top 100 comments

sorted by: hot top controversial new old
[–] 85 points 6 months ago (5 children)

all trackers hate this one trick

  • source
  • hideshow 5 child comments
  • [–] 28 points 6 months ago (3 children)

    Unironically a solid way to block a lot of tracking. Although they can still fingerprint you I think.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 50 points 6 months ago (2 children)

    Nothing makes you more unique than being one of the few people who disable java script

  • source
  • parent
  • hideshow 2 child comments
  • [–] 118 points 6 months ago (21 children)

    This ones my fave: https://amiunique.org/fingerprint

    It shows the percentages of people who use your same browser features (called similarity ratios), and can determine whether you're unique in their dataset. Can help for tweaking browser settings to try to make yourself not unique.

  • source
  • hideshow 21 child comments
  • [–] 10 points 6 months ago (2 children)

    Is there no add on, for Firefox, for example, to stop or confuse fingerprinting?

    Any suggestions?

    For Android.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 8 points 6 months ago* (last edited 6 months ago)

    My Mum always said I was unique.

    Now I have proof!

    Just being in Australia, and setting the timezone correctly gets you to below 0.6%

    😒

  • source
  • parent
  • [–] 14 points 6 months ago (6 children)

    i used to think that firefox on linux and as plain-jane-generic as you could get besides windows; but no, i'm ultra unique:

    Yes! You are unique among the 5084762 fingerprints in our entire dataset.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 13 points 6 months ago (5 children)

    Somehow safari on an iPhone is also unique.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 8 points 6 months ago (3 children)

    Check next week or in a new private tab now, prob be unique then too—think Apple’s fuzzing/reporting some noise/junk data for us.

    Canvas:

    & WebGL:

    gotta be noisy, here’s hoping!

  • source
  • parent
  • hideshow 3 child comments
  • [–] 7 points 6 months ago (2 children)

    Look at my epic WebGL render:

  • source
  • parent
  • hideshow 2 child comments
  • [–] [S] 6 points 6 months ago

    that's pretty comprehensive, and similarity ratios show how easy it is to create a unique fingerprint for somebody if you hash a few of these metrics together for example.

  • source
  • parent
  • [–] 56 points 6 months ago (11 children)

    "We know your IP address". No kidding, that's how IPv4 works, even if the browser wasn't leaking offering it.

  • source
  • hideshow 11 child comments
  • [–] 11 points 6 months ago (10 children)

    The point is not that they know your IP, but that even your IP already gives away information. That's why they start with the information, rather than the IP being the source.

    This is not intended to be for people who understand how this works.

    And as someone else said, probably vibe coded.

  • source
  • parent
  • hideshow 10 child comments
  • [–] 1 point 6 months ago (2 children)

    I understand how all of it works. Whether it's vibe coded or not it, it showed me stuff that I didn't think about like arbitrary web pages can know my phone tilt, battery level??

    The opsec implications are severe.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 6 months ago (1 child)

    Oh yeah, it's insane. The only way to truly protect your identity on the internet is by not using the internet. Second best would be tor, I suppose

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 6 months ago* (6 children)

    The public IP is irrelevant, only shows the IP of the server used by your ISP, which can be at the other side of the country. It can maybe identify the ISP, but not the user, less if a dynamic changing IP is used. The public IP is always leaked if you don't use a VPN or the TOR network.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 6 months ago* (4 children)

    Absolutely not, the public IP a website sees is your home IP. The resolved location will be inaccurate by design, but the IP definitely identifies you at that time.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 6 months ago (1 child)

    depends on the isp, my router has its own adress on the iternet

    couple of friends have a different isp that layers it users behind multiple nats so half the city would show the same ip on a website

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 6 months ago* (last edited 6 months ago)

    I've never heard of that kind of network, is that a US thing? I can't imagine having my traffic routed, as the person I replied to said, to the other side of the country before being routed to the proper destination. That is so incredibly inefficient and unnecessary. Not to mention the single point of failure.

    Edit: And it makes hosting a public facing server at home a nightmare... I see no benefit to this except not having to get a large IP range to properly assign them to your customers, which sounds like capital efficiency rather than decent user experience. Did I get it right, is this a US thing? :D

    Edit 2: And there are a lot of systems IP-banning abusers (it is, in fact, one of the most basic recommendations), meaning that if someone sharing that public IP gets IP banned, the entire customer group sharing the IP is troubled. Even worse if it ends up on a shared blacklist...

