Posted by royfish 1 day ago
If people have a problem with fingerprinting, they need to focus on making it illegal to trade data tied to fingerprints, not trying to make users all look the same (we aren't!).
I have a hard time figuring out why quality values are even included for Accept-Language. They either have one of the preferred values, or they don't.
I don't know about expressing ties. If there really is a tie and the client is just as happy to receive either language of equal Q, then it doesn't matter to the client that one is consistently preferred over another. Perhaps it could matter to the server if e.g. the client indicated that "en" and "zh" are tied, but the "en" content can be served in fewer bytes than it can serve the "zh" content, but it seems like such a niche use case.
edit: RFC 9110 offers an explanation: "Note that some recipients treat the order in which language tags are listed as an indication of descending priority, particularly for tags that are assigned equal quality values (no value is the same as q=1). However, this behavior cannot be relied upon. For consistency and to maximize interoperability, many user agents assign each language tag a unique quality value while also listing them in order of decreasing quality."
Fun anecdote: I remember seeing a screenshot of a website selling a scented candle called "basic bitch", which was machine translated so that the idiomatic meaning was entirely lost. So the translation ended up meaning something like "foundational female dog".
Say I have a remote employee who is only able to access your internal systems via his yubikey. His fingerprint is "Genuine Antelope".
Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him. I create a new session for him on the provisioning portal (so he can enroll the new key) but now his fingerprint is "Interesting Elephant". What do I do with this information?
It might be better to log the exact forensics and show the administrator the differences, e.g, "User has a new font called "my_handwriting.ttf" since a week ago", or "appears to be a totally different processor, and the new system has Russian fonts installed".
They should be authorized ahead of time.
> What do I do with this information?
Not much. You can't authenticate a person using their (public) fingerprint information.
Your problem boils down to: "How can I verify someone's identity over the internet". You can exchange emergency recovery codes ahead of time (e.g. in an envelope), you could trust public keys from both of their yubikeys, but they can be stolen.
Yes, but it's a signal! There's a cost to spoof it. A scammer could cheaply start a VM that clones your font profile, but at what cost could they replicate your CPU SKU and GPU combination to provide identical webGL timings?
Other signals include the ability of your employee to show their face on a video call, to sound like themselves on a voice call, the ability contact you from their home IP, to receive official mail at their listed address, to produce a second 2FA token you'd previously registered (but not activated) or repeat a code word you'd exchanged. Any of these things can be spoofed, bypassed, copied, or burgled, but each one imposes some cost on the attacker.
The question is how to surface this information in a way that equips help desk staff and doesn't deceive them into authorizing unnecessary risks.
What if "fingerprints" are contained in the values of Cookie: headers
It does mean that sites that uses 2FA (so every site nowadays) flag me as a coming from a new device each visit, and I have to have my phone nearby every time I want to use my computer, which is quite annoying. If you use GrapheneOS, you can obfuscate your phone too on WiFi networks (and sites, but GrapheneOS not needed for that, just Brave). You can't obfuscate yourself on cellular networks though, unless you have a ton of sim cards you rotate through.
I would bet money that Brave cannot defeat CreepJS. The only thing I've ever seen do it, ironically, is Safari in private mode.
Also just using your computer normally and visiting regular websites already tracks you regardless of your browser's privacy abilities, and I promise data brokers don't care what browser you use, your overall online behavior is still unique.
And phones!
So what sort of benefits are you reaping from your anti-fingerprinting measures?
> So what sort of benefits are you reaping from your anti-fingerprinting measures?
Mostly pride on knowing that I'm preventing companies from doing to me exactly what I wouldn't consent to if they asked me outright.
Sure its just for ads (mostly). Sure the chances of my data leak leading to a personalized cyber attack are slim (I don't actually believe this but you might). Sure, [niche scenario] [non-zero probability] might be prevented. Sure there is a meatspace equivalent to the cyberspace invasion of privacy.
I wouldn't consent to stalking in meatspace, for any reason, and conveniently to my knowledge no one is stalking me physically. I dont consent to stalking in cyber space either, for any reason, and I do know that companies do, and they make it an unending uphill battle to let them know and force them to not be blatantly disrespectful. So I will make it as hard as possible, within what I think is reasonable, to make it useless or difficult for them to stalk me online.
And yes, online things have affected my physical life, so these niche applications have occurred to me and my efforts have reduced the negative impacts, to a satisfactory level, and I will continue to kick against the pricks, because it works.
