you are viewing a single comment's thread
view the rest of the comments
[–] 37 points 2 weeks ago (2 children)

What it got right,

  • My OS. It's in the user agent header, which I hate.
  • I read the page methodically at a human reading pace.
  • I am using a VPN.

What it got wrong,

  • Location.
  • Screen res.
  • Num of CPU cores.

It's good for ppl to think about fingeprinting. So demo pages like this are good. But I'm sure the identity resolution industry is MUCH better at it. They have capabilities like TLS fingerprinting, outside the browser. For most ppl, not the privacy crowd so mcuh but normal ppl, they fingerprint resource fetches to diff geographic servers. They can run 100's of scripts on a single page from every identity broker. They employ the best data scientists, to figure out every possible way.

I'm pretty careful. More than 99.999% will ever do. Can commercial fingerprinters still ID me? IDK. But like Skywalker, I have a bad feeling about it.

  • source
  • hideshow 4 child comments
  • [–] 5 points 2 weeks ago (2 children)

    They can run 100’s of scripts on a single page from every identity broker. They employ the best data scientists, to figure out every possible way.

    The impact of this is probably greatly reduced by anti-JS measures like NoScript. Some sites probably still bundle fingerprinting code into their own scripts, but the really big players contract that out to companies whose entire purpose is data-harvesting, and that's easily defeated by denying scripts from outside domains

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 2 weeks ago (1 child)

    the really big players contract that out to companies whose entire purpose is data-harvesting

    For sure, blocking those scripts goes a LONG way. But that'll only work until lots of ppl do it. If it ever catches on big, the Identity Brokers will adapt. They'll integrate their shit into sites in ways that are hard or impossible to separate this easily without totally breaking the site you were trying to visit.

    IDK for sure, but I fear we could be living on borrowed time.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 week ago (1 child)

    I liked the idea of noscript but, it just wasn't practical to adjust it to every site which scripts should run and which shouldn't

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 week ago

    Yeah, it definitely makes browsing a lot more hands-on, and the lack of cross-device syncing means that you're constantly duplicating work. There's probably a way to export settings and diff/patch and sync the settings files for each device, but I just haven't bothered; seems like a lot of time investment to automate something that takes me seconds to do manually.

    On the other hand, there were two big shifts for me after I started using it. One was when I got the sites I use frequently all set up after a few weeks, it became a lot smoother sailing after that. The other was when I finally took the minute to find the setting to default (temporarily) allow, but only for the current domain (after like a year or two on default deny everything).

    It's now rare that I visit sites where I feel like I'm missing out without the added scripts. The only times that has really changed is when everything started implementing anti-scraper measures, and sites along the high seas that have trouble streaming videos from other servers.

  • source
  • parent
  • [–] 3 points 2 weeks ago (1 child)

    It doesn't really matter if they got it right or wrong, as long as it's consistent. The goal isn't to know your location, screen res, or cpu core count, it's to track you across websites.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 2 weeks ago

    Yah. I agree. Which is why I think, it is often better to randomize the fingerprint every time, than TBB's approach. Tor is still good for the onion routing, ofc. But I'd like a semi random return on screen res, timezones, and w/e.

  • source
  • parent