Hacker News Reader

Comment by jimktrains2 | Hacker News Reader

If (2) was a huge issue for them, wouldn't removing the UA header help tremendously as well?

(Sure, you'd know it was an apple device, but that's still less than currently. It's also less if other browsers followed suit.)

View on HN

The safari UA is fixed - there was a post or document at some point saying that it had basically become a tracking tool, so beyond the compatibility requirements it is no longer changing.

Similarly queryable font and plugin apis are fixed.

But DNT is simply a tracking metric - and was opposed by everyone with non-ad revenue (specifically it was offered up by the ad industry to avoid regulation).

iOS user agents aren't very identifying. Despite having multiple version numbers in them, all they pretty much tell you is 1) what type of ios device it is (eg. iphone or ipad) and 2) what ios version it is (mobile safari is updated along with ios, so the version numbers are pretty much the same for the same ios release). Considering that most ios users are up to date, you'll be hard pressed to squeeze more than a few bits of entropy from it.

>Considering that most ios users are up to date,

That's what makes it so valuable really. You get little to no entropy for a large portion of users, but you get a huge amount of entropy about the people who aren't.

So you get amazing entropy on my grandma, which is quite possibly not worth the processing time you spent to track her, in terms of ad revenue or marketing campaigns. Sure - that's probably not the case in most of the cases, but it sure pollutes your otherwise good dataset.

I think part of the advantage of DNT for fingerprinting is that it's a user set signal.

BTW you can query the WebGL render to identify CPU / GPU information for iOS devices which is slightly more useful than just the UA

https://webkit.org/blog/8042/release-notes-for-safari-techno...

> Froze the user-agent string to reduce web compatibility risk and to prevent its use for fingerprinting

https://github.com/WebKit/webkit/commit/4bc237458115ac916f39...

> Freeze the version reported as User Agent to OS 10.13.4 (OS 11.3 on iOS) and WebKit 605.1.15 for User Agent purposes.

IMO 2) is a PR move. Removing 1 bit of data isn't going to do much for anti-fingerprinting.

The number of people who enable DNT is relatively small, so having it enabled is worth a lot more than 1 bit.

It’s vastly more than 1 bit - if I recall correctly the amount of bits of info you get is something like log(1/P(event)) so if P(dnt==true) is less than 0.5 you accede 1 bit of information. It’s logically probably closer to 10bits of uniqueness assuming .01% of the population have it enabled.

Reply on news.ycombinator.com