The fly in the ointment with this theory is why Apple (or even Mozilla) would expose the same kind of information. Apple has only recently started experimenting with ads, and their ads are limited to the apps that they control.

The more benign explanation would be to allow developers to work around device-specific or browser-specific bugs.

(I'm aware Apple changes the GPU Model to "Apple GPU", however they do expose a ton of other properties that make it possible to fingerprint a device.)

Continuing the push the browser to be a general app platform is the only way it can survive against native experience, which is already eating into the enthusiasm for the web. It seems like the trend for consumer companies is to maybe launch first on the web for velocity but eventually migrate to native experiences.

I wonder to what degree we can enable hardware performance without leaking user data.

Firefox do have a mechanism to limit the amount of data being leaked for fingerprinting, but it’s disabled by default: https://support.mozilla.org/en-US/kb/firefox-protection-agai...

Wow I just realised I’ve had this enabled for… since I first remember the feature announced, and the internet hasn’t broken.

They're not that big of a deal, but my two biggest annoyances with RFP:

1. prefers-color-scheme is completely broken, even in the dev tools. Mozilla refuses to fix this in any way, it is allegedly "by design" that you have to disable all RFP protection if you're a web dev and need to test the dark color scheme of your website.

2. Similarly, RFP always vends your timezone as UTC with no way to change.

They could add switches for individual features to mask on a hidden/advanced menu

that's a great way to get even more fingerprinting potential, each additional switch is another bit of identification on top of the actual fingerprint itself.

Mozilla refuses to add _any_ toggle to disable RFP's control over features it touches, including even an about:config entry.

See example bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1535189

My "fix" for this involves using a janky old version of an addon that attempts to muck with the CSS/JS to reproduce the effect.

Does adding your website to privacy.resistFingerprinting.exemptedDomains not work?

Apple devices are in fact fairly difficult to fingerprint. In my experiments [1] all instances of the same hardware model (on iOS, iPadOS, and macOS) give the same fingerprint, so the best a tracker can get is "uses iPhone 14". Better than nothing, but not terribly unique.

[1] fingrprintr.pages.dev

Isn't Mozilla's main source of income from Google?

I thought the developer of the browser is the only ad provider that _doesn't_ need it (since they have other, better ways to get that intel which their competitors do not).

they (google) did try.

that's the profile icon you see on your google-chrome UI.

but only fools use that feature.

what makes someone who uses that feature a "fool"? Some users don't particularly mind being tracked.

Also, it's very convenient in a work context if your employer uses G Suite/Workspace. I don't have anything to hide work-wise, and I do everything else in incognito windows.

Please don't spread obviously untrue conspiracy theories.

The main reason is that it's really hard to avoid fingerprinting (while providing rich features like WebGL and WebRTC anyway).

A secondary reason is that web browsers started off from a position of leaking fingerprint data all over the place so there's not much incentive to care about it for new features.

You might be interested in this effort to reduce fingerprinting: https://developer.chrome.com/en/docs/privacy-sandbox/privacy...

(The real conspiracy is that Google added logins to Chrome specifically so that they don't have to rely on fingerprinting. They have a huge incentive to stop fingerprinting because it leaves them as the only entity that can track users.)