As Google gives you the choice to opt out of cookie tracking, it silently starts collecting your online habits with fingerprinting.
  • werefreeatlast@lemmy.worldEnglish
    35·
    4 days ago

    I go to pornhub every morning to check out the articles. Lately I’ve noticed that they have exactly the kind of articles I’m interested in always at the top two rows and then a bunch of stuff I’m not really into elsewhere. They are definitely testing stuff.

  • JackAttack@lemmy.dbzer0.comEnglish
    9·
    4 days ago

    Great read from Tuta on thia topic. It’s been an issue for a while but Google going full force publicly on it causes this issue to grow greater.

    I left a comment replying to someone further down about how this can be at least a little combatted and how it is with browsers. (At least to my minimal knowledge of it)

    • NuXCOM_90Percent@lemmy.zipEnglish
      91·
      4 days ago

      I just wish Tuta put more effort into their product than their marketing.

      I noped out because of them not letting me have any control over my emails outside of asking them for a dump. But reading the support reddit is just brutal.

      • JackAttack@lemmy.dbzer0.comEnglish
        8·
        4 days ago

        I personally have never used them. I use Proton myself (despite some news) and haven’t had any issues. I’ve heard Tuta is also great but I think one of the cons of privacy mail is that they’re not going to be nearly as polished as the big players like Gmail or outlook.

  • WorldsDumbestMan@lemmy.todayEnglish
    324·
    3 days ago

    I don’t bother. I know they know everything about me already, and that I’m not an important person. As such, I wonder why it matters.

      • perfectly_boiled_pizza@lemmy.worldEnglish
        13·
        4 days ago

        It’s a nice feature for those that actively enable it and know that it’s enabled, but not for the average user. Most people never change the default settings. Firefox breaking stuff by default would only decrease their market share even further. And this breaks so much stuff. Weird stuff. The average user wants a browser that “just works” and would simply just switch back to Chrome if their favourite website didn’t work as expected after installing Firefox. Chrome can be used by people who don’t even know what a browser is.

    • fossphi@lemm.eeEnglish
      1·
      3 days ago

      Please don’t enable this blindly. A lot of modern websites depend on a bunch of features which will simply not work with that flag enabled. Only do it, if you’re willing to compromise and debug things a bit

    • pHr34kY@lemmy.worldEnglish
      15·
      4 days ago

      I’ve used this. The only annoyance is that all the on-screen timestamps remain in UTC because JS has no idea what timesone you’re in.

      I get that TZ provides a piece of the fingerprint puzzle, but damn it feels excessive.

      • treadful@lemmy.zipEnglish
        13·
        4 days ago

        And automatic darkmode isn’t respected, and a lot of other little annoyances. That’s why this is so difficult. These are all incredibly useful features we would have to sacrifice for privacy.

        • unwarlikeExtortion@lemmy.mlEnglish
          21·
          3 days ago

          Dark mode can be recreated using extensions, although the colors most likely won’t be as legible as “native support”.

          I don’t see why a similar extrnsion couldn’t change the timezones of clocks.

          Additionally, I don’t see why the server should bother with either (pragmatically) - Dark mode is just a CSS switch and timezones could be flagged to be “localized” by the browser. No need for extra bandwidth or computing power on the server end, and the overhead would be very low (a few more lines of CSS sent).

          Of course, I know why they bother - Ad networks do a lot more than “just” show ads, and most websites also like to gobble any data they can.

    • sem@lemmy.blahaj.zoneEnglish
      18·
      4 days ago

      Why does it do this?

      • Math operations in JavaScript may report slightly different values than regular.

      PS grateful for this option!

    • Ulrich@feddit.orgEnglish
      141·
      4 days ago

      I mean it doesn’t hurt but as far as I can tell, it doesn’t actually block fingerprinting, it blocks domains known to collect and track your activity. The entire web is run on Google domains so that would be nearly impossible to block.

      The crazy part about fingerprinting is that if you block the fingerprint data, they use that block to fingerprint you. That’s why the main strategy is to “blend in”.

      • Schadrach@lemmy.sdf.orgEnglish
        4·
        3 days ago

        The crazy part about fingerprinting is that if you block the fingerprint data, they use that block to fingerprint you. That’s why the main strategy is to “blend in”.

