Websites can now fingerprint a device when multiple browser instances are used

It makes many more completely usable. Floating headers and footers? Dead. Survey pop-ups? Dead. Pop-ups begging for your email address? Dead. Dumb fading in text and images? Dead. Needless whiz-bang animations? Dead. Site load times? Dramatically reduced.

Browsing the web with NoScript is far more pleasant, even if I have to sometimes open a menu to enable a couple domains to make a poorly developed website usable. I'd highly recommend it to anyone even remotely technical.

Well, afaik Opera has content blocking by default, Firefox should do the same. MS and Apple could potentially add it.

Hmm, a good idea would be to make it possible to use Tor Browser without Tor, for those who don't need strong anonymity, but still want to resist browser fingerprinting.

If the browser reports that your OS is GNU Hurd you could only be RMS, so fingerprinting would be redundant.

You can just enable those parts that you need while still avoiding vast majority of bloat. At least for Firefox there's uMatrix that allows for finetuning of what exactly you want to enable/disable.

So my two points are perhaps overlapping.

I don't want people to track me on the internet, I think the main reason they bother is that they can show me ads that will be more interesting to me and make them more money. I can resist this by not showing the adverts to myself.

I'd like to make it harder for them to track me at all, though this is always an arms war it seems like I'm labeling myself at the moment. I'm not familiar with the technology they use to detect adblockers, does it detect "U-Block Origin (Firefox) Ver 17.3" or does it just detect "I can't seem to see the ad I know should be here, this user is blocking my ads." if it's the latter then my proposal to adopt a blank/universal fingerprint is willing to confess the single bit of information of whether the user has decided to refuse adverts.

> I could be mistaken but doesn't the use of an adblocker make you even more obvious - e.g. Your fingerprint becomes more easily discernible from the rest of the Hurd, you become more obvious.

In my generation (I'm 28), and even more in my cousins' (early twenties) it looks like the hurd is using an adblocker. And I'm talking about art students, acountants and chefs not IT engineers.

You just can't spend hours on YouTube videos without an adblocker on …

If the browser reports that your OS is GNU Hurd you could only be RMS, so fingerprinting would be redundant.

For a lot of single page applications, javascript makes sense. Less data to load from server on subsequent requests. Your app is a lot richer.

Sure you can disable js, but for the majority the Web would be really broken without js.

As a culture, tracking is everywhere. Disabling js still logs your up, referrer and a bunch of other things.

I do like what uorigin/adblock and other extensions are doing.

> In an ideal world, I wouldn't even need to know your browser, I would just need to know its capabilities.

Isn't that info still enough for finger printing the browser, if they have enough different capabilities?

From firsthand experience, I've learned to live with broken websites and often end up _not_ using sites that rely heavily on javascript, and especially not sites that rely heavily on loading javascript from third-party domains. The worst offenders, by far, are news sites. Coming close are just about every startup that has a heavy focus on fancy web front end.

Since many of those sites "work" by tracking you and relentlessly analyzing your behavior, I'd say that's a good thing.

If a site shows me nothing but a blank screen when I load it up with scripts disabled, I am very reluctant to enable 14 different script domains just to see a paged article, or worse, a slide show.

Allowing scripts to run only from whitelisted domains makes the web a better place.

If a website doesn't have at least minimal functionality (i.e. the article can be read), then the website is broken. Fortunately, most websites that aren't complete trash work ok without JS. Very few websites need to have their JS whitelisted, which only has to be done on the first visit.

Running unknown programs from random hosts on the internet - even in a limited environment - is a bad idea. Fortunately, documents (including images, audio, video, etc.) do not need Turing completeness. A lot of people will react strongly against the idea of not using JS, often because their income depends on tricking users into running spyware/malware,

> If you shut off JavaScript a lot of sites won't work

If a site requires JavaScript, it already doesn't work. If a site requires JavaScript, its owner clearly doesn't care about either your security or your privacy.

Why use a site which requires JavaScript?

JavaScript delenda est.

Logging in to the Guest account on OSX accomplishes what you want, no?

