Hacker News Reader

Comment by mihaic | Hacker News Reader

Fingerprinting is doing terrible things for big-tech data collection, and at the same time it's excruciatingly hard to protect against bots, spammers, fraudaters etc without it.

Few people seem to try to reconcile this, since neither side cares about the other.

I personally think that discussion about fingerprinting as raw tech, without mentioning the size of the company collecting the date or the purpose is meaningless, and only leads to a few tech savy users having less data collected on them.

Most people want to use Javascript, use the default setting and not be afraid of clicking on links. I can't really see a good solution without a coordination of regulation and tech standards, so I'm hopeful at least for decent solutions.

View on HN

You don't need to precisely identify users across sessions without their consent to detect bots, advanced anti-bots make heavy use of biometrics to detect bots and don't rely too heavily on fingerprinting, mostly because they're easy to spoof in general, but generating human-like mouse data is a bigger challange.

I wonder if you could use a chicken like in the old chicken tic-tac-toe machines to mimic real user behavior.

Sure, but on the other hand, a lot of anti-fingerprinting efforts strive to reduce the info available including things like mouse movement data.

Mouse movement data is a fairly potent fingerprinting vector. Bucketing the average spouse speed and acceleration rates could provide provide useful information. This may imply specific OS speed settings, or physical mouse DPI. A machine learning system would likely be able to distinguish traditional mouse, vs trackpoint, vs touchpad, vs trackball. Etc.

Also it is not just bots that have non-human like mouse movement. Many assistive technologies would have no mouse movement, or would auto snap the mouse to relevant spot. That is actually a quite powerful for fingerprinting, since assistive technology users are a pretty small subset of internet users, so only a relatively small amount of additional data is needed to uniquely fingerprint that user/machine.

I wonder if that would be enough to precisely identify a single user between millions like regular fingerprinting can already do, but yeah it's still a big fingerprinting vector

https://github.com/Xetera/ghost-cursor

Bezier curves are easily detected by machine learning models as non-human, that software wont work on akamai or any decent anti-bot

Disabling JavaScript does not stop fingerprinting either. HTTP headers are sufficient to construct unique user identifiers. Passing that data via API to a FaaS provider would enable cross site tracking that's invisible to the visitor.

Edit: The required FaaS implementation is trivial too. I could launch an endpoint that performs exactly this function in 30-60 minutes.

In fact, the disablement of JavaScript itself is a very identifying characteristic.

Its one added bit versus countless bits that can no longer be probed. Yeah disabling JS alone is not enough but it is not useless either.

Not all bits have an equivalent distribution. If very few people have that bit set then it is very differentiating.

> I can't really see a good solution without a coordination of regulation...

Totally agree that this is perfectly within the government's purview, and they should be doing something about it. But, as with anything else in the US, until a Fortune 100, some few 1%-ers, or the deep state MIC wants it, we're not going to be getting it.

Reply on news.ycombinator.com