Developer publishes analysis of fingerprinting as successor to cookies
1 Oct 11 6:33 PM · 3d ago · 1 article · 1 post · 10 comments · 2 sources · development 1 of 1
Royfish publishes a detailed technical essay demonstrating how device fingerprinting works and arguing it has become the de facto replacement for third-party cookies in web tracking. The piece traces the regulatory and industry path from cookies to fingerprinting, showing how companies have sidestepped privacy protections.
“I look at all this data and I don't see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche.”
RoyfishRoyfish Developer and analystGoogle Browser vendor and ad platform operator
The whole story articlespostscomments the bright band is this development · numbered dots are the others · click one to jump
What was reported 1 claim about this development
-
2 outlets Fingerprints are the new cookies
first by HN Best, 3d ago · also HN Frontpage
What people said 24 voices · best of 81 · verbatim
-
> The law could be very simple A classic of the "why don't we just?" genre. The law is complicated for a reason (I say as someone who worked on privacy matters as a lawyer). So let's talk about your proposed law #1. I run ZomboCom LLC, and I have some users who've given me money in exchange for being part of the ZomboCommmunity. It's coming to the…
-
> The request already reveals information about you; what browser you use, the language it’s in, the OS that runs it and your IP address, which the server needs to send you the response. That often reveals your location.If we control the servers the clients are connecting to, I don't see how there could be much hope of hiding. We can spoof things…
-
Wishful thinking, but I wonder how the internet would be different if we just made it illegal to sell information about people.
-
>Test your browser:>coveryourtracks.eff.org shows you how unique your fingerprint is, with entropy for each measured data point.Something to note - if a fingerprint is generic enough, that might be a _good_ thing!Having worked with fingerprinting, anti-fingerprint browsers are very hard to properly identify. The ways to get around it are things…
-
> Is it different in incognito? Good. But it’s always the same? Bad news. If I visit the webpage in private browsing mode with Firefox (153.0.1) I get a different fingerprint as in non-private browsing mode. But the fingerprint on private browsing mode does not change if I refresh page, restart Firefox and re-open the page or even if I use the…
-
The EU/banner situation keeps confusing people because there are two different laws in play:1) ePrivacy. the OG banner law. requires you to inform the user (but not consent, as I understand it) if you store data on a user's device. includes cookies, localStorage, indexedDB, etc. does not affect fingerprinting 2) gdpr. requires you to ask consent…
-
Opening in private browsing gives me a different fingerprint, which does not really make this a convincing argument. I also asked a couple of colleagues with the same Macbook Pro. Some of them actually get the same fingerprint as I do.
-
Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching…
-
Unfortunately, fingerprinting scripts are quite often first-party. Moreover, popular CDNs offer the service of embedding these type of scripts directly into the served HTML :/
-
I still don't understand why the highest entropy APIs aren't gated behind browser consent.A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?Broad geographical targeting shouldn't be an issue. In fact, it's so easy that I think we should…
-
The law could be very simple : 1. Any data collected by a private entity A about an individual X cannot be shared to another entity B without the explicit agreement of X at the moment of the share. Agreement should be given for each transaction. The way it is shared doesn’t matter. If A is bought by entity B, X should consent to its data being…
-
These are all a joke anywayIf you've ever worked at a startup, you're probably familiar with the fact that no one gives a crap about this type of stuff early onThe hell with pretty much anything, the only thing that matters is revenuePeople only start to care about this after the fact if you've grown to large enough sizeIf you think stuff like…
-
The GDPR is already fairly simple: data sharing requires *informed* consent. The person whose data are being shared needs to understand the thing that they are consenting to. If they do not, then you do not have consent. The problem is not the law, it's the enforcement. Note that the GDPR says very little specifically about cookies…
-
The solution has to come from law. I propose we handle privacy invasion the same as rape. Body and mind aren't up for grabs. That the average internet user is unconscious isn't a valid excuse.It would be great if a wave of lawmaking started in the USA, because most tech behemots operate from there. I would expect EU to take the lead though IF such…
-
Well, what niche market would browse https://coveryourtracks.eff.org/ ?
-
How could this information be surfaced in a reasonable way in administration software?Say I have a remote employee who is only able to access your internal systems via his yubikey. His fingerprint is "Genuine Antelope".Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him. I create a new…
-
Thank you for the lovely examples! I did fairly deliberately say "sell" not "share" with my original statement, for *some* of these reasons, though it's a much weaker statement. I think it'd be a lot easier to mop up the ecosystem of the more abusive bottom-feeders a bit than solve the problem in one fell swoop, though I can already think of ways…
-
I feel it's worth distinguishing between the Hacker News Audience that is highly tech-educated and security-conscious and the general public that just wants to use the web and seems more than happy to give all their data to Meta, Google & Co.If you ask my 70-year-old mom to decide whether she'd like to allow the WebGL API, she'll go bonkers. If…
-
> Edit: I'm Cheeky Raven in both normal and incognito. Does that mean my normal session is also fully anonymized ? Err... I think that would mean that there's no benefit to using the incognito window? If you have the same identifier across both then your private window isn't helping much and sites can track you as the same person across both... I…
-
> the consenst banner is required either way.Consent is required. The banner is just one mechanism, but not required. A website could hold off on all tracking until a suitable point in the usage of the site (like creating a profile, for example) and ask at that point.The banner is an artefact of the hostile way most sites choose to try and…
-
Thanks for replying with your expertise. Very useful! > It's coming to the end of the year and my accounts are a mess, so I engage a bookkeeper to work through my paperwork. I give them access to my Stripe account so they can reconcile incomings. Have I breached the law? Do I need to ask all my customers first, and do I need to disclose the…
-
Doing this on GrapheneOS's built in Vanadium browser, I am concerned to see that the ID remains the same if I move to incognito tabs, or even a private space. Or perhaps Vanadium is doing such a magnificent job of reporting generic info that this ID would be the same for anyone using Vanadium on my model of Pixel, but I don't think so, since the…
-
The only way to win is to not allow connections to third parties.
-
The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of…
All 1 developments of Device fingerprinting replaces third-party cookies as… →
Hacker NewsNewswiresMastodonLobsters