Hacker News Reader

Comment by nwah1 | Hacker News Reader

Canvas API allows fingerprinting precise enough to, by itself, create a unique identifier for a user.

However, fingerprinting doesn't require any kind of single magic API, but almost certainly will use a collection of techniques to narrow down users. If they know your browser version, default language, screen resolution, etc those three alone can narrow you down by many orders of magnitude.

And they are adding more APIs like Device Memory which, while not as precise as a canvas fingerprint by itself, could probably whittle it down an order of magnitude further.

Apparently turning on "Do Not Track" has long been known as a way to single you out on the web. You'll help them narrow you down by about three orders of magnitude. It was a silly idea to begin with.

View on HN

Note that Mozilla is explicitly pushing back on the Device Memory API, because of fingerprinting concerns. See https://groups.google.com/forum/#!topic/mozilla.dev.platform...

> Apparently turning on "Do Not Track" has long been known as a way to single you out on the web. You'll help them narrow you down by about three orders of magnitude. It was a silly idea to begin with.

Wouldn't that be solved if FF turned DNT on by default?

It would also make it even more useless. IE originally had it default on; they turned it off after people complained that it meant advertisers wouldn't honour it anymore.

https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer...

Well it was useless to begin with anyways, as it's just kindly asking ad-publishers to please not track you, which is the closest thing we have to the platonic idea of naivety.

It's not useless in the context of a legislative requirement to honor it, which was the original goal that DNT was supposed to drive to. Since we now have pretty much 100% regulatory capture in the Internet space that of course is now dead.

> It's not useless in the context of a legislative requirement to honor it, which was the original goal that DNT was supposed to drive to. Since we now have pretty much 100% regulatory capture in the Internet space that of course is now dead.

It was never really likely to happen, especially when even advocacy groups like the EFF opposed legislative approaches to enforcing DNT.

It might actually be useful to randomly turn it on and off per request...

DNT is meant as an explicit opt-out. A unified way for users to expressly say that they do not want to be tracked, if possible. Users actually going into the settings and flipping that switch makes it clear that it's their request and therefore could have given it legal bearing. (Exceptions from that for functionality that requires tracking, like online shopping, would be given implicitely by using that functionality.)

Unfortunately, Google, Facebook and Microsoft managed to kill that effort off.

Microsoft by doing exactly that, they default-enabled it in Internet Explorer, taking away any legal bearing. And Google+Facebook came out saying they don't give a fuck, they'll track users anyways, and then with something around 2/3 of all bigger webpages having Google Analytics deployed and some other ridiculous percentage having a Facebook Like-Button, there were essentially no webpages left that could have come out and said that they want to respect it in some fashion.

How can that be? If 100 users buy a specific MacBook or ThinkPad they have identical hardware. Or do different revisions of the same chip have different rendering? Windows and browsers force updates at about the same schedule on everyone.

I'd expect it to narrow you down to hardware/OS, perhaps driver (though most users use whatever Windows or the OEM throws at them). How can it do more?

What?

If 2 people buy a new MacBook and run a WebGL or Canvas fingerprint, why would they have different results?

I do not believe it is unique at all. It will be unique for a hardware-OS-driver-browser combo. And if you are not doing anything strange, those numbers will be pretty common (most users just use whatever OS/driver package ships, and the browser gets upgraded like everyone else).

100 users buy the same hardware but decided to resize their browser window slightly differently. Bravo, window.outerHeight and window.outerWidth.

100 users buy the same hardware but some decided to install some custom font they need. Bravo there’s a difference now.

GP is very clear that there’s no single magical API used for fingerprinting. It’s anything and everything.

Reply on news.ycombinator.com