I've seen anti-fingerprinting plugins and browser configs, etc, but they all seem to make you more interesting for not being fingerprintable, or for turning off a lot of features used in fingerprinting.
Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
Random is often going to be indirectly fingerprintable too, since some values are always the same (or the same given each browser version). Some values can't be set to be random or otherwise non-fingerprintable data without affecting the user, like viewport size.
Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.
You can forcefully disable hardware acceleration, that removes a few bits - though javascript can still guesstimate your CPU and memory.
For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.
The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis.
How would you enforce that? Who can be trusted with the ability to classify things as advertising and in so doing silence their critics?
The solution is explicit trust. Not fingerprints for users, but digital signatures for content. If it's not signed by somebody the user trusts, don't render it.
The user is the only one who can be trusted to approach that task without a conflict of interest.
The problem isn't advertising, it's data harvesting and sale. Ads used to rent space on websites - totally reasonable. The whole industry around the purchase and sale of user data is what needs to be banned.
How do you tell the difference between a regular human trying to not have a weird creepy perma-dossier collected on them... versus a bot set up to always look like a new visitor?
The only winning move is not to play--er, to somehow not to have this kind of game in the first place.
I worked in fraud prevention for years and device fingerprinting didn't stop fraud, but it reduced it by upping the up the cost. It is not hard to circumvent fingerprinting, but it still takes a non-zero amount of effort on behalf of the fraudster. Device fingerprints helped us identify and block or prevent a lot of low effort fraud and abuse on various platforms.
Huh, it is different for me on every page refresh. No VPN, etc... just Firefox on Windows with uBlock, CanvasBlocker, and a PiHole. No persistent fingerprint for me!
I have heard from some power users that Brave is one of the best browsers with regard to ad-blocking and privacy.
But I think I have read elsewhere that it receives money from ad companies to display only certain ads, which does not make me trust it.
Does anyone have facts or know where to find them?
As a general role, always be suspicious of very loud and vocal opinions about product and services. Specially for closed source products and paid services, they often invest in what is called Native Advertisement/Marketing which is basically paying people to lie and pretend it is organic content/opinion.
Second, despite the dumpsterfire that Mozilla’s leadership has been in a decade or so, it is very robust with privacy and anti fingerprint features out of the box, the containers has also stabilised and works great.
These tests aren't reliable - Brave does randomise values but it ultimately doesn't do much to prevent fingerprinting, as many values remain static. For example, Brave still exposes your GPU model and driver version.
See Fingerprint.com, despite Brave's protections you'll likely find it works reliably.
Fingerprinting is really bad for privacy and the defenses against it are not there. See https://fingerprint.com. Tor Browser defeats it but I don't think there's a highly usable browser like Brave you can use and prevent being tracked by it.
Wow, that is a seriously impressive demo. I wonder how it’s able to distinguish people using identical hardware and software versions (e.g., iPhones on the same iOS version). It was able to correlate my sessions across multiple independent ISPs, with a VPN, and with Apple’s extra tracking resistance in private mode.
I've been obfuscating my fingerprint with Brave for years, which I selected specifically because it was the browser I was able to do this with, based on my testing of 5 popular browsers, using https://coveryourtracks.eff.org/ as my benchmark.
It does mean that sites that uses 2FA (so every site nowadays) flag me as a coming from a new device each visit, and I have to have my phone nearby every time I want to use my computer, which is quite annoying. If you use GrapheneOS, you can obfuscate your phone too on WiFi networks (and sites, but GrapheneOS not needed for that, just Brave). You can't obfuscate yourself on cellular networks though, unless you have a ton of sim cards you rotate through.
For years, I've been practicing good privacy-hygiene in public. At my doctor's office, I always wear a Groucho Marx moustache to keep them guessing. Before I walk into my bank for a withdrawal, I team up with two of my friends, set them on my shoulders, and throw a trenchcoat over us! I made a fake ID with my birthday on July 4th and my weight as 98 pounds, but my pharmacy is now refusing to fill my prescriptions!
So what sort of benefits are you reaping from your anti-fingerprinting measures?
It’s really kind of pointless. They fingerprint you to target ads and that’s it. The valuable data that’s collected and sold can’t be hidden through fingerprint avoidance: anything you actually pay for. Sure there’s privacy cards, but the second you purchase a physical product you have to give up a delivery address and now they’ll just correlate all your disposable emails and privacy cards and whatever else.
