Fingerprints are the new cookies (royfish.dev)

696 pointsby royfisha day ago333 comments

alkonaut 13 hours ago

I still don't understand why the highest entropy APIs aren't gated behind browser consent.

A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?

Broad geographical targeting shouldn't be an issue. In fact, it's so easy that I think we should invent an ad-targeting API people can opt in to. If I could tell advertisers my geographic location, gender, age cohort, languages, and 3 interests, I'd not feel that's an invasion of privacy when they use that to deliver ads. I'd just get lawnmower ads instead of shampoo ads and that's fine.

The problem is, they don't want to use that kind of targeting. They want to target me with ads for a travel destination that my coworker mentioned in a Messenger message to another coworker five minutes ago. But we should just not accept that.

conductr 13 hours ago

That would be nice. However, It’s easy to see why it’s way more than simply what they want, they don’t really have a preference but it boils down to money. You’ll only replace your lawnmower every couple years and the rest of the time they’re guessing what you may buy next. By spying on your daily conversations and browsing, they have an idea of what you are likely to buy this week, next week, and the week after. This is so much more valuable to an advertiser.

alkonaut 12 hours ago

Exactly. And here's where regulators come in. What we need to do as a society is basically say "Unless you can make your ad-funded business work with this tiny bit of information, your ad-funded business should fail and shut down".

conductr 7 hours ago

Most of the ads are pushed via free services. Facebook, Google, as examples. These are entirely optional to consume. And I’m not sure people are really collectively willing to give up the trade they have yet (Data for free services).

I agree with you but really from a point of privacy and what/how data is allowed to be mined, shared, sold, etc. The implications to the business/ad industry are second order effects that are just collateral damage.

fc417fc802 12 hours ago

Well yeah, but there's also the part where I'm not okay loading ads from a third party because they eat my battery, add latency, and can potentially be used to spread malware. So there's the conflicting preferences regarding targeting that you mention but also conflicting preferences regarding how they are served.

alkonaut 12 hours ago

That could also be a preference. Do you allow third party ads to begin with? But then I'd understand if people would just block visitors that don't agree to them. I think paying via showing ads is fine. Paying with my integrity isn't.

account42 8 hours ago

The conflicting interest starts with the very idea of ads already. The entire point of ads is to manipulate you into doing things you wouldn't do otherwise.

fc417fc802 5 hours ago

I suppose that depends on the ad. I don't mind non-intrusive ads that are directly relevant to whatever I'm currently doing. What google currently does with product placement in AI responses is a good example. It's on topic, unobtrusive, and secure.

goodpoint 12 hours ago

Same reasons why browsers allow javascript on every site.

lopis 12 hours ago

That might sound good, but people already moan and groan about cookie notices. Imagine if each website that legitimately needs it would start asking for permission to each fingerprintable API. Although I do think we should have that option, just not as a default.

alkonaut 11 hours ago

You could accept things once per API and site. It doesn't feel that terrible. We do it for camera and clipboard already.

Panzerschrek 11 hours ago

> A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?

We should go further. A web-site with mostly static content should not use user-side scripting (Javascript) at all, it's unnecessary for it. It should be required only in rare cases where a site is basically an application and require manually turning it on each time such application is opened.

alkonaut 11 hours ago

I think that ship sailed and I'm pragmatic enough to accept it. The web is an application platform, not a web of hypertext content. That's not going to change, and I've given up on the idea to even try to "go back" there. If it worked, you'd just have half of websites be "sites" that work without JS, and half would be "apps" which would require switching on JS? The whole reaosn the web took off as it has is because we removed the distinction between "web app" and "web site". There's no putting that genie back in the bottle.

jcgl 11 hours ago

Sure, for the most static of static sites. But without JavaScript you can’t even do basic things client-side, such as having some variable-length list of fields in a form. Or customized field validation.

If such client-side behavior counts as “basically an application,” then “applications” is a larger set than seems useful.

account42 8 hours ago

Most sites also don't need forms at all either, at least for normal users.

usefulcat 6 hours ago

> A web-site with mostly static content should not use user-side scripting (Javascript) at all

Then sites that want to track will just add some JS. Seems unlikely to help.

rickdeckard 11 hours ago

> "I still don't understand why the highest entropy APIs aren't gated behind browser consent"

Because it's known that interrupting the user-intent with a unrelated consent-popup doesn't help.

Older people may remember that this was the approach of Java J2ME, where you couldn't provide a fluent user-experience as the user first had to answer huge popups about individual API-permissions with "Always Allow", "Allow now" etc.

alkonaut 11 hours ago

So long as it's once per API and site, it seems it doesn't need to be too bad?

If it's a site I trust, and I think it genuinely needs audio, I give it audio. If someone doesn't understand and just does allow all, they never see it again either (and their ads are suspiciously well targeted).

We already have these consent popups for camera and microphone. Reading back bytes from an audio buffer seems like such a rare thing to do that it hopefully just stops happening.

routerl 9 hours ago

It's less rare than you'd hope. Disclosure: I do developer relations at Friendly Captcha, and our widget is one of the scripts that uses generated offline audio (but with no microphone recording) and reads the buffer back on sites that otherwise have no use for audio.

We do this to check whether the browser is what it claims to be, not to track who you are. Similarly, font rendering, floating-point math results, WebGL renderer strings, and whether built-in functions are patched is all much harder to fake. These considerations determine how hard the proof-of-work puzzle should be, and site owners can see it as a risk score. We don't do cookies or browser storage, IPs aren't stored, and nothing gets used to recognize you on another site or on a later visit. The biggest players in automated traffic prevention can't (and usually don't) say this much, because of conflicts of interest between automated bot detection and their other products (e.g. ad sales and IP-profiling).

Your example is really fair though. I chatted with our engineers, prompted by this thread, and we found nothing in our detection that currently uses the audio hashes we collect, so we've started talking about removing the collection.

alkonaut 8 hours ago

I think "proof of humanity" is going to be an increasingly important thing, but I think we need to forego the age-verification and make some sort of zero-proof/integrity-preserving age/humanity verification.

fireflash38 10 hours ago

If it isn't an informed decision, it isn't really a decision at all. And the huge majority of people the huge majority of the time do not want to make an informed decision: they want what they came to the site for, news, games, family photos, etc.

You go to Facebook to see your cute nephew make spit bubbles. Do you care that they access your camera and canvas? What is a canvas? And sure access my camera, I want to upload photos!

It's fundamentally broken. They've studied the dark patterns, not to avoid them but to implement them best.

tyromaniac 6 hours ago

Absolutely. I spoke to an ex-Meta guy and his only answer to stuff like this was "actually its good for privacy because they don't want third parties to access your data since its valuable"

qurren 4 hours ago

Also, people not in tech do not generally understand the implication of consent popups.

For example, on multiple instances, my spouse declined "location permissions" an app designed to work with a piece of Bluetooth-connected hardware, and would blame the hardware as being crappy.

"This smart lock app doesn't work."

"You need to enable this permission."

"Why do I need to give the smart lock app location permissions?"

It's not obvious to people that "Bluetooth can be used sneakily by big-enough companies as a makeshift GPS" even if the app needing Bluetooth access doesn't actually need a GPS location.

floorsthelimit 2 hours ago

Your partner isn’t wrong. It’s a crappy product and crappy ecosystem when you have to be hyper precise.

IshKebab 5 hours ago

> I still don't understand why the highest entropy APIs aren't gated behind browser consent.

Last I checked it's because it was generally considered that preventing fingerprinting is practically impossible anyway. It's not like you need a lot of entropy for fingerprinting, and the web API surface is enormous. To actually stop fingerprinting you'd need to make your web browser more or less useless.

fg137 4 hours ago

The most used browser comes from the same company that runs the largest ad network.

It's the browser that introduced many of these APIs in the first place.

That should answer the question.

(If you ask me if a browser should report how many cores the machine has, including physical and logical ones, I would answer never, every time. But not everyone thinks that way. https://developer.mozilla.org/en-US/docs/Web/API/Navigator/h...)

qurren 4 hours ago

> I still don't understand why the highest entropy APIs aren't gated behind browser consent.

Simple answer: The makers of 3 largest browsers by market share (collectively 90%+) are buddies with the people who want to fingerprint you. Only the 4th largest gives a shit.

drnick1 19 hours ago

The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis.

samtheprogram 19 hours ago

If everyone else you know has JavaScript turned on, congrats, you're still fingerprinted.

autoexec 17 hours ago

If anyone else has JavaScript turned off you're fine (as long as you can account for all the other stuff like IP address).

cosmic_cheese 18 hours ago

The scope and amount of information that browsers hand over without the slightest shred of consent from the user or indication it’s happening is crazy.

cookiengineer 17 hours ago

Is it though?

Google's business model has been ads from the beginning. Search, gmail, drive, office, chrome, everything they do is just to drive ad revenue further.

They don't care about the user. Never have, and never will.

And the outcome we are seeing is what happens when a defunct state isn't able to protect citizens from conglomerates. That's what the Kartellamt or the FTC is supposed to be for.

robk 13 hours ago

Nope. At least until 2008 I cared and Larry and Sergey cared quite a bit.

cookiengineer 13 hours ago

> Nope. At least until 2008 I cared and Larry and Sergey cared quite a bit.

