.
- deepstack 5y ago
  should be able to guess who is doing it. And if the legal infrastructure is there, it can be quite easy for whistleblower to expose that. This is the reason why user who care about their privacy ought to use only web page that works with No Javascript
- beberlei 5y ago
  You are thinking like a software engineer that an illegal practice should be completely impossible to do, but socially it always sufficed to just put a reasonably high penalty on something and fine offenders regularly.
  - ClumsyPilot 5y ago
  - Sebb767 5y ago
    And, unlike some other computer crimes, it is sufficient to prevent local companies from using the technique. While someone who's hacking or laundering money might simply use a proxy in the Bahamas without problems, a company local company won't risk fines for using it. Sure, companies from far away can still advertise to you via tracking, but the value of their advertisements will go down sharply if no business near you can buy them.
- asimpletune 5y ago
  Ok, so follow up question then is what about the same techniques used for finger printing but done so legitimately and then gray areas in between? Because I think relying on legislation cuts both ways, no? I'm not an expert on front end technologies, but all those capabilities exist, I think, for some legitimate technical purposes. Now the only question is how is the data used... Obviously using media queries to display a page correctly is fine. Someone's preferred language and user agent detection also fine. And then eventually you do all this legitimate stuff and maybe cache it to improve page speed. (Bear with me haha, I'm out of my depth) Until, eventually, the same laws get used to do something kinda bad... I could see security heuristics being used as sort of an excuse to do actual fingerprinting and storing and sharing that data... all with promises of free stuff and totally safe and trustworthy partners. Maybe a good way to help alleviate the situation is for browser vendors to provide an actual good way to track people without identifying them... what's it called? Differential Privacy? I think that's like a mathematically proven way to do this. Even better would be if you could some how also poison the utility of finger printing in a persisted format, although I don't know how you could do that... I guess fully holomorphic encryption? Maybe browser vendors could provide some kind of "clearing house" for operations that utilize these fingerprinted traits to take place. Like you, the developer, supply a function that accepts some fingerprinted input, to sort of a black box that then performs the work but hides the inputs. I just guess one problem with this is that the same developer could sample before and after and intuit what the original input was. At any rate, I do sort of prefer well architected technical solutions, and would rather see the legislation demand that, then demand good behavior when good behavior can be so wishy washy.
rvnx 5y ago
except Facebook and Google, who have their own identifiers baked-in the client :| So it's going to favor the monopoly.
- Griffinsauce 5y ago
  Google builds the browser, so I follow that, but how so with Facebook? If you are talking about the in-app browser, this is an interesting grey area that we should be able to define generically.
  - priansh 5y ago
    They have their own pixel that presumably helps them match users to visitors; also most sites have a Facebook like button somewhere. The FB app ID is also one of the most common meta tags behind Open Graph. A nice small example of what this can do can be seen with Clearbit [0] which does a good job of telling you where someone works based off of nothing but their IP address. Imagine that but with the exponentially larger data warehouses of Facebook or Google, paired with referrer tags (FB has CLIDs that allow them but not you to match clicks to actual users) and meta tags (FB can tell exactly what app, page etc a website is associated with and use that data to advertise to users). [0] https://clearbit.com https://clearbit.com
    - coldcode 5y ago
      Since I started using Safari and iCloud Private Relay, hiding my IP address, this no longer works, since the IP they see changes a lot and is only vaguely in your area. I think FB etc. knows the address range of the IP that are exposed and just gave up using them as it gives no useful information.
- deleted 5y ago
  [deleted]
- cjfd 5y ago
  So, storing these identifiers should be illegal as well.

asimpletune 5y ago

I'm all for this, but, um, how?

tommek4077 5y ago
One could just outlaw it. Like theft. It would not hinder you in the first place, but you would could be prosecuted.
- mellavora 5y ago
  and unlike theft, much easier to establish and prove guilt.
deepstack 5y ago
should be able to guess who is doing it. And if the legal infrastructure is there, it can be quite easy for whistleblower to expose that. This is the reason why user who care about their privacy ought to use only web page that works with No Javascript
beberlei 5y ago
You are thinking like a software engineer that an illegal practice should be completely impossible to do, but socially it always sufficed to just put a reasonably high penalty on something and fine offenders regularly.
- ClumsyPilot 5y ago
- Sebb767 5y ago
  And, unlike some other computer crimes, it is sufficient to prevent local companies from using the technique. While someone who's hacking or laundering money might simply use a proxy in the Bahamas without problems, a company local company won't risk fines for using it. Sure, companies from far away can still advertise to you via tracking, but the value of their advertisements will go down sharply if no business near you can buy them.
asimpletune 5y ago
Ok, so follow up question then is what about the same techniques used for finger printing but done so legitimately and then gray areas in between? Because I think relying on legislation cuts both ways, no? I'm not an expert on front end technologies, but all those capabilities exist, I think, for some legitimate technical purposes. Now the only question is how is the data used... Obviously using media queries to display a page correctly is fine. Someone's preferred language and user agent detection also fine. And then eventually you do all this legitimate stuff and maybe cache it to improve page speed. (Bear with me haha, I'm out of my depth) Until, eventually, the same laws get used to do something kinda bad... I could see security heuristics being used as sort of an excuse to do actual fingerprinting and storing and sharing that data... all with promises of free stuff and totally safe and trustworthy partners. Maybe a good way to help alleviate the situation is for browser vendors to provide an actual good way to track people without identifying them... what's it called? Differential Privacy? I think that's like a mathematically proven way to do this. Even better would be if you could some how also poison the utility of finger printing in a persisted format, although I don't know how you could do that... I guess fully holomorphic encryption? Maybe browser vendors could provide some kind of "clearing house" for operations that utilize these fingerprinted traits to take place. Like you, the developer, supply a function that accepts some fingerprinted input, to sort of a black box that then performs the work but hides the inputs. I just guess one problem with this is that the same developer could sample before and after and intuit what the original input was. At any rate, I do sort of prefer well architected technical solutions, and would rather see the legislation demand that, then demand good behavior when good behavior can be so wishy washy.

rvnx 5y ago

except Facebook and Google, who have their own identifiers baked-in the client :| So it's going to favor the monopoly.

Griffinsauce 5y ago
Google builds the browser, so I follow that, but how so with Facebook? If you are talking about the in-app browser, this is an interesting grey area that we should be able to define generically.
- priansh 5y ago
  They have their own pixel that presumably helps them match users to visitors; also most sites have a Facebook like button somewhere. The FB app ID is also one of the most common meta tags behind Open Graph. A nice small example of what this can do can be seen with Clearbit [0] which does a good job of telling you where someone works based off of nothing but their IP address. Imagine that but with the exponentially larger data warehouses of Facebook or Google, paired with referrer tags (FB has CLIDs that allow them but not you to match clicks to actual users) and meta tags (FB can tell exactly what app, page etc a website is associated with and use that data to advertise to users). [0] https://clearbit.com https://clearbit.com
  - coldcode 5y ago
    Since I started using Safari and iCloud Private Relay, hiding my IP address, this no longer works, since the IP they see changes a lot and is only vaguely in your area. I think FB etc. knows the address range of the IP that are exposed and just gave up using them as it gives no useful information.
deleted 5y ago
[deleted]
cjfd 5y ago
So, storing these identifiers should be illegal as well.