11 ms·

A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are. Anyway, what they're call

by ef2k 6mo ago

A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are. Anyway, what they're calling "spectroscopy", is a combination of extension probing and doing residue detection (looking for what extensions might leave behind in the DOM). An ad blocker is not necessarily equipped to help since the script is embedded with the application code. Since they're targetting Chrome, switching browsers will help with the probing but not the detection part and you'll still be fingerprinted. The only way forward is for browser vendors to offer a real privacy or incognito mode where sites are sandboxed by default. When the default profile is identical across millions of users there won't be anything unique to fingerprint.

tombert 6mo ago
It's the typical Microsoft playbook, where they release a product and convince everyone that it has to be used everywhere, and by the time people realize how unbelievably terrible the product is it's too late and it has entrenched itself everywhere. They've run this experiment before; Windows is terrible and has been for a very long time, Microsoft Office is terrible and has been for a very long time, Sharepoint is terrible and has been for a very long time, LinkedIn is terrible and has been for a very long time, etc. It's what they do, there is not a single thing that Microsoft does not half-ass, because all they focus on is getting embedded into places, and that does not require that any of their products be good.
varenc 6mo ago
> A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are. For over 15 years reCAPTCHA has relied on browser fingerprinting to help distinguish humans from bots. And fingerprintjs.com has been around for well more than a couple years. That said, sniffing the browser extensions someone is using is NOT a common fingerprinting method used by my examples, but just saying fingerprinting itself without explicit disclosure has been around for quite a long time. It happens on literally every CAPTCHA service. I hate it of course, but the ship sailed a long time ago. -- I like this demo for testing my browser's resilence against fingerprinting: https://fingerprint.com/demo/ https://fingerprint.com/demo/
- purplehat_ 6mo ago
  Have you (or anyone reading this) been able to "beat" fingerprint.com without Tor or turning JavaScript off outright? I've tried it various times over the last couple years, using different browsers with various privacy settings enabled and a VPN. I can get good partial results and am able to reset my fingerprint by changing my OS and browser at the same time, so it's not entirely there with regards to sniffing the hardware. But I can never revisit the site and have it not recognize me. Is there no one but me using (for example) Debian testing Librewolf with resistFingerprinting on Proton VPN? If there are others, then resistFingerprinting is doing a bad job hiding my hardware. That's depressing! Despite our genuine best efforts, enough identifiers leak that it seems to me there's no practical solution. I am genuinely at a loss for what we can do. (If you're reading this and think it doesn't matter, it's possible you're not realizing that this means that any site collecting and storing these identifiers now will be able to talk to any site in the future and link your identity. Your past actions on every website on a given piece of hardware are liable to be linked to create a detailed profile in the future, so even if Reddit and Pornhub and Discord and the government aren't talking to each other now, you can put some decent probability in the fact that if they decided to share identifiers, they could link all your historical (signed out) activity to your real-world identity without much effort. I use those sites as examples because they're sites where people tend to generate information that they may want private, but they visit using the same hardware identifiers.)
  - varenc 6mo ago
    It is depressing how robust it is! I can beat it, but only be changing my IP. Since I'm not using a shared IP like a university/company might, my IP is giving them a lot of bits about me since I'm the only entity using it... No matter the browser switch, if I hit it from the same IP, it correctly assumes that my IP is still me. But the moment I switch to a different browser and change IPs I get a new fingerprint. Haven't dug deep on it though, like would an incognito window in Chrome on a new IP, have the same fingerprint as a non-incognito Chrome window on another IP? Not sure I would love to play around with that fingerprint demo while on a large shared IP, where they the IP itself provides less signal and is less unique.
mosquitobiten 6mo ago
this should lead to the browser be the one doing human or robot user check, is that possible?
Neikius 6mo ago
By GDPR this is illegal. But I assume no action will be forthcoming

by ef2k 6mo ago

tombert 6mo ago

It's the typical Microsoft playbook, where they release a product and convince everyone that it has to be used everywhere, and by the time people realize how unbelievably terrible the product is it's too late and it has entrenched itself everywhere. They've run this experiment before; Windows is terrible and has been for a very long time, Microsoft Office is terrible and has been for a very long time, Sharepoint is terrible and has been for a very long time, LinkedIn is terrible and has been for a very long time, etc. It's what they do, there is not a single thing that Microsoft does not half-ass, because all they focus on is getting embedded into places, and that does not require that any of their products be good.

varenc 6mo ago

> A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are. For over 15 years reCAPTCHA has relied on browser fingerprinting to help distinguish humans from bots. And fingerprintjs.com has been around for well more than a couple years. That said, sniffing the browser extensions someone is using is NOT a common fingerprinting method used by my examples, but just saying fingerprinting itself without explicit disclosure has been around for quite a long time. It happens on literally every CAPTCHA service. I hate it of course, but the ship sailed a long time ago. -- I like this demo for testing my browser's resilence against fingerprinting: https://fingerprint.com/demo/ https://fingerprint.com/demo/

purplehat_ 6mo ago
Have you (or anyone reading this) been able to "beat" fingerprint.com without Tor or turning JavaScript off outright? I've tried it various times over the last couple years, using different browsers with various privacy settings enabled and a VPN. I can get good partial results and am able to reset my fingerprint by changing my OS and browser at the same time, so it's not entirely there with regards to sniffing the hardware. But I can never revisit the site and have it not recognize me. Is there no one but me using (for example) Debian testing Librewolf with resistFingerprinting on Proton VPN? If there are others, then resistFingerprinting is doing a bad job hiding my hardware. That's depressing! Despite our genuine best efforts, enough identifiers leak that it seems to me there's no practical solution. I am genuinely at a loss for what we can do. (If you're reading this and think it doesn't matter, it's possible you're not realizing that this means that any site collecting and storing these identifiers now will be able to talk to any site in the future and link your identity. Your past actions on every website on a given piece of hardware are liable to be linked to create a detailed profile in the future, so even if Reddit and Pornhub and Discord and the government aren't talking to each other now, you can put some decent probability in the fact that if they decided to share identifiers, they could link all your historical (signed out) activity to your real-world identity without much effort. I use those sites as examples because they're sites where people tend to generate information that they may want private, but they visit using the same hardware identifiers.)
- varenc 6mo ago
  It is depressing how robust it is! I can beat it, but only be changing my IP. Since I'm not using a shared IP like a university/company might, my IP is giving them a lot of bits about me since I'm the only entity using it... No matter the browser switch, if I hit it from the same IP, it correctly assumes that my IP is still me. But the moment I switch to a different browser and change IPs I get a new fingerprint. Haven't dug deep on it though, like would an incognito window in Chrome on a new IP, have the same fingerprint as a non-incognito Chrome window on another IP? Not sure I would love to play around with that fingerprint demo while on a large shared IP, where they the IP itself provides less signal and is less unique.

mosquitobiten 6mo ago

this should lead to the browser be the one doing human or robot user check, is that possible?

Neikius 6mo ago

By GDPR this is illegal. But I assume no action will be forthcoming