A better question would be how are you being screwed over if you never bother to try to stop companies from collecting as much data as they possibly can about your private life? It can cost you a job offer, or cause you to pay more than your neighbor for the same products/services. It can get your data leaked, or sold to scammers. Companies use the data they collect on you for things as trivial as deciding how long to you leave you on hold. The more data they have on you, the easier it becomes for them to use it against you.
Feel free to give companies every bit of personal data they want from you. They'll be thrilled to use that information at any time and in any way they think it will benefit them. Until we have laws against surveillance capitalism the only person looking out for your interests is you, but only if you can be bothered. It'll sure help companies take advantage of you if you decide it's not worth trying.
Anywhere I go in meatspace, people could be collecting data about me and my behavior. That has always been true since the beginning of time. An old lady can sit on her porch and take notes about my outfit, my comings and goings, and every driver who comes to my door. Today, they're saying that Target can definitely hear our WiFi/BT MACs as soon as we get into their store, and they see/track everything on camera everywhere inside. My Groucho Marx isn't going to hinder or change that!
All I can do, honestly, is be judicious about what sites I visit, and be forthright in my interactions. I should cultivate good relationships with trustworthy, reputable companies, and stay away from the rest. I cannot ultimately prevent the buying and selling behind the scenes. We cannot realistically prevent collection of everything possible.
I don't shop at Temu or Alibaba, and I don't search on Yandex. I checked my "About Me" on Amazon yesterday and it's shockingly bland and shallow. However I interact with Google, YouTube, Microsoft, and Cloudflare, it's a foregone conclusion that they know everything. My extensive 19-year history on Wikimedia projects is a shockingly rich treasure trove, if anything just my waking hours of every day since 2007! Your own karma score 22,495 in 14 years is probably a fantastic track record of when you were awake and using a computer. If you're so paranoid about Internet privacy, then you wouldn't be so willingly revealing that stuff in public.
I'm using adblocking DNS again, but awhile ago I sort of dropped the pretense of paranoia, because I understood its futility, and again, life's too short. If evil corpos want to do evil to me based on what they think they know, they can do their worst. I am a Christian man accustomed to suffering and infirmity. I got nothing to lose in this life, except integrity.
Yeah, but you can very easily _limit_ what is collected and sold behind the scenes just buy switching browsers, changing browser settings, or using a couple privacy extensions. A little goes a long way.
Your only option is to never buy anything online and only pay cash.
I probably wouldn't go as far as never buying anything online, but paying cash IRL should be something done by everyone to protect their privacy. There are a few other easy things that can massively improve your privacy with minor or no inconvenience: Linux on every PC/laptop, GrapheneOS on phone(s), uBlock on every browser (or a DNS-level sanitizer), car without cellular modem (pull the fuse), non-Google and non-Apple email (ideally your own server or a small provider in a friendly jurisdiction). Also, don't use social media and text over Signal instead. Of course, TVs and other home appliances should be kept off the Internet. Overall, those are some very minor sacrifices for anyone with a little bit of maturity. It's very far from living off the grid or anything like that.
That's a very early 2000s view of the issue. Ads are not what all the surveillance is for, it's just the publicly acceptable excuse for tracking you that companies love to use because nobody cares which ad they get shown. Being able to build a profile of which websites you visit can provide a ton of information about you and that data is increasingly being used offline. It stopped being about ads ages ago and now what you do online can impact your next job offer, what prices you pay, which policies companies apply to you, etc.
You can never limit all data collection. Going to the store and paying in cash will still have you tracked by Flock cameras. The point is just to limit what you can, where you can. Every scrap of data collected about you is going to eventually be used against you later by somebody. No point in giving them anymore ammo than you have to.
At {{job}} we did briefly consider rolling out fingerprint.com, but settled on ja3/ja4 at the CDN layer.
It would be great if a wave of lawmaking started in the USA, because most tech behemots operate from there. I would expect EU to take the lead though IF such a wave would start. The EU has still a fair share of christian/conservative MP's that keeps doing the bidding for companies by pushing chat control, but on the other hand also has some progressive and knowledgeable representatives doing great work, so there might be a glimmer of hope. We need media campaigns and public education though. Political leaders are selected for their political abilities and as such rarely have leadership qualities. If the electorate moves, the leaders will follow it. So we have to start at the bottom.