Hacker News Reader

Comment by jammygit | Hacker News Reader

What terrible browser design to send all that data. I would never have imagined my computer was sending all that off 10 years ago

View on HN

It's doesn't "send the data" so much as "a general purpose UI platform cannot work unless a program knows the configuration of the UI". The idea that your complex computing environment could have an arbitrary complex conversation with an app, and not expose its identity, while perhaps desirable, it impractical.

You can browser behind a generic user-agent firewall, but you'll get a severely degraded experience that treats an Apple watch the same as a desktop workstation.

Using the user agent string for this is not needed and is not common now for new projects.

Indeed, I didn't write "user agent string"; I wrote "user agent".

Standardization on only a few design variations might fix this? People would complain about monocultures, though.

It's not just about design. For instance there is Canvas and WebGL for interactive content. Different GPU's draw things slightly differently. Someone creates a canvas in the background, draws stuff, reads it back and since your machine has a particular way of drawing things (because of GPU design, drivers, different browser implementations of the painting stack) you can be tracked. Same goes for audio capabilities. If you don't want multimedia, then fine, it is slightly easier. Then the server can probably try to track you with your upload / download speed, ping etc. They can tax your cpu to see how fast it is. Then they get your browser width / height. Combine them and you can be tracked pretty accurately. There are countless avenues for fingerprinting.

Well, sure, but at the hardware level, more standardization is possible too. If you have a popular model of computer and it's the same as everyone else's computer, it's hard to get much out of identifying it. This is kind of what Apple does by offering a limited number of models.

Another approach would be to use standardized VPN's that hide client machine differences.

There are downsides, of course. I'm not sure people care about fingerprinting enough to do all that.

I didn't sign up for "a general purpose UI platform". I got on board when it was a hypertext publication system. They've been boiling this frog for 25 years.

Every year, I'm less and less convinced that JavaScript is desirable to have in a web browser.

I've heard of a similar phenomenon where hackers probing a system can fingerprint different software stacks based on what they get as responses to different "undefined behavior" inputs. Anything that communicates with the outside world is intrinsically giving up some information about itself.

It was worse when flash and java were in common use.

Reply on news.ycombinator.com