News for hackers. Stuff that matters.
Re:Web fingerprinting is worse than I thought by comboy on Tuesday March 21, 2023 @05:40AM (#35244194)
The more you customize the more unique your session becomes.
Re:Web fingerprinting is worse than I thought by kuschku on Tuesday March 21, 2023 @06:03AM (#35244311)
Not if you disable JS, cause the website then can't see any of these customizations.
Re:Web fingerprinting is worse than I thought by zamnos on Tuesday March 21, 2023 @06:33AM (#35244482)
Except that disabling JavaScript is an anomaly all on its own. The dozens of users running without JavaScript might not be individually fingerprint able but it's still a small enough cohort that I don't know how much I'd lean on that. Figure in the user agent string and it's probably unique enough a subgroup to sell ads to.
Re:Web fingerprinting is worse than I thought by giancarlostoro on Tuesday March 21, 2023 @06:45AM (#35244537)
> Figure in the user agent string and it's probably unique enough a subgroup to sell ads to.

But if you never see ads how do you sell ads to them and how do you meaningfully discover enough about the person to feed them valuable ads?

Re:Web fingerprinting is worse than I thought by zagrebian on Tuesday March 21, 2023 @06:49AM (#35244567)
> it's probably unique enough a subgroup to sell ads to

I have been browsing with JavaScript disabled by default for the past 6 months. Based on my experience, no-JavaScript ads are rarer than four-leaf clover.

Re:Web fingerprinting is worse than I thought by Throwaway62884 on Tuesday March 21, 2023 @07:12AM (#35244703)
More common than you think

https://amiunique.org/fpnojs

Re:Web fingerprinting is worse than I thought by nerdponx on Tuesday March 21, 2023 @08:02AM (#35245051)
Probably not a representative sample though.
Re:Web fingerprinting is worse than I thought by bawolff on Tuesday March 21, 2023 @08:33AM (#35245299)
Also that cuts down the group so much, i imagine other things that are usually too coarse grained to be useful suddenly become much more useful. E.g. geoip location or accept-language headers.
Re:Web fingerprinting is worse than I thought by GoblinSlayer on Tuesday March 21, 2023 @12:18PM (#35248339)
But ads don't work without javascript.
Re:Web fingerprinting is worse than I thought by ch33zer on Tuesday March 21, 2023 @06:23AM (#35244429)
Having JS off probably puts you in the < .1% of users bucket. Unless you additionally are: * Routinely moving between IPs * Modifying your headers to avoid giving away info (user agent, etc) * Defeating all the other non-JS things that fingerprinters probably look for

then you are not safe by just turning off JS.

Re:Web fingerprinting is worse than I thought by account42 on Friday March 24, 2023 @08:46AM (#35288309)
Being in a 0.1% bucket is only ~10 bits of information - much less than what can be gathered with JS on.

And of course its not enough, but the situation is even more hopeless with JS on.

Re:Web fingerprinting is worse than I thought by Dah00n on Tuesday March 21, 2023 @06:19AM (#35244408)
You are easily tracked without JS. It is much easier than tracking a default settings browser.
Re:Web fingerprinting is worse than I thought by d-z-m on Tuesday March 21, 2023 @09:01AM (#35245534)
> It is much easier than tracking a default settings browser.

Not true. Especially if you mean a default browser with Canvas/WebRTC APIs enabled.

It is much more difficult for fingerprinting companies to get a high entropy fingerprint from a no-JS user.

Re:Web fingerprinting is worse than I thought by anthk on Tuesday March 21, 2023 @07:45PM (#35254496)
Good luck with Lynx/Dillo with a fake UA.
Re:Web fingerprinting is worse than I thought by withinboredom on Tuesday March 21, 2023 @06:49AM (#35244568)
It’s fun to put Easter eggs for people like you. https://once.getswytch.com
Re:Web fingerprinting is worse than I thought by chrismorgan on Tuesday March 21, 2023 @07:38AM (#35244887)
I have no idea what you’re talking about. That URL only tries to load one piece of JavaScript, htmx, and all it does is unbreak the mobile navigation.

(Aside: this mobile navigation is, incidentally, the worst implementation I have ever encountered: instead of twiddling some classes or such, which would happen instantly, it makes an HTTP request that responds with the new navbar. For me, this means at least half a second’s latency on clicking the button, more if time has passed so that the HTTP connection is no longer open (1.5–2 seconds). It also fails the no-JS test, as the unintercepted form-submit just serves the page with the closed mobile navbar again, not switching out the navbar as I expected it might, and which would have been enough to avoid an unconditional “worst implementation” award. Sorry if you made this and it hurts your feelings, but… ugh, this is just a baffling misapplication of hx-post and naive Tailwind use, and just unconditionally a bad approach.)

Edit: better link which shows what I suppose you probably meant: https://once.getswytch.com/app

Re:Web fingerprinting is worse than I thought by withinboredom on Tuesday March 21, 2023 @08:10AM (#35245112)
Haha. Yeah, it is pretty terrible and I made it.

It’s mostly a tech demo, so the things it does are intentionally weird/strange.

Re:Web fingerprinting is worse than I thought by reaperducer on Tuesday March 21, 2023 @07:13AM (#35244716)
Not if you disable JS, cause the website then can't see any of these customizations.

That's adorable. I guess you're not old enough to remember when we used to track people with things like invisible pixels. Or todays equivalent: testing CSS parameters.

Neither require JavaScript, and there are a hundred other non-JavaScript methods.

Re:Web fingerprinting is worse than I thought by psychlops on Tuesday March 21, 2023 @08:36AM (#35245328)
Hah! I used to embed invisible pixels for our marketing department decades ago.
Re:Web fingerprinting is worse than I thought by dylan604 on Tuesday March 21, 2023 @11:01AM (#35247190)
This should automatically qualify one to lose their internet privileges. Not just the fact that you did it, but your cavalier attitude towards it with the lack of regret for having done it
Re:Web fingerprinting is worse than I thought by psychlops on Tuesday March 21, 2023 @03:15PM (#35251083)
I actually agree with you. However, I plead that it was novel at the time, used ineffectively by a tiny marketing department, and not anywhere near this spy level capacity achieved today.
Re:Web fingerprinting is worse than I thought by kuschku on Wednesday March 22, 2023 @04:15AM (#35258194)
With that method, you won't be able to distinguish between the many different devices using the same browser at same resolution behind one IP.

In the era of CGNAT that means you now only know which city I'm from and whether I use Chrome or Firefox. People mostly use browsers in maximized and resolutions are relatively standardized nowadays.

Compared to the data you get from canvas and webgl, that's much less unique.