Hacker News Reader

Comment by toyg | Hacker News Reader

VPN protection from site-level tracking is basically nonexistent. Browser fingerprinting is widespread and bypasses anything a VPN might offer. VPN is effective against network-level issues, not against browser-based tracking - it's a different level in the stack.

View on HN

Virtual machines have the same virtualized graphics drivers, if everyone used virtual machines for browsing and deleted cookies and cache, web tracking would be restrict to IP-based.

There are still several bits of data, like plugin support, touch support, platform, language, screen size, and timezone, that have to be actively manipulated if you want to reduce the likelihood of unique tracking.

are there any browsers that obscure these properties to sites?

Not that I know of -- there are just browsers that don't send out some stuff because they don't have the capability to detect it. You could do some more header-stripping with extensions and proxies, but in the end, like with cookies, this is stuff that a website might need to actually work properly.

The TOR browser if probably your best bet for this, even if you don't use TOR to browse.

Yes, but it is trivial to distinguish usage of Tor browser as commonly distributed and Tor browser in TAILS, by default one comes with an additional plug-in.

To do this well, you have to take special care with how exactly you obscure them. If your browser refuses to report those values, or sends junk values, then you might actually make the problem worse. It's the internet version of this: https://xkcd.com/1105/

Firefox has various privacy.resistFingerprinting preferences that can be flipped by extensions (or manually). Expect some sites to break though.

Edit: Oh, apparently there's built-in UI now: https://blog.mozilla.org/firefox/how-to-block-fingerprinting...

Yes. And using a VPN in a dedicated VM isolates activity well from the host machine and ISP uplink. There's still the risk that VPN providers will share information with adversaries. And so it's better to use nested VPN chains, which distributes over multiple providers.

The matter of virtual graphics drivers cuts both ways, however. Multiple VMs in a host that use the same virtual graphics driver have the same WebGL fingerprint. So if you want multiple fully compartmentalized VMs on a given host, they must use different virtual graphics drivers. That is, Windows vs macOS vs Debian family vs vs Red Hat family vs BSD family etc.

Sounds like that's fairly easily solved by just using a different browser only for your porn habits. If you use FF for your normal web browsing, only use Chrome just for porn, etc.

My understanding is that finger printing relies on gleaning data about the underlying os and hardware. I'd think using a browser in a fresh VM may offer more security security in this case.

Shouldn't browsers enable anti-fingerprinting (fingerprint spoofing) when you go incognito?

incognito was designed for when sharing a browser with another user, but does nothing on the remote end to keep you private.

ad nauseum actively poisons the dataset by clicking on every link it is presented. this can be useful when it is combined with other techniques. https://web.archive.org/web/20180714043311/https://iotdarwin...

(sadly) do-not-track also doesn't work - it makes you stick out even more when activating it. best is to try to blend in with aggressive hardware compartmentalization. there are no solutions that can easily be recommended to somebody less tech-savvy which would protect them from bad actors (and GDPR or not - there will always be plenty of them).

Well, Firefox for one does things to help against tracking. Surely not all the things that can be done, but at least the ones they figured out to be worth it for everyone.

VPN in a VM, then, or on a different PC altogether.

How does that factor in with locked-down platforms like iOS? Can you effectively fingerprint one of those devices?

I'm not in that business but I'd be surprised if you couldn't. Mobile devices are usually more trackable, since they are always at the forefront of browser/hardware integration in ways that increase the fingerprint surface ("does it support geolocation? does it support battery-related apis?" etc etc).

Does Brave impact that?

Brave on android FWIW seems to help fingerprinting efforts by including the model of phone in the user agent.

Reply on news.ycombinator.com