        So, essentially the best way to actually resist fingerprinting would be to spoof the results to look more common - for example when I checked amiunique.org one of the most unique elements was my font list. But for 99% of sites you could spoof a font list that has the most common fonts (which you have) and no others and that would make you “blend in” without harming functionality. Barring a handful of specific sites that rely on having a special font, that might need to be set as exceptions.

        • Ulrich@feddit.orgEnglish
          1·
          3 days ago

          No, the best way is to randomly vary fingerprinting data, which is exactly what some browsers do.

          Font list is just one of a hundred different identifying data points so just changing that alone won’t do much.

          • Schadrach@lemmy.sdf.orgEnglish
            2·
            3 days ago

            I wasn’t suggesting it as “font list and you’re done”. I was using it as an example because it’s one where I’m apparently really unusual.

            I would think you’d basically want to spoof all known fingerprinting metrics to be whatever is the most common and doesn’t break compatibility with the actual setup too much. Randomizing them seems way more likely to break a ton of sites, but inconsistently, which seems like a bad solution.

            I mean hypothetically you could also set up exceptions for specific sites that need different answers for specific fields, essentially telling the site whatever it wants to hear to work but that’s going to be a lot of ongoing work.

    • masterofn001@lemmy.caEnglish
      87·
      4 days ago

      You can also use canvas blocker add-on.

      Use their containers (firefox multi-account container add-on) feature and make a google container so that all google domains go to that container.

      If you want to get crazy, in either set in about:config or make yourself a user.is file in your Firefox profile directory and eliminate all communication with google. And some other privacy tweaks below.

      google shit and some extra privacy/security settings

      Google domains and services:

      user_pref(“browser.safebrowsing.allowOverride”, false);
      user_pref(“browser.safebrowsing.blockedURIs.enabled”, false);
      user_pref(“browser.safebrowsing.downloads.enabled”, false);
      user_pref(“browser.safebrowsing.downloads.remote.block_dangerous”, false);
      user_pref(“browser.safebrowsing.downloads.remote.block_dangerous_host”, false);
      user_pref(“browser.safebrowsing.downloads.remote.block_potentially_unwanted”, false):
      user_pref(“browser.safebrowsing.downloads.remote.block_uncommon”, false);
      user_pref(“browser.safebrowsing.downloads.remote.enabled”, false);
      user_pref(“browser.safebrowsing.downloads.remote.url”, “”);
      user_pref(“browser.safebrowsing.malware.enabled”, false);
      user_pref(“browser.safebrowsing.phishing.enabled”, false);
      user_pref(“browser.safebrowsing.provider.google.advisoryName”, “”);
      user_pref(“browser.safebrowsing.provider.google.advisoryURL”, “”);
      user_pref(“browser.safebrowsing.provider.google.gethashURL”, “”);
      user_pref(“browser.safebrowsing.provider.google.lists”, “”);
      user_pref(“browser.safebrowsing.provider.google.reportURL”, “”);
      user_pref(“browser.safebrowsing.provider.google.updateURL”, “”);
      user_pref(“browser.safebrowsing.provider.google4.advisoryName”, “”);
      user_pref(“browser.safebrowsing.provider.google4.advisoryURL”, “”);
      user_pref(“browser.safebrowsing.provider.google4.dataSharingURL”, “”);
      user_pref(“browser.safebrowsing.provider.google4.gethashURL”, “”);
      user_pref(“browser.safebrowsing.provider.google4.lists”, “”);
      user_pref(“browser.safebrowsing.provider.google4.pver”, “”);
      user_pref(“browser.safebrowsing.provider.google4.reportURL”, “”);
      user_pref(“browser.safebrowsing.provider.google4.updateURL”, “”);

      Privacy and security stuff:

      user_pref(“dom.push.enabled”, false);
      user_pref(“dom.push.connection.enabled”, false);

      user_pref(“layout.css.visited_links_enabled”, false);
      user_pref(“media.navigator.enabled”, false);

      user_pref(“network.proxy.allow_bypass”, false);
      user_pref(“network.proxy.failover_direct”, false);
      user_pref(“network.http.referer.spoofSource”, true);

      user_pref(“security.ssl.disable_session_identifiers”, true);
      user_pref(“security.ssl.enable_false_start”, false);
      user_pref(“security.ssl.treat_unsafe_negotiation_as_broken”, true);
      user_pref(“security.tls.enable_0rtt_data”, false);

      user_pref(“privacy.partition.network_state.connection_with_proxy”, true);

      user_pref(“privacy.resistFingerprinting”, true);
      user_pref(“privacy.resistFingerprinting.block_mozAddonManager”, true);
      user_pref(“privacy.resistFingerprinting.letterboxing”, true);
      user_pref(“privacy.resistFingerprinting.randomization.daily_reset.enabled”, true);
      user_pref(“privacy.resistFingerprinting.randomization.enabled”, true);

      user_pref(“screenshots.browser.component.enabled”, false);

      user_pref(“privacy.spoof_english”, 2);

      user_pref(“webgl.enable-debug-renderer-info”, false); user_pref(“webgl.enable-renderer-query”, false);

