this post was submitted on 18 Feb 2025

982 points (99.3% liked)

Technology

technology@lemmy.world

87,929 readers

15,933 active

3,861 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago

moderators

L3s@lemmy.world

enu@lemmy.world

technopagan@lemmy.world

L4s@lemmy.world

L3s@hackingne.ws

Digital Fingerprinting: Google launched a new era of tracking worse than cookie banners | Tuta (tuta.com)

submitted 2 years ago by misk@sopuli.xyz to c/technology@lemmy.world

230 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] drmoose@lemmy.world 74 points 2 years ago* (last edited 2 years ago) (6 children)

This has been the case for years. I develop fingerprinting services so AMA but it's basically a long lost battle and browser are beyond the point of saving without a major resolution taking place.

The only way to resist effective fingerprint is to disable Javascript in its entirity and use a shared connection pool like wireguard VPN or TOR. Period. Nothing else works.

hideshow 12 child comments

[–] Lifter@discuss.tchncs.de 17 points 2 years ago (2 children)

How can you live with yourself?

parent

hideshow 4 child comments

[–] drmoose@lemmy.world 21 points 2 years ago

I do it as a security measure for private institutions and everyone involved has signed contracts. It's not on the public web.

parent

[–] victorz@lemmy.world 6 points 2 years ago

I know right. I was offered a job at a betting site and online casino with those addictive games and shit. Gave that a hard pass, said no thanks, don't think that's the right business area for me. I would feel so dirty going to and coming from work every damn day.

parent

[–] spicehoarder@lemm.ee 15 points 2 years ago* (2 children)

Hello grease monkey and no script, my old friends

parent

hideshow 4 child comments

[–] markko@lemmy.world 6 points 2 years ago

What are some good scripts for grease monkey?

parent

[–] bestboyfriendintheworld@sh.itjust.works 5 points 2 years ago (1 child)

Wouldn’t selective disabling of JavaScript make fingerprinting easier? Your block and white list are likely to be unique.

parent

hideshow 2 child comments

[–] spicehoarder@lemm.ee 1 point 2 years ago

Tracking scripts are usually separate from the scripts that do stuff. But also giving them less info is always just better.

parent

[–] bestboyfriendintheworld@sh.itjust.works 10 points 2 years ago (2 children)

Disabling JavaScript entirely is another data point for fingerprinting. Only a tiny fraction of users do it.

Besides, without JavaScript most websites are not functional anymore. Those that are are likely not tracking you much in the first place.

parent

hideshow 4 child comments

[–] drmoose@lemmy.world 6 points 2 years ago

Yeah unfortunately disabling JS is not viable option tho onion websites are perfectly functional without JS and it just shows how unnecessarily JS had been expanded without regard for safety but theres no stopping the web.

parent

[–] unemployedclaquer@sopuli.xyz 3 points 2 years ago

I disable JS with noscript.net and it really is an enormous pain. It has some security advantages, like I don’t get ambushed so easily by an unfamiliar site and pop ups. I often will just skip a site if it seems too needy

parent

[–] hansolo@lemm.ee 7 points 2 years ago

This is what I've been saying for months in the reddit privacy sub and to people IRL. Some people seem perfectly happy to just block ads so they don't see the tracking. Literal ignorance is bliss. Most simply don't have time or wherewithal to do the minimal work it takes to enjoy relative "privacy" online.

FWIW, any VPN where you can switch locations should do the job since the exit node IPs ought to get re-used. My practice is to give BigG a vanilla treat because my spouse hasn't DeGoogled, and leave anything attached to our real names with location A. Then a whole second non-IRL-name set of accounts usually with location B with NoScript and Chameleon. Then anything else locations C, D, E, etc.

Ugh... This all sucks.

parent

[–] geography082@lemm.ee 5 points 2 years ago

What are you people trying to hide ???? /s

parent

[–] gcheliotis@lemmy.world 3 points 2 years ago (1 child)

So… how effective is it? The fingerprinting. I’m guessing there are studies? Also don’t know whether there’s been legal precedent, ie whether fingerprinting has been recognized as valid means of user identification in a court case.

parent

hideshow 2 child comments

[–] drmoose@lemmy.world 4 points 2 years ago* (1 child)

It's super effective but there are very few real use cases for it outside of security and ad tracking. For example you can't replace cookies with it because while good fingerprint is unique it can still be fragile (browser update etc.) which would cause data loss and require reauth.

Usually fingerprint plays a supporting role for example when you do those "click here" captchas that's actually just giving the browser time to fingerprint you and evaluate your trust to decide whether to give you a full captcha or let you through. So fingerprint is always there in tbe background these days tho mostly for security and ad tracking.

As for court cases and things like GDPR - the officials are still sleeping on this and obviously nobody wants to talk about it because it's super complex and really effective and effects soo many systems that are not ad tech.

parent

hideshow 2 child comments

[–] gcheliotis@lemmy.world 2 points 2 years ago (1 child)

Usually fingerprint plays a supporting role for example when you do those "click here" captchas that's actually just giving the browser time to fingerprint you and evaluate your trust to decide whether to give you a full captcha or let you through. So fingerprint is always there in tbe background these days tho mostly for security and ad tracking.

I’ve been wondering about those “click here” captchas and their purpose 🤔

parent

hideshow 2 child comments

[–] drmoose@lemmy.world 2 points 2 years ago (1 child)

Yes, and even before js fingerprint happens the connection is fingerprinted through HTTP and TLS protocol fingerprints as each system is slightly different like supporting different encryption ciphers, different http engine and how requests are performed etc.

So even before you see the page itself the server has a pretty good understanding of your client which determines whether you see this captcha box at all. That's why on public wifi and rare operating systems (like linux) and web browsers you almost always get these captcha verifications.

The more complex the web becomes the easier it is to gather this data and currently the web is very complex with no sight of stopping.

parent

hideshow 2 child comments

[–] gcheliotis@lemmy.world 2 points 2 years ago

Huh had no idea. I still wonder how accurate this is though, like whether it can be used forensically as the word “fingerprint” suggests to identify a specific person/private machine. It’s kind of fascinating as a topic. I would think that given that most people use similar setups, similar hardware and software, similar routers and settings, it would be impossible, but perhaps with enough details of a particular setup, a specific machine and user can be identified with decent accuracy.

parent