The fingerprinting signal does not necessarily need to be revealed to the fraudulent actor in order to be useful. It’s a cat and mouse game, but it’s worth it because of the cash at stake.

> Screen size is easily configured and/or randomized to some degree, or shifted between 10-20 common values.

I don't want my browser to keep changing its screen size.

> All this fingerprinting is ridiculous and trivial for someone with any incentive to do so to defeat.

I disagree. There are a number of efforts to defeat fingerprinting underway already and I think the fact that they haven't been able to eliminate it says volumes about how difficult of a problem this is.

> I don't want my browser to keep changing its screen size.

Neither do I. I'm taking about how useless it is to use these metrics to identify bots, sine any bot can easily circumvent them, and with far more less hassle than a user.

The fingerprinting is "for" fraud, but is not very useful in that context. The fallout is that all our privacy is worse though.

> I disagree ... the fact that they haven't been able to eliminate it

They haven't eliminated it because it still works well enough on end users, even though the narrative is that it's to prevent fraud.

Fingerprinting works for users, but for any halfway competent adversary it's close to useless. Just keep that in mind when it's brought up as a solution to fraud and that's why it's worth allowing.

TOR makes the most usability compromising security choices of any browser and even they don't have a fixed window size to avoid any fingerprinting here.

They do prevent manually resizing the window because the exact width could be used to rack you across sites in the same windows.

The attacker would be shifting screen sizes, in the given justification of bots.

Ah yes, so trivial. That must explain why millions of people are doing it and we have perfect privacy online. Who knew perfect privacy was one hackathon away the whole time?

The context of this is that the tracking helps prevent fraud. It's trivial for someone to circumvent it that puts some effort into it, so it doesn't work well for any but the most simple instances of fraud detection.

We all, as end users, pay for this because as an end user it's much more onerous to work around because site specific tweaks to make a site work require a lot of effort.