1. There is magic css/js that can not only tell different browsers and devices apart, but can tell two phones from the same manufacturing run with the same software apart.
2. Despite the fact that this magic code would have to run in the client browser where its content, execution, and the data it sends back are all plainly visible to anyone who can hit ctrl-shift-j, no "public researcher or browser vendor" knows anything about it.
3. This technology is not used to combat ad fraud because of some weird conspiracy at Google.
It could be true, I suppose, but I don't see why anyone would believe this based on the evidence so far.
However the author of the paper could not get it to work on low end devices, whereas we could. And we discovered this around 2015.
Ours was more advanced then this. As far as I've read the paper cited on the source above, they are like 30% of ours tech POC back in 2015.
Google, Facebook advertiser have more specific budgets, especially Facebook which has a large number of small advertisers.
Large adnetworks however get large advertisers with advertising budgets in tens of millions on average.
There is a larger pressure on Google and Facebook to be competitive then say smaller ad networks.
Also the techniques that I mention of are not in use in wild after the POC on millions of devices few months ago. They're a backup plan. Also not every adtech company has them. Maybe 2 or 3 at the most are at the cutting edge of tracking.
Google knows this very well. You really think Google couldn't counter fraud? Its a fake and manufactured outrage. No one wants to give away their "secret sauce" just yet.
Also right now many adtech companies are going bankrupt. Many larger one are waiting for smaller ones to be gone after which the landscape changes.
As someone currently working in IT for an adtech company, I can at least provide one data point in that the company I work for is slowly (but surely) dying.
Also we know many exploits to bypass noscript if we wanted to (yes I know there are bounties for this, but we were paid much higher then any public bounty for this stuff)
> Wait for the new CSS version over which our team had a watch. Wont require JS after it comes out. ;D
So how does that work considering what I said above?
Why would I believe you over all the public research available? If you really were working on this why would you be stupid enough to post about it here?
Also this is nothing but getting dimension of screen and other browser attributes which are useless now. The current state of the art cannot be mitigated unless you put a 95% penalty on performance on the CSS engine AFAIK.
Now we're waaay past this easy stuff to fake stuff. This now considered to be basic.
Look into distill networks, but their public product is very far behind what we did. Not sure if they have better tech to be used in future.
All the public computer researchers and browser vendors are years behind the techniques to fingerprint devices (probably 5+).
Canvas, WebGl etc are techniques of the past. There are much more advanced ones, than can identify devices with completely uniquely (on both desktop and mobile)
Also we know when users fake their fingerprints, and the algorithm respects the decision even though we know who the user is despite faking with all state of the art methods.
Latest methods dont even use JavaScript. Just CSS is enough to identify every device uniquely but you'd need JS to send the data back.
Every public researcher I've seen are given honeypot techniques that they consider state of the art even thought the industry is way ahead of the researchers.