  • source
  • parent
  • [–] 1 point 6 months ago (1 child)

    What the website see is the current IP of the used ISP server in this moment. In the last check it was Madrid, several hundreds km from my real home. The public IP isn't the same as my user IP, which only know my ISP and I (and the police by the ISP, if exist a court order). The public IP don't show your real location, the website only can use your GPS data if you have it activated or if it appears in your account data (Google, Google Maps).

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 6 months ago*

    The public IP location is not precisely your location because your IP address does not convey that information at all. Services that locate an IP guesstimate based, mostly, on what range your IP is a part of, and what public data is available about that range.

    I'm not sure about Spain (pretty confident it is the same, only a capitalist hellhole would do what you suggest), but in France and the Netherlands at least, your IP (the one a website sees) is always yours and yours only, not the IP of some ISP server.

    If you can open your ports in your router and access them from the internet, then your public IP is yours. Most people can (even with a dynamic IP). If it was an ISP server, you wouldn't be able to.

    The thing a european ISP usually do is assign a dynamic IP, so that while your IP is assigned to your home router and yours only at a moment in time, it will likely change the next day, and will always change on a reboot of your router. But it still is your router's IP at that moment in time, not a random ISP server. IPs are not physically assigned to a device

    My home IP is mine, fixed, and I can verify that it is indeed my router. Yet the location of it according to locators is the other side of the country. The location locators give you for your IP being different to your actual location is not a proof that your public IP is not your actual home IP at all. And that is because an IP is not tied to a location and only your ISP can tell the location of their IPs.

  • source
  • parent
  • [–] 1 point 6 months ago

    Depending on your location it can actually be geolocated into your specific city block, I geolocated an online friend's IP just for the hell of it (I already knew where they lived) and it spit back out the city block they lived in as well as a lot of other very identifiable information

    Also, if you can ping devices on that network using that IP you can also use that as a way to easily identify users. That's if they have anything that isn't firewalled, obviously, but the point stands!

  • source
  • parent
  • [–] 41 points 6 months ago (1 child)

    1000014440

    And yet here they are showing me their webpage in darkmode 😒

  • source
  • hideshow 1 child comment
  • [–] 38 points 6 months ago

    Really interesting and slightly scary, thanks for sharing!

  • source
  • [–] 28 points 6 months ago (2 children)

    Funny how websites can read the gyroscope. It can also be used as a microphone. https://crypto.stanford.edu/gyrophone/

  • source
  • hideshow 2 child comments
  • [–] 28 points 6 months ago (4 children)
  • [–] 23 points 6 months ago (1 child)
  • [–] 22 points 6 months ago

    This post helped me discover that my SurfShark VPN built-in kill switch does not work within the Android app. My home IP was showing.

    I turned kill switch on at the OS level and my IP was correctly showing the VPN IP.

  • source
  • [+] 63 points 6 months ago* (6 children)
  • [–] 17 points 6 months ago (5 children)

    How can you tell that it was vibe coded? Genuine question.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 17 points 6 months ago (3 children)

    One clue to me is the "how many times you moved" statement. One actual human "move" is worth hundreds of what the site calls a move. A human would notice that but the reality of it means nothing to an AI.

    Secondly just the language used being quite dramatic but also generic.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 6 months ago

    You know it's just counting the change in acceleration in your phone's gyroscope chip or whichever it is. If you are typing something the phone "moves" twice with each swipe.

    This page is just putting numbers it's collecting from your phone into a template paragraph.

  • source
  • parent
  • load more comments (1 reply)
  • [–] 19 points 6 months ago (1 child)

    Great news. My VPN is working!

  • source
  • hideshow 1 child comment
  • [–] 19 points 6 months ago (1 child)

    I'm glad it acknowledges explains the impacts of anti-fingerprinting measures. I've seen some others assume that a random canvas is unique rather than one of the many people randomising it the same way, leading to a false "unique" assessment.

    Your browser appears to be returning the viewport in place of the real screen — anti-fingerprinting at work. The substitution is itself distinctive.

    Your browser masked your graphics processor. Firefox and Safari have started returning generic strings — "Mozilla", "Apple", "or similar" — instead of the real renderer. The fact that yours did so tells us, with reasonable confidence, which browser you are running. The mask is also a fingerprint.