Not sure if I can't see this comment as anything else than hypocritical. It's always easier on the money receiving side, isn't it? How do you think the term malvertisement came to be?

AdMob is kind of the definition of inevitable Surveillance Capitalism and the prime example for necessary regulation through government.

catoc 12 hours ago

Yes, I believe they initially really meant it when making their “don’t be evil” statement.

The company as a whole also really stopped caring at some point and are now following the “do be evil” paradigm

jaapz 8 hours ago

So "never have" might not be true. But what about the rest of the comment?

gorgoiler 17 hours ago

And also without logging it. Even if I don’t want popups to give consent for every document.getEyeColor() call, it would be nice go back and see who’s doing which queries and/or have Firefox collect aggregate statistics. Naming and shaming the crooks won’t stop them but it might have an impact on curbing any bad behavior from big commercial retailers.

cosmic_cheese 16 hours ago

I like this idea a lot. It’s similar in principal to how macOS shames battery hog apps in its battery menu extra.

remus 13 hours ago

It's a UX trade off. For non-adversarial websites it's very convenient for users because things just work without having to go through loads of permissions pop ups for every website, but of course this then makes this info a juicy target if you're trying to fingerprint someone.

goodpoint 12 hours ago

It's not a tradeoff, it's poor design.

lopis 12 hours ago

But it is a design trade-off. The opposite case can be seem in the many websites asking to send you notifications, and the many flavours of cookie notices. When you have to ask the user permission to do anything and everything, the user gets annoyed and desensitized. They start allowing everything (my always collects dozens of notification-enabled websites if given the chance), and the point of asking for permission is lost.

remus 3 hours ago

> It's not a tradeoff, it's poor design.

How so? There seems a fairly inherent tension between having things just work by default and hiding surface area for fingerprinting behind permissions pop ups. For example say you go to a maps website, how do you decide whether to share the users location with the website? Or enable webGL functionality to render some fancy layout on the screen? As a user having to enable all that stuff per-website is annoying.

Maybe there's some other way Im missing?

brazukadev 12 hours ago

That's not a browser thing. Fingerprinting native apps is much easier.

cosmic_cheese 8 hours ago

Sure, but at least native apps can only do that if I download and install them. If I do that, I’ve made a conscious decision that the tradeoff is worth the utility of the app. This limits the blast radius considerably.

On the web one is drive-by fingerprinted by sites they never once approved of or intended to visit thanks to the browser’s ability to redirect and embed without input from the user. The magnitude of the problem is far greater on the web.

To reframe it, in a given week the average person only uses a small handful of apps, but in the same span of time their browser has connected to thousands, maybe tens of thousands, of unique domains, most of which are tracking them in some capacity and the majority of which are tracking things most of us would consider invasive.

bawolff 17 hours ago

> identifying hardware,

> language

I dont think js is needed for either of those things.

Vinnl 14 hours ago

Even without JS, there is timing, HTTP headers, conditional CSS, etc.

drooopy 13 hours ago

I can't help but keep thinking that client-side scripting was a mistake. Sure, the web would be a lot more primitive without it, but I'm not convinced that wouldn't be for the best.

brazukadev 12 hours ago

The alternative is to install a binary that has full access to the computer.

Dah00n 11 hours ago

Chrome is a binary. What's your point?

dns_snek 6 hours ago

I assume it's something like: choosing to forego the protection of a battle-tested sandbox in favor of rawdogging random binaries off the internet would be insane.

hilbert42 10 hours ago

My default is to run without JS and selectively enable it when absolutely necessary, so when I clicked on this story the page was prefaced with the following comment:

"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else.

From now on I’ll call you:…"

I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it. On rare occasions when I'm forced to use JS I'll cut-and-paste the URL into another browser.

I no longer use ad blockers as I just don't see ads with JS disabled. The other privacy precautions I take are the obvious ones such as no Google or social media accounts, flushing cookies at session's end, regularly randomize my IP and never let Chrome anywhere near my machines and make judicious use of multiple browsers (this is being written in Privacy Browser on Android).

Using NewPipe and sponsor block on PipePipe increases privacy and makes YouTube ad free.

Client-side scripting was a mistake which was obvious from the outset (or not severely limiting the reach of scripting engines).

What I find hard to understand is why alternative plugin JS engines haven't been developed that are under user control. Spoofing, randomizing and returning junk data to webservers would go a huge way towards stopping fingerprinting by websites.

archerx 10 hours ago

I used to believe in that and would make sure all of my sites would work without Javascript until one of my projects (a micro community) got targeted by pedotrolls which lead to an awful time and now I associate people who are staunch no JS as pedos, I am not accusing you or anything but that is the impression it left on me. Ever since then I really don't care if the site doesn't work without JS, and if users can post stuff damn straight Javascript will be involved.

Unfortunately this idealistic principle (no JS) attracts the worst people.

You're on Tor? You have JS disabled? I might as well warm up fbi.gov/investigate/cyber for the probable report I'll have to do...

hilbert42 8 hours ago

Well, I find your comment pretty offensive. In the past I've had some pretty rough and disparaging comments from JavaScript fanboys but yours has to be the worst. Associating disabling JS with pedos is about as low as it gets. Where did you get those stats from, or are they just a figment of your imagination?

"Unfortunately this idealistic principle (no JS) attracts the worst people."

Again, how did you come to that opinion? Where's your evidence/stats? Generally comments like that come from web/JS programmers who've realized that client-side users have them stymied when they disable JS.

An additional reason I avoid JS is speed, webpages become blinding fast when there's no JS. Once one gets addicted to the great rendering speed there's no return. I'm not against JS per se, trouble is you JS programmers have weaponised it against users, webpages of 7, 10 and even 20MB are now commonplace. Presenting such slow massive pages to users is nothing other than abuse.

I do not use Tor.

BTW, I should point out that my views about JS and privacy abuse were formed from my years working in govt. surveillance where the stakes are very high.

archerx 7 hours ago

I came to my opinion through experience, I’m sorry you’re offended but I did say that I don’t imply that you’re a pedo but my stats sure show a pattern.

That does not change what I have dealt with. I am not a “JavaScript fanboy” remember I made a community that could work WITHOUT needing JavaScript and that lead to a bunch of grief for me which made me understand the extreme naivety of that original idealistic idea on the internet.

gib444 7 hours ago

> I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it.

I guess you use the web in quite a limited manner? (Or use that other browser quite a lot...?).

I've tried no JS various times over the years and always end up constantly whitelisting sites. It's even worse in 2026 and gets worse each year.

Banking, insurance, webmail, groceries, eBay, CAPTCHAs... not to mention what feels like 50% of the web that is behind either Cloudflare or similar, which almost always require Javascript.

ishouldbework 12 hours ago

You can do plenty (like view port size) via just CSS.

IshKebab 5 hours ago

https://fingerprint.com/blog/disabling-javascript-wont-stop-...

qlte 4 hours ago

Great how this is currently the 2nd highest comment despite completely ignoring the numerous fingerprinting techniques based on CSS alone (including one of the most famous fingerprinting methods by testing font support). Simply thanks to reflexive "JS=bad" upvotes.

https://en.wikipedia.org/wiki/CSS_fingerprinting

bob1029 15 hours ago

> The request already reveals information about you; what browser you use, the language it’s in, the OS that runs it and your IP address, which the server needs to send you the response. That often reveals your location.

If we control the servers the clients are connecting to, I don't see how there could be much hope of hiding. We can spoof things like latency toward an upper bound, but we can never ever defeat the lower bound. Physics is still quite insistent about that one.

If we control multiple servers, we know where they are, and we can periodically compel our clients to rotate between them (see: DNS), we can engage in latency-based multilateration to put them on a real-world map. Depending on the number of servers and samples over time, this can be remarkably accurate. Determining someone's actual postal code just from network timing information is feasible.

VPNs obviously confound this in first order terms, but if we aren't careful they can make it even easier to identify our activity in other ways. We are trading concealment in the woods for concealment in a crowd. Both have their advantages and disadvantages. The VPN might also have a side channel that we aren't aware of.

https://www.usenix.org/legacy/event/nsdi07/tech/full_papers/...

thwgrw 13 hours ago

I think that's how ipinfo works: https://ipinfo.io/trace

helterskelter2 20 hours ago

I've seen anti-fingerprinting plugins and browser configs, etc, but they all seem to make you more interesting for not being fingerprintable, or for turning off a lot of features used in fingerprinting.

Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?

conception 20 hours ago

I think this is what canvas blocker does.

Telaneo 20 hours ago

Random is often going to be indirectly fingerprintable too, since some values are always the same (or the same given each browser version). Some values can't be set to be random or otherwise non-fingerprintable data without affecting the user, like viewport size.

Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.

Computer0 20 hours ago

Any idea how iOS’ private browsing impacts fingerprinting?

cush 19 hours ago

It doesn’t. Same there

yeahforsureman 9 hours ago

It can make a small difference on this site, though. Testing it with three browsers (Safari, Brave, Firefox Focus) on iOS with Private Browsing on, each gets a different name and hash — then again, those do stick to the browser pretty well after that and are resistant to incognito mode (or session switch by other means), for example, just like you’d expect. On Safari, Private Browsing masks the IP at least, and Brave has its own tricks.

