Comment by hilbert42 | Hacker News Reader

Comment by hilbert42 | Hacker News Reader

Parent Full thread

Ha! I followed the instructions and went to fingerprint.com and it all 'crashed' because I had JavaScript turned off—that's my normal default setting.

I have five different browsers on my smartphone and three on the PC all sans JS and none of them are Chrome. Also, normal operation is to automatically delete all cookies at session's end.

My smartphone and PCs are de-googleized and firewalled and I never see ads in my browsers nor in apps. The apps are mainly from F-Droid and sans ads and the few Playstore ones I use are via Aurora Store and are firewalled from the internet when in use. Honestly, I cannot remember when I last saw an app display an ad, it has to be years back.

In the past I used to go to more extensive measures to stop the spying but I found it was unnecessary as the spy leakage was essentially negligible with much less stringent efforts.

It's pretty easy to render one's online personal data essentially wothlesss if one wants to. On the other hand if you insist on using JS, Gmail, Google search, Facebook etc. then you're fair game and you only have yourself to blame if your personal data is stolen.

Before you get all jubilant, note that they have fingerprinting techniques which don't use JS[0]. It was able to identity me. Contrary to popular opinion, disabling JS doesn't protect you from fingerprinting.

They describe their approach[1]. They use HTTP headers and conditional request triggered by CSS conditional media queries to gather data. Something like @media(...) {background: url(/tracking/$clientid)}. But in principle, they could also try and fingerprint the TCP/IP stack or the TLS implementation. I'm not sure it would get them more data than OS+Browser, though.

[0] https://noscriptfingerprint.com/

[1] https://fingerprint.com/blog/disabling-javascript-wont-stop-...

"Before you get all jubilant, note that they have fingerprinting techniques which don't use JS[0]. It was able to identity me."

I didn't detail every protection I've put in place or the post would have been too long. However, I'd suggest that spreading my browsing over at least eight browsers (and I actually use more than two machines and do so at different locations and with different ISPs) effectively reduces my profile across the net.

I also use randomized browser user agents and clean links, occasionally I'll even cut-and-paste links between multiple browsers in a single session. I often do this on HN not to hide from HN but for convenience when multitasking. (Having worked in surveillance professionally, this modus operandi just comes naturally, it's now second nature for me to work this way.)

Working with multiple browsers and multiple machines also solves the problem when on rare occasions I have to use JS. That said, I never watch YouTube with a JS-enabled browser, instead I'll use NewPipe or similar. There are other measures I could list but you get the idea. Oh, and I never use the internet on a smartphone with a SIM enabled, instead the SIM resides in a separate portable router and my 'real' phone is a dumb feature phone, it's only capable of making phone calls.

I really don't care if some stuff leaks but I've satisfied myself it's pretty trivial, as frankly, I've not had one indication over the past 20 or so years that I've been targeted as a result of fingerprinting. It's not necessary to make things completely watertight, I'm not trying to hide from the NSA or GCHQ, etc. (and it'd be unsuccessful and a complete waste of time to bother trying).

Moreover, even if something were to leak, I'm simply not a revenue-making target—that means I never respond to any targeted marketing because I simply never receive any.

FF mobile gives be different IDs each time I run a new private session on both the JS an non-js demos (I run w/o JS usually AND have enabled the resistFingerprint setting)

It’s one thing to generate the same hash for the same client, but it would be interesting to know how often the hashes collide, too.

I also notice that the no-JS hash changes when I move the window to a different monitor.

To me this seems extremely elitist. Non-technical people deserve to have their personal data stolen because they don't know about javascript for example?

Technical defenses are never perfect. In a sense they provide security through obscurity, as evinced by the comments above regarding Stallman's use of wget. If everyone applied technical defenses equally then workarounds would quickly be found, and everyone would be equally vulnerable. So privacy is a scale, and being in the minority provides its own defense. If in aggregate each individual is equally valuable, then the value of breaching a minority's technical defenses is some inverse multiplier of the minority's size. Personally my threat model is to put in just enough work to never be the juiciest target.

I run a similar setup as the OP when browsing the modern web, but i think it is in a way our responsibility as professionals to help the less tech inclined to navigate the sea of monsters the modern web has become.

For example: I have set up the systems of family members for whom i am some sort of digital janitor with a nice collection of firefox plugins to get rid of the worst offenders.

I get where you're coming from,but...

If you continue to willingly use socials like FB, TikTok, et al, your complaints about stolen personal data fall on deaf ears. Show me that you don't have those apps installed or do not visit their websites, then we can talk about being serious on deserving to not have data stolen.

