Hacker News Reader

Comment by josefresco | Hacker News Reader

> The visibility of fonts to websites has been restricted to system fonts and language pack fonts to mitigate font fingerprinting in Private Browsing windows.

Nice, I wonder if this will effect results here: https://www.amiunique.org/fingerprint

Update: Still unique and the results show 215 Fonts which are 0.0% unique so I'm not sure this is working for me.

View on HN

> https://www.amiunique.org/fingerprint

Hmm, according to this site, 27.87% of people use Linux and 42.47% use Firefox.

Those are great stats. Alas I don't believe them.

Out of the people that enter the site, those stats wouldn't surprise me at all.

It just says that 27% of the entries in their database are Linux. You could infer that Linux users are more likely to use the website. Which matches my understanding

I dunno about this site. It claims that being on Eastern Time puts me in 5% of users.

I tried EFF's version* and it also said my Firefox browser was unique: Your browser fingerprint appears to be unique among the 179,689 tested in the past 45 days.

However the fonts listed looked to be only system fonts so there's that.

*https://coveryourtracks.eff.org/

The EFF version also tells you for each metric how (dis)similar you are from other users/devices. Or at least it’s supposed to - for one of them which was supposed to be a true/false boolean test, it said my browser revealed -1.00 bits of information and shared its value for that test with 1 out of every 1 device they saw.

I don't really get that "unique" fingerprint

Sure I'm unique. I try it in private mode.

> Your browser fingerprint appears to be unique among the 180,370 tested in the past 45 days.

Close down the window, switch VPN endpoint, and retry, and once again I'm unique.

> Your browser fingerprint appears to be unique among the 180,381 tested in the past 45 days.

Looking at the values it seems they are identical. How do they know that the two tests are the same user

If I try outside of private mode I see differences in DNT (set to true in private mode, false in not private mode) and in Hardware Concurrency (4 in private mode, 2 in non-private mode). The rest of the entries are the same.

Nethertheless

"Our tests indicate that you have strong protection against Web tracking."

That claim sounds completely plausible to me. What part seems wrong to you?

That sounds about right. US+Canada population is about 5% of the world, and eastern time is just a slice of that. People in ET are more likely to be internet users than people in some other parts of the world, so that apparently brings the percentage back up to around 5%.

However it also says that 42% of users are on Firefox, which definitely suggests that this isn't a totally representative sample.

I'm guessing that most people who visits a website called "My browser fingerprint" with a domain of "amiunique.org" has at least a fleeting interest in privacy and making choices around that. And that group is most likely biased to using Firefox instead of Google Chrome, at least compared to a general section of the population.

I wonder if this realistically has any impact.

I'm pretty sure my system fonts are a near-unique set. https://www.amiunique.org/fingerprint indicates that 0.0% of the net has the same set of system fonts.

OTOH, I know that installing user fonts (e.g.: non-system wide) is supported on fontconfig (Linux, BSD, etc), and I've done it in the past... but is this even common enough to make a difference?

Edit: my set of fonts is unique and I only have 6 fonts installed.

That site says I'm "NaN%" unique! Seems the real trick to avoid fingerprinting is to not allow JS to run

Wouldn't jump to that conclusion.

It showed me a 0.xx% (i.e. a number less than 1%) just due to the "no JS" alone. So not allowing JS is a strong identifier on its own.

Not allowing JS cuts them off from a ton of specific data points in exchange for one big general one. Honestly I think the trick is to present a different unique fingerprint each time. It doesn't matter if you standout so long as each session can't be linked to all your previous ones.

That seems a lot easier to pull off than trying to blend in perfectly with the crowd. I wouldn't bet on my efforts to account for everything that might uniquely ID me in a never ending game of Whac-A-Mole with fingerprinters. They seem to find new tricks all the time.

They count the referer which is silly. This doesn't identity me at all, it is only present in that one request.

Reply on news.ycombinator.com