      • oaklandnative@lemmy.worldEnglish
        21·
        3 days ago

        I use (and love) Firefox containers, and I keep all Google domains in one container. However, I never know what to do about other websites that use Google sign in.

        If I’m signing into XYZ website and it uses my Google account to sign in, should I put that website in the Google container? That’s what I’ve been doing, but I don’t know the right answer.

      • Chulk@lemmy.mlEnglish
        9·
        4 days ago

        I’m still trying to wrap my head around fingerprinting, so excuse my ignorance. Doesn’t an installed plugin such as Canvas Blocker make you more uniquely identifiable? My reasoning is that very few people have this plugin relatively speaking.

        • RecallMadness@lemmy.nzEnglish
          2·
          3 days ago

          Iirc, Websites can’t query addons unless those addons manipulate the DOM in a way that exposes themselves.

          They can query extensions.

          Addons are things installed inside the browser. Like uBlock, HTTPS Everywhere, Firefox Containerr, etc.

          Extensions are installed outside the browser. Such as Flashplayer, the Gnome extensions installer, etc.

          • RecallMadness@lemmy.nzEnglish
            1·
            3 days ago

            Further: the Canvas API doesn’t have any requirements on rendering accuracy.

            By deferring to the GPU, font library, etc, tracking code can generate an image that is in most cases unique to your machine.

            So blocking the Canvas API would return a 0. Which is less unique than what it would be normally.

        • happydoors@lemm.eeEnglish
          2·
          4 days ago

          Maybe if they can connect you to your other usage but it’s probably more of their resources and such a small % of the population that it isn’t worth the time to subvert? Idk just guessing here

  • Ledericas@lemm.eeEnglish
    6·
    4 days ago

    its captcha v3, its the same thing reddit uses to catch bots and ban evaders, apparently its expensive for reddit so they only mostly use it for ban waves.

  • pHr34kY@lemmy.worldEnglish
    132·
    4 days ago

    So, manifest v3 was all about preventing Google’s competitors from tracking you so that Google could forge ahead.

    • Cethin@lemmy.zipEnglish
      16·
      4 days ago

      The fewer of your competitors who have the data the more valuable that data is.

    • Ulrich@feddit.orgEnglish
      692·
      4 days ago

      It was never about privacy, it was supposedly about security, which there is some evidence for. There were a lot of malicious extensions. The sensible thing to do would be to crack down on malicious extensions but I guess that costs too much money and this method also conveniently partially breaks adblockers.

  • Phoenixz@lemmy.caEnglish
    53·
    3 days ago

    Yeah, I have an anti fingerprint extension installed in Firefox, and immediately no Google site will work anymore, all google sessions break with it while most other sites just continue to work.

    I’m working to rid myself completely from Google, my target being that I will completely DNS block all google (and Microsoft and Facebook) domains within a year or so. Wish I could do it faster but I only have a few hours per weekend for this

      • 🅃🅾🅆🅴🄻🅸🄴@lemm.eeEnglish
        312·
        3 days ago

        Hi, here are the extensions I use in FireFox/Librewolf (all will work in Chromium too, but I don’t recommend Chromium browsers):

        Privacy and Security-focused

        uBlock Origin: A lightweight and efficient wide-spectrum content blocker.

        Decentraleyes: Protects you from tracking through free, centralized content delivery. (not recommended alongside uBlock Origin; see the reply below)

        CanvasBlocker: Protects your privacy by preventing websites from fingerprinting you using the Canvas API.

        Ghostery Tracker & Ad Blocker - Privacy AdBlock: Blocks trackers and ads to protect your privacy and speed up browsing. Also has a handy feature that automatically rejects cookies for you. (not recommended alongside uBlock Origin; see the reply below. You can disable the ad blocking functionality and keep the cookie rejection function).