Computer0 3 hours ago

I use private browsing and could not replicate your result, though I have done a few things on my device such as enable developer mode that the OS has warned me decreases my security.

ycombinatrix 20 hours ago

There are projects that do this already e.g. https://github.com/lwthiker/curl-impersonate

autoexec 17 hours ago

> Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard

It doesn't matter if it looks wrong as long as it looks differently wrong over time. Don't bother trying to blend in with the crowd because you can't ever expect to catch everything that can be used to fingerprint you. New techniques come out all the time. You can block a lot of information from even being collected. Limit what data you send at all, randomize what's left, change IP frequently (VPN) and you should be fine.

hobo123 17 hours ago

That's the thing, no web page, except for games, should ever need to know about your viewport size. So spoofing would be just fine, imho, with an override option/permission for individual sites.

edelbitter 20 hours ago

You can forcefully disable hardware acceleration, that removes a few bits - though javascript can still guesstimate your CPU and memory.

For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.

pkal 18 hours ago

IIRC that is what https://jshelter.org/ does.

DavideNL 17 hours ago

> "What JShelter configuration should I pick?

https://jshelter.org/faq/#what-jshelter-configuration-should... :

First, see our blog post. Consult also other blog posts and other questions in this FAQ.

If you want to have the same fingerprint as many users, We suggest going for Tor Browser (do not install JShelter in Tor Browser). If you want to make cross-site fingerprinting linkage hard, go for the Recommended JShelter level. If you want better protection for the real data at the cost of having the same fingerprint on different sites, go for the Strict JShelter level. Keep NBS active. If you want to detect and prevent fingerprinting attempts, use FPD.

aorth 16 hours ago

Thanks. I tried this on Firefox for Android and each time I close the browser and load the page my fingerprint ID is different. So it seems to work. Have you had any sites break with this extension installed?

pkal 6 hours ago

Yes, Anubis and other sites that really insist on abusing browser APIs breaks a lot of sites, but that is kind of the point.

autoexec 17 hours ago

> Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?

That's basically the ideal. It's become obvious that it's impossible to try to be identical. Web browsers are too leaky, and something will out you. You really don't want to try to blend in the "typical" users because none of them use ad blockers.

russdill 15 hours ago

This very often will trigger cloudflare protection.

avodonosov 11 hours ago

The reason is that the browser maker is interested to support tracking.

On the technical level there is no problem to block tracking - intriduce noise and make APIs unavailable until user permits to a web site. But that is not implemented.

The same with native applications. If your bank app requires you to share your location you can't spoof it. The makers of Android and iOS made spoofing of geo location impossible - you don't have that control, which means the phone is not your device. You have to give up your real location.

HughParry 3 hours ago

>Test your browser:

>coveryourtracks.eff.org shows you how unique your fingerprint is, with entropy for each measured data point.

Something to note - if a fingerprint is generic enough, that might be a _good_ thing!

Having worked with fingerprinting, anti-fingerprint browsers are very hard to properly identify. The ways to get around it are things like collecting more coarse fingerprints[0], as the overall one is fairly easy to change (e.g. make your browser lie about a collection of browser apis).

What's imo more difficult though is a fingerprint like:

- iPhone <new_version> - running os <latest_stable> - using default safari - bought and used in <common_location> (e.g. usa)

on a 5g mast in a decently sized city, you'll share a fingerprint with at least one other active user using a setup like ^

grapheneOS on the other hand stands out a bit more!

[0] - https://blog.castle.io/fingerprints-beyond-device-ids-engine...

olalonde an hour ago

Reddit definitely relies on this. I got banned from a subreddit ages ago (can't even remember which one), and ever since, any fresh account created from the same device gets shadowbanned almost immediately. Very annoying.

legitster 18 hours ago

Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.

Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes.

90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months).

What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.

meowface 18 hours ago

Overall correct, but you're kind of missing some of the cat-and-mouse details for fingerprinting centered around infosec and anti-fraud purposes rather than generic ad-related tracking. That stuff can get way more intense, and is constantly changing based on new techniques developed, countermeasures from cybercriminals, and mitigations from browser developers.

andai 17 hours ago

I think the idea here is that the details shouldn't be publicly known. (Or that if they were they would have to invent their details!)

j16sdiz 18 hours ago

IMO, data brokering is what should be illegal, not the cookie .

legitster 18 hours ago

The problem with this is the biggest, most important, and sketchiest data brokering services (credit monitoring) are all but entrenched in law at this point.

cortesoft 17 hours ago

How should credit reports work?

ryandrake 17 hours ago

How did lending work before nationwide mass surveillance of consumers and reporting on their activities?

pie_flavor 16 hours ago

It typically required more direct sources of trust. If you were a grocery store, you might let customers you personally knew to be good for it, run up a 'tab' and settle on payday. If you were a bank, you might only lend to rich high-class people. You can find this all around the world today; the US is a standout for credit scoring and for access to credit. When a British person wants to sell their house, it has to happen on the same day that the buyer sells their old house, and the house they're moving into to be sold, and so on in a big same-day daisy-chain, until you hit someone who has enough cash for initial outlay. In Japan, up until very recently, you could expect your boss to need to co-sign your apartment lease (and your landlord to immediately escalate any disagreements to your boss).

fmbb 16 hours ago

Sounds like a mess! How in that system will people get access to credit for things like buying fast food or books?

donandon 15 hours ago

Wow credit for fast food! What about toilet paper? The companies producing toilet paper can't just run a "tab" for their good customers

ffaccount2 13 hours ago

I can't tell if this is sarcasm, or do you honestly consider credit for fast food a good thing. I hesitate because I know that in America people buy everything with credit (or at least a lot), so it's possible some people think like that. But obviously not buying fast food with credit is a good thing?

master-lincoln 12 hours ago

they shouldn't

oarsinsync 15 hours ago

> It typically required more direct sources of trust. If you were a grocery store, you might let customers you personally knew to be good for it, run up a 'tab' and settle on payday. If you were a bank, you might only lend to rich high-class people.

You hit the nail on the head with the first statement. It required humans in the loop. It scaled linearly. Local branch managers had relationships with the people in their community, and knew who could and couldn't be trusted.

It was an imperfect system, where a human could be prejudiced against another human, and deny them access to credit.

Sometimes that would get discovered, and the human was held accountable for their actions, or had their actions upheld by a (org-chart-superior) human.

Similar to the imperfect system today, where the models a computer uses could be prejudiced against a human, and deny them access to credit. Dissimilar in that the model or the computer is rarely, if ever, held to account. "Computer says no" is a meme for a reason.

onion2k 16 hours ago

Poor people couldn't borrow and middle-class people paid really high interest rates. Credit ratings are pretty much what enabled the expansion of availability to everyone.

tonyedgecombe 17 hours ago

Why should they work. We used to think that money lenders were evil.

pie_flavor 17 hours ago

Yes, and then in the interim we invented having a hundred trillion dollars in GDP. I prefer having access to credit and so does everyone who owns a credit card. If you own a house, you didn't have its cash value when you bought it; neither your car, nor (most likely) your education. In the days of no borrowing, we solved the problem with ramshackle one-room buildings with dirt floors, handcarts, and the one book whose distributors desperately wanted everyone to have it for free.

deaux 16 hours ago

> I prefer having access to credit and so does everyone who owns a credit card.

A good number of European countries have only half the poverty rates - the dirt floors and carts you're talking about - of the US yet barely use credit cards.

ricksunny 16 hours ago

> If you own a house, you didn't have its cash value when you bought it;

> we solved the problem with ramshackle one-room buildings with dirt floors,

there is a fallacy here. People with access to debt bid up the price of an asset, like a house, against other peoples’ similar access to debt. Sans debt access, the solution was not necessarily a small ramshackle house. The fallacy is the belief that the same asset price - whether opulent or ramshackle house, wouldn’t adjust to the reduced level from the bidding environment. The differential cost of construction for a nicer house can be countenanced in the access-to-debt case, but that is second order.

Illustrative straw-man example: Suppose, once one had a parcel of land, that it was trivial to construct one’s ‘starter home’ the ramshackle house if you like. Get one’s family and friends to help build in exchange for future return favors. As one advances in life, rebuild to have something more opulent. The rub is in the parcel itself. Unlike the would-be house, it had no cost built-in, just whatever price the previous owner was willing to accept to release their parcel. That parcel’s (and those around it) price reflects the market’s access to debt, or lack of access to debt. In the market without access to debt, parcel pricing reflects which buyers have accrued more savings vs other buyers. In the market with access to debt, parcel pricing reflects who can access more debt (through the various means we know of today - down payment ability yes, which parallels the non-debt’s savings case, someone co-signing, long term expected future earning potential vs someone retired, the parcel itself put up as collateral, perhaps other non-immobile assets put up as collateral, like the family oxcart).

