Hacker News Reader

Comment by gruez | Hacker News Reader

...and that's why you should be using firefox with resistfingerprinting enabled.

…which has its own track record of subtle website breakage, something that is difficult to notice and impossible to mitigate short of disabling this globally. Don’t get me wrong, it’s nice that this exists, but it’s disabled by default for a reason. There are no silver bullets here.

Note: I am the author of this article.

I find it helpful to realize when websites are taking measures to track me. If their site is broken by privacy protections, maybe I don't want to be using that site any more.

It tends to make animations sluggish, see for example https://github.com/framer/motion/issues/441. That’s not because they are trying to track you but simply because requestAnimationFrame (which has its legitimate uses) can potentially be used for fingerprinting. No regular user is going to make the connection between broken functionality and this setting, and I’ve seen developers waste lots of time on this.

I did not knew this! But on the other hand, I've seen "performance.now" in the wild being used to track people.

resistfingerprinting works by making JS APIs less useful, even if used legitimately. If you rely on something that is both accurate and distinct to a user for functionality, that functionality os going to be broken by fingerprinting mitigation. There is no "fingerprinting API" that can simply be disabled, it's a combination of many APIs that all have real-world not-evil uses.

I actually use Firefox to resist fingerprinting, but it's definitely annoying and not for everyone. For one, all times are presented to me in UTC now. I understand why Firefox doesn't present my real timezone, but it's kind of absurd to complain that the website is broken in that case and not the JS API.

Well for one it limits the max texture size to 2048px, when normally 4096 has support everywhere.

>…which has its own track record of subtle website breakage

A perfectly acceptable cost for my privacy.

> …which has its own track record of subtle website breakage, something that is difficult to notice and impossible to mitigate short of disabling this globally. Don’t get me wrong, it’s nice that this exists, but it’s disabled by default for a reason. There are no silver bullets here.

If Firefox had bigger marketshare, that breakage would magically turn into bugs in the broken websites.

> If Firefox had bigger marketshare, that breakage would magically turn into bugs in the broken websites.

... which is probably why Firefox-with-resistFingerprinting doesn't have bigger marketshare.

Mr. Chicken, meet Ms. Egg.

Unlikely. Some of this is very useful functionality being dumbed down, without real workarounds short of scrapping website functionality.

I agree but only partially, because this needs to be enabled by default to get the most out of it.

The issue is that few people use firefox, and even fewer have this flag enabled, and as such it makes you stand out.

My only concern with enabling it by default is that it might just advance the arms race. As well intentioned as the DNT header was, enabling it by default ultimately led to it being completely meaningless. I could see the potential for it making a comeback if there were some sort of legislation behind it giving it teeth.

Those aren’t comparable at all. DNT is a header that required cooperation; nothing to work around. privacy.resistFingerprinting actually solves fingerprinting, and if it were enabled by default it would be incredibly effective. (It won’t be anytime soon, because it breaks many features that average users rely on, via average websites - but individual aspects of it could trickle in.)

If you were worried that determined parties would develop new tracking technologies as a response, rest assured that they’re always doing that.

A user-agent should do what it thinks is in the users best interest. People don't want to have to micromanage it. If it needs to be set up manually it's undermining itself and preventing it's own success. Ultimately it was not a good offer, and Microsoft, not being in the ads business, was correct in rejecting it.

EDIT: Removed wording about the intentions of the inventors.

> The inventors of DNT wanted to look good without actually changing anything

I don't believe that's a fair characterisation at all. The inventors of DNT may have been over-optimistic about potential adoption, but the intention was most certainly to bring about change.

> enabling it by default ultimately led to it being completely meaningless

No, DNT was completely meaningless from the moment it was proposed. Enabling it by default was just Microsoft pointing out that the emperor had no clothes. I don't even agree with you that it was well-intentioned; IMO it was a bad faith effort to push a non-fix, to try and hoodwink people into not calling for regulation and/or technical solutions with actual teeth.

Solutions which require cooperation from hostile attackers (i.e. advertisers) are not solutions.

Other folks point out major differences between the two. The most important one, though, is that DNT required the server to comply.

Disabling or lying with JS method calls doesn't.

And there is an arms race, and it will not end. That is the nature of adversarial intelligence-gathering.

even with firefox resistfingerprinting on, my browser has a unique fingerprint on the EFF test site

Reply on news.ycombinator.com