  • source
  • hideshow 1 child comment
  • [–] 6 points 6 months ago

    I like that they covered all the possibilities for the do not track flag, as I saw it as useless from the very start, as by then I realized the honour system didn't mean shit and it would just be another piece of data.

  • source
  • parent
  • [+] 18 points 6 months ago (2 children)
  • [–] 17 points 6 months ago (3 children)

    Your finger moved 899 times.. what????

  • source
  • hideshow 3 child comments
  • [–] 8 points 6 months ago* (1 child)

    It seems to count a swipe as a series of dozens of movements. Probably to show there's a clear fingerprint even in how exactly you move your finger.

    Websites don't just get a "swipe" command. They know exactly where your finger is on the screen at any given moment.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 16 points 6 months ago (8 children)

    I found it interesting that it knows my battery level and current orientation of the phone.

  • source
  • hideshow 8 child comments
  • [–] [S] 9 points 6 months ago (4 children)

    I can understand the latter since it might want to render differently, but why does it need to know the battery level?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 5 points 6 months ago (1 child)

    Potentially to activate battery-saving features? Like AMOLED-black mode if your battery is <15 % or something (and your screen is AMOLED)

  • source
  • parent
  • hideshow 1 child comment
  • [–] [S] 10 points 6 months ago

    Shouldn't that be the provenance of the device itself though. My phone already allows me to set a threshold when it should go to night mode for example. The system can tell the browser to switch rendering to night mode. There's no real reason for the browser then to report to the site.

  • source
  • parent
  • [–] 15 points 6 months ago (2 children)

    This volume requires JavaScript. That is part of the point — your browser is what is being read.

    Looks like I'm safe

  • source
  • hideshow 2 child comments
  • [–] 22 points 6 months ago (2 children)
  • [–] 10 points 6 months ago (3 children)

    Time to start installing and uninstalling random fonts everyday.

  • source
  • hideshow 3 child comments
  • [–] 10 points 6 months ago

    Opend it in Tor Browser inside a Whonix dispVM inside Qubes OS it got nothing on me

  • source
  • [–] 10 points 6 months ago
    [–] 9 points 6 months ago* (last edited 6 months ago) (2 children)

    I wonder, do phones have 6dof tracking (space + rotation) or 3dof tracking (just rotations)
    because if it's 3dof I'm calling bullshit on some of this.

    I have 7 3dof fullbody trackers for vrchat (cough cough !VRChat@sh.itjust.works cough cough) and they're so damn inconsistent and need to constantly be ready to be calibrated to line up with what your body is actually doing. Having 1 3dof device can definitely detect walking or swinging, no shot it can tell if you're in bed or on a couch

  • source
  • hideshow 2 child comments
  • [–] 9 points 6 months ago (5 children)

    why would my browser share a list of fonts?

  • source
  • hideshow 5 child comments
  • [–] [S] 10 points 6 months ago (3 children)

    so the site knows what it can render

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 6 months ago (2 children)

    I don't anything about web development, so I assumed websites told browsers: 'Hey type this text in X font.' If the machine didn't have that font the browser would fall back to another font.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 6 months ago

    That is how it works, but that fall back tells the website what is and isn't available. Websites don't get a list provided by your browser- this website tests a big list of them:

    /* Fonts — measured via width comparison; the device names what it carries */ const testFonts = ['Helvetica Neue','Georgia','Courier New','Comic Sans MS','Impact','Trebuchet MS','Palatino','Garamond','Futura','Gill Sans','Verdana','Tahoma','Lucida Console','Cambria','Consolas','Menlo','Monaco']; const installed = []; const probe = document.createElement('span'); probe.style.cssText = 'position:absolute;left:-9999px;font-size:72px;visibility:hidden'; probe.textContent = 'mmmmmmmmlli'; document.body.appendChild(probe); probe.style.fontFamily = 'monospace'; const baseW = probe.offsetWidth; testFonts.forEach(f => { probe.style.fontFamily = '"' + f + '",monospace'; if (probe.offsetWidth !== baseW) installed.push(f); }); document.body.removeChild(probe);
    

    I use a custom font on one of my websites with the font files hosted on my server, which it offers to the browser, but it can be overridden by user accessibility settings

  • source
  • parent
  • load more comments
    view more: next ›
    11 comments in c/hackernews@lemmy.bestiver.se view that post
    9 comments in c/privacy@programming.dev view that post
    1 comment in c/pulse_of_truth@infosec.pub view that post