The point is that there isn’t necessarily a 1:1 coupling between market’s debt vs non-debt access and whether the construction is opulent vs ramshackle.

master-lincoln 12 hours ago

> If you own a house, you didn't have its cash value when you bought it; neither your car, nor (most likely) your education

When I grew up I was told to not make debts if not needed. So many older people did indeed save up until they could afford a car or a house. Education was always mostly free where I lived.

Nowadays it seems like ordinary people would need to pay off a house their whole life and thus also need to keep income high enough to keep paying installments. This takes away so much freedom from people as they are trapped in their high paying jobs...

josefx 2 hours ago

> Yes, and then in the interim we invented having a hundred trillion dollars in GDP.

And every now and then we have to rescue banks that are too big too fail at the cost of everyone else, because someone dreamed up a way to increase short term profits that involves giving loans to people who will never pay them back.

> neither your car,

Praising a trillion dollar GDP, but can't afford a used car.

gorgoiler 17 hours ago

You bring your own data to each credit check.

It feels onerous as an idea because bank statements, monthly bills, payslips, will bequests, stock vests and trades, bank robberies*, and investment income each have different ways of being tracked. At least most of these records of individual financial activity come with a PDF these days. It wasn’t that long ago that applying for a loan meant scanning in papers for your lender to review.

Computers are smarter now. Not only can they read documents (or at least match the shapes against shapes they’ve been told are real) but they can also understand the contents too (or at least match the words against ideas they’ve been told are real.)

There may well yet be a future Data Valhalla where individuals hold their life.zip themselves, and upload whatever bits of it are needed to get that Nordstrom store card / car financing / cheeseburger loan without having an intermediate credit agency.

*I feel there’s a kernel of a joke there about a bank robber asking for a receipt with the loot in anticipation of declaring it on their tax return.

Closi 15 hours ago

I don't see how this works in reality - The issue is that users wouldn't upload negative information (e.g. county court judgements or the bank robbery from your example).

Credit isn't like insurance where these things can be checked later during a claim (which can then be denied) - you need to know the person is a bad-payer before you send them the ten thousand dollar loan as that affects the terms, not afterwards when they default and you can't get your money back.

sksksk 14 hours ago

For CCJs and bank robberies, you'd upload a clean sheet from the government that gives a list of all CCJs and criminal convictions (in the UK we have a system called DBS for criminal records).

Potentially, with loans or other things, some kind of technical solution could work. You could have a personal document that you control, and you give permission for companies to write to the document.

With a loan, for example, if I give you a loan, I can also append to your document that I've loaned you the money; for every payment you make, I write to the log to say you've made a payment. If you stop making payments, I stop writing to the log. This would be cryptographically signed by me, so it can't be forged.

When you want to take out another loan, you can proactively share your document, the bank can see everything written on the log, and make a decision based on that.

gorgoiler 14 hours ago

Naively, credit is if you can pay, and if you will pay.

For the latter it’s whether you’ve had a judgment against you, which is a matter of public record.

For the former it’s based on how much money you have and what you spend, including on servicing existing debt. Lying about this would be fraud. In that sense, my proposal does indeed open up a new avenue for fraud but I don’t think that’s the same as it being unworkable!

mschuster91 11 hours ago

So what. Maybe it is corrosive to society to provide unsecured credit willynilly. Yes, it makes the banks giant amounts of money, but IMHO consumer credit should only be a thing for two classes of assets (that can be repo'd easy-ish) real estate and vehicles.

The Western governments have horribly failed of caring for their people - cost of living are exploding, and at the moment way too many people are papering over that with unsecured credits backed by their data being free to exploit, and everyone else not willing of doing that is increasingly locked out of existence.

wood_spirit 15 hours ago

The point of the credit agency is to work for the lender?

tancop 15 hours ago

You send them digitally signed statements from other lenders (who are legally required to give them for free with accurate info) or independent rating agencies, they evaluate them and make a decision. They can have their own model or license one from FICO.

That does mean banks can't know if you lie by omission and hide some unpaid bills, but they can raise the evidence requirements to compensate and I think everyone deserves a second chance.

Balinares 15 hours ago

Well, there are multiple approaches, but here's one that worked well for me: when I purchased a home in the country where I now live, and the mortgage lender asked for a credit report from the (high-privacy) country where I lived the longest, what they got was a letter from that country's central bank listing the penalties for requesting that information. Up to and including jail time.

Suddenly the credit report was no longer a prerequisite to the mortgage.

sdsd 14 hours ago

Wouldn't this make credit riskier for lenders, reducing access to credit in general and thus making housing less accessible especially to working people?

Not asking polemically, I just have never studied economics and wonder if my intuition here is flawed

vladms 12 hours ago

I think the actual trade-off is between average acceptable risk at society level.

Some societies prefer huge risks for huge benefits, in those one (might) need a more detailed credit reports because everything is faster, people accept huge risks and the situation can suddenly change.

Some societies prefer more stability. Lower risks, lower surprises. Less opportunities, everything is slower, people can't even take that many risks, simpler histories will do th trick.

From what I notice though, housing seems to be a problem in both types of societies, irrespective on how credits are given, because there are other things involved (regulation, NIMBY, housing used as value, airbnb, geography, etc).

sire-vc 11 hours ago

You are so full of BS it's scary. No credit report is a non-starter at any financial institution that wants to stay in business. They won't be giving you a loan unless they know you are wealthy e.g. own 17 investment properties already. 'High-privacy' countries is code for 'tax-haven', and 'my money in the Cayman Islands' means your bank is about to run afoul of AML and KYC laws if they give you a loan. And this is the whole world: doing business with America means adopting their financial posture i.e. penalties for doing business with money launderers.

eks391 an hour ago

That is rad. Is your high-privacy country friendly to immigrants? Asking for a friend...

But for real. You say you no longer live there, so I'm assuming you left for more opportunities. My wife and I are interested in countries with opportunities for engineers and privacy. Bonus points if there is engineering research opportunities.

mohamedkoubaa 6 hours ago

Having someone vouch for you.

MisterMunchkin 6 hours ago

I don't really know what you expect, people are obviously going to want to know your credit history when they're lending to you. If you can't tell what loans someone has, they could have opened a hundred different accounts and used the money in the casino.

elric 17 hours ago

It is illegal, if it's PII without explicit consent.

tribby 18 hours ago

on what basis do you believe this about fonts? my guess would be that the average user doesn’t install or remove fonts often if ever, but it’s only a guess

legitster 18 hours ago

I don't actually know how much this happens - software versioning is the biggest one. Chrome updates every two weeks, Microsoft updates once a month, your GPU drivers get updated semi regularly, etc. Any one of those would break the fingerprint.

autoexec 17 hours ago

Your IP changes way less often so that combined with everything else would be more than enough to track you through browser version changes. Even a new IP with the exact same everything else would be pretty easy to correlate too. It just depends on how much they're willing to track and companies are often willing to track a lot already, including things like how fast you type, what kind of movements your mouse makes, etc.

mahboi 18 hours ago

Most people probably have completely default fonts, right? Doesn't seem like much of an identifier anyway

autoexec 17 hours ago

Depending on the browser new fonts can be downloaded and installed automatically. I'd bet most people have a lot more than just the default fonts that came with their OS installed.

ranguna 15 hours ago

Automatically installed fonts don't give much of a signal if they are automatically installed on everyone's machines.

sejje 18 hours ago

Hmm. I used to have to do that a lot, but I haven't in a few years now.

root_axis 17 hours ago

Perhaps, but that would also mean the cardinality is lower.

Quothling 17 hours ago

One intereting part about installed fonts is that many enterprise companies buy specific fonts. Then they are rolled out to all their devices, and sometimes at least one of them will have the company name as part of it's name.

manlymuppet 17 hours ago

Is there any way to link this data over longer periods of time?

A lot of data can change over days, weeks, but if you can maintain an accurate fingerprint with tinier changes, and granted you have consistent visits from the user, could you just keep up?

Especially if one service is tapped into several websites, and can continually keep up with smaller data changes and distribute that info. Is this possible? In practice anywhere?

gbalduzzi 16 hours ago

I'm thinking that you just need one website where you can associate a given fingerprint to a specific user and then tracking its activity around the web becomes easy.

Let's say I'm logged in a famous search engine, they associate my fingerprint X to my account A. If they then encounter fingerprint X anywhere else, there is a good chance it was me, A, doing it. If the next day I get fingerprint Y, it gets attached to A as well and the tracking information follows it.

Does this make sense?

ssivark 15 hours ago

You mean, like a really popular web service or app that someone would log into every day/week/month...?

Even easier if, additionally, many of the smaller websites were syndicated into a tracking network?

mawadev 16 hours ago

I was thinking about the literal fingerprint sensor a device has. Imagine a "prove youre not a bot" challenge and the finger scanner pulls up. What a nightmare, reminds me when a website asked me if I want to login with windows hello (facescan)

adithyassekhar 14 hours ago

That is different though. That site is just creating a passkey and storing in your keychain (or windows equivalent). Windows hello unlocks the keychain. It can be your face, fingerprint, usb key, 4 digit pin anything. Chrome already uses this. You’re not sending your face to that website nor to microsoft, I hope.

mawadev 12 hours ago

Yes, very much. I just fear we may end up there at some point...

tete 15 hours ago

> Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.