"To me this seems extremely elitist."

Right, it probably is. But the issue of stolen personal data has been around for so long that nontechnical people have had years to develop political lobbying and to swing elections to put a stop to it.

The fact is that most people don't give a damn about such matters, if most did then the problems would be behind us by now.

Thus, unfortunately, with the internet it's every man and woman for him or herself. QED!

Have you ever tried to talk to "non-technical" people about this subject? They treat you like you're one of those tinfoil hat crazies.

At this point I'm 100% OK with us being the only ones able to protect ourselves. We warned them and they didn't care. Allow them to remain uncaring. We don't have to help everyone. People must want to be helped.

"Allow them to remain uncaring. We don't have to help everyone. People must want to be helped."

When people don't understand the implications or full ramifications then governments and lawmakers have to step in as they have a duty of care to protect citizens. It's one of the principal reasons for having government.

There are any number of examples, regulating the use of poisons, putting protection fences around cliff top lookouts, specifying the breaking strain of elevator cables, aircraft compliance design, removing lead from petroleum, and so on.

Unfortunately, governments have failed to act despite many warnings about these privacy matters.

Incidentally, there's an uncanny parallel between this example of governments failing to act even when in presence of the facts and my last example. In 1923 when Thomas Midgley and cohorts—engine makers and petroleum companies—sought permission to put tetraethyllead in fuel governments already knew the dangers of lead poisoning. Not only did they ignore all scientific warnings about the dangers of using the additive but also they embraced Big Business and approved the move at the citizenry's great expense.

What they want is things to be easy and require a low to non existent cognitive load. You start confusing them with details of what could happen etc and all the gyrations they have to do to avoid it, they tune out and look at you like a tinfoil hat crazy (are you sure they aren’t right?)

As the techno elite, it’s actually our job to create the underlying reality everyone else participates in when using technology. So, it is our responsibility to care, if you care. It’s not theirs - they’re just here for the party. But that doesn’t mean they’re sheep for slaughter, because there are plenty of folks ready to slaughter them for money.

It’s our ability to understand the issues and to actually improve them that uniquely makes it important for us to care. But we can’t expect people to turn off the cat video for long enough to listen to us nerd at them, and we really can’t expect them to do something complex to avoid something they don’t understand or care about. What our challenge is is - how do we improve internet technologies sufficiently that everyone enjoys what we know is important but we don’t require them to care? That’s how you build a better emergent reality.

I’m glad to have had a hand in the Netscape and Mozilla’s launch and have watched Firefox for years with pride. They are the closest to a mainstream any man product that even remotely cares. WebKit safari is a close second. I hope we all find ways to develop the tech platforms that protect as well.

> are you sure they aren’t right?

Yes, I'm absolutely sure. Do I really need to justify myself here on HN of all places? On a thread about the fingerprinting implements of the surveillance capitalism industry?

> that doesn’t mean they’re sheep for slaughter

Welp. If they don't want to be slaughtered like sheep, they better start caring then. I'm done with that.

At this point what I really care about is strengthening my own privacy by having more users in the anonymity set. The more indistinguishable users there are, the more effectively we are protected. I figure that if they're apathetic enough to allow corporations to exploit them with absolute impunity, they're also apathetic enough to join the anonymity set. Browsers just need to make that choice for them. It needs to be the new default.

> we can’t expect people to turn off the cat video for long enough to listen to us

I can and I do. What we're saying about this matter is important. People should listen, join the discussion even. When we reach out to people about matters we consider important, we do it with the best of intentions. We expect they'll at least put some thought into it. If not that, we expect they'll at least treat us with some respect, not like some schizophrenic off his meds. Can't expect anyone to continue caring after multiple instances of that.

> What our challenge is is - how do we improve internet technologies sufficiently that everyone enjoys what we know is important but we don’t require them to care?

Someone's gonna need to have the balls to make the choice for them. I don't have the resources to just make a better browser though. I do what I can by installing uBlock Origin on every single browser I come across. Everyone loves it and tells me that the web "feels" much better, though they can't quite explain why.

> Non-technical people deserve to have their personal data stolen

Nobody said that. "My defenses work" != "my defenses should be necessary".

"On the other hand if you insist on using JS, Gmail, Google search, Facebook etc. then you're fair game and you only have yourself to blame if your personal data is stolen."

... okay, I reread it for a third time and you're right. Not sure how I managed to miss it the first two times I read the comment. Yeah, that's nonsense.

Uh… they definitely said that. They specifically said that people were “fair game”.

