My OS. It’s in the user agent header, which I hate.
I read the page methodically at a human reading pace.
I am using a VPN.
What it got wrong,
Location.
Screen res.
Num of CPU cores.
It’s good for ppl to think about fingeprinting. So demo pages like this are good. But I’m sure the identity resolution industry is MUCH better at it. They have capabilities like TLS fingerprinting, outside the browser. For most ppl, not the privacy crowd so mcuh but normal ppl, they fingerprint resource fetches to diff geographic servers. They can run 100’s of scripts on a single page from every identity broker. They employ the best data scientists, to figure out every possible way.
I’m pretty careful. More than 99.999% will ever do. Can commercial fingerprinters still ID me? IDK. But like Skywalker, I have a bad feeling about it.
It doesn’t really matter if they got it right or wrong, as long as it’s consistent. The goal isn’t to know your location, screen res, or cpu core count, it’s to track you across websites.
Yah. I agree. Which is why I think, it is often better to randomize the fingerprint every time, than TBB’s approach. Tor is still good for the onion routing, ofc. But I’d like a semi random return on screen res, timezones, and w/e.
They can run 100’s of scripts on a single page from every identity broker. They employ the best data scientists, to figure out every possible way.
The impact of this is probably greatly reduced by anti-JS measures like NoScript. Some sites probably still bundle fingerprinting code into their own scripts, but the really big players contract that out to companies whose entire purpose is data-harvesting, and that’s easily defeated by denying scripts from outside domains
the really big players contract that out to companies whose entire purpose is data-harvesting
For sure, blocking those scripts goes a LONG way. But that’ll only work until lots of ppl do it. If it ever catches on big, the Identity Brokers will adapt. They’ll integrate their shit into sites in ways that are hard or impossible to separate this easily without totally breaking the site you were trying to visit.
IDK for sure, but I fear we could be living on borrowed time.
As long as there’s an incentive to violate privacy, it will always be an arms race. The upside is that we’ll get better and keep adapting just as they do.
Yeah, it definitely makes browsing a lot more hands-on, and the lack of cross-device syncing means that you’re constantly duplicating work. There’s probably a way to export settings and diff/patch and sync the settings files for each device, but I just haven’t bothered; seems like a lot of time investment to automate something that takes me seconds to do manually.
On the other hand, there were two big shifts for me after I started using it. One was when I got the sites I use frequently all set up after a few weeks, it became a lot smoother sailing after that. The other was when I finally took the minute to find the setting to default (temporarily) allow, but only for the current domain (after like a year or two on default deny everything).
It’s now rare that I visit sites where I feel like I’m missing out without the added scripts. The only times that has really changed is when everything started implementing anti-scraper measures, and sites along the high seas that have trouble streaming videos from other servers.
What it got right,
What it got wrong,
It’s good for ppl to think about fingeprinting. So demo pages like this are good. But I’m sure the identity resolution industry is MUCH better at it. They have capabilities like TLS fingerprinting, outside the browser. For most ppl, not the privacy crowd so mcuh but normal ppl, they fingerprint resource fetches to diff geographic servers. They can run 100’s of scripts on a single page from every identity broker. They employ the best data scientists, to figure out every possible way.
I’m pretty careful. More than 99.999% will ever do. Can commercial fingerprinters still ID me? IDK. But like Skywalker, I have a bad feeling about it.
It doesn’t really matter if they got it right or wrong, as long as it’s consistent. The goal isn’t to know your location, screen res, or cpu core count, it’s to track you across websites.
Yah. I agree. Which is why I think, it is often better to randomize the fingerprint every time, than TBB’s approach. Tor is still good for the onion routing, ofc. But I’d like a semi random return on screen res, timezones, and w/e.
The impact of this is probably greatly reduced by anti-JS measures like NoScript. Some sites probably still bundle fingerprinting code into their own scripts, but the really big players contract that out to companies whose entire purpose is data-harvesting, and that’s easily defeated by denying scripts from outside domains
For sure, blocking those scripts goes a LONG way. But that’ll only work until lots of ppl do it. If it ever catches on big, the Identity Brokers will adapt. They’ll integrate their shit into sites in ways that are hard or impossible to separate this easily without totally breaking the site you were trying to visit.
IDK for sure, but I fear we could be living on borrowed time.
As long as there’s an incentive to violate privacy, it will always be an arms race. The upside is that we’ll get better and keep adapting just as they do.
I liked the idea of noscript but, it just wasn’t practical to adjust it to every site which scripts should run and which shouldn’t
Yeah, it definitely makes browsing a lot more hands-on, and the lack of cross-device syncing means that you’re constantly duplicating work. There’s probably a way to export settings and diff/patch and sync the settings files for each device, but I just haven’t bothered; seems like a lot of time investment to automate something that takes me seconds to do manually.
On the other hand, there were two big shifts for me after I started using it. One was when I got the sites I use frequently all set up after a few weeks, it became a lot smoother sailing after that. The other was when I finally took the minute to find the setting to default (temporarily) allow, but only for the current domain (after like a year or two on default deny everything).
It’s now rare that I visit sites where I feel like I’m missing out without the added scripts. The only times that has really changed is when everything started implementing anti-scraper measures, and sites along the high seas that have trouble streaming videos from other servers.