Sorry, but that's simply not true. It's actually the default way of how people eg track people across installs in app stores ever since they started removing that feature.

ajsnigrutin 14 hours ago

On the other hand, browsers don't need to share all this data at all. Sure, IP address can't be hidden, but from your example, installed fonts and volume settings? Why should that be shared at all? Sure, for example for a teams meeting, but you'd have to allow the use of microphones or that, youtube for example doesn't need to know how loud you're listening to a video.

3RTB297 14 hours ago

18 months ago Google publicly stated they were going to start using browser fingerprint data to track users, a reversal of their 2019 policy on it because it was considered too invasive.

https://www.malwarebytes.com/blog/news/2025/02/google-now-al...

There's a fingerprint demo on github called JSCreep (https://abrahamjuliot.github.io/creepjs/) that used to keep your fingerprint profile for 90 days and show you how many times you visited. Worked extremely well, and is still around, but no longer uses the API to retain fingerprint data, so you have to track your hash yourself. It would easily track most browsers across changes in IP address. Only Mullvad, Brave, or Tor would not leave an easily tracked fingerprint.

The demo presented in the royfish.dev link is easily foiled by browser extensions that scramble fingerprint data, the presence of which would itself be detected by more sophisticated profilers and used to define the fingerprint. I can refresh the page and get a new hash and adjective-animal name with the same IP. JSCreep sticks firm to the same hash for me, even with a new IP address and some spoofed browser data.

klaussilveira 4 hours ago

This fingerprint breaks every 2 weeks when Chrome auto updates. Or any other modern browser.

latexr 9 hours ago

> Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days.

Indeed. I checked this website a few hours ago and got one fingerprint. Just rechecked and got another.

MiroslavPokorny a day ago

Theres only one solution, ban third party advertising. Everything else is a compromise that doesnt work anyway.

charcircuit 21 hours ago

Fingerprinting is still needing for preventing fraud and platform abuse like spam.

wyager 20 hours ago

It doesn't actually work for that

anthonyIPH 20 hours ago

I worked in fraud prevention for years and device fingerprinting didn't stop fraud, but it reduced it by upping the up the cost. It is not hard to circumvent fingerprinting, but it still takes a non-zero amount of effort on behalf of the fraudster. Device fingerprints helped us identify and block or prevent a lot of low effort fraud and abuse on various platforms.

etatester 17 hours ago

If it didn't, why do you think every captcha solution uses it? It doesn't have to be 100% effective to be useful.

Terr_ 20 hours ago

How do you tell the difference between a regular human trying to not have a weird creepy perma-dossier collected on them... versus a bot set up to always look like a new visitor?

The only winning move is not to play--er, to somehow not to have this kind of game in the first place.

vntok 14 hours ago

You don't, you simply make both spend a few billion cpu cycles for it. The human will tolerate the one-time cost. The bot's owner won't because it's not scalable.

pull_my_finger 19 hours ago

The problem isn't advertising, it's data harvesting and sale. Ads used to rent space on websites - totally reasonable. The whole industry around the purchase and sale of user data is what needs to be banned.

psychoslave 18 hours ago

That's one perspective. Other are in different perspectives, like "anything that present something else than the very topic looked for is pure propaganda."

The spectre of possible interpretations is wide.

Some see only problems everywhere whatever the benefits might be, some see only new opportunities no matter the tragic outcomes, some see various blend of this and that.

MiroslavPokorny 15 hours ago

Theres only one problem most what people call opportunities are not actually positive life experiences.

struant 18 hours ago

Advertising and paid promotion in any form has never been ok. It has always been a cancer on society. That is what happens when you ignore a mild symptom until it metastasizes into something horrible. We need to ban it completely.

autoexec 17 hours ago

You can never get rid of advertising entirely. Ultimately people want to learn about new products and services and new companies that couldn't ever advertise anywhere would die off. It makes sense to support limitations on how and where ads are used though. Banning surveillance capitalism would solve a lot of the problems we have and would mean that a website about cars can still show ads about things people who go to car websites would typically be interested in and that's pretty much the only level of targeting we need.

ryandrake 17 hours ago

> Ultimately people want to learn about new products and services

Maybe I'm just not a typical person, but I have never woken up in the morning and said to myself, "You know, I would just love for a corporation to help me learn about their new products and services today." Never. Not even once. When I want to learn about something, I will actively seek information out about it, and I'm not going to look to advertisements for impartial information. The purpose of advertising is never to inform. It's to bombard and saturate.

goodpoint 11 hours ago

You are 100% typical in this. Advertising is the opposite of informing.

MiroslavPokorny 16 hours ago

Nobody claims one can get rid of it entirely. Nothing in this world is black and white, there are always shades of gray.

We also cant get rid of cancer, it doesnt mean we shoudl close down all hospitals.

mordae 15 hours ago

> Ultimately people want to learn about new products and services

Yes, and those people are free to visit equivalent of mail order catalog or go to the store or subscribe to consumer goods quality testing journal or to any of the enthusiast magazines about electronics or gardening or whatever where they perform independent testing and benchmarking or look up a video comparing ceiling fans across a century when they feel hot in the summer.

So yes, we should absolutely ban third party advertisements. People will still be able to discover good products.

OroPla 12 hours ago

> Ultimately people want to learn about new products and services and new companies that couldn't ever advertise anywhere would die off.

I want to learn about products that are useful to me, but not through ads. As it turns out, it is incredibly difficult to learn about new products that are useful, as those do not tend to show up in ads at all and even seeking them out is very difficult.

It's weird how no one has come together to make a website specifically designed around users finding product categories that will make their life better. For example, I didn't learn about height adjustable desks from an ad. Nor did I learn about balance boards from an ad. Or trackballs. Or essentially every other product that made my life better once I realized that product category exists.

oenton 5 hours ago

> You can never get rid of advertising entirely.

What a myopic view. Also, the world is very much filled with shades of gray. I’m certain this dichotomy is indeed a false one.

psd1 13 hours ago

Much as i hate being advertised to, i do like the existence of trade, and of new products. In the old days, you would take your products to market once a week on a cart, and the market would pass by your stall. That isn't how it works any more.

Generally, how can society discover new products and services?

I would be open to having some kind of directory that i could browse at my own convenience, but that's ultimately going to devolve to paid placement.

rcMgD2BwE72F 12 hours ago

>Generally, how can society discover new products and services?

I'm surprised you can't imagine a society where the consumer would be the one recommending products and not the producer. Any entrepreneur can find one first consumer to test their new product. And that first consumer have access to a great communication network to recommend that products to their social network — it's called "the Internet". Social networks are a great platform for people to share interesting things to their friends, family, colleagues and also to people they don't actually know ("the Internet" can connect you to strangers). Such networks cost little to operate when the content is created by users, instead of producers and their intermediaries (people favors short, insightful written text instead of catchy commercial once detoxed).

Being born in the 1990s, I did experience that "Internet", when advertising networks didn't exist and when people intentionally interacted to make connections and actively look for information. They were happy to tell about things they discovered, with little to expect in return ("influencer", aka mercenary, wasn't a job yet).

MiroslavPokorny 16 hours ago

Consequences are deeper than the immediate cause. Advertising is at the heart that gives a lot of value to data harvesting and similar scams.

Data harvesting gains most of its value because they sell some or all data to businesses which wish to leverage that data in advertising. If they cant advertise they wont need most of the data, which should at the least reduce the problem significantly...

__MatrixMan__ 18 hours ago

How would you enforce that? Who can be trusted with the ability to classify things as advertising and in so doing silence their critics?

The solution is explicit trust. Not fingerprints for users, but digital signatures for content. If it's not signed by somebody the user trusts, don't render it.

The user is the only one who can be approach that task without a conflict of interest. If somebody wants the user to run code that phones home about user behavior, make them gain the user's trust.

MiroslavPokorny 16 hours ago

Many countries ban cigarette advertising. Not saying its perfect but has helped reduce smoking.

__MatrixMan__ an hour ago

That works if your ads have a physical location in space, like a billboard or a radio station, so that you have a place to go when you decide it's time to shut them down. You can't even get a stable URL for a web ad. Where are the cops gonna go? How many different "not my problem try this guy" hops are they gonna have to traverse before they find somebody who actually did the bad thing, how many different countries will they have to visit while they do so?

It only works if you re-architect the web into something that's even more censorship friendly than it currently is. I hate ads too, but the medicine seems worse than the disease in this case.

MiroslavPokorny 33 minutes ago

This is silly, you are dismissing a solution which improves a problem in a positive way.

Hospitals are not perfect, people die, with your l;ogic we should close down them all.

Doing nothing and keeping advertising keeps a negative situation alive.

fsflover 14 hours ago

Or ban all advertising, https://news.ycombinator.com/item?id=43595269

littlecranky67 14 hours ago

> Remember the big fuss about third-party cookies? It was so big that the EU had already rolled out one of its greatest inventions - consent banners.