Yeah? If they don't know how to operate a computer then they shouldn't be operating one. The same I would feel if someone without a licence crashed their car.

Using the web while being unfamiliar with Javascript is not analogous to driving without a license. It's closer to driving without being a mechanic.

But when my mechanic tells me that the grinding noise while braking means I need to have the brakes fixed doesn't excuse me from continuing to drive without fixing the brakes and it doesn't really magically get fixed by turning up the radio until the noise goes away. To further your comparison, devs would be the mechanics, and devs have been screaming that operating browsers without blockers is similar to not getting the squeaking noises fixed. Everyone just keeps turning up the volume until the underlying noise goes away.

The more you customize the more unique your session becomes.

Not if you disable JS, cause the website then can't see any of these customizations.

Except that disabling JavaScript is an anomaly all on its own. The dozens of users running without JavaScript might not be individually fingerprint able but it's still a small enough cohort that I don't know how much I'd lean on that. Figure in the user agent string and it's probably unique enough a subgroup to sell ads to.

> it's probably unique enough a subgroup to sell ads to

I have been browsing with JavaScript disabled by default for the past 6 months. Based on my experience, no-JavaScript ads are rarer than four-leaf clover.

More common than you think

https://amiunique.org/fpnojs

Probably not a representative sample though.

Also that cuts down the group so much, i imagine other things that are usually too coarse grained to be useful suddenly become much more useful. E.g. geoip location or accept-language headers.

> Figure in the user agent string and it's probably unique enough a subgroup to sell ads to.

But if you never see ads how do you sell ads to them and how do you meaningfully discover enough about the person to feed them valuable ads?

But ads don't work without javascript.

Having JS off probably puts you in the < .1% of users bucket. Unless you additionally are: * Routinely moving between IPs * Modifying your headers to avoid giving away info (user agent, etc) * Defeating all the other non-JS things that fingerprinters probably look for

then you are not safe by just turning off JS.

Being in a 0.1% bucket is only ~10 bits of information - much less than what can be gathered with JS on.

And of course its not enough, but the situation is even more hopeless with JS on.

Not if you disable JS, cause the website then can't see any of these customizations.

That's adorable. I guess you're not old enough to remember when we used to track people with things like invisible pixels. Or todays equivalent: testing CSS parameters.

Neither require JavaScript, and there are a hundred other non-JavaScript methods.

With that method, you won't be able to distinguish between the many different devices using the same browser at same resolution behind one IP.

In the era of CGNAT that means you now only know which city I'm from and whether I use Chrome or Firefox. People mostly use browsers in maximized and resolutions are relatively standardized nowadays.

Compared to the data you get from canvas and webgl, that's much less unique.

Hah! I used to embed invisible pixels for our marketing department decades ago.

This should automatically qualify one to lose their internet privileges. Not just the fact that you did it, but your cavalier attitude towards it with the lack of regret for having done it

I actually agree with you. However, I plead that it was novel at the time, used ineffectively by a tiny marketing department, and not anywhere near this spy level capacity achieved today.

It’s fun to put Easter eggs for people like you. https://once.getswytch.com

I have no idea what you’re talking about. That URL only tries to load one piece of JavaScript, htmx, and all it does is unbreak the mobile navigation.

(Aside: this mobile navigation is, incidentally, the worst implementation I have ever encountered: instead of twiddling some classes or such, which would happen instantly, it makes an HTTP request that responds with the new navbar. For me, this means at least half a second’s latency on clicking the button, more if time has passed so that the HTTP connection is no longer open (1.5–2 seconds). It also fails the no-JS test, as the unintercepted form-submit just serves the page with the closed mobile navbar again, not switching out the navbar as I expected it might, and which would have been enough to avoid an unconditional “worst implementation” award. Sorry if you made this and it hurts your feelings, but… ugh, this is just a baffling misapplication of hx-post and naive Tailwind use, and just unconditionally a bad approach.)

Edit: better link which shows what I suppose you probably meant: https://once.getswytch.com/app

Haha. Yeah, it is pretty terrible and I made it.

It’s mostly a tech demo, so the things it does are intentionally weird/strange.

You are easily tracked without JS. It is much easier than tracking a default settings browser.

> It is much easier than tracking a default settings browser.

Not true. Especially if you mean a default browser with Canvas/WebRTC APIs enabled.

It is much more difficult for fingerprinting companies to get a high entropy fingerprint from a no-JS user.

Good luck with Lynx/Dillo with a fake UA.

Reply on news.ycombinator.com