        KeePassXC-Browser: Integrates KeePassXC password manager with your browser.

        NoScript: Blocks JavaScript, Flash, and other executable content to protect against XSS and other web-based attacks (note: you will be required to manually activate javascript on each web page that you visit, but this is a good practice that you should get used to).

        Privacy Badger: Automatically learns to block trackers based on their behavior. (not recommended alongside uBlock Origin; see the reply below)

        User-Agent Switcher and Manager: Allows you to spoof your browser’s user-agent string (avoid creating a unique configuration; opt for something common, such as Chrome on Windows 10).

        Violentmonkey: A user script manager for running custom scripts on websites (allows you to execute your own JavaScript code, usually to modify how a website behaves or block behavior that you don’t like. VERY useful. Check out greasyfork for UserScripts).

        Other useful extensions (non-privacy/security)

        Firefox Translations: Provides on-demand translation of web pages directly within Firefox.

        Flagfox: Displays a flag depicting the location of the current website’s server.

        xBrowserSync: Syncs your browser data (bookmarks, passwords, etc.) across devices with end-to-end encryption.

        Plasma Integration: Integrates Firefox with the KDE Plasma desktop environment (for linux users).

        • kalpol@lemmy.worldEnglish
          2·
          2 days ago

          Port Authority is a good one too, I think. Need to check that it is still maintained.

        • JimRaynor@lemm.eeEnglish
          1·
          2 days ago

          Thanks for this list! Just got off chrome and this helped speed things along!

        • helloyanis@jlai.luEnglish
          11·
          3 days ago

          Thanks for the list! Although most of the time it’s advised to not use multiple adblocker in tandem, because they might conflict with each other and get detected by the website. For example, uBlock origin has, in its settings, an option to disable JavaScript and in the filter list, an option to block cookie banners “Cookie notices”. But if all of these work for you that’s great!

        • aceshigh@lemmy.worldEnglish
          3·
          3 days ago

          How do these extensions work with ubo?

          On a different note. Your name used to be my nickname lol thanks for that memory.

          • 🅃🅾🅆🅴🄻🅸🄴@lemm.eeEnglish
            2·
            3 days ago

            They work well on desktop and mobile (firefox). As the other replier stated, you may want to avoid using multiple ad blockers (decentraleyes, privacy badger, and ghostery) alongside UBlock; and NoScript’s functionality can be achieved with UBlock.

            Lol the name came from a ironscape clan member from my osrs days. I don’t suppose that’s you?

  • RejZoR@lemmy.mlEnglish
    424·
    4 days ago

    Good thing I erased Google out of my life a decade ago meaning I can much easier block even more of their everywhere present garbage and not have issues.

    • howrar@lemmy.caEnglish
      162·
      3 days ago

      Considering how few people block all scripts, this could also make it trivial for them to fingerprint you.

      • _cryptagion@lemmy.dbzer0.comEnglish
        3·
        2 days ago

        I just don’t use any sites like that. If a site is using something other than Turnstile from Cloudflare, then I refuse to use it. I haven’t really experienced any inconvenience myself with this policy, but obviously I don’t depend on any sites that require recaptcha.

        But you can allow/block any elements per site, or globally, which makes it trivial to block all unwanted scripts except on specific sites. So there is nothing preventing you from only exposing yourself to Google on the few sites you use that need those scripts.

  • 9point6@lemmy.worldEnglish
    511·
    4 days ago

    Further evidence that a Republican government in the USA results in private organisations pushing the bar as far as they can.

    In Reagan’s time it was Wall Street. Now it’s Silicon Valley.

    You want private organisations working for your benefit and not that of their shareholders? You need a government that actually has the gumption to challenge them. The current US government is 4 years of a surrender flag flying on the white house.

    Or we could bin off this fucking failed neoliberal experiment, but that’s apparently a bit controversial for far too many people

    • One_Blue_Shoe@lemmynsfw.comEnglish
      7·
      4 days ago

      Having the gall to suggest we not allow less than 3000 people to own all of the worlds supply lines, media platforms, institutional wealth, construction companies, dissemination platforms, politicians, private equity firms and the single largest interconnected (private or otherwise) espionage and social engineering plot known to mankind?

      You fucking tanky you! Go back to Russia!!!

    • sugar_in_your_tea@sh.itjust.worksEnglish
      1·
      3 days ago

      Republicans aren’t the problem here, they’re a natural result of a two party system. If you have a coin, half the time you’ll get the “good” side, and half the time you’ll get the “bad.”