It was never about cookies. Thats what the industry made you think. You don't need to show consent banners for cookies (like auth sessions). You need consent for tracking. This includes profiling. And it doesn't matter what you use, fingerprinting or tracking cookies, the consenst banner is required either way.

conorcleary 14 hours ago

The banners were for those other cookies, often for affiliate marketing and needed permission or at least the appearance of state order

eitau_1 12 hours ago

A 'cookie banner' I've came across recently (https://www.courthousenews.com/scotus-calls-for-redo-on-wash...) feels so bizarre yet arguably should be the standard.

> Global Privacy Control detected. Advertising cookies are turned OFF.

MarleTangible 12 hours ago

> Global Privacy Control detected. Advertising cookies are turned OFF.

Yes, I love this. My browser is already sending "do not track" requests.

catoc 12 hours ago

I’m sure the Meta’s and Google’s on this planet will all faithfully honor our “do not track” requests.

littlecranky67 11 hours ago

I'm sure if they had to by some EU directive, they would. Organizations that big can't conceal that, as they risk discovery findings and whistleblower activities.

jaapz 8 hours ago

Only when the punishment for not complying is a certain (ever increasing) % of their revenue. And it is actually enforced.

Cthulhu_ 11 hours ago

I'm getting a cookie popup floating thing myself with five options, "Accept all", "reject all", "cookie settings", "confirm my choices", and... "cookie settings" again.

itishappy 9 hours ago

Sounds like you don't have the global privacy control flag set. In Firefox there's a "tell websites not to share or sell my data" flag. In Chrome you need to install an extension (such as an adblocker).

louthy 12 hours ago

> the consenst banner is required either way.

Consent is required. The banner is just one mechanism, but not required. A website could hold off on all tracking until a suitable point in the usage of the site (like creating a profile, for example) and ask at that point.

The banner is an artefact of the hostile way most sites choose to try and hoodwink the user into being monetised and ultimately to piss users off so much that they complain about the legislation rather than the lack of online privacy.

stingraycharles 11 hours ago

And there was an initiative to include tracking preferences in browser HTTP headers, which never made it, as it was quite obvious that this would lead to a lot of people opting out.

Better to just harass them into a habit of dismissing the banner.

darkwi11ow 11 hours ago

Well DNT indeed did not made it, but there is global privacy control header that is nowadays required as explicit opt-out mechanism by CCPA and some other states legislation. I always implement support for GPC in my products.

stingraycharles 11 hours ago

Never seen this offered to be set by any browsers, though.

jsmailes 10 hours ago

Firefox offers it: https://support.mozilla.org/en-US/kb/global-privacy-control

They don't seem to call it GPC, but their "ask websites not to track" feature now uses it instead of GPC.

stingraycharles 9 hours ago

Yes ok, and Firefox was also the only browser that offered DNT, which is why it pretty much died.

weberer 9 hours ago

It died because companies had no incentive to respect it. The writers of the GDPR could have easily added a single line saying you had to respect the DNT header, but they chose not to.

flaburgan 8 hours ago

It's the complete opposite. What killed DNT is Microsoft adding it to their browser and set it to true by default, pretending they cared about their users. Doing so, it was not the expression of the users anymore and so web developers ignored it, and so it died.

FabHK 8 hours ago

Sorry, that does seem like a reasonable default. This is the fault of web developers to not respect it, not Microsoft. Nice cope.

hiccuphippo 7 hours ago

I wonder how many websites use that header as part of their fingerprint mechanism.

darkwi11ow 10 hours ago

It's set on by default in "privacy browsers" like Brave or Zen, but off by default in most mainstream ones -- user needs to set it on explicitly via about:config

busssard 9 hours ago

There is also https://killthecookiebanner.eu/

if you write to your reps, they might just change that. The Eu is one of the few democracies left. Slow but powered by the people

xingped 7 hours ago

I dunno man, from an outsider's perspective I used to think that but it seems to slowly be getting worse with trying to shove through internet surveillance and corporate protectionism under the guise of "protect the kids". I guess sadly someone saw how unreasonably effective that can be in the US.

johannes1234321 8 hours ago

When there is "legitimate purpose" there isn't reason to as soon items are put in the shopping cart this has to be tracked (be it session in url, cookie, local storage, ...) and no consent is needed.

The exact definition of "legitimate purpose" is unspecific (which is important to be able to adapt to development of new services) which leads to some lawyers being careful.

I also claim that some lobby groups promote having too many and too big consent banners to move blame from tracking companies to the EU ("stupid EU forcing all those banners!") in order to reverse the policy on tracking, which seems to have some effect.

eli 6 hours ago

Legitimate interest definition is pretty narrowly scoped. Most of the sneakiness relies on nobody checking or enforcing it.

buzer 5 hours ago

You are confusing GDPR and ePD. Legitimate interest is GDPR legal basis for processing personal data (it has it's own requirements). ePD triggers when you read/store e.g. browser data and make it available via network. Consent is the primary ePD legal basis and the exception related to that is much narrower (strictly necessary for ISS provider to provide service requested by user).

Generally speaking JS code that makes request to server is covered by ePD while actually processing that request server side is covered by GDPR (there are some nuances to this).

SilasX 3 hours ago

I know it's tempting to put this consent-banner anti-pattern all on toxic ad-driven platforms, because their motives are bad.

The problem with this view, though, is that even the very agencies propagating these rules do the exact same thing! You can go to any site from an EU arm and get the same banners.

At this point, you can't really blame it on bad-faith actors, you have to accept that it's a bad rule. Which is not to say I know a better one!

Havoc 12 hours ago

Yeah it’s absolutely how effective the industry psyop against that was

Or alternatively how weak the EU messaging was I guess

ligne 5 hours ago

it's hard to make yourself heard when your opponents have trillions of dollars hinging on you not being heard and also control the biggest communication channels.

elohimus 11 hours ago

I feel it's worth distinguishing between the Hacker News Audience that is highly tech-educated and security-conscious and the general public that just wants to use the web and seems more than happy to give all their data to Meta, Google & Co.

If you ask my 70-year-old mom to decide whether she'd like to allow the WebGL API, she'll go bonkers. If anything, the constant cookie banners have just trained her to consent to stuff out of muscle memory. You could probably design a "Are you ok to sign over the deed to your house" question in the rough shape of a cookie banner and get 90%+ agreement.

littlecranky67 11 hours ago

My favorite cookie banner is on arstechnica.com:

> We Care About Your Privacy

> We, and our 228 partners use cookies and similar methods to recognize visitors [...]

228 partners should make anybody concious about the fact that something is wrong and you probably should not consent to that at all. Also, nobody cares about your privacy when they think sharing data with 228 parties is okay.

mnw21cam 8 hours ago

The typical wording is "We value your privacy". Which just means they think it's valuable and want a part of that pie thank you very much.

drummojg 6 hours ago

I like that! "We value your privacy. At about $.0003 per data point."

code_duck 8 hours ago

I've seen some sites, mainly in the video game field, that have even higher numbers such as 750. Do I want to share my info with your 750 partners? Um, no. Typically I just leave the site.

fennecfoxy 9 hours ago

I've never seen a consent banner for being fingerprinted even though I'm sure companies are fingering my prints in the background enough that my colon could become a national database.

dolia 9 hours ago

And then you open the details mentioned in those cookie banners and see literally 600, 700 entities that get data about you shared by the website.

Malicious compliance is not the law-maker's fault.

IgorPartola 8 hours ago

Is too. They could have thought through the law they were writing and predicted malicious compliance. Or written a stronger law. Or revised the law when they spotted malicious compliance.

dcminter 8 hours ago

It's not even compliance. You're required to make consent and decline require equal effort. A large percentage of them make it much easier to consent.

Not to mention the large number of "legitimate interest" exceptions that are absolutely not justifiable.

The main problem with the legislation is its lack of teeth and enforcement.

kittomic 6 hours ago

I don’t understand why that’s considered legal under GDPR. How can consent be express and informed when it would take 30 minutes just to identify each entity your data is being shared with?

In fact the law even specifies “no pre-ticked boxes” but every banner always has “accept all”. And it’s 50/50 to see “reject all” even though it is a requirement that denying must be as easy as accepting.

They should pay a bounty for reporting non-compliance.

vkou 6 hours ago

> In fact the law even specifies “no pre-ticked boxes” but every banner always has “accept all”.

That's not entirely true. Websites that don't actively try to fuck over their users (because their purpose is not shoving third party ads at you, it's providing information about/a platform for their company's product) often provide a modal with two buttons:

'Accept' 'Decline'.

