Hacker News Reader

Comment by Bartweiss | Hacker News Reader

Learning about browser/machine fingerprinting is what finally broke me. I block ads, fight script execution, and enforce SSL, but it was one bridge too far. I can't conceal every trace of what my browser is sending, no matter what I do, and so I just accept that I'll be tracked.

On mobile, I turn off location, but I use Gmail and Android and Google search and I can't pretend I actually have any privacy left. Realistically, I don't see a way out worth taking.

And here I am preaching the value of privacy, but that's not the same as being able to make it happen.

View on HN

" I can't conceal every trace of what my browser is sending, no matter what I do, and so I just accept that I'll be tracked."

It's worse than that. I determined early on in that game that just concealing stuff could be an identifier or profile in itself. The apathy of the crowds, little oligopolies that form in browsers/apps to make them more alike, and creative ways outliers try to be different combine to increase the odds outliers get identified given certain amount of data.

The original way I figured it out was when I was working on deployment strategies for both high-assurance SSL and Tor appliances. They HW/SW architecture should've made them immune to code injection with some protection against leaks. Sounds great right? Wrong. They'd be about the only nodes where the 0-days NSA et al likely had wouldn't work. That would instantly identify them as using the strong stuff. Low volume & niche offering means small enough for close inspection. Few that mattered to enemy would be so low in number so as to be easily targeted with other more personal attacks. Just being bulletproof was itself an identifier that led to them using something better than digital bullets.

Any solutions devolved from the strong security I could prove to a large degree to a cat and mouse game like others were playing but for different objectives. Seems a bit hopeless. Even software immune to hacks has to blend in if you're wanting privacy or dodging attention of nation states. So, the widely deployed stuff also needs that property at least for whatever components you're blending with. Didn't leave me optimistic...

I'm not sure the big companies actually track you based on browser/machine fingerprinting. It's certainly entirely possible that they could, but it's relatively expensive to develop and maintain the infrastructure that does so, all to track a bunch of paranoids who aren't lucrative subjects of targeted advertising.

Sort of a cold comfort, I know.

Also, you're not fighting for the/your privacy of today- you're fighting for tomorrow's privacy. Facebook is scummy with your data, but Google (who knows hell of a lot more about you) is pretty nice with your data. The problems start when they won't be. Google knows what you buy, what's on your mind, which apps you open during the day and when, which people you have contact with and how often and when, they have your e-mail, they have your location and your usual routes, where you work and live. They also have aggregate data about stuff like traffic flow, festivals, businesses, etc. etc.

Now imagine them selling this data to the highest bidders. Insurance will know if you sport or not, if you eat healthy, if you smoke, etc.. Other companies will spring up that buy data to check if you were really sick for work, or just slacking (and businesses then buy this service for a price). Advertisers would sell their kids, mother and grandmother's soul for access to this kind of data. You think impulse-buy-optimization of supermarkets is bad? oh boy..

So yeah, fight the good fight, even if its a bit of a hassle, and slightly more expensive. You can actually find a good balance between privacy and usability. I use Protonmail for my mail, Apple Maps for my mapping needs (Google Maps as backup, sparingly), DuckDuckGo for search, Lastpass for passwords and iOS (Android is mined HARD by Google) + OS X as my OSes. Linux is even better, but you're constantly tweaking or fixing small things.

> Now imagine them selling this data to the highest bidders.

A bit of a moot point, because Google not selling it is their business model. What Google might start selling pretty soon are predictions about people (and in some way they already do it) - but never the underlying data.

If Google starts failing, then I'd become really worried though. If they're desperate enough they might just sell the data off (at their own loss of course, but a business fighting for survival will go to any lengths possible...)

I think the breakdown has four/five key cases that need to be considered to 'trust' someone with your data.

1. Day to day use of data. (Google does pretty well here).

2. Collapse/failure behavior. (Will they sell it? If not, will they securely delete it as they close up shop?)

3. Breach risk. (Heartbleed was bad news, but Google is no worse than anyone.)

4. Abuse risk. (Police databases might have noble motives, but people keep stalking exes with them.)

5. Government access. (Ugh.)

Google's data ownership does better on that checklist than most people, but no one offers full safety with that list.

> So yeah, fight the good fight

The best way to "fight" would be to make alternatives to Google and Facebook. You're not gonna sway the masses any other way,

Typing something into your browser's address bar (which defaults to Google's search on every platform) remains the most convenient way to find something online. For the vast majority of people, Google effectively IS the internet.

Cold comfort, but better than most. I'd never looked into in-the-wild use of fingerprinting, but it does seem likely that people who've blocked cookies are terrible advertising targets to begin with.

Reply on news.ycombinator.com