> I am reminded that what I really want is the ability to jail/chroot a browser.

Sounds a bit like local Docker for browsing?

Everyone would download the same Chrome container with the exact same clean config and software rendering so the canvas/WebGL fingerprinting yielded nothing?

You actually can do something like this with Firefox. If you load Firefox with the "-ProfileManager" switch (and you don't have another Firefox window open; see below for how to get round this), it'll open a window where you can choose your user profile. You can create and delete profiles from there, and a new profile is exactly the same as a completely new browser installation. (This includes any settings you may have for automatic browser updates; if you've turned these off on your normal profile, the first thing you should do on the new profile is turn off the automatic browser updates again, as browser updates are global and not per-profile.)

If you like, you can uncheck the "Use the selected profile without asking at startup" checkbox to have the window show up every time you start Firefox (which is defined as loading Firefox when there's no Firefox window already open). Doing this has the additional side benefit that if an application tries to open Firefox and load a new URL when you don't have any Firefox windows open, you'll be alerted to it by the Choose User Profile box - very useful if your normal profile takes a long time to load!

If you want, you can add the "-no-remote" switch to tell a new Firefox process not to connect with any existing one, which will allow you to open a new profile in a different browser window while you've still got the original running in other windows. However, those windows will share the same taskbar grouping, so I'd recommend you apply a different theme to the new profile to allow you to distinguish the two.

(Note: You should not use "-no-remote" by default, as a browser profile can only be open by one process at a time and you won't be able to open new windows through your shortcut icon.)

Of course, none of this will defeat the multiple-browser fingerprinting techniques mentioned in the article, but it's still incredibly useful.

I'm not sure if there's an equivalent in Chrome, or at least one that goes as far as Firefox does.

Try uMatrix. It's available on both Firefox and Chrome, and I actually like it better than NoScript.

Chrome allows you to enable/disable javascript on a per domain basis. It's not an extension or very flexible but I've found it useful for most situations e.g whitelisting js for my bank website.

Sometimes it's frustrating to get sites working with it, but it's nice to know I can have such fine grained control over every (I think?) connection each website is making. Sometimes I'm just astonished - some sites are making network requests to dozens and dozens of other domains!

Good point. So maybe browsers should make the full version the default and then add the following options for more tech savvy users (and users can set the permanent default or per website setting):

1) full mode (all JS is enabled)

2) lite mode (only the bare JS is enabled, no tracking possible)

3) suggested mode (a machine learning algorithm decides what is really needed to be enabled and what is there for tracking purposes)

4) manual mode (somewhere in the settings you can tick and untick verious JS APIs that you want enabled and disabled, like websockets, WebGL etc)

I understand the view and pains of the webdeveloper, but quite frankly I think privacy issues are way more important. Not even in the same order of magnitude.

Your comment feels like a restaurant saying 'Ok, I understand cleanliness is important, but as a cook washing dishes all the time is really annoying so I only wash them if customers ask for clean dishes'

Let me address the "normal" web developers then:

Don't use cookies. Don't use Javascript.

And to use your own words:

<quote> "It would be better to add the functionality you are suggesting as an option and not by default, so people, who understand the "risks" of not viewing some sites properly in favor of more privacy, will turn it on by themselves." </quote>

Turning off all the cruft makes websites MORE usable not less. Plain text, offers the highest information density available. So do you want dancing monkeys on your screen, or do you want information?

> I understand that privacy is a big issue, but think about "normal" web developers who just want to show a cool working website to their users, but need to display this message to them: "Thank you for looking at our website, but unfortunately your browser is in lite JavaScript mode. Please set it to full functionality again and restart your browser en go to our site once more.".

My brain melted out of my ears when I read this sentence. Why on Earth do you need JavaScript to display a "cool" website? So you can make the text fade in for no reason? I think you need to re-think what the Internet is for.

This isn't about being invisible. 99.9% of the people can't, including most of the HN crowd. It has become literally almost impossible. This is about making a statement for what you believe and fighting for digital world we want.

You can always use techniques such as blending in if you really must, tools such as Tails or QubesOS.