This, IMO, meets both the letter and the spirit of the law. The funny thing is, for any website actually doing that, if you click 'Accept', your data will likely only be used to improve it.

beached_whale 7 hours ago

Consent banners are generally malicious compliance and designed to annoy.

unilynx 6 hours ago

The EU/banner situation keeps confusing people because there are two different laws in play:

1) ePrivacy. the OG banner law. requires you to inform the user (but not consent, as I understand it) if you store data on a user's device. includes cookies, localStorage, indexedDB, etc. does not affect fingerprinting 2) gdpr. requires you to ask consent for any kind of user data processing, unless you can find another legal basis

eprivacy was about cookies, but forgot fingerprinting. gdpr was not specifically about cookies. but gdpr (or at least its past interpretation by the dutch privacy authority) didn't require consent for limited first party analytics.

which led to situations where you'd get the impression that you wouldn't need a banner for first party tracking using cookies .. well the gdpr didn't require it, but the older ePrivacy rules still did.

we still have the digital omnibus law package coming up which is supposed to simplify and resolve the overlap between the two above, and reduce banner requirements at least for SMB just analyzing their website visitors

eli 6 hours ago

That would be pretty narrow analytics to not need GDPR consent. No IP addresses or any way to uniquely identify a person.

buzer 4 hours ago

> does not affect fingerprinting

It does. The current version says "storing of information, or the gaining of access to information already stored, in the terminal equipment". Reading e.g. navigator.userAgent is information already stored in the terminal equipment. If you then use that in any way that gets communicated to remote server (e.g. directly or calculating some fingerprint) you read that information in manner ePD describes.

The directive itself has been transposed incorrectly in many jurisdictions. For example from what I understand the Dutch law added an exception (roughly "for obtaining information about the quality or effectiveness of a supplied information-society service, provided this has no or only minor consequences for the user's privacy.") which is not permitted under ePD. ePD exception list is exhaustive and the only other exception can be done via Article 15. The exceptions done via that are related to things like national security and certain criminal prevention/investigation.

Of course that then raises the issue on how you get invalid exception invalidated. I don't know Dutch procedural law well enough to answer that.

nign 3 hours ago

Doing this on GrapheneOS's built in Vanadium browser, I am concerned to see that the ID remains the same if I move to incognito tabs, or even a private space. Or perhaps Vanadium is doing such a magnificent job of reporting generic info that this ID would be the same for anyone using Vanadium on my model of Pixel, but I don't think so, since the site says it has a "clean read" on all the info it takes. I really do not know. Curious what other Graphene/Vanadium users are seeing.

boomlinde 10 hours ago

My understanding of the EU "cookie law" is that it really concerns a broader category of tracking devices rather than cookies specifically. Referring specifically to cookies is probably a side effect of the way tracking was typically implemented at the time.

aenis 17 hours ago

The fingerprints don't need to be long-time-stable to be harmful. Some companies have your stable datapoints (e.g., email) and your fingerprint. Other companies only have your fingerprint on the same day/week. Some companies have locations of edge devices and the fingerprints. And there are companies out there that will take all of those data streams, both from above board and not-so-above-board players and mix them for commercial benefit.

brainwad 10 hours ago

Per coveryourtracks.eff.org, just my HTTP headers leak 18.46 bits of information, which seems to be the most the tool can report? Presumably most of that entropy comes from my language settings (en-AU,en;q=0.9,de-CH;q=0.8,de;q=0.7), so the only way to be not fingerprintable is to give up on smart localisation.

If people have a problem with fingerprinting, they need to focus on making it illegal to trade data tied to fingerprints, not trying to make users all look the same (we aren't!).

boomlinde 10 hours ago

RFC 3282 allows for the exclusion of the quality value, in which case the languages are just given in priority order. Removing that will shave some entropy off.

I have a hard time figuring out why quality values are even included for Accept-Language. They either have one of the preferred values, or they don't.

brainwad 6 hours ago

The quality values here seem pretty generically tied to the order, so shaving them off probably wouldn't help? I presume they are there at all to let you express ties?

boomlinde 5 hours ago

It seems so, but I don't know that all browsers map quality values to order of preference in the same way.

I don't know about expressing ties. If there really is a tie and the client is just as happy to receive either language of equal Q, then it doesn't matter to the client that one is consistently preferred over another. Perhaps it could matter to the server if e.g. the client indicated that "en" and "zh" are tied, but the "en" content can be served in fewer bytes than it can serve the "zh" content, but it seems like such a niche use case.

edit: RFC 9110 offers an explanation: "Note that some recipients treat the order in which language tags are listed as an indication of descending priority, particularly for tags that are assigned equal quality values (no value is the same as q=1). However, this behavior cannot be relied upon. For consistency and to maximize interoperability, many user agents assign each language tag a unique quality value while also listing them in order of decreasing quality."

brainwad 2 hours ago

re: ties, often a page has "main" language(s) with more content, and translated version with just the basics. If you speak both you probably want the former. Actually for me often I need to go to the German version of a site rather than English to get what I'm looking for, contra my stated preferences... Localisation is a mess.

boomlinde 28 minutes ago

That's a good point. I suppose that the quality of the translation could also be a factor. If for example I only slightly prefer my native language over English, the website could (theoretically) spare me the poorly machine translated page in my native language over the original page in English. Multiply the client's quality assessment of the relative degradation in quality given language options with the server's quality assessment of the localizations on offer and serve the content with the highest score.

Fun anecdote: I remember seeing a screenshot of a website selling a scented candle called "basic bitch", which was machine translated so that the idiomatic meaning was entirely lost. So the translation ended up meaning something like "foundational female dog".

paulnpace 9 hours ago

Apparently, I have to enable JavaScript to receive a rating.

elevation 7 hours ago

How could this information be surfaced in a reasonable way in administration software?

Say I have a remote employee who is only able to access your internal systems via his yubikey. His fingerprint is "Genuine Antelope".

Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him. I create a new session for him on the provisioning portal (so he can enroll the new key) but now his fingerprint is "Interesting Elephant". What do I do with this information?

It might be better to log the exact forensics and show the administrator the differences, e.g, "User has a new font called "my_handwriting.ttf" since a week ago", or "appears to be a totally different processor, and the new system has Russian fonts installed".

dns_snek 6 hours ago

> Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him

They should be authorized ahead of time.

> What do I do with this information?

Not much. You can't authenticate a person using their (public) fingerprint information.

Your problem boils down to: "How can I verify someone's identity over the internet". You can exchange emergency recovery codes ahead of time (e.g. in an envelope), you could trust public keys from both of their yubikeys, but they can be stolen.

elevation 5 hours ago

> You can't authenticate a person using their (public) fingerprint information.

Yes, but it's a signal! There's a cost to spoof it. A scammer could cheaply start a VM that clones your font profile, but at what cost could they replicate your CPU SKU and GPU combination to provide identical webGL timings?

Other signals include the ability of your employee to show their face on a video call, to sound like themselves on a voice call, the ability contact you from their home IP, to receive official mail at their listed address, to produce a second 2FA token you'd previously registered (but not activated) or repeat a code word you'd exchanged. Any of these things can be spoofed, bypassed, copied, or burgled, but each one imposes some cost on the attacker.

The question is how to surface this information in a way that equips help desk staff and doesn't deceive them into authorizing unnecessary risks.

victor_pudeyev 7 hours ago

Fingerprinting is a way to track you. Cookies is a way for you to keep your own configuration (a panel inside an app open or closed, theme choice, pre-filled calendar, etc). They are completely different.

prepend 7 hours ago

Cookies are also used to track you. And I’d guess way more cookies are for tracking than personalization.

royfish 5 hours ago

"Cookies are a way to track you. Fingerprinting is a way to detect fraud. They are completely different."

1vuio0pswjnm7 2 hours ago

"Fingerprints are new cookies"

What if "fingerprints" are contained in the values of Cookie: headers

1a527dd5 a day ago

My reaction to this is always two fold; firstly cool tech, secondly horrifying invasion of privacy.

At {{job}} we did briefly consider rolling out fingerprint.com, but settled on ja3/ja4 at the CDN layer.

Cider9986 a day ago

Fingerprinting is really bad for privacy and the defenses against it are not there. See https://fingerprint.com. Tor Browser defeats it but I don't think there's a highly usable browser like Brave you can use and prevent being tracked by it.

eks391 21 hours ago

I've been obfuscating my fingerprint with Brave for years, which I selected specifically because it was the browser I was able to do this with, based on my testing of 5 popular browsers, using https://coveryourtracks.eff.org/ as my benchmark.

It does mean that sites that uses 2FA (so every site nowadays) flag me as a coming from a new device each visit, and I have to have my phone nearby every time I want to use my computer, which is quite annoying. If you use GrapheneOS, you can obfuscate your phone too on WiFi networks (and sites, but GrapheneOS not needed for that, just Brave). You can't obfuscate yourself on cellular networks though, unless you have a ton of sim cards you rotate through.

Cider9986 21 hours ago

> unless you have a ton of sim cards you rotate through

And phones!

ButlerianJihad 20 hours ago

For years, I've been practicing good privacy-hygiene in public. At my doctor's office, I always wear a Groucho Marx moustache to keep them guessing. Before I walk into my bank for a withdrawal, I team up with two of my friends, set them on my shoulders, and throw a trenchcoat over us! I made a fake ID with my birthday on July 4th and my weight as 98 pounds, but my pharmacy is now refusing to fill my prescriptions!

So what sort of benefits are you reaping from your anti-fingerprinting measures?

what 19 hours ago

It’s really kind of pointless. They fingerprint you to target ads and that’s it. The valuable data that’s collected and sold can’t be hidden through fingerprint avoidance: anything you actually pay for. Sure there’s privacy cards, but the second you purchase a physical product you have to give up a delivery address and now they’ll just correlate all your disposable emails and privacy cards and whatever else.

