- cross-posted to:
- [email protected]
- [email protected]
- cross-posted to:
- [email protected]
- [email protected]
You must log in or register to comment.
What it got right,
- My OS. It’s in the user agent header, which I hate.
- I read the page methodically at a human reading pace.
- I am using a VPN.
What it got wrong,
- Location.
- Screen res.
- Num of CPU cores.
It’s good for ppl to think about fingeprinting. So demo pages like this are good. But I’m sure the identity resolution industry is MUCH better at it. They have capabilities like TLS fingerprinting, outside the browser. For most ppl, not the privacy crowd so mcuh but normal ppl, they fingerprint resource fetches to diff geographic servers. They can run 100’s of scripts on a single page from every identity broker. They employ the best data scientists, to figure out every possible way.
I’m pretty careful. More than 99.999% will ever do. Can commercial fingerprinters still ID me? IDK. But like Skywalker, I have a bad feeling about it.
Yeah got my gpu and cpu incorrect it got my location correct, if this was 10 years ago. They diagnosed my typing as on edge, and hyper attentive. I think my neurological condition, and how it affects my typing, confused it.
They can run 100’s of scripts on a single page from every identity broker. They employ the best data scientists, to figure out every possible way.
The impact of this is probably greatly reduced by anti-JS measures like NoScript. Some sites probably still bundle fingerprinting code into their own scripts, but the really big players contract that out to companies whose entire purpose is data-harvesting, and that’s easily defeated by denying scripts from outside domains
I liked the idea of noscript but, it just wasn’t practical to adjust it to every site which scripts should run and which shouldn’t
A small point but it assumes that your browser’s self-declared timezone is “true” to where you live. My timezone is spoofed to UTC+0; my VPN server is in a different country; and my browser language is set to en-us. I feel like if you see a user whose settings are all of the above then you can assume that none of those three data points actually describe the user, unless they coincidentally are a US English speaker or live in UTC+0, but that’d just be them coincidentally living where anti-fingerprinting browsers report you as.
Anti-fingerprinting is a fingerprint too.
Only if too few people do it.
I loaded the site and went through the stuff and it worked fine. Then I turned on my VPN, and it gave me a new ID.
Changing my VPN endpoint and refreshing the page didn’t work, it still knew who I was, but closing the window and quitting the browser before changing the VPN again gave me a third ID.
They seem to know quite a bit about my phone, but it doesn’t seem like there is much that it could differentiate it from another person with the same model of phone.
This was a fun exercise.
Needed to enable JS.
Honest question, do you browse without JS enabled? I suppose you could just whitelist sites that you need it for.
Interesting. The only thing that really surprised me was the time zone thing. Can I hide that somehow?
I know IronFox and some other forks have a setting to change your timezone to UTC-0. But you’ll have to live with remembering to convert time on most websites unless you log in and your profile sets the timezone. Not a huge deal, but it trips me up more than I’d like to admit. Especially since I avoid sites that require logins. I have heard that you can get a browser plugin to change the time locally, but you’d have to trust the plugin since it will need access to all content on all sites.
