Digital Fingerprinting: Google launched a new era of tracking worse than cookie banners | Tuta

Hi, here are the extensions I use in FireFox/Librewolf (all will work in Chromium too, but I don't recommend Chromium browsers):

Privacy and Security-focused

uBlock Origin: A lightweight and efficient wide-spectrum content blocker.

Decentraleyes: Protects you from tracking through free, centralized content delivery. (not recommended alongside uBlock Origin; see the reply below)

CanvasBlocker: Protects your privacy by preventing websites from fingerprinting you using the Canvas API.

Ghostery Tracker & Ad Blocker - Privacy AdBlock: Blocks trackers and ads to protect your privacy and speed up browsing. Also has a handy feature that automatically rejects cookies for you. (not recommended alongside uBlock Origin; see the reply below. You can disable the ad blocking functionality and keep the cookie rejection function).

KeePassXC-Browser: Integrates KeePassXC password manager with your browser.

NoScript: Blocks JavaScript, Flash, and other executable content to protect against XSS and other web-based attacks (note: you will be required to manually activate javascript on each web page that you visit, but this is a good practice that you should get used to).

Privacy Badger: Automatically learns to block trackers based on their behavior. (not recommended alongside uBlock Origin; see the reply below)

User-Agent Switcher and Manager: Allows you to spoof your browser’s user-agent string (avoid creating a unique configuration; opt for something common, such as Chrome on Windows 10).

Violentmonkey: A user script manager for running custom scripts on websites (allows you to execute your own JavaScript code, usually to modify how a website behaves or block behavior that you don't like. VERY useful. Check out greasyfork for UserScripts).

Other useful extensions (non-privacy/security)

Firefox Translations: Provides on-demand translation of web pages directly within Firefox.

Flagfox: Displays a flag depicting the location of the current website’s server.

xBrowserSync: Syncs your browser data (bookmarks, passwords, etc.) across devices with end-to-end encryption.

Plasma Integration: Integrates Firefox with the KDE Plasma desktop environment (for linux users).

How must it feel being clever enough to come up with these ideas and then implement them for companies invading everyones privacy for advertisement revenue and malicious information serving or stealing.
I guess they sleep soundly on a fat bank account.

It's way worse than that.

Even if you somehow magically have the same settings as everyone else, you're mouse movement will still be unique.

You can even render something on a canvas out of view and depending on your GPU, your graphics driver, etc the text will look different...

There is no real way to escape fingerprinting.

I just don’t use any sites like that. If a site is using something other than Turnstile from Cloudflare, then I refuse to use it. I haven’t really experienced any inconvenience myself with this policy, but obviously I don’t depend on any sites that require recaptcha.

But you can allow/block any elements per site, or globally, which makes it trivial to block all unwanted scripts except on specific sites. So there is nothing preventing you from only exposing yourself to Google on the few sites you use that need those scripts.

I've checked, its true. Linux plus Firefox already puts you in the 2 percent category.

Anyone who uses uBlock blocks Google scripts.

plus Random User Agent.

I get that some things like screen resolution and basic stuff is needed, however most websites don’t need to know how many ram I have, or which CPU I use and so on. I would wish for an opt-in on this topics: So only make the bare minimum available and ask the user, when more is needed. For example playing games in the browser, for that case it could be useful to know how much ram is available, however for most other things it is not.

No it isn't.

And this is really important. If you go on Google tracked websites without tor, Google will still know it's you when you use tor, even if you've cleared all your cookies.

Tor means people don't know your IP address. It doesn't protect against other channels of privacy attack.

*Tor browse

Leave everything default and you'll look like every other Tor browser user.

same way other regulations are enforced: fines

Not sure how to effectively do that, but I reckon it would be no different than the cookie mess today. Which unfortunately is, hardly ever. The big GDPR related fines can still apply. Let's say a data set is leaked that includes tracking data that was not necessary for the service to have, then the company can receive a hefty fine. As long as the fine is larger than the reward, it might not be worth it for the company to track you anymore.

Yeah unfortunately disabling JS is not viable option tho onion websites are perfectly functional without JS and it just shows how unnecessarily JS had been expanded without regard for safety but theres no stopping the web.

I disable JS with noscript.net and it really is an enormous pain. It has some security advantages, like I don’t get ambushed so easily by an unfamiliar site and pop ups. I often will just skip a site if it seems too needy

I do it as a security measure for private institutions and everyone involved has signed contracts. It's not on the public web.

I know right. I was offered a job at a betting site and online casino with those addictive games and shit. Gave that a hard pass, said no thanks, don't think that's the right business area for me. I would feel so dirty going to and coming from work every damn day.

Wouldn’t selective disabling of JavaScript make fingerprinting easier? Your block and white list are likely to be unique.

What are some good scripts for grease monkey?

It's super effective but there are very few real use cases for it outside of security and ad tracking. For example you can't replace cookies with it because while good fingerprint is unique it can still be fragile (browser update etc.) which would cause data loss and require reauth.

Usually fingerprint plays a supporting role for example when you do those "click here" captchas that's actually just giving the browser time to fingerprint you and evaluate your trust to decide whether to give you a full captcha or let you through. So fingerprint is always there in tbe background these days tho mostly for security and ad tracking.

As for court cases and things like GDPR - the officials are still sleeping on this and obviously nobody wants to talk about it because it's super complex and really effective and effects soo many systems that are not ad tech.

