I'm sick of fingerprinting itself actually. Coming the office and seeing the ads of stuff my family browsed at home is really getting old now.
> Removing features like WebUSB, WebBluetooth, etc, is not going to make users less fingerprintable.
No, but I think it'll reduce attack surface considerably for boty wired and wireless devices. Just being able to abuse webbt to listen my wireless keyboard or abuse my information stored on an external drive via webusb or just being able to poke around via an untrusted medium by design is perfectly safe as blindly poking a positive coefficient nuclear reactor (we know how well it went in Chernobyl).
> Are users any less fingerprintable because WebAudio now requires a user activation to run? No, users are still 100% fingerprintable.
Again, microphone access?
I think there's a lot of insanity going on the web right now. Exclusion of extremely cool technologies because of a real and big potential for abuse is probably the leading one.
Edit: I also use technologies for their intended purposes, but not everyone is doing that, AFAWCS
Crypto-*: it might be used by criminals!
Anonymous content sharing: it might be used be poedophiles!
Free speech: it might be used by yucky people!
UBI: it might be used as an excuse to not work!
Consumer-grade GPUs: they might be used by cryptominers trying to burn the world!
Paternalism and prior-restraint are anti-democratic. Other people using a tool for bad purposes should have no bearing on my usage.
Let's dig deeper, with your examples:
Crypto: If you're a normal user, you can be private. If you're criminal, you'll get to cover some of your tracks. The other effects are secondary and indirect.
Anonymous content sharing: If you're a normal user, you can share stuff. I personally share stuff this way in HN. It keeps my cloud accounts tidy. It can be used for other nefarious purposes, but it's effects are again secondary.
Free Speech: It shall also be used by yucky people, so we can improve our civilization, systems and ourselves further. It causes a lot of pain I know, but alas, humans probably need it sometimes to evolve. We're lazy otherwise.
UBI: I think it's a neat idea. I can't think any bad examples, sorry.
Consumer Grade GPUs: I don't think using a country's worth of energy to speculate on something's value is hardly efficient, so I'll pass. However, again its effects are secondary.
In all your examples, the receiving party is narrow. The receiving party's number grows because of secondary effect. However, web technologies bring everything to your home, including exploits and abuse.
It's a big can of worms for 1-click and 0-click exploits. "Oh, the web browser was not on the foreground, how my data is exfiltrated?" yeah, webusb/webbt/webaudio.
Crypto cannot directly harm you, neither GPUs. But I can get into your home and violate your with every privacy right with a couple of little, neat technologies.
Maybe you're right. We shall let these technologies loose and allow everyone to snoop into everyone's devices. That'd be equal and democratic. Maybe exploited people will like it and allow more of it. Like the most recent Facebook breach...
While we're at it, I really like the glow of Cherenkov Radiation. I'd like to build a small, fish-tank sized reactor with lead-glass sides. I won't use the material for any other reasons. If only they let me...
Yes, it will.
I don't know of anyone who would seriously argue that less variation between client data doesn't also offer less uniquely identifiable variation between users.
Less remotely-viewable variables, less rolls of chance to be unique.
>Are users any less fingerprintable because WebAudio now requires a user activation to run, and timing information needed to have artificial noise added? No, users are still 100% fingerprintable.
Less fingerprint-able doesn't mean completely un-fingerprintable.
These very edge cases and seemingly unnecessary inclusions into the spec are the very things that allow you to keep the technology in place while reducing possible privacy concerns.
These changes and inclusions are designed as a compromise between the two goals of technological innovation and privacy infringement.
And why, in this sisiphian effort, is the answer to hobble Web APIs, rather than request permissions, as native mobile apps do? Why should there be a functional difference between native mobile apps and web apps? The app stores don't vet submissions, so malicious apps are apparently quite trivial to get into the stores. Users don't really think twice about installing apps. Why do web apps need to be uniquely hobbled in comparison?
I just wish there was a way to automatically turn all this off when I'm just reading an article or filling a form, browsers should have a special app mode.
HTTP Referer header is so unreliable and so frequently used to spam server logs that it would break nothing to remove it completely, yet it's still there and we've got people complaining about the `navigator.hardwareConcurrency` value "leaking information".
Why does WebAudio need a user activation, but WebGL can run straight away, maybe even in a Worker where you'll never even see it?
The userAgent string alone tells you tons of information about a user, especially when you consider how frequently browsers bump version numbers versus how much user upgrade patterns can lag behind. But Ambient Light Events, man, they might be used to capture the user's face, one pixel at a time, over the course of a year, so that's clearly evil, too!
Because it's not really about security. It's all about pushing developers off of the Web and into app stores. Mozilla goes along because they're locked in an abusive relationship with their misinformed users, the 5% of the world that is so-called "privacy conscious" people who comprise their only user base.
If you create an app that makes good use of advanced features, then it has a higher likelihood of being something people are willing to pay for. So what does an app developer do, if they need this functionality? They make a native app instead. The user is still giving up the information (not to mention their email address at the point of purchase), but the app now has to give up 30% of revenue and be at the whims of a group of unelected technocrats' ever-changing, unspecified censorship criteria.
I've gotten really tired of this browser fingerprinting FUD. Removing features like WebUSB, WebBluetooth, etc, is not going to make users less fingerprintable. You're 100% fingerprintable from just your browsing activity. Preventing fingerprinting is not just "hard", it's impossible.
But we still get people complaining about it enough that browser vendors implement these security theater mitigations like when Google unilaterally decided WebAudio needed to be hobbled. Are users any less fingerprintable because WebAudio now requires a user activation to run, and timing information needed to have artificial noise added? No, users are still 100% fingerprintable. But now we have to jump through hoops to get it to work, the API as a whole is unusable for timing-critical applications, and old demos and apps are broken.
I'd be fine with a permissions prompt. We have the web app manifest format. Let's use it. It's not like the app stores are doing anywhere near a good job at preventing abuse, anyway. But no, is so often not even an option.
That is what is insane.