Hacker News Reader

Comment by tombert | Hacker News Reader

Forgive a bit of ignorance on this, but I'm not 100% sure I know what browser fingerprinting actually is. I remember reading something by the DuckDuckGo founder mentioning that it could be a problem even if you use a VPN and incognito mode, but I had some trouble actually figuring out what that actually meant.

View on HN

Browser fingerprinting allows you to identify uniquely a browser and thus the user. This usually means that VPN and incognito mode will not help you to "change you identity".

One example I know well is AudioContext fingerprinting with a demo available here: https://audiofingerprint.openwpm.com/

There are also worse fingerprinting methods that work cross-browsers.

audiocontext fingerprinting is less identifying than you think. It pretty much boils down to "what's your browser complied with and what FPU implementation you're running"

https://github.com/WebAudio/web-audio-api/issues/1500#issuec...

https://github.com/w3cping/tracking-issues/issues/53#issueco...

Imagine gathering screen size, installed fonts, graphics card, processor model, extensions, plugins, operating system, ... and so on. Perhaps you could gather enough system properties to actually identify someone uniquely. It’s like a fingerprint.

Some of these are more interesting than others. OS is exposed through the user agent. I'm not sure if you can actually capture processor model an graphics card, and plugins were more interesting when people installed plugins like Flash and Java.

WebGL fingerprinting usually works by rendering something off-screen that exposes GPU differences, then captures the rendered image as the fingerprint.

If you’re really clever you can figure timings out using JavaScript.. to the point spectre was remotely exploitable. LOL.

Hmm, would disabling hardware acceleration in Firefox provide any privacy benefit, then?

if you're the only person in the world who has disabled hardware acceleration, you will be uniquely identified by not having hardware acceleration

I’ll bet a lot of computers have it disabled: VMs, perhaps Tor Browser, kids who tweak settings for no good reason.

This tracking method (WebGL) disregards VPNs, user agent changes and incognito mode.

Browser fingerprinting is the ability of the website you are accessing to differentiate between you and other people because of a "fingerprint": A hash string that uniquely identifies your current browser, and since its using WebGL, your computer, because of its configuration and graphical capabilities.

Using the way that your browser renders a page to uniquely identify you amongst other visitors. This can take the form of measuring how your computer generates random numbers, timing how long it takes to compute certain things, minute differences in how your your gpu renders some pixels via webgl etc. With enough signals you can pierce through the noise.

I do participate in research project at https://browser-fingerprint.cs.fau.de as a user. You can find more info about fingerprinting here https://browser-fingerprint.cs.fau.de/faq?lang=en

It's when a site is able to take a variety of Javascript-accessible state that in isolation is benign (such as your reported graphics driver, as the case here) but together form a unique identifier for a user given the high dimensionality involved. This allows identifying users without their consent and avoids some methods of anti-tracking.

My understanding is it's simply checking the level of support for different Web APIs. Since that is invariant with respect to the route between you and the website, a VPN wouldn't save you from this.

Basically, each browser has an unique set of features so each device can be uniquely identified and profiled across different domains, regardless if you block cookies, use incognito mode and other techniques.

Some of the web APIs expose information that in aggregate can give an almost unique fingerprint to that device. Using fingerprinting techniques you can then track what the device is doing.

basically no two systems are the same, and if the website can gather enough information about your system, it can identify you, even through a VPN or in incognito mode. Popular information for fingerprinting include: your browser, the country you are in, your language(s), your graphic card (through webgl), the fonts installed on your computer, the size of your screen (or your browser window), ...

Reply on news.ycombinator.com