YHK - yet another hacker news clone

Fingerprints Are the New Cookies

45 points royfish 2 hours ago 17 comments

1a527dd5 1 hour ago | parent

My reaction to this is always two fold; firstly cool tech, secondly horrifying invasion of privacy.

At {{job}} we did briefly consider rolling out fingerprint.com, but settled on ja3/ja4 at the CDN layer.

blooalien 1 hour ago | parent

Cookies, in and of themselves, are not bad. Like any tool that can be misused, they're just being abused by a ton of really shitty people in an effort to try to enrich themselves at the expense of others. Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"

Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"

crote 1 hour ago | parent

This is already illegal in the EU. The consent banners were never about cookies, they have always been about the tracking itself!

Same thing the other way: no need to have a banner for a simple login cookie which isn't being used for privacy-invading tracking purposes.

cromka 1 hour ago | parent

Yet I am constantly flagged by various pages because Cloudflare decided I had some bot running at some point on my network. And my IP is fixed. Whatever EU is doing, it doesn't work.

throawayonthe 39 minutes ago | parent

if your IP is fixed, surely no further fingerprinting is necessary?

cowlevel 30 minutes ago | parent

Have you got a TV? Or a car?

Gigachad 29 minutes ago | parent

You might have a residential proxy running somewhere on the network. The latest in botnets is bundling a proxy in with some TV torrent streaming app or whatever else that can run in the background and proxy malicious traffic from your residential IP. Services like cloudflare and crowdsec will keep a constantly updating list of the IP addresses that are actively sending bot traffic and blacklist them. If you can work out where the traffic is coming from and shut it down you should have this issue go away.

buzer 30 minutes ago | parent

> they have always been about the tracking itself!

Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.

Of course there is also the GDPR layer on top of this.

iugtmkbdfil834 1 hour ago | parent

So what is next in this cat and mouse game? Fake-slow browser to miss fingerprint? Declare revolution and declare all advertising illegal?

howunfortunate 59 minutes ago | parent

> See, the thing is, it’s not about you at all. It’s not really about the ads anymore either. Nobody cares about you. And if the police or your government happen to care, I’ll gladly take their money too.

> I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.

> And to the highest bidder it goes!

> What does that make you then? A gear? An ox? A volunteer?

This does absolutely nothing for me. If this resonates with you, can you explain?

I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.

floorsthelimit 30 minutes ago | parent

If every website you ever visits knows it is you, exactly what links you clicked on, and what content you viewed, forever, are you truly ok with that?

howunfortunate 11 minutes ago | parent

Guaranteed deidentified, as the quote above is talking implying?

It's truly totally ok with me, yes.

(I get the non-anonymized concerns, or risk of becoming non-anonymized, that's not what I'm confused about)

Cider9986 38 minutes ago | parent

Fingerprinting is really bad for privacy and the defenses against it are not there. See https://fingerprint.com. Tor Browser defeats it but I don't think there's a highly usable browser like Brave you can use and prevent being tracked by it.

oofbey 36 minutes ago | parent

It’s a question of entropy. If your device is unusual in detectable ways, then the fingerprint has high entropy. But on my iPhone I suspect most of the things being fingerprinted are the same. How many other people get “smug koala”?

micromacrofoot 21 minutes ago | parent

fingerprints pick up on all sorts of things that make you different enough combined with another signal, 33 bits can be enough to single you out from anyone else on the planet... iOS can be 10-15, and given a residential IP that's plenty - always mobile is more anonymous on the web but guess what's much worse? apps.

a native app with 0 permission prompts gets you more bits than web

MiroslavPokorny 23 minutes ago | parent

Theres only one solution, ban third party advertising. Everything else is a compromise that doesnt work anyway.