upvote
a lot of what is used for fingerprinting is also used legitimately, and a lot of sites fingerprint. so ~every site would be behind a security risk warning.

we know from the boy who cried wolf that too many warnings quickly turns into legitimate warnings being ignored

reply
How? How would a browser "know" what classifies as finger printing? Literally every piece of the engine is used for finger printing.

It can be mitigated, a bit, but I don't see how browsers can win that battle.

Finger printing is a lost battle in my opinion, unless we drastically reduce what a web engine can do (like Tor does).

reply
I feel like there are two levels of fingerprinting here, and a lot of the confusion is downstream of not properly distinguishing them:

There's the kind that tries to find out what browser vendor, OS, and sometimes hardware you use, and the kind that tries to identify you across visits, unrelated origins etc.

I agree that the former is probably inherently impossible to avoid to a large extent, but the latter is both a bigger privacy issue and at least in theory possible to prevent.

reply
I've only encountered the latter described as fingerprinting. Which makes sense side, like fingerprints, the information is being used to uniquely identify an individual.

The former is traditional analytics and is not enough to uniquely identify an individual.

Not all analytics are as privacy invasive as fingerprinting.

reply
>The former is traditional analytics and is not enough to uniquely identify an individual

shockingly little information is required to uniquely identify someone.

"traditional analytics" (lets just say os + browser + some hardware info) is likely to be uniquely identifying when combined with just one other sparse dataset.

>Not all analytics are as privacy invasive as fingerprinting.

fingerprinting isn't a separate category of analytics. every data point can be (and often is) used for fingerprinting.

reply
Just assume any site using javascript is using it for nefarious purposes.
reply