Is this really important given that browser fingerprinting can almost always identify a web browser?
"Firefox 85 Cracks Down on Fingerprinting"
"Is this really important given that supercookies can almost always persist between sessions and across domains?"
----
If you want to fix a problem, there are going to be points during that process where the problem is partially fixed. This only becomes an issue if we're headed in the wrong direction, or focusing on a sub-problem that would be better addressed in a different way, or if we have no plans to fix the other attack vectors.
But the steps we'll take to attack fingerprinting are very similar to the steps we'll take to attack supercookies, so there's no harm in grabbing the low-hanging fruit first.
Supercookies clearly have some value to advertisers and other bad actors or else they wouldn't be used. There's value in closing off that specific tracking method while we continue to try and figure out the harder problem of how to standardize headers, resource loading, etc...
But yeah, we still have a ways to go. Small steps.
And FF and Safari should continue their work to close any fingerprinting opportunities Fingerprinting is becoming less effective over time - for example fingerprinting on iOS is pretty unsuccessful.
Do you have more information about how iOS is blocking fingerprinting?
https://9to5mac.com/2020/09/04/ad-industry-tracking/
"my iPhone 11 Pro was also unique among the more than 2.5 million devices they have tested."
Time zone is one possible fingerprint data point.
Totally forget that. Oops.
Now for the meat of your comment ...and how many have tested their protections so that their testing site recognize that your device is not unique?
A very good counterclaim was posted in the comments:
I strongly disagree with your findings, Ben. Namely, you list fingerprinting techniques available to browsers, and fail to mention how Safari (and Firefox to some extent) make those methods less precise. Instead, you say
Note that this isn’t a comprehensive list, it’s just examples. When a website analyses all of the data available to it, things get very specific, very fast.
So let me point out where you were wrong about Safari in particular:
• Fonts installed. Safari reports very limited subset of fonts, which does not vary. it is the same for every Safari users.
• Plugins installed. Unsurprisingly, Safari lists just one: PDF reader. Native plugins are not reported.
• Codecs supported for video. The uniqueness checking site reported just H.264 and FLAC. Audio format are not reported at all. There's no mention of H.265 and VP9 which work in my Safari beta version, and no mention of the whole plethora of audio formats which are supported.
• Screen resolution is not the real screen resolution. I'm on 27'' 5K iMac and the screen is reported as 2048 x 1152.
• Media devices attached reported as "audioinput" and "videoinput". It has nothing to do with the actual available media devices.
And incorrect reporting goes on.
As you can see, fingerprinting through browser leaves Safari users very poorly segregated. As long as you running latest OS with latest version of Safari, you are a part of a very broad chunk. You can't be identified through browser fingerprinting along.
This means that the only unique data that you can get are: a) Language settings. There is no way to work-around this (unless you consistently lie that you solely use English) b) Time zone. There is no way to work-around this (unless you consistently lie that you solely use UTC)
These things can be predicted anyway with IP address, so it is not perceptibly meaningful in any way. In other words, advertisers can literally give up on detecting when Safari are the browser and rely instead on IP addresses (which can tie into a family (or in some IPv6 cases) a device.
Disclaimer: This is a genuine question. I'm a hardware guy and I don't know how web works nowadays.