      And this isn’t to say either side is consistently “good” or “bad,” parties rarely stick anything. The deregulation you’re complaining about started under Jimmy Carter, affectionately called “the great deregulator.” In fact, many (most?) of Carter’s changes took effect during Reagan’s term, and it was incredibly successful.

      However, for some reason Democrats are now against deregulation, probably because Republicans took the credit and Democrats needed to rebrand.

      That doesn’t imply that Trump’s deregulation is “good,” it just means deregulation isn’t inherently “bad.”

  • Zarxrax@lemmy.worldEnglish
    74·
    4 days ago

    Would it be possible for a browser or extension to just provide false metadata in order to subvert this type of fingerprinting?

    • JackAttack@lemmy.dbzer0.comEnglish
      61·
      4 days ago

      So from what I understand, theres 2 common ways that browsers combat this. Someone add to or correct me if I’m wrong.

      1. Browsers such as Mull combat this by looking the same as every other browser. If you all look the same, it’s hard to tell you apart. I believe this is why people recommend using default window size when using Tor.

      Ex: Everyone wearing black pants and hoodies with the facemasks. Extremely hard to tell who is who.

      1. Browsers such as Brave randomize metadata that fingerprinting collects so that it’s more difficult to piece it all together and build a trend/profile on someone.

      Ex: look like a dog in one place, a cat in another place. They get data for a dog but that doesn’t help build anything if the rest of the data is a cat, hamster, whatever. No way to piece it together to be useful.

      In both my examples, there are caveats. Just because everyone dressed the same doesn’t mean someone isn’t taller or shorter, or skinnier or fatter. There can still be tells to help narrow down. Or a cat that barks like a dog suddenly is more linkable to a dog if that makes sense lol.

      In other words it still depends user behavior that can contribute to the effectiveness of these tools.

      EDIT: got distracted. To answer your question I don’t think so. I think it’s more about user behavior blending in or being randomized. I think the only thing an extension would be able to do is possibly randomize the data but I’m unsure of such an extension yet. These aren’t the only options, these are just ones I’ve read about recently. Online behavior, browswr window size, and I’m sure so much more also goes into it. But every little bit helps and is better than nothing.

      EDIT2: Added examples for each for clarity.

      • Dr. Moose@lemmy.worldEnglish
        5·
        4 days ago

        The first point is flawed and even TOR doesn’t execute javascript because it’s impossible to catch everything when you give the server full code running capabilities.

        The second point is more plausible but there’s an incredible amount of work to do to fix this. Like, needing to rework browser engines from ground up and removing all of the legacy cruft. Brave is not capable of this and never will be no matter what they advertise because it doesn’t have it’s own engine.

        That being said, these tools will get you quite far against commercial fingerprint products especially ones used for Ads but that will also ruin your browser experience as now you’re just solving captchas everywhere 🫠

    • Dr. Moose@lemmy.worldEnglish
      111·
      4 days ago

      No. Anything that executes Javascript will be fingerprinted.

      That being said it depends who are you fighting. For common commercial tools like Cloudflare fingerprinter it might work to some extent but if you want to safeguard against more sophisticated fingerprinting then TOR and no JS is the only way to combat this.

      The issue is that browsers are so incredibly complex that it’s impossible to patch everything and you’ll just end up getting infinite captchas and break your browsing experience.

    • kipo@lemm.eeEnglish
      91·
      4 days ago

      Yes. There is a firefox extension called Chameleon that does this.

    • fmstrat@lemmy.nowsci.comEnglish
      2·
      4 days ago

      Others have mentioned what Firefox/etc do, but another option is a PiHole. If you can’t look up the IP for an advertiser URL, you don’t load the JavaScript to begin with.

    • Ulrich@feddit.orgEnglish
      3·
      4 days ago

      Yes but that metadata is also used to serve you the webpage, so if you spoof it, the page may not load properly.

  • RangerJosey@lemmy.mlEnglish
    12·
    4 days ago

    Unlock Origin, Ghostery, and what else? Scriptmonkey maybe?

    They’ll stop it.

    • hansolo@lemm.eeEnglish
      2·
      4 days ago

      Ooooh, no they won’t stop this. It’s the workaround for tracking with all the things you just mentioned.

      You have to either mask the fingerprint like how Brave does, or spoof the headers and block JS to make the fingerprint useless.