Hacker News Reader

Comment by rosmax_1337 | Hacker News Reader

>It seems that browser vendors hurry to push forward as many features as possible without much thinking about user's privacy.

Vendors in plural makes it sound like the market isn't a monopoly of Google at this point. Google naturally loves to be able to fingerprint people based on as many metrics as possible, for their ads.

View on HN

Indeed, the WebGL extension that leaks videocard and driver name [1] is written by Google's employee.

[1] https://www.khronos.org/registry/webgl/extensions/WEBGL_debu...

I think you do need driver or video card name if you need to make it work (or have a usable performance) in every vendor.

Video cards behaves wildly different between vendors. Some shader runs smoothly in one vendor while lag like hell in another. And some don't even run correctly under certain vendor. Without knowing the vendor, it is not possible to patch them up to get a usable program.

They share the same API doesn't mean they behave identical.

Sure but most websites don't need this, and if they do they can ask nicely.

There is no way you can expect a non-technical user to understand the full implications of a prompt like that.

Something like: "This web site is requesting access to 3D acceleration. This is required for fancy 3D graphics, but can also give the web site more information about your computer than it would otherwise, which may be used to track you, so only say yes if you are expecting fancy 3D graphics and you trust this web site" seems usable?

1) Almost noone is going to read all that. It also assumes the common person knows what 3D acceleration is (yes gamer types and graphics professionals know what it is but the average grandparent probably won't).

2) WebGL is being used for a lot more than just 3D objects now -- it's used for everything from 2D games, graphing libraries and even webgl-accelerated machine learning in the browser (like tensorflow.js).

Then this feaure should be disabled so that nobody relies on it.

Most of the major applications that actually rely on WebGL do need this. Largely so they can avoid graphics glitches for the small fraction of users with buggy graphics drivers

…these are few and far between in comparison to the sheer amount of the web that now gets to freely query that information.

They should be asking nicely, not getting it for free.

Totally agree. I bet in the wild 99% of pages that use this are ad trackers and 1% are valid WebGL applications.

Yes... And people keep bashing at the Safari team for holding the web development back. I mean, it's clear that the Safari team also has their own agenda, regarding competition with the App Store. But the stuff that Google is pushing is just more ways for them to track you in the end.

The things safari lack isn't even relevant to privacy.

They are more about buggy layout (not the shiny grid layout or style worker, it doesn't even works correctly with css2 a lot of time), incorrectly implemented API (not the 'not implemented due to privacy' one, they are those implemented but reporting wrong result).

Firefox also rejects a lot of proposal due to security reasons. But for every one it supported, it works correctly. Instead of work in funny way and require devs to guess the browser and insert ransom workaround just to make it not using the improper result safari gives and breaking the page.

Fun fact: Safari doesn't even handle the full ISO8601 correctly until very recent version. A timestamp without timezone will be parsed into incorrect timezone. A timestamp without colon in the middle of timezone don't even be parsed(which is unfortunately go's default output format).

Regarding timezones, this seems to be a fault of ISO standard. Why do they allow several representations of the same thing?

> Google naturally loves to be able to fingerprint people based on as many metrics as possible, for their ads.

I guess that's why they have a explicit policy of prohibiting browser fingerprinting in all their ad business.

https://digiday.com/media/googles-opaque-practices-to-restri...

It is actually. They want their system to do it, but not the people who buy ads from them, so their advertisers become reliant on google's user segmentation.

Last I checked, Google still adheres to w3c standards on these things. And they haven't captured the w3c process itself... We need to be holding the w3c accountable for considering privacy as they refine new rfcs for apis.

It's actually the WHATWG you need to watch[0], not the W3C. The latter has had basically no power for some time now and only endorses what the WHATWG propose[1].

[0] https://github.com/whatwg/sg

[1] https://www.w3.org/2019/04/WHATWG-W3C-MOU.html

> Last I checked, Google still adheres to w3c standards on these things.

It adheres to web standards that it primarily writes and pushes through.

> We need to be holding the w3c accountable for considering privacy as they refine new rfcs for apis.

You know, when w3c does that HN is ablaze with "Safari is the new IE" and "Firefox is irrelevant". See all of hardware APIs (Bluetooth, Serial, HID etc.) that are rejected by both Safari and Firefox primarily on privacy issues.

How did that saying go?

It Is Difficult to Get a Man to Understand Something When His Salary Depends Upon His Not Understanding It

Follow the money, people in tech get their paychecks from companies that do not respect privacy. And I don't mean that as an accusation: in capitalism it is your duty to do whatever you can get away with.

You know Google literally writes the specifications that are subsequently used by advertisers to fingerprint users, right?

For example, the AudioContext API allows websites with zero audio to query sensitive personalized information about your audio equipment, with no permission. It was written by a Google employee, and implemented first in Chrome, then abused throughout DoubleClick's (owned by Google) display advertising network.

That's what I mean by "holding them accountable." So Safari and Firefox should implement that API behind a privacy-check flag (same as we get for location services, etc.). If Google complains it's not to spec, tell Google to fix the spec.

Don't rubber stamp specs that aren't privacy-conscious; Apple, Mozilla, and Microsoft are WHATWG standards members too.

"We need to be holding the w3c accountable for considering privacy as they refine new rfcs for apis."

How do we do that?

Who do you think proposose the standards?

Reply on news.ycombinator.com