In other words, they went public and must now maximize gains for shareholders.

for decades now

You should drop that S. The company has only existed for a little over 2 decades and Android hasn't been around for much more than 1. Yes they've become an evil fucking corporation but let's not exaggerate for how long.

It's still sad to see the development. We're allowed to mourn things that happened long ago, you know.

Oh absolutely. At this point I'm not surprised anymore that they turned to shit, it's more like I think they've hit rock bottom already but they manage to surprise me with new ways to dig their hole even deeper.

This is why I like Lemmy, never knew canvas blocker was a thing. Thank you.

I'm still trying to wrap my head around fingerprinting, so excuse my ignorance. Doesn't an installed plugin such as Canvas Blocker make you more uniquely identifiable? My reasoning is that very few people have this plugin relatively speaking.

I use (and love) Firefox containers, and I keep all Google domains in one container. However, I never know what to do about other websites that use Google sign in.

If I'm signing into XYZ website and it uses my Google account to sign in, should I put that website in the Google container? That's what I've been doing, but I don't know the right answer.

Some math functions have slightly different results depending on architecture and OS, so they fuzz the results a little. Here's a tor issue discussing the problem: https://gitlab.torproject.org/legacy/trac/-/issues/13018

And automatic darkmode isn't respected, and a lot of other little annoyances. That's why this is so difficult. These are all incredibly useful features we would have to sacrifice for privacy.

Wait is that why my Firefox giving me errors when I try to log into websites with 2FA?

The crazy part about fingerprinting is that if you block the fingerprint data, they use that block to fingerprint you. That’s why the main strategy is to “blend in”.

So, essentially the best way to actually resist fingerprinting would be to spoof the results to look more common - for example when I checked amiunique.org one of the most unique elements was my font list. But for 99% of sites you could spoof a font list that has the most common fonts (which you have) and no others and that would make you "blend in" without harming functionality. Barring a handful of specific sites that rely on having a special font, that might need to be set as exceptions.

But does privacy badger also act on the canvas APIs & cie. ?

It's a nice feature for those that actively enable it and know that it's enabled, but not for the average user. Most people never change the default settings. Firefox breaking stuff by default would only decrease their market share even further. And this breaks so much stuff. Weird stuff. The average user wants a browser that "just works" and would simply just switch back to Chrome if their favourite website didn't work as expected after installing Firefox. Chrome can be used by people who don't even know what a browser is.

Mull is discontinued unfortunately, although I think it got forked?

The first point is flawed and even TOR doesn't execute javascript because it's impossible to catch everything when you give the server full code running capabilities.

The second point is more plausible but there's an incredible amount of work to do to fix this. Like, needing to rework browser engines from ground up and removing all of the legacy cruft. Brave is not capable of this and never will be no matter what they advertise because it doesn't have it's own engine.

That being said, these tools will get you quite far against commercial fingerprint products especially ones used for Ads but that will also ruin your browser experience as now you're just solving captchas everywhere 🫠

Just for an example that isn't visible to the user: the server needs to know how it can communicate responses to the browser.
So it's not just "what fonts do you have", it also needs to know "what type of image can you render? What type of data compression do you speak? Can I hold this connection open for a few seconds to avoid having to spend a bunch of time establishing a new connection? We all agree that basic text can be represented using 7-bit ASCII, but can you parse something from this millennium?”.

Beyond that there's all the parameters of the actual connection that lives beneath http. What tls ciphers do you support? What extensions?

The exposure of the basic information needed to make a request reveals information which may be sufficient to significantly track a user.

I fucking hate this. Let me zoom, stop reacting and centering omfg.

I know that it has that in theory, but my Firefox just reached a lower score on https://coveryourtracks.eff.org/ (which was posted in this threat, thanks!) than a Safari. Firefox has good tracking protection but has an absolute unique fingerprint, was 100% identifiable as the first on the site, as to Safari, which scored a bit less in tracking but had a not unique fingerprint.

He was the main character on Silicon Valley

Idk, I see a lot of "a", "an", and "the" there.

I go to pornhub for the definite article

What did you switch to?

Our work is switching from them and god damn they are so good at things though. I always disliked labels but the layout is top tier.

But yeah they are awful people

Beware, the current administration might send you to Gitmo if you don't kneel to King Trump!

Mullvad, (the vpn, I have not tried the browser) uses a single account number as both name and password, no emails. It allows for multiple anonymous payment methods and it's open source.

Sliiiiightly more trustworthy than Google imo.

If you don't trust anyone the internet (or any net you don't fully control yourself) is not something you will use.

Practical security is a matter of threat-modeling and calculated risks.

Mullvad has a good track record, but if you know of better alternatives that don't require building it yourself, please share!

And Mullvad is not in business if selling user profiles to advertisers, at least as far as we know

Still parading that lie around? It was removed and then added back later.

And recaptcha. And Google-hosted Javascript libraries. And youtube embeds.

I'm aware of fingerprinting techniques, thank you. The article is claiming that Google will start using some of those and I'm looking for the source for that claim, hopefully with specifics about which techniques are involved. Confusingly, the article does not appear to provide such a source.

I personally have never used them. I use Proton myself (despite some news) and haven't had any issues. I've heard Tuta is also great but I think one of the cons of privacy mail is that they're not going to be nearly as polished as the big players like Gmail or outlook.

Do you have a link for those reviews of Tuta email?

Sure, but look at it this way. Fingerprints are benefiting the advertisers, and their purpose is to better target ads. Well I say fingerprint the hell out of everything, but I'll make sure no ads get through. If we all do that, what's the added value of fingerprinting then?