Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.
For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.
The solution is explicit trust. Not fingerprints for users, but digital signatures for content. If it's not signed by somebody the user trusts, don't render it.
The user is the only one who can be trusted to approach that task without a conflict of interest.
The only winning move is not to play--er, to somehow not to have this kind of game in the first place.
Second, despite the dumpsterfire that Mozilla’s leadership has been in a decade or so, it is very robust with privacy and anti fingerprint features out of the box, the containers has also stabilised and works great.
Using Brave EFF reports that I have a randomized fingerprint.
Using Firefox or Edge EFF reports I have a unique fingerprint
See Fingerprint.com, despite Brave's protections you'll likely find it works reliably.
At {{job}} we did briefly consider rolling out fingerprint.com, but settled on ja3/ja4 at the CDN layer.
It does mean that sites that uses 2FA (so every site nowadays) flag me as a coming from a new device each visit, and I have to have my phone nearby every time I want to use my computer, which is quite annoying. If you use GrapheneOS, you can obfuscate your phone too on WiFi networks (and sites, but GrapheneOS not needed for that, just Brave). You can't obfuscate yourself on cellular networks though, unless you have a ton of sim cards you rotate through.
So what sort of benefits are you reaping from your anti-fingerprinting measures?
Your only option is to never buy anything online and only pay cash.
I probably wouldn't go as far as never buying anything online, but paying cash IRL should be something done by everyone to protect their privacy. There are a few other easy things that can massively improve your privacy with minor or no inconvenience: Linux on every PC/laptop, GrapheneOS on phone(s), uBlock on every browser (or a DNS-level sanitizer), car without cellular modem (pull the fuse), non-Google and non-Apple email (ideally your own server or a small provider in a friendly jurisdiction). Also, don't use social media and text over Signal instead. Of course, TVs and other home appliances should be kept off the Internet. Overall, those are some very minor sacrifices for anyone with a little bit of maturity. It's very far from living off the grid or anything like that.
This is backwards. The antitrust concerns of removing 3rd party cookies led to them developing alternatives.
Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"
Don't you people remember how it was done back when web browsers didn't have cookies, or could be configured to reject or ask for each cookie? The server software automatically added a PHPSESSID parameter to every link, containing the session identifier.
Same thing the other way: no need to have a banner for a simple login cookie which isn't being used for privacy-invading tracking purposes.
I’ve checked my network. I’ve monitored egress traffic. There is no residential proxy. I’m not on a VPN. If anything, services should be able to track me entirely by my home IP that doesn’t change that often.
My best guess is that I’ve committed the crime of not allowing third party cookies? Or maybe the crime of not being logged into a Google account 24/7. It’s not browser or device specific. My iPhone is just as likely to fail the cloudflare checkbox as my desktop with Firefox + uBlock.
I haven't seen a YT ad in years while in lurk-only mode (no login), which is nice, but I also see cloudflare everywhere , which is not great.
One of the nicer things about LLMs, is that they arrived just in time to erase my dependency in search.
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
The thing the site is doing that isn’t “strictly necessary” is always tracking.
It also limits the exception in relation to e.g. employment.
The article's points still stand, but the trick didn't work this one time.
> I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.
> And to the highest bidder it goes!
> What does that make you then? A gear? An ox? A volunteer?
This does absolutely nothing for me. If this resonates with you, can you explain?
I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.
It's truly totally ok with me, yes.
(I get the non-anonymized concerns, or risk of becoming non-anonymized, that's not what I'm confused about)
But at least the moment we start using websites the largest players will know it’s us. Nobody else swipes and types exactly like me on my screen size of iOS over the relay.
a native app with 0 permission prompts gets you more bits than web
Now on a desktop PC sure I believe these fingerprints are highly descriptive. And in android land they probably work okay because of the diversity of products and configurations. But iPhones resist fingerprinting just because they all give the same answers.