If they want to put a red pin on me with the words activist and "conscious of us", let them while and if they can.

Edit: changed the word "secure" to "invisible" because they are different things entangled in this scenario.

Is it, though? To the best of my knowledge, macros don't execute by default, silently, and in so doing facilitate my being tracked by people wanting to sell me generic brand pharmaceuticals.

JS is different---your browser automatically downloads and executes untrusted, unsigned, arbitrary, ephemeral code that can do whatever it feels like. Almost worse: is does so silently without the user's knowledge, and has the illusion of remote execution, misleading the user into thinking no software is actually running on their own computer.

>Computers help you be more productive, but it also helps the people who want to profile you

I disagree with the idea that computers == JavaScript, and furthermore with the idea that JavaScript helps me be more productive.

Excel makes me productive. React.js as a service does not.

> What's the alternative?

The alternative is cleanly separating web browsing (a passive activity requiring no code execution) and using distributed apps.

I'm not at all against the idea of a common, cross-platform execution environment; I'm 100% against the idea of executing cross-platform code when all I want to do is read an article.

> Throwing web-interactivity (via Javascript) away

Javascript is not the only way to provide interactivity. CSS, for example, provides some form validation methods in a declarative style. Sometimes you can do it server-side. Many types of interactivity were possible before the current JS mess.

If there is a type of common interactivity that is not supported without JS, we can always add it as a new browser features, just like we did with everything else in the browser.

> any functionality that offers access to the hardware (via however many layers) to "apps" from the "cloud" can be exploited this way

That's why you don't provide an runtime environment for "apps". Rendering data (a document, an image, video, etc.) does not need arbitrary software. It only needs a way to send a media file to the appropriate renderer. <img> and <video> tags should work fine.

> how will YouTube play videos?

Why is this even a question? They can serve an mp4 (or whatever) at some URL, and reference it in the <video> tag. Video playback doesn't require running arbitrary software, because we already have local video players.

Are you implying that Firefox hasn't solved this problem only because Mozilla takes money from Google for search referrals?

The functionality (and corresponding machine implementation) matrix of a user will always give enough entropy to construct an identity, but much of this was created because of the lack of any other reliable and stable option. A stable ID would definitely be used since services now spend a considerable amount of time and effort in constantly figuring it out through other means.

A single website is too narrow since things like ad networks (which are the economic backbone of the web) work across many sites. A single root domain is an outdated isolation model on the modern web.

Outside of that, the only other answer is regulation. Something that is missing in many areas although some countries seem to be making good progress.

A standard UUID generated at the OS level and passed through seamlessly through a browser? Yes.

Client-side control means that you can turn it off depending on TOR, private-mode, VPN, or whatever else. The technical aspects though would make the web faster and easier to deal with.

Checking what sites use specific techniques is not the same as reversing JS to find new techniques.

Charge backs. For a long time those industries were dominated by affiliate programs, and so affiliates would hire firms in other countries to use stolen credit cards to inflate memberships, then charge back after the affiliate got their payout. By using shared networks of the finger prints we were able to identify computers already used for fraud on other sites or our own sites and refuse them the chance to even sign up.

EDIT: Sorry, to be clear, the people using the stolen credit cards didn't charge back, the actual owners of the cards would. But this affected the industries two-fold, first in constantly having to battle with credit card and billing companies that didn't want to provide services for an industry with such a high charge back rate, but it also hurt us in paying out to affiliates who cost us money instead of bringing it in.

You get tracked, that's all. And perhaps linked to browsing on your default browser, without Tor. But maybe that doesn't concern you :)

Letting a browser access video graphics processor is a terrible idea.

I don't know, maybe massive pwnage?

I'm sure you know that and are just being difficult. Its because OpenGL/DirectX drivers run a large compiler in the kernel and then send the compiled code to the GPU. None of that code is inspectable. Drivers routinely have special hacks to tweak the performance of particular games or matching patterns of use that tweak special paths, making thorough testing particularly hard.

https://medium.com/@afd_icl/hey-a-web-page-just-restarted-my... https://twitter.com/alexstamos/status/829124727289544704