Hacker News Reader

> There's a difference between something being provent theoretically possible in a laboratory environment and actually making it out in the real world.

Fingerprinting using IP address, running scripts, canvas fingerprinting, using installed fonts, and checking what resources are cached/blocked are all things that are being widely used in many websites, and are not just "theoretically possible".

They are even being sold as a product and are used by many companies.

Look at their customers - https://fingerprint.com/ .

To add to this, basic fingerprinting is trivial. And more advanced fingerprinting isn't much harder.

I'm so confused by GP post. We were doing fingerprinting 15 years ago.

> Look at their customers - https://fingerprint.com/ .

Welp that's scary, can detect me when I'm on VPN, off it, in private browsing mode, different country in private browsing mode...

that's nice claim, but for it to work you need to leak enough entropy, and you can check that on various sites.

there's a little widget on the site that can check that for you

Try it again with cookies disabled. It looks like they only do the browser fingerprinting if cookies are disabled.

Sure, but I was specifically referring to a marketing context.

We maintain pretty robust customer databases and our needs are much different. Just proving you are a unique device isn't useful in most contexts if we don't have good or reliable ways of associating it with existing profiles. Notice that none of their customers are marketing companies.

What this site won't tell you is that fingerprints have a half-life less than 24 hours (when you lose the fingerprint). Useful for anti-abuse measures, somewhat useful for ad-attribution, absolutely garbage for long-term tracking.

I've spent 12 years in adtech and built 3 ad platforms from the ground up.

Fingerprinting is used everywhere. It's a wide spectrum from basic metrics to very in-depth tracking, all depending on the scale, latency and functionality of each scenario. This can range from frequency capping to fraud detection to stopping bots, to uniquely identifying devices.

I will say that it's mostly used to improve UX by increasing security and limiting spam/bots/fraud but that doesn't mean its not used to track devices and people, although it's sold as targeted ad campaigns rather than specifically following individuals.

How does a fingerprint remain stable over any reasonable period of time? How do you distinguish between different user accounts on the same device? How do you tie a fingerprint to your database of existing customers? How do you keep cookie data from conflicting with fingerprint data?

I have yet to ever see a database of fingerprints or what it even looks like. It could very well be that advertisers keep it as part of a secret black-box, but every vendor we have ever used has been entirely dependent on cookies and the only data we've ever collected has been cookie or session-based. I've been sold a lot of garbage adtech over the years, so my hunch was that this was another bit of industry vaporware.

> "How does a fingerprint remain stable over any reasonable period of time?"

Depends on how stable the signals being used are. Some can be very durable.

> "How do you distinguish between different user accounts on the same device?"

Fingerprints usually identify a device or specific user-agent. I'm not sure about the context for this but you can augment it with cookies to specify "user accounts".

> "How do you tie a fingerprint to your database of existing customers?"

How do you tie any random alphanumeric ID - whether stored as a cookie on device or recognized as a fingerprint - to a customer? Mappings still exist and work the same way.

> "How do you keep cookie data from conflicting with fingerprint data?"

What would be the conflict? Ideally only one is used as the primary identifier and takes precedence.

> Depends on how stable the signals being used are. Some can be very durable.

How so? We have even deprecated IP Addresses in our database as we found they no longer have any sort of day to day accuracy (too many devices jumping networks constantly) or there are too many shared IPs for work networks. It seems like most fingerprints are just IP address + random identifiers.

The entire browser profiling angle refers to something that does not currently exist, does not conceivably scale well, and chases after an infinitesimally small potential monetary gain

This is where the tech industry is at though. All the low hanging fruit has been harvested long ago. The tens of thousands of devs in the Bay Area are building things that make "infinitesimally small potential monetary gain" because at web scale that's hundreds of millions of dollars. They might not be doing this particular thing, but they are doing something, so vigilance is necessary if you value your privacy.

> often only things that lets someone know they are being MitM attacked or phished is when the corporate branding feels "off"

Why? Man in the middle can just snatch off the credentials on the way back to the backend, they don't need to change anything.

It's not bizarre if you realize that the decisions are not really in your hands. You are an engineer working in martech, you do what your company tells you to do and your company is motivated by profit, especially in martech. When your bosses decide it's time to start doing that, you will follow and if not, plenty of other engineers will. It's not like there are not dozens and dozens of examples of companies doing exactly that

>The entire browser profiling angle refers to something that does not currently exist, does not conceivably scale well

You sure? Quick google suggests somewhere in the low single digits of big sites is applying some sort of fingerprinting - though unclear how much is for security vs tracking

[0] https://webtransparency.cs.princeton.edu/webcensus/