Today all websites that have anti bot protection using pow (proof of work) already use cookies. Which is before they “ask you if you want to agree with cookies” haha. Dammit eu rules.
I mean “1 in 122.7 million browsers look like” mine meaning it got me down to one out of about 2% of all internet users globally. I’d say it’s still pretty difficult to target anything at that many people and have it be relevant. Just knowing my location and that it’s a weekend basically gets down to that many or maybe fewer people on it’s own since fewer than that live in my city permanently, and adding tourists/visitors and people who work on weekends, that might be about right for how many devices are online in my city right now. And that was browsing with my less locked down browser on my phone.
Actually, looking with ironfox, though, actually reduced that to about 112m. I think part of that is that ironfox apparently still seems to enable the “do not track flag” even though it was removed from Firefox because it actually made people more easy to track and no sites who track are ethical so they are not going to obey something like that. So now it’s rare and makes for a really good tracking point. Need to figure out how to remove it from ironfox I guess.
What it got right,
- My OS. It’s in the user agent header, which I hate.
- I read the page methodically at a human reading pace.
- I am using a VPN.
What it got wrong,
- Location.
- Screen res.
- Num of CPU cores.
It’s good for ppl to think about fingeprinting. So demo pages like this are good. But I’m sure the identity resolution industry is MUCH better at it. They have capabilities like TLS fingerprinting, outside the browser. For most ppl, not the privacy crowd so mcuh but normal ppl, they fingerprint resource fetches to diff geographic servers. They can run 100’s of scripts on a single page from every identity broker. They employ the best data scientists, to figure out every possible way.
I’m pretty careful. More than 99.999% will ever do. Can commercial fingerprinters still ID me? IDK. But like Skywalker, I have a bad feeling about it.
They can run 100’s of scripts on a single page from every identity broker. They employ the best data scientists, to figure out every possible way.
The impact of this is probably greatly reduced by anti-JS measures like NoScript. Some sites probably still bundle fingerprinting code into their own scripts, but the really big players contract that out to companies whose entire purpose is data-harvesting, and that’s easily defeated by denying scripts from outside domains
Interesting. The only thing that really surprised me was the time zone thing. Can I hide that somehow?
Yes, the time zone can be spoofed via browser settings or with an ad-on.
“Remember me on this device”
I loaded the site and went through the stuff and it worked fine. Then I turned on my VPN, and it gave me a new ID.
Changing my VPN endpoint and refreshing the page didn’t work, it still knew who I was, but closing the window and quitting the browser before changing the VPN again gave me a third ID.
They seem to know quite a bit about my phone, but it doesn’t seem like there is much that it could differentiate it from another person with the same model of phone.
This was a fun exercise.
Are you using a browser which rotates the fingerprint like Brave?
I did a private window in Safari on iOS.
It’s interesting to me because while it’s mostly correct in each instance I tried it (phone, desktop) it actually gets some pertinent information incorrect.
For one, it only recognized the one monitor I had the browser open on, I have four monitors, so it got the resolution correct for a single monitor, but fails to capture the others, and so technically if I opened it on a different monitor with a different resolution (I had two that have different resolutions), that aspect of the fingerprint should change.
Secondly, when I went to this link from my cell phone it registered it as me typing the link in by hand while on PC it correctly registered where the link originated from (here on lemmy). Although I was using Jerboa on Android so perhaps it can’t read link origin from Jerboa (which is good).
Finally, it registers my Wayland session as X11, although I’m not sure if that’s a current limitation of browsers since Wayland isn’t the dominant compositor yet and perhaps hasn’t been added to browser user-agent info yet.
A small point but it assumes that your browser’s self-declared timezone is “true” to where you live. My timezone is spoofed to UTC+0; my VPN server is in a different country; and my browser language is set to en-us. I feel like if you see a user whose settings are all of the above then you can assume that none of those three data points actually describe the user, unless they coincidentally are a US English speaker or live in UTC+0, but that’d just be them coincidentally living where anti-fingerprinting browsers report you as.
Anti-fingerprinting is a fingerprint too.
