Hacker News Reader

Comment by gruez | Hacker News Reader

>It seems so powerful, all I need is to have my browser have js with canvas enabled and I can be matched across websites?

Note the fingerprint isn't unique, it's basically a property of your graphics hardware + operating system. If you have a M4 macbook pro, in all likelihood you'll have the same fingerprint as all the other M4 macbook pro users.

>I know you can disable canvas in firefox, how does one do it in Chrome

Bad news. Disabling features is also a fingerprint vector, and having it disabled probably makes you more suspicious. Imagine you're at a border checkpoint that fingerprints you (many countries do that), and your fingerprints were burned off. How do you think the border guard will react?

View on HN

> in all likelihood you'll have the same fingerprint as all the other M4 macbook pro users.

er... maybe if they're using metamask or something with the viewport pixel WxH set arbitrarily. canvas size/window size, fonts installed (are you a graphic designer or typographer?), who knows what else. the EFF has a site that shows you all the nonsense we can be tracked with.

open safari on a second monitor? at the same time? probably globally unique WxH between the two windows.

https://coveryourtracks.eff.org for those that are curious

https://www.amiunique.org/

i'm unique in their dataset on firefox on a 2k monitor.

looks like my main culprits: useragent, timezone (lol), navigator properties (99.9% unique,) fonts, canvas (100% unique,) screen dimensions (available and .. actual?). all of these showed >99% unique.

I wouldn't read too much into that site. For instance it says my chrome browser, updated to latest version has a user-agent "similarity ratio" (whatever that means) of 0.43%. This can't possibly be true because autoupdate is enabled by default for chrome, so you'd expect everyone to have the user-agent, or at least all the windows users to have the same user-agent. For whatever reason it also thinks firefox has a 37.8% market share, which is clearly not correct. I also tested some phones, which it also claims is "unique". That clearly can't be the case either. Phones are pretty basically run the same software/hardware, and are pretty locked down from a customization/sandboxing perspective, so at the very least you'd expect most of the iPhone 15 in New York to have the same fingerprint, for instance. It certainly shouldn't single any one out as "unique".

>er... maybe if they're using metamask or something with the viewport pixel WxH set arbitrarily

I was talking about canvas specifically, since the OP mentioned "js with canvas enabled". The rest can be somewhat mitigated by avoiding configurations that stick out, eg. using a "common" window size (ie. maximized). On firefox you can also use RFP with letterboxing, which rounds windows dimensions to the nearest 100 pixels, and defaults to 1000x1000. However, that's also somewhat suspicious (who perfectly sets their window to multiples of 100?) that you're better off using maximized window + common display resolution + standard taskbar/dock size. RFP also has mitigations for some of the other issues you mentioned, eg. a font whitelist.

I just opened edge on my 1080p monitor and made it fullscreen, and it's "you are unique among 3.4mm fingerprints".

I'm just saying it's not as easy as all of that, even on a "computer" using the stock browser.

you'd also have to figure out where most users are in the timezone data as that narrowed my browser down to 95% unique all on its own. (UTC-5)

See my other comment on fingerprinting sites: https://news.ycombinator.com/item?id=43175193

>you'd also have to figure out where most users are in the timezone data as that narrowed my browser down to 95% unique all on its own.

The best timezone to use is the one that corresponds to your IP info, because it doesn't reveal anything about you. You'd expect 95+% of users with a Californian geo ip to be on pacific time, for instance. Using anything else makes you stick out like a sore thumb.

Statistics like "95% unique" also make little sense. Being able to identify you as one out of 400 million people (5% * world population) seems... fine? You can get better targeting through geoip/latency measurements, for instance. If you use a VPN in California, that narrows you down to 1 in 39 million people.

I'm on starlink, so i don't get to pick my exit geographical region, and i actually live in UTC-5, UTC-5 is evidently only represented by 4.6% of all fingerprints.

i understand what you're saying, of course.

If a site deems me too suspicious that it blocks me because it cannot track me so be it, close tab

Reply on news.ycombinator.com