Hacker News Reader

Comment by user17843 | Hacker News Reader

It looks like the prevalence is low and it can easily be blocked with blocking the scripts in question.

Nevertheless, what needs to happen is that all major browser makers come together and simply create a set of standard API values that do not harm daily browsing and make it possible for users to blend in with the masses, if they opt-in to activate

It would be sufficient to create a couple of uniform user agents, list of fonts, list of plugins, canvas hash, platform and webgl data to bring the uniqueness down.

View on HN

There are SaSS companies that have their entire business model around creating databases of fingerprints - for example determining bots. These scripts track you over multiple websites and are very well concealed, so you won't find them on any ad blocker blacklist.

Also, living in the EU won't protect you from getting fingerprinted.

why do the studies referenced in the above study only show a very low <1% prevalence? Do they omitt the "good fingerprinters"?

I don't think so. A good fingerprinter will use a honeypot - an easy to detect fingerpriting script in addition to the real one.

I suspect it will always be possible to detect at least the brand of the browser, regardless of what the user-agent string says. It's just too damn hard to implement the entire web specification consistently, and malevolent actors can easily exploit any small deviations in the implementation. And of course things which are not in the web specification (such as timing) can be exploited.

After you figured out the browser, it will also always be possible to find out the browser version, because newer versions implement features not present in older versions. Then you just need a hint to the OS (at least distuingishing Linux from Windows seems easy) and you have reconstructed the entire User Agent string.

> it will also always be possible to find out the browser version, because newer versions implement features not present in older versions

True, but most browsers have an auto-update scheme, so basically everybody is on the same version at a given time (by approximation).

Reply on news.ycombinator.com