I know that…? I’m not sure how this relates to the comment you replied to.
they are just warning other readers who might read your comment and think “oh I should spoof timezone and language too”. To those readers: don’t spoof these yourself, find a browser that has fingerprint resistance on by default, like Tor or Mullvad Browser, and don’t change the defaults. The goal is to blend into a crowd of users with the same fingerprint
Only if too few people do it.
Ironfox seems to do its job. Me fingerprint every time. Vanadium as well (though it does disclose more in-depth device data).
Needed to enable JS.
Honest question, do you browse without JS enabled? I suppose you could just whitelist sites that you need it for.
Some folks browse using Tor or other high-privacy respecting browsers, in which things like NoScript are a default.
Anyway, yeah, NoScript is still pretty popular and if I recall correctly you can whitelist and regex with it. I just use the same functionality to disable javascript that is in uBlock Origin, personally.
Though uBlock doesn’t set javascript.enabled to false, only blocking any kinds of js. Meaning, the
<noscript>tag (with the ever so useless error message) doesn’t get triggered, which results in some sites built in a defective framework just being empty.The
<noscript>messages seem to work for me with uBO.
So I tried this in *Privacy Browser, mojeek search engine, with and without .js. Thing is, most websites are designed not to work, without it. I could use some help with settings, if anyone is inclined.
Also, that made my fingerprint much more unique. It almost seems worse.
yeah turning off js means that you can’t really use most sites
I had to edit the post you answered here, for accuracy. Cloudflare on kbin.earth isn’t having it, for anything. I checked the box to prove I’m human a dozen times, with .js and cookies enabled, and the whole shebang just noped. 😋
ha
Also, that made my fingerprint much more unique. It almost seems worse.
Unique but useless data.
Having a unique fingerprint I swear is just a way to scare people into compliance. Unique doesn’t always mean known. Sure, it’s unique that they can’t track you so well. Oh no…
I feel if 1 out of 200 people had this unique fingerprint, it’d be hard to distinguish who’s actually who. No distinct way to really differentiate with such little data being allowed to be gathered.
The paradox is that your traffic is so unique that it can be compared to traffic captured from other websites you’ve visited and be used to build a profile around your commonly visited websites and current interests.
That fingerprint is then sold to brokers that forward to websites that will serve targeted content to your fingerprint when you do happen to show up. It doesn’t necessarily care what your identity is just that you have an identity.
But if you’re not running multiple tabs, or in private tab view, and you’re not allowing most or any cookies, then they’re going to have a harder time following what you do and where you go.
- Use a solid VPN
- Use Firefox derivative (Waterfox and Libre Wolf, feel free to use multiple to separate tracking)
- Use pivate tab mode
- Use Privacy Badger (EFF)
- Use Port Authority (highly rated port scan blocker to block network port scanning from LexisNexis)
- Close unused tabs
- Clear cache and cookies on exit
- Disable unused network stuff (WiFi and/or data, GPS, BT, NFC, anything that’s not required that could be used for location scanning)
- On Android 15+ iirc, disabled mic and/or camera permissions until necessary. Most people don’t talk on the phone anymore so it’s rare you need the mic (unblock for camera)
I shouldn’t need a 9 point checklist to browse the internet. I’d rather there be proper user protections in place.
Oh for sure! I agree! But I do the following, mostly automated through settings, to either poison the data or avoid them from getting it at all.
One out of 119k.
Edit: but yes, I am satisfied. I just need to know how to do settings so .js IS enabled but also not so evil (and I doubt it’s possible), as well as just general functionality with privacy, if that’s even possible.
Imagine enough data was random that it was always unique. Never duplicate.
Or if that’s some kind of issue, then instead allowing the user to randomize their fingerprints by click of button. Surely there’s some kind of spoofing, virtualization, something that browsers can do to effectively “randomize” the measured fingerprint by third parties.
I use Fake Traveler to spoof location sometimes. I sometimes do this while shopping for various travel things that are affected by region… If you catch my drift.
For me my fingerprint is unique, but the advertisers list was empty so yeah, it’s pretty pointless when you have Adblock at a dns level. You can be identified by first party sites, but that requires visiting every advertisers site to actually get them to fingerprint you. Otherwise your data won’t and can’t be sold realistically.
I’m 1 in 166 million lol, I think I’m easy to track, however a lot of the data is wrong so not sure how to feel
