Hacker News Reader

Comment by alecsm | Hacker News Reader

So there's no light at the end of the tunnel.

We remove the privacy settings because otherwise webs won't work.

Avoid the websites. Call companies, go to the library, or just abstain altogether.

This is the approach I've been taking. Outside of a handful of websites, the situation has become so intolerable that it's not really worth trying to find a way to safely use the wider web anymore.

Avoid legitimate websites that Brave willfully and carelessly breaks?

Avoid websites which require a specific browser, and specific browser settings to function. In the vast majority of cases there's no reason why a site needs to scan my computer, use webgl, use webrtc, and a million other things which are used to track me. They're built poorly in this way because they're only testing against chrome, and are apathetic about privacy.

I recently had to purchase some audio plug-ins for music production. I was trying to decide between two bundles by two competing companies. They were pretty even, in my mind, in terms of pros and cons.

Then I discovered that one of the two companies had a website that's broken by basic privacy settings, such as preventing autoplay for videos.

I gave my money to the other company.

Or write custom clients for any website you care about. Essentially scrapers for every site which will extract and present information without the website's code running.

I’ve lost hope. My amiunique.org fingerprint is always unique.

I’d like my web browser to peach less on me. Websites don’t need to know my primary browsing language is en-gb, I’m rather proficient in other written dialects.

They don’t need to fingerprint my audio setup.

It seems like browsers were conceived at a time when surveillance capitalism didn’t exist and they still behave like thar

What I don't understand is, why can't we just have a browser that doesn't give any of those details that is used to determine unique a browser. It doesn't make sense to allow a website to have access to that info.

I think we can? I mean, technically it's possible. Maybe it even already exists.

There are such projects. The problem is that so few people use such browsers that just having that browser is often enough to fingerprint you.

The most popular browsers are all funded by advertising, which has entirely consumed the web.

You mean like the tor-browser? It's not that they don't exist it's more that they're pointless if they're not used by lots of people.

Personally I'm more in favour of randomizing some of the properties. That way you don't need to rely on being unique. In the end it's all about how much information you're transmitting about your identity, and while picking a common value is one way of increasing entropy picking a random value is much more effective.

You don't actually want that. Not giving up those details is information unto itself. You want a browser that gives up the same bits as everyone else's browsers so they can't tell it apart from the others.

I've never understood why websites need to be able to get a list of installed fonts.

Try implementing Photoshop as a web app without it.

I've never understood why someone would want to implement Photoshop as a web app.

Given that the original Photoshop is a nightmare subscription service, I hope developers implement a version of it on all existing platforms.

To some the browser is the platform, more than the operating system.

You may dislike the move. For me it has made the linux desktop more feasible.

I can order photos through a print shop online, without having to install a windows-only program (just as an example).

Photopea.com is actually pretty great. It works on any device under the sun and it's free (ad supported, with a subscription if you don't want ads).

It's good enough that I stopped pirating a copy of Photoshop ages ago. Not perfect, but pretty close to it.

You can ask for permission, like browsers already do for a ton of things.

Instead of that capability, couldn't there have been, e.g., <input type="font"> instead? Let the website ask the browser to show the user a list of installed fonts, and to pick a single one to tell the website about.

> I've never understood why websites need to be able to get a list of installed fonts.

I assumed it was a left over from the early days of the web before fonts were a thing.

Brave actually has font protection I believe :)

> My amiunique.org fingerprint is always unique.

A bit of an aside, but I love that their data set consists of 26% Linux users and 41% Firefox users.

It’s the year of Linux on the desktop!

> It seems like browsers were conceived at a time when surveillance capitalism didn’t exist and they still behave like thar

It's worse than that - the world's most popular browser was created by a company which gets most of its competitive advantage and, arguably, revenue from surveillance capitalism. The incentive to make fingerprinting hard is not just 0, it's negative.

False. https://support.google.com/analytics/answer/9682282?hl=en

Google doesn't like fingerprinting. That may be because they already have all your identities and don't want competition, but they still don't like fingerprinting.

> Google doesn't like fingerprinting. That may be because they already have all your identities and don't want competition

Google sells ads. Of course they don't want you rolling your own fingerprinting. That's their job. I'd need to see a statement signed under oath to believe Google, itself, doesn't fingerprint.

>amiunique.org fingerprint is always unique.

Do we really have reason to believe this matters? Just because amiunique.org identifies users based on all possible metrics available from a website doesn't necessarily mean much:

- We don't know whether other websites actually use this same technique to attempt to identify unique users. In other words, there's no indication that normal commercial websites are taking every possible measure of the browser, assigning a UUID to that configuration, and then attempting to build a fingerprint based on that, rather than just using cookies, and perhaps other, more basic fingerprinting.

- A browser might give different metrics in private browsing mode, due to some plugins operating differently.

- A normal website (eg: google.com) observes a much, much wider list of potential browser configurations than amiunique.org. There's no reason to think that you'd be just as unique when compared to a much wider selection of possible configurations.

- Corporate solutions, such as fingerprint.com _can_ be tricked.

Unfortunately that particular test telling everyone their fingerprint is unique isn't very useful.

Try something like fingerprint.com, close your browser session, go back, and compare IDs.

On Tor Browser or Mullvad Browser, it should generally register each session as your first session, with unique IDs. If not, the useful life of the tracking should be short.

Relevant discussion: https://old.reddit.com/r/TOR/comments/qxt7di/tor_is_still_fi...

Thanks for the explanation

> My amiunique.org fingerprint is always unique.

Disable JavaScript. That helps a little bit. Keep js off by default on all websites, and enable it by individual bases.

https://addons.mozilla.org/en-US/firefox/addon/disable-javas...

https://apps.apple.com/us/app/stopthescript/id1588394487

>primary browsing language is en-gb

Related to this, being multi-lingual on the web can be annoying. If I set my language to da-DK (my native), some non-danish websites will serve a poorly translated or machine translated version. But if I set it to en-GB a lot of danish web sites will serve an english translation, which I also don't want. I have to fiddle with this setting a lot. I wish I could set da-DK only for .dk TLDs.

If anything we need more settings, and more warning popups to go along with them that list or link to information on some of the breakage users can expect. Inform the user and let them decide.

Reply on news.ycombinator.com