It would be nice if the settings inside resistFingerprinting were configurable. I understand that the point of it is to make every browser look the same to analytics engine, but having timezones and zoom levels reset is not the best thing.
Not sure about the status of AudioContext tracking, though.
- for web, stop using chrome, install firefox (or firefox mobile) and in about:config set privacy.resistFingerprinting on true then add following addons:
https://addons.mozilla.org/en-US/android/addon/canvas-finger...
https://addons.mozilla.org/en-US/android/addon/audioctx-fing...
https://addons.mozilla.org/en-US/android/addon/webgl-fingerp...
https://addons.mozilla.org/en-US/android/addon/font-fingerpr...
They will not only prevent fingerprints but also screw with the data (add random noise to audio/webgl sample, return random fonts,...).
- the most important rule, don't use applications like tiktok, fb,.. if your phone is not rooted, with xprivacylua (https://github.com/M66B/XPrivacyLua, for added kicks https://github.com/M66B/NetGuard) installed and you have basic understanding what you allow there (disallow everything for new apps and work permissions one by one). The sole purpose of those apps and their bussiness model is to steal your data. This is most sane advice I can give, sorry :(
Voila. Solved.
Those methods of fingerprinting are few years old and well known.
In my experience, blocking these everywhere globally as a default will result in being banned from websites, trigger bullshit "fraud" invasive analytics, and all sorts of obnoxious fail-closed problems by invasive trackers.
You will also be banned from most Distil-hosted sites for refusing to enable WebGL or return a canvas fingerprint. Ticketmaster, etc.
Be the change you want to see. Do it. I'm always amazed at how people will complain but then let themselves be pushed around. I wonder how many people reading this article will change their or their browser's behaviour afterwards. Very few I guess.
The EU (via GDPR) made a collective decision to disallow invasive privacy, if TickTock's response to that is to ban everyone in the EU and entirely lose the market that sounds good to me - teenagers will complain and people will shrug.
I personally have EasyPrivacy enabled on uBlock (because these tracking scripts using canvas, webgl, etc spin up my GPU and absolutely shit all over my battery life) but they are getting more and more aggressive with first-party CNAMEs, shipping a list of dozens or hundreds of hostnames to try progressively if any are blocked (and probably honestly risk score you higher for "trying to evade them" even though it's a default uBlock list).
I think it's honestly rather stupid, and I am not a fan of hearing my fans spin up for no reason accessing an otherwise plain website while it tries to open media players, try video elements, draw to canvas, download several megabytes of obfuscated garbage to evaluate.
You missed it, this doesn't require an Allow, because it's not actually accessing the microphone. It's using the audio APIs to generate a waveform, and depending on your computer/DSP, the waveform will be slightly different. It's not using any of your computers sensors
Presumably, without an allow the API doesn't function at all, so it works perfectly well. When denied access, the API should either not exist, or (more appropriately) just return errors.
An incorrect presumption. The API works perfectly fine without the need for permissions.
This is not a new technique. There's a decent write up here [0].
Permissions are only required to play to the actual device, or record from the actual device. Recording from nothing and not playing is allowed.
"This website has asked for permission to use the Audio API. If they aren't actively doing audio processing, this may be an attempt to identify and track you. If you haven't been presented by the site with a good reason why to allow this access, and it's not immediately obvious (such as for a music service), consider whether you want them to have access."
This accomplishes a few things. First, it's very clear about the implications and when it's obvious it should be allowed. Second, it gently suggests the default behavior for people should be to deny unless needed. Thirdly, it communicates to sites (through users the appropriate way to ask for permissions if hey have a legitimate reason, which is to let users know why they need access. Lastly, if sites lie to users about why they need access, they can be called out on that. People don't like being lied to.
That'd require rewriting the API itself.
If you visit a random internet site and get a prompt for the audio API are you going to allow it? Probably not, especially if you think it's just so the site can be obnoxious with sounds or listen to you.
The canvas api might be a little more likely to be allowed by the average person, but enough might disallow or ask about it that sites that have a valid use for it will put up a banner noting why it's important, making sites using it for tracking stand out all the more.
The bottom line is that we're coming to an understanding (well, it's been known for years) that each additional browser feature has downsides, so making them enabled by default has repercussions.
Those dialogs and settings are controlled by the Permissions API today.
> If you visit a random internet site and get a prompt for the audio API are you going to allow it? Probably not, especially if you think it's just so the site can be obnoxious with sounds or listen to you.
You and I might disable it. Overwhelmingly, the majority of the public click "enable" or "yes" on permission pop-ups. And tend to make sure "enable forever" is ticked.
> The bottom line is that we're coming to an understanding (well, it's been known for years) that each additional browser feature has downsides, so making them enabled by default has repercussions.
I don't disagree. The problem here is that the permission model itself has been broken, and won't be repaired because of backwards compatibility, and a lack of incentive.
You're a world-leading computerist and you had no clue either (nor I), how in the world are legislators supposed to do this. It's a fundamental problem. And once it's finally legislated the sme's are already on the next thing.
If you want that stuff you use Firefox and enable resistFingerprinting its the only possible way
What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things?
I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups mean since so many major websites use these hacks, so the average user is just going to be conditioned to mindlessly click "Allow All" every time they pop up like UAC on Windows Vista, punishing the average person while doing nothing to enhance their security.
Doesn't help that legislators are absolutely clueless here. For example, demonizing cookies when cookies are the most fair and transparent way to implement tracking, and leading to the first wave of pointless opt-in spam that plagues the internet. I'd rather they leave the internet alone and for browser vendors to step up for us.
Of course, the problem also includes native apps like in TFA. I'm just more optimistic about clients that run in web browsers.