Your only option is to never buy anything online and only pay cash.
> Your only option is to never buy anything online and only pay cash.
I probably wouldn't go as far as never buying anything online, but paying cash IRL should be something done by everyone to protect their privacy. There are a few other easy things that can massively improve your privacy with minor or no inconvenience: Linux on every PC/laptop, GrapheneOS on phone(s), uBlock on every browser (or a DNS-level sanitizer), car without cellular modem (pull the fuse), non-Google and non-Apple email (ideally your own server or a small provider in a friendly jurisdiction). Also, don't use social media and text over Signal instead. Of course, TVs and other home appliances should be kept off the Internet. Overall, those are some very minor sacrifices for anyone with a little bit of maturity. It's very far from living off the grid or anything like that.
Cookies, in and of themselves, are not bad. Like any tool that can be misused, they're just being abused by a ton of really shitty people in an effort to try to enrich themselves at the expense of others. Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"
> Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Don't you people remember how it was done back when web browsers didn't have cookies, or could be configured to reject or ask for each cookie? The server software automatically added a PHPSESSID parameter to every link, containing the session identifier.
Yet I am constantly flagged by various pages because Cloudflare decided I had some bot running at some point on my network. And my IP is fixed. Whatever EU is doing, it doesn't work.
You might have a residential proxy running somewhere on the network. The latest in botnets is bundling a proxy in with some TV torrent streaming app or whatever else that can run in the background and proxy malicious traffic from your residential IP. Services like cloudflare and crowdsec will keep a constantly updating list of the IP addresses that are actively sending bot traffic and blacklist them. If you can work out where the traffic is coming from and shut it down you should have this issue go away.
I have a similar issue. I see cloudflare checkboxes all the time. Google makes me fill out captchas all the time. Sometimes it decides I can’t search, sometimes cloudflare doesnt let me past the checkbox.
I’ve checked my network. I’ve monitored egress traffic. There is no residential proxy. I’m not on a VPN. If anything, services should be able to track me entirely by my home IP that doesn’t change that often.
My best guess is that I’ve committed the crime of not allowing third party cookies? Or maybe the crime of not being logged into a Google account 24/7. It’s not browser or device specific. My iPhone is just as likely to fail the cloudflare checkbox as my desktop with Firefox + uBlock.
I've committed the extreme crime of running no JS and clean cache of cookies.
Plus, something as simple as containerizing work/play/research reading, into different browsers, has provoked the Eye of Google to be cast on me
I haven't seen a YT ad in years while in lurk-only mode (no login), which is nice, but I also see cloudflare everywhere , which is not great.
One of the nicer things about LLMs, is that they arrived just in time to erase my dependency in search.
I have experienced the same with Google and with PayPal, whenever I used Tor. When I afterwards visited those sites using my normal browser I got Captchas. They are actively fighting attempts to avoid fingerprinting. Also, I am pretty sure that no browser protects against getting fingerprinted. Test with https://fingerprint.com/.
> they have always been about the tracking itself!
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
Point is that tracking isn't the only thing that's not "strictly necessary". And additionally that "strictly necessary" is tied to something specific: internet society service. That includes a very specific requirement: "Normally provided for remuneration". That's why e.g. public authorities should not (usually) be allowed to rely on it, public services are not often provided for remuneration in EU-law sense.
It also limits the exception in relation to e.g. employment.
> See, the thing is, it’s not about you at all. It’s not really about the ads anymore either. Nobody cares about you. And if the police or your government happen to care, I’ll gladly take their money too.
> I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.
> And to the highest bidder it goes!
> What does that make you then? A gear? An ox? A volunteer?
This does absolutely nothing for me. If this resonates with you, can you explain?
I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.
It’s a question of entropy. If your device is unusual in detectable ways, then the fingerprint has high entropy. But on my iPhone I suspect most of the things being fingerprinted are the same. How many other people get “smug koala”?
Couple different results than that across three refreshes on iOS w/iCloud Private Relay. Apple does work to do some randomization.
But at least the moment we start using websites the largest players will know it’s us. Nobody else swipes and types exactly like me on my screen size of iOS over the relay.
fingerprints pick up on all sorts of things that make you different enough combined with another signal, 33 bits can be enough to single you out from anyone else on the planet... iOS can be 10-15, and given a residential IP that's plenty - always mobile is more anonymous on the web but guess what's much worse? apps.
a native app with 0 permission prompts gets you more bits than web
No. Almost everybody using an iPhone is on the latest release, plus or minus one while updates are rolling out. For a given iOS release and hardware type almost all of those probes are highly correlated. No way there’s 30 bits of entropy in that. I doubt there’s even 10.
