this post was submitted on 01 Aug 2024
173 points (97.8% liked)

Technology

60033 readers
2990 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 53 points 4 months ago* (last edited 4 months ago) (1 children)

Another problem with Cloudflare:

They are a man-in-the-middle between users and a sizable chunk of web and domain name servers, putting them in a position to track your behavior all over the place (even if you use an ad blocker).

And in many cases, they provide the encryption for those sites, so they can read or modify your unencrypted traffic as it passes between them and the origin servers.

[–] [email protected] 15 points 4 months ago (1 children)

AdBlock doesn't do shit about advanced fingerprinters

Have a look at CreepJS

Only way I found to circumnvent it is by using JShelter with WebWorkers removed

[–] [email protected] 3 points 4 months ago (1 children)
[–] [email protected] 20 points 4 months ago* (last edited 4 months ago) (5 children)

Well, this is a way to vast topic to explain everything here but I'll try and summarize the most important things:

Let me first explain how websites are able to "fingerprint" you: It's basically just collecting as much data as possible about your device. Simple things like your browsers size (in pixels), your screen size, your CPU's core count an many, many more. Having all this data makes it possible for websites to create a profile that only matches one of your specific devices (world wide!). Some websites/fingerprinters even go as far as scanning your local network for other devices, which could even tell them where you live, with whom etc. This wouldn' be such a big deal if every website had their own database, but almost every page uses ads from Amazon, Meta or Google which makes these companies able to reliably track most of your internet usage even across different devices

So fingerprinters can be very intrusive nowadays, the best way to be anonymous is for everyone to share the same fingerprint which is what the tor browser tries to attempt. Obviously this needs everyone to conform to some predefined norms to work, otherwise you'll become an outlier which can be tracked again

Tor browser sadly is very slow and by definition not very customizable, so I chose to forsake it in favor of Librewolf in combination with uBlock Origin in Strict Mode, all filterlists and all privacy settings enabled. Additionally I use JShelter to restrict websites Javascript usage and spoof some of the data which can be fingerprinted. Also for Android I use Firefox with some settings from the Arkenfox user.js (Librewolf uses this by default, I mostly use DNS over TLS and Resist Fingerprinting) and Firefox's own Enhanced Tracking Protection in Strict mode. Additionally I like LibRedirect to access Reddit when I need to without having to login.

This setup stops most fingerprinters from even being loaded, those that still get loaded won't run most of the time. It also sadly doesn't work very well with pages behind Cloudflare, so you sadly need to (temporarily) disable some protections to get arround cloudflares captcha (or alternatively delete the webpages cookies each time you request another page from the same domain, this can be automated with addons/Firefox)

Keep in mind though that my setup might be considered pretty overkill by most and that privacy is a spectrum. It's possible to block all tracking, but that would make almost the whole web unusable so keep that in mind. Your goal should be to limit the data that can be harvested from you to an acceptable degree, not to eliminate it. Most of the time this is a tradeoff of convenience vs privacy

If you wanna learn more look arround uBlock Origin Wiki, the Arkenfox user.js Wiki and the JShelter webpage

Additionally here's some websites to test your overall fingerprintability:

  • Browserleaks (My favorite, as it explains most things it shows you)
  • Cover your tracks: Let's you look at your fingerprint generated by real tracking companies, mine is unique but changes every browser session (restarting my browser/wiping the pages cookies)
  • CreepJS: Strongest fingerpriner I have found to date, almost impossible to fool. Goes as far as knowing when your browser lies about some things and much more!
  • IPLeak: Some more identifiable information about your ip address and DNS settings

Shoutout to LibreJS as well, sadly it breaks wayyy to many websites without doing endless tweaking for me to consider it usable and also LocalCDN

Also to finish this I should tell you that I'm by no means an expert and that you should do your own research. Having a semi random fingerprint can itself be a trackable vector but atleast I feel safe enough doing it this way

Feel free to ask more if something's unclear/you want to know some more about privacy outside of your browser

[–] [email protected] 3 points 4 months ago (1 children)

Knew some of this but did not know how far it went. Great write up.

[–] [email protected] 2 points 4 months ago
[–] [email protected] 2 points 4 months ago (1 children)

Something I don't get is, why try to make all browser look the same when you can do the easier thing and just make each browser session have a new fingerprint?

A unique fingerprint doesn't matter much if it's only valid till I close that website, right? So why not change a lot of variables by some small amount to make the data useless?

[–] [email protected] 1 points 4 months ago

That's exactly what my setup does. But like I said, this could in theory lead to you being more trackable

[–] [email protected] 2 points 4 months ago (1 children)

Mate thx for the wall post, I did learn a lot.

I heard about generating unique IDs from harvesting PC data since the days that Adobe flash version were pretty telling, but no idea browsers today leaked so much semi identifying info.

You are in fact an expert even if there's people you look up to. Keep sharing and keep being awesome.

[–] [email protected] 1 points 4 months ago* (last edited 4 months ago)

Mate thx for the wall post, I did learn a lot.

You are in fact an expert even if there's people you look up to. Keep sharing and keep being awesome.

Oh wow, I really didn't expect such a kind response. I appreciate it, a lot actually. Now I know it was 100% worth it to write this 30 minute essay :D

Glad to help you mate and thank you

You are in fact an expert even if there's people you look up to

I don't wanna say you're right/wrong with this. Although I definitely agree that it's always a matter of perspective

I heard about generating unique IDs from harvesting PC data since the days that Adobe flash version were pretty telling, but no idea browsers today leaked so much semi identifying info.

Yeah, it's honestly scary. These huge tracking companies can easily tell who you are, where you live, with whom and also deeply analyze your psyche and psychological state. That's why I went so deep into the privacy rabbit hole

It's also really scary that most people are okay with this

[–] [email protected] 2 points 4 months ago* (last edited 4 months ago) (1 children)

Didn’t expect this. Thank you so much for such a great write-up. Stuff like this makes Lemmy great. What field are you in? Also, do you find CreepJS more powerful than Fingerprint.com?

[–] [email protected] 2 points 4 months ago* (last edited 4 months ago)

Thank you so much for such a great write-up

Don't worry, I kinda nerd out over this so it was fun to share some of my knowledge

What field are you in?

Nothing specific sadly, as I messed up school because I didn't care enough. I started learning to program at 11 years old though, got into reverse engineering by 12 and so much more stuff by now because it's all so fascinating I just can't stop researching and messing arround with things

Also, do you find CreepJS more powerful than Fingerprint.com?

Haven't seen that one yet, I'll play arround with it the next time I'm at my PC

Edit: It's not, my android setup was enough to fool it automatically. CreepJS is insane though, it even kept track of me on Tor!

[–] [email protected] 2 points 4 months ago

Awesome write-up, thanks