Tracking is establishing your identity. Try using a private mode Firefox via a VPN. Half of the web is completely unusable. You get put in unsolvable catchpa hell as punishment for being anonymous.

Try walking into a real place with a mask on and you might also get treated less pleasantly.

Walking into real places with a mask on has been normal for the past three years.

OK, but not with a balaclava.

Will a fake nose, moustache and glasses do?

(My point? Characterising anonymity with an item of clothing associated with paramilitaries has associations that don't need to be there.)

I think that a randomly generated completely real looking expert disguise is probably best. And a pain in the ass.

Have you visited many stores since 2020? There was an event around that time.

I still today wear a mask in every store I enter and I can completely honestly say that I have never gotten a weird look from staff over it; it's never been a problem.

Try a balaclava.

I am pretty sure I could wear a balaclava to Walmart. In fact early on in Covid during mask shortages I'm pretty sure I did wear basically the functional equivalent of a balaclava into a Walmart because I couldn't find N95s.

Admittedly France has tried this bullcrap with burkas before, but that's not exactly something anyone should be emulating, I think we'd pretty much all agree that "I'm sorry but for security reasons you can't buy groceries wearing a burka" is not an acceptable argument. Security doesn't grant free license to override other people's rights.

Bear in mind that the actual real-world examples of the argument "people shouldn't be able to wear masks in stores because of security risks" have for the most part mostly been examples of security being used as a justification to infringe on religious rights or to block marginalized/disabled people from taking reasonable safety measures to protect themselves from infectious disease.

If you're going to bring up an example of security overriding other concerns, at least bring up an example where security hasn't observably immediately become a slippery slope to infringing on people's rights and excluding them from society. Is "stores can ban you for wearing a mask" supposed to make me more comfortable with websites fingerprinting me? I mean, I know where that argument ends up in the real world, it never ends with balaclavas, we've had that argument in the real world and where it actually ends is with immunocompromised people not being able to buy groceries.

So I'm not sure any of this is really supporting your point. Anonymity should not be punished in physical or virtual spaces, and there are huge debates about de-anonymization, facial recognition, and tracking in both public and private physical spaces and for the most part we don't accept security as a justification for de-anonymization.

> I still today wear a mask in every store I enter

But why.

Halfway through Covid a witch cursed me so that anyone who looks at my face in public immediately goes into horrible convulsions and dies. It was a confusing week until I found out what was happening, and the bodies were very hard to dispose of discretely.

----

More seriously (and more relevantly), in the context of the current conversation about privacy and user autonomy, the correct answer to "why do you need to be able to do X" should usually be, "that's none of your business."

"Why do you need to run a VPN?" None of your business. "Why do you need to wear a mask?" None of your business. "Why do you have WebGL disabled?" None of your business. "Why does your browser not have this font installed?" None of your business.

A big part of autonomy and agency is that you don't need to ask permission or justify to anybody why you're doing the things you have agency to do. If you need to explain then it's not autonomy, it's permission. I don't feel I need anyone's permission to wear a mask indoors in a public space regardless of my reasoning (and in practice I'm never asked to explain, millage may vary but my experience is that nobody really cares). And similarly I shouldn't need Cloudflare's permission to run an obscure browser or to customize my computer setup.

That's implausible. Using finger printing for fraud detection would only catch someone using different cards on the same machine. Once a card is deemed stolen it stops working so it's unnecessary for that scenario. That doesn't even go into fake fingerprinting some browsers/plugins.

The price is the highest the market will pay. Increasing that price means few customers lower revenue. Fraud is a cost to the business they must pay out of profits because if they tried to increase prices demand would drop.

It can be an aspect of it. For example, if there are suddenly many unique fingerprints making purchases from the same residential IP, that might look suspicious.

Granted, I'm not aware of a lack of fingerprint being penalized. That said, there are products that allow custom rules, in which case anything is possible.

I work for a company in this space. Opinions are my own.

>Using finger printing for fraud detection would only catch someone using different cards on the same machine.

In this context the goal of fingerprinting is to detect requests coming from an attacker. It does not care about the ability to distinguish between individual machines.

>Once a card is deemed stolen it stops working so it's unnecessary for that scenario.

The whole point of automating it is so you can cash out many stolen credit cards. If you only have one you might as well do it manually.

>Increasing that price means few customers lower revenue

Making more revenue doesn't matter if that extra revenue ends up getting eaten by chargebacks.

> Also, fingerprinting isn't always "bad" -- any business who takes credit cards online, wants to try to exclude people who will commit fraud (because they might have done it before.) Preventing fingerprinting, means you prevent certain anti-fraud, which means that you see higher prices and more friction doing commerce online, which also affects your experience. The connection is just much less direct.

By the same argument you could say it should be fine for a physical store to refuse service to anyone who they get a bad feeling about or don't want to serve. But if you permit that then you're immediately opening the door to racism etc., which we consider socially unacceptable. It should be the same for websites too - I bet all these browser fingerprinting techniques just happen to mean better service for people who can afford the latest iphone.

> business who takes credit cards online, wants to try to exclude people who will commit fraud

How bad is it nowadays? Can't you just enforce 3DS2?