Comment by wlesieutre | Hacker News Reader

Comment by wlesieutre | Hacker News Reader

Parent Full thread

What a dumb idea. We just wised up and took away the battery API because it was being used for fingerprinting, and now they want to add more permissionless hardware info back in.

You just know the argument being made is "Light sensor input changes frequently enough that it isn't useful for fingerprinting." But history tells us that literally everything will be used for fingerprinting.

Provides a tiny amount of differentiation to maybe identify particular devices? Scoop it up!

Or if you're already able to identify a particular person, how about keeping a persistent log of whether they're indoors or outdoors and aggregating that from as many different sites as possible? Collect all the data and store it forever! Maybe it will help sell ads 0.004% more effectively, and there's no downside!

IMO, whatever amount of risk this carries clearly outweighs the benefit of websites being able to access my light sensor without asking for permission, because the value of that is 0.

> But history tells us that literally everything will be used for fingerprinting

I don't think you realize how right you are. Fingerprinting is eventually going to be a lost cause. In 10 years or so, we will have the tech to fingerprint anyone just by their writing style (some companies even claim to be able to do this already today). What do you do then? Ban posting stuff online?

>In 10 years or so, we will have the tech to fingerprint anyone just by their writing style (some companies even claim to be able to do that already today).

...given a large enough corpus of text. I doubt that you're able to pick up much from a dozen 1 sentence replies on reddit, for instance. You could even use some sort of neural network based sentence transformer to scramble the structure without significantly altering the meaning.

I am not sure it has to be too large.

It only takes 33 bits of information to identify 1 person out of 7 billion. How many bits did you lose just by talking about neural networks in that one sentence? How many bits did you lose from the timing/time zone of your comment? By the language of your comment?

I imagine that there's a lot of information in the specific cadence of typing, in addition to the final text.

https://en.wikipedia.org/wiki/Keystroke_dynamics

As a low tech solution, you can always compose the contents in a separate window and paste it in when you're done. Hardened browsers (eg. Firefox with resistfingerprinting) can frustrate attempts by throttling key events (key events get coalesced into 1s/5s/10s intervals).

First time I hear about this (edit: Firefox with resistfingerprinting) and I'm the kind of person who finds this interesting.

Which means anyone who does this will probably have made themselves unique, or - I guess- at least narrow down the scope of possible users more than the typing speed would do.

This is another browser stupidity. Dont send anything until the submit button is pressed. It's the browsers job to implement the text edit box and spell check, not every website.

Being able to see keystrokes in Javascript is pretty useful for things like autocomplete. Say you want to send an invoice to "Foo Bar, Inc.". Do you really want to type that every time? Do you want to type "Foo" and then click submit, and then be taken to search results? Why make a 700ms task into a 5s task, especially when you're doing it hundreds of times a day.

There are hardened browsers that will make the script wait for a while to get the key events. That seems like the right solution; most people using controlled enterprise apps don't have to deal with huge amounts of input lag, while people that are paranoid won't be profiled by their typing cadence.

How limiting would it be to have auto complete implemented in the browser? Probably not quite as nice as Google but still useful.

>How many bits did you lose just by talking about neural networks in that one sentence? How many bits did you lose from the timing/time zone of your comment? By the language of your comment?

uhh, probably 2 or 3 at most? Given the demographics of Hacker News (technical background, mostly American), probably half the site have the attributes you have listed.

Provide tools to anonymize writing, probably.

How does that help companies trying to track what I search for on webshops?

Imagine light beacons in any graphical media same as the audio beacons that already exist.

This is about technology that identifies people based on their writing style which is claimed to be some kind of panopticon that can be used for tracking you everywhere you go.

> we will have the tech to fingerprint anyone just by their writing style

we're far beyond that; I have successfully fingerprinted users by buttons they press in Office 365

It's the web trying to take back share from native by integrating more hardware related APIs i.e. storage, authentication, etc. - driven by large corporations with disproportionate voices in these working groups.

I doubt it's even this particular feature, just an ethos of: let's add as much as possible because it'll increase our relevance.

Agreed, and I assume the main use case is for websites to be able to offer a "dark UI" like maps apps do, so if you're using it for navigation at night it won't blind you.

But here's a crazy idea for them:

    @media (prefers-color-scheme: dark) {
        color: white;
        background-color: black;
    }

That way it doesn't leak any uncontrollable information, and it makes the UI look how I want it to! It can even happen automatically at night if I've set my phone to do that. Downside, if I drive through a tunnel during the day the UI stays bright. I'll live.

If they really think they need to access my light sensor, they can ask. Maybe someone wants to make a light meter web app, I don't know. But I do know they have no business accessing sensor hardware without permission.

It's like with the battery API, people had this idea that web developers could say "Oh your battery is low, we'll throttle back into low power mode to respect that."

But instead, websites are happy to continue burning all the CPU, data, and battery life in the world, because by and large developers aren't paid to give a shit about your battery. They're paid to ship features and make whatever metrics go up. So the only thing it gets used for is identifying phones for advertiser targeting.

One benefit of only WebKit being allowed on iOS is that it gives Apple the market power to shape web standards in favor of privacy.

Apple may be happy to differentiate on privacy but surely they don't care or might even prefer that android and others get worse in that regard.

It doesn't really matter if Apple is for privacy in their heart of hearts or because they're ruthless capitalists if the end result is in favor of privacy.

In fact it's better if there's a profit incentive. Alignment of interests is what's been Apple's superpower for a long time now.

Sure, but I'd guess their incentives align with being better than median, and thus not necessarily with improving the standards with their market power.

Exactly this. Otherwise they'd push their things to standards processes or open them to non-Apple users. Like their login thing, which is genius but useless to non-Apple users.

you can have an apple id and not have any apple device.

>but surely they don't care or might even prefer that android and others get worse in that regard

There are more levels than just their own direct position though right? Apple's more data/ad-driven competitors directly gain revenue from having more information. In some cases if Apple is able to shape standards themselves in favor of more privacy, their business model enables them to profit in that environment while it starves others of oxygen. Competitors can't just necessarily take the same privacy stance without suffering harm (and conversely, Apple can't fight battles on pricing or data-driven features like AI as effectively). Businesses seeking to alter the environment itself to match their strengths isn't unheard of and can make a lot of sense.

On the flip side, Chrome can ram through implementations before their standardized and people will start using them.

But not on iOS, which as of this writing is still a big deal.

Reply on news.ycombinator.com