Your only option is to never buy anything online and only pay cash.

drnick1 19 hours ago

> Your only option is to never buy anything online and only pay cash.

I probably wouldn't go as far as never buying anything online, but paying cash IRL should be something done by everyone to protect their privacy. There are a few other easy things that can massively improve your privacy with minor or no inconvenience: Linux on every PC/laptop, GrapheneOS on phone(s), uBlock on every browser (or a DNS-level sanitizer), car without cellular modem (pull the fuse), non-Google and non-Apple email (ideally your own server or a small provider in a friendly jurisdiction). Also, don't use social media and text over Signal instead. Of course, TVs and other home appliances should be kept off the Internet. Overall, those are some very minor sacrifices for anyone with a little bit of maturity. It's very far from living off the grid or anything like that.

autoexec 17 hours ago

> It’s really kind of pointless. They fingerprint you to target ads and that’s it.

That's a very early 2000s view of the issue. Ads are not what all the surveillance is for, it's just the publicly acceptable excuse for tracking you that companies love to use because nobody cares which ad they get shown. Being able to build a profile of which websites you visit can provide a ton of information about you and that data is increasingly being used offline. It stopped being about ads ages ago and now what you do online can impact your next job offer, what prices you pay, which policies companies apply to you, etc.

You can never limit all data collection. Going to the store and paying in cash will still have you tracked by Flock cameras. The point is just to limit what you can, where you can. Every scrap of data collected about you is going to eventually be used against you later by somebody. No point in giving them anymore ammo than you have to.

radical_halogen 13 hours ago

Well you can buy prepaid cards with monero on xmrbazaar if you want

autoexec 17 hours ago

> So what sort of benefits are you reaping from your anti-fingerprinting measures?

A better question would be how are you being screwed over if you never bother to try to stop companies from collecting as much data as they possibly can about your private life? It can cost you a job offer, or cause you to pay more than your neighbor for the same products/services. It can get your data leaked, or sold to scammers. Companies use the data they collect on you for things as trivial as deciding how long to you leave you on hold. The more data they have on you, the easier it becomes for them to use it against you.

Feel free to give companies every bit of personal data they want from you. They'll be thrilled to use that information at any time and in any way they think it will benefit them. Until we have laws against surveillance capitalism the only person looking out for your interests is you, but only if you can be bothered. It'll sure help companies take advantage of you if you decide it's not worth trying.

ButlerianJihad 14 hours ago

Yeah, you know what? Life is far too short to live in fear and paranoia of the scenarios you suggest.

Anywhere I go in meatspace, people could be collecting data about me and my behavior. That has always been true since the beginning of time. An old lady can sit on her porch and take notes about my outfit, my comings and goings, and every driver who comes to my door. Today, they're saying that Target can definitely hear our WiFi/BT MACs as soon as we get into their store, and they see/track everything on camera everywhere inside. My Groucho Marx isn't going to hinder or change that!

All I can do, honestly, is be judicious about what sites I visit, and be forthright in my interactions. I should cultivate good relationships with trustworthy, reputable companies, and stay away from the rest. I cannot ultimately prevent the buying and selling behind the scenes. We cannot realistically prevent collection of everything possible.

I don't shop at Temu or Alibaba, and I don't search on Yandex. I checked my "About Me" on Amazon yesterday and it's shockingly bland and shallow. However I interact with Google, YouTube, Microsoft, and Cloudflare, it's a foregone conclusion that they know everything. My extensive 19-year history on Wikimedia projects is a shockingly rich treasure trove, if anything just my waking hours of every day since 2007! Your own karma score 22,495 in 14 years is probably a fantastic track record of when you were awake and using a computer. If you're so paranoid about Internet privacy, then you wouldn't be so willingly revealing that stuff in public.

I'm using adblocking DNS again, but awhile ago I sort of dropped the pretense of paranoia, because I understood its futility, and again, life's too short. If evil corpos want to do evil to me based on what they think they know, they can do their worst. I am a Christian man accustomed to suffering and infirmity. I got nothing to lose in this life, except integrity.

Dezvous 8 hours ago

> I cannot ultimately prevent the buying and selling behind the scenes. We cannot realistically prevent collection of everything possible.

Yeah, but you can very easily _limit_ what is collected and sold behind the scenes just buy switching browsers, changing browser settings, or using a couple privacy extensions. A little goes a long way.

eks391 an hour ago

Your wit mad my day even though we probably won't agree. I appreciate your humor.

> So what sort of benefits are you reaping from your anti-fingerprinting measures?

Mostly pride on knowing that I'm preventing companies from doing to me exactly what I wouldn't consent to if they asked me outright.

Sure its just for ads (mostly). Sure the chances of my data leak leading to a personalized cyber attack are slim (I don't actually believe this but you might). Sure, [niche scenario] [non-zero probability] might be prevented. Sure there is a meatspace equivalent to the cyberspace invasion of privacy.

I wouldn't consent to stalking in meatspace, for any reason, and conveniently to my knowledge no one is stalking me physically. I dont consent to stalking in cyber space either, for any reason, and I do know that companies do, and they make it an unending uphill battle to let them know and force them to not be blatantly disrespectful. So I will make it as hard as possible, within what I think is reasonable, to make it useless or difficult for them to stalk me online.

And yes, online things have affected my physical life, so these niche applications have occurred to me and my efforts have reduced the negative impacts, to a satisfactory level, and I will continue to kick against the pricks, because it works.

majorchord 2 hours ago

IMO The EFF test is very flawed because it only tests your uniqueness among the other visitors to that site, not the total possible uniqueness from all the bits of data.

I would bet money that Brave cannot defeat CreepJS. The only thing I've ever seen do it, ironically, is Safari in private mode.

Also just using your computer normally and visiting regular websites already tracks you regardless of your browser's privacy abilities, and I promise data brokers don't care what browser you use, your overall online behavior is still unique.

eks391 2 hours ago

I accept the challenge. What testing did you do to ensure that you were able to defeat CreepJS on Safari private mode? I would like to replicate it and then see if I can do the same on Brave or another browser.

snazz 19 hours ago

Wow, that is a seriously impressive demo. I wonder how it’s able to distinguish people using identical hardware and software versions (e.g., iPhones on the same iOS version). It was able to correlate my sessions across multiple independent ISPs, with a VPN, and with Apple’s extra tracking resistance in private mode.

ranger_danger 18 hours ago

> Wow, that is a seriously impressive demo

https://abrahamjuliot.github.io/creepjs/

sridevisridevi2 8 hours ago

These fingerprints now track us much more effectively than ever, not just for security but for real ad tracking and data selling. Instead of using cookies that are mostly vulnerable to ad blockers and other content blockers, these fingerprints can track us more precisely and can easily bypass our current data security systems like ad blockers. So I think the demand for sophisticated anti-detect browsers and proxy-level tracking prevention will increase. Hmm, let's see what will happen.

exceptione 11 hours ago

The solution has to come from law. I propose we handle privacy invasion the same as rape. Body and mind aren't up for grabs. That the average internet user is unconscious isn't a valid excuse.

It would be great if a wave of lawmaking started in the USA, because most tech behemots operate from there. I would expect EU to take the lead though IF such a wave would start. The EU has still a fair share of christian/conservative MP's that keeps doing the bidding for companies by pushing chat control, but on the other hand also has some progressive and knowledgeable representatives doing great work, so there might be a glimmer of hope. We need media campaigns and public education though. Political leaders are selected for their political abilities and as such rarely have leadership qualities. If the electorate moves, the leaders will follow it. So we have to start at the bottom.

phantomathkg 11 hours ago

I like your idea, but as a pessimist, I believe the ship has sailed, all government are craving on monitoring their citizens' move. If there are way for the government to fingerprint their citizen digitally, they will want to do it instead of protect us.

bradley13 6 hours ago

It is offensive that browsers give away so much unnecessary info. What is necessary? Language preference, Javascript (yes/no), screen resolution. Optionally, latest supported html/css versions. That it, nothing else.

I understand Google having Chrome send way more info. Why do all other browsers go along with this?

Make it make sense...

zkmon 5 hours ago

Why can't a government simply ban all advertising and instead provide a good enough yellow pages service that just provides the specs of the product in a templated way?

Why would it be a good idea to expose unsuspecting citizens to false claims by the sellers?

davidjade 21 hours ago

Huh, it is different for me on every page refresh. No VPN, etc... just Firefox on Windows with uBlock, CanvasBlocker, and a PiHole. No persistent fingerprint for me!

felixfurtak 20 hours ago

firefox, ublock and canvasblocker seems to be enough for me. New identity every refresh

nomilk 17 hours ago

I wonder if a browser extension could be made that inspects your fingerprint and informs you if you're too unique, then one-click to 'correct' those unique items (or at least list them), so you can conveniently go back to being ~anonymous if preferred.

absqueued 10 hours ago

If you use Firefox, do the following: Use the extension Chameleon (set it to rotate Random profile every minute), had strict mode with JShelter extension.

This royfish blog example, or anyother, including that fingerprint.com gets new value everytime.