Now on a desktop PC sure I believe these fingerprints are highly descriptive. And in android land they probably work okay because of the diversity of products and configurations. But iPhones resist fingerprinting just because they all give the same answers.
Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.
For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.
The solution is explicit trust. Not fingerprints for users, but digital signatures for content. If it's not signed by somebody the user trusts, don't render it.
The user is the only one who can be trusted to approach that task without a conflict of interest.
The only winning move is not to play--er, to somehow not to have this kind of game in the first place.
Second, despite the dumpsterfire that Mozilla’s leadership has been in a decade or so, it is very robust with privacy and anti fingerprint features out of the box, the containers has also stabilised and works great.
Using Brave EFF reports that I have a randomized fingerprint.
Using Firefox or Edge EFF reports I have a unique fingerprint
See Fingerprint.com, despite Brave's protections you'll likely find it works reliably.
At {{job}} we did briefly consider rolling out fingerprint.com, but settled on ja3/ja4 at the CDN layer.
It does mean that sites that uses 2FA (so every site nowadays) flag me as a coming from a new device each visit, and I have to have my phone nearby every time I want to use my computer, which is quite annoying. If you use GrapheneOS, you can obfuscate your phone too on WiFi networks (and sites, but GrapheneOS not needed for that, just Brave). You can't obfuscate yourself on cellular networks though, unless you have a ton of sim cards you rotate through.
And phones!
So what sort of benefits are you reaping from your anti-fingerprinting measures?
Your only option is to never buy anything online and only pay cash.
I probably wouldn't go as far as never buying anything online, but paying cash IRL should be something done by everyone to protect their privacy. There are a few other easy things that can massively improve your privacy with minor or no inconvenience: Linux on every PC/laptop, GrapheneOS on phone(s), uBlock on every browser (or a DNS-level sanitizer), car without cellular modem (pull the fuse), non-Google and non-Apple email (ideally your own server or a small provider in a friendly jurisdiction). Also, don't use social media and text over Signal instead. Of course, TVs and other home appliances should be kept off the Internet. Overall, those are some very minor sacrifices for anyone with a little bit of maturity. It's very far from living off the grid or anything like that.
This is backwards. The antitrust concerns of removing 3rd party cookies led to them developing alternatives.
Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"
Don't you people remember how it was done back when web browsers didn't have cookies, or could be configured to reject or ask for each cookie? The server software automatically added a PHPSESSID parameter to every link, containing the session identifier.
Same thing the other way: no need to have a banner for a simple login cookie which isn't being used for privacy-invading tracking purposes.
I’ve checked my network. I’ve monitored egress traffic. There is no residential proxy. I’m not on a VPN. If anything, services should be able to track me entirely by my home IP that doesn’t change that often.
My best guess is that I’ve committed the crime of not allowing third party cookies? Or maybe the crime of not being logged into a Google account 24/7. It’s not browser or device specific. My iPhone is just as likely to fail the cloudflare checkbox as my desktop with Firefox + uBlock.
I haven't seen a YT ad in years while in lurk-only mode (no login), which is nice, but I also see cloudflare everywhere , which is not great.
One of the nicer things about LLMs, is that they arrived just in time to erase my dependency in search.
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
The thing the site is doing that isn’t “strictly necessary” is always tracking.
It also limits the exception in relation to e.g. employment.
The article's points still stand, but the trick didn't work this one time.
> I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.
> And to the highest bidder it goes!
> What does that make you then? A gear? An ox? A volunteer?
This does absolutely nothing for me. If this resonates with you, can you explain?
I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.
It's truly totally ok with me, yes.
(I get the non-anonymized concerns, or risk of becoming non-anonymized, that's not what I'm confused about)
But at least the moment we start using websites the largest players will know it’s us. Nobody else swipes and types exactly like me on my screen size of iOS over the relay.
a native app with 0 permission prompts gets you more bits than web
Now on a desktop PC sure I believe these fingerprints are highly descriptive. And in android land they probably work okay because of the diversity of products and configurations. But iPhones resist fingerprinting just because they all give the same answers.