upvote
Great how this is currently the 2nd highest comment despite completely ignoring the numerous fingerprinting techniques based on CSS alone (including one of the most famous fingerprinting methods by testing font support). Simply thanks to reflexive "JS=bad" upvotes.

https://en.wikipedia.org/wiki/CSS_fingerprinting

reply
The scope and amount of information that browsers hand over without the slightest shred of consent from the user or indication it’s happening is crazy.
reply
And also without logging it. Even if I don’t want popups to give consent for every document.getEyeColor() call, it would be nice go back and see who’s doing which queries and/or have Firefox collect aggregate statistics. Naming and shaming the crooks won’t stop them but it might have an impact on curbing any bad behavior from big commercial retailers.
reply
I like this idea a lot. It’s similar in principal to how macOS shames battery hog apps in its battery menu extra.
reply
It's a UX trade off. For non-adversarial websites it's very convenient for users because things just work without having to go through loads of permissions pop ups for every website, but of course this then makes this info a juicy target if you're trying to fingerprint someone.
reply
It's not a tradeoff, it's poor design.
reply
But it is a design trade-off. The opposite case can be seem in the many websites asking to send you notifications, and the many flavours of cookie notices. When you have to ask the user permission to do anything and everything, the user gets annoyed and desensitized. They start allowing everything (my always collects dozens of notification-enabled websites if given the chance), and the point of asking for permission is lost.
reply
> It's not a tradeoff, it's poor design.

How so? There seems a fairly inherent tension between having things just work by default and hiding surface area for fingerprinting behind permissions pop ups. For example say you go to a maps website, how do you decide whether to share the users location with the website? Or enable webGL functionality to render some fancy layout on the screen? As a user having to enable all that stuff per-website is annoying.

Maybe there's some other way Im missing?

reply
Is it though?

Google's business model has been ads from the beginning. Search, gmail, drive, office, chrome, everything they do is just to drive ad revenue further.

They don't care about the user. Never have, and never will.

And the outcome we are seeing is what happens when a defunct state isn't able to protect citizens from conglomerates. That's what the Kartellamt or the FTC is supposed to be for.

reply
Nope. At least until 2008 I cared and Larry and Sergey cared quite a bit.
reply
Yes, I believe they initially really meant it when making their “don’t be evil” statement.

The company as a whole also really stopped caring at some point and are now following the “do be evil” paradigm

reply
So "never have" might not be true. But what about the rest of the comment?
reply
> Nope. At least until 2008 I cared and Larry and Sergey cared quite a bit.

Not sure if I can't see this comment as anything else than hypocritical. It's always easier on the money receiving side, isn't it? How do you think the term malvertisement came to be?

AdMob is kind of the definition of inevitable Surveillance Capitalism and the prime example for necessary regulation through government.

reply
That's not a browser thing. Fingerprinting native apps is much easier.
reply
Sure, but at least native apps can only do that if I download and install them. If I do that, I’ve made a conscious decision that the tradeoff is worth the utility of the app. This limits the blast radius considerably.

On the web one is drive-by fingerprinted by sites they never once approved of or intended to visit thanks to the browser’s ability to redirect and embed without input from the user. The magnitude of the problem is far greater on the web.

To reframe it, in a given week the average person only uses a small handful of apps, but in the same span of time their browser has connected to thousands, maybe tens of thousands, of unique domains, most of which are tracking them in some capacity and the majority of which are tracking things most of us would consider invasive.

reply
I can't help but keep thinking that client-side scripting was a mistake. Sure, the web would be a lot more primitive without it, but I'm not convinced that wouldn't be for the best.
reply
My default is to run without JS and selectively enable it when absolutely necessary, so when I clicked on this story the page was prefaced with the following comment:

"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else.

From now on I’ll call you:…"

I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it. On rare occasions when I'm forced to use JS I'll cut-and-paste the URL into another browser.

I no longer use ad blockers as I just don't see ads with JS disabled. The other privacy precautions I take are the obvious ones such as no Google or social media accounts, flushing cookies at session's end, regularly randomize my IP and never let Chrome anywhere near my machines and make judicious use of multiple browsers (this is being written in Privacy Browser on Android).

Using NewPipe and sponsor block on PipePipe increases privacy and makes YouTube ad free.

Client-side scripting was a mistake which was obvious from the outset (or not severely limiting the reach of scripting engines).

What I find hard to understand is why alternative plugin JS engines haven't been developed that are under user control. Spoofing, randomizing and returning junk data to webservers would go a huge way towards stopping fingerprinting by websites.

reply
> I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it.

I guess you use the web in quite a limited manner? (Or use that other browser quite a lot...?).

I've tried no JS various times over the years and always end up constantly whitelisting sites. It's even worse in 2026 and gets worse each year.

Banking, insurance, webmail, groceries, eBay, CAPTCHAs... not to mention what feels like 50% of the web that is behind either Cloudflare or similar, which almost always require Javascript.

reply
I used to believe in that and would make sure all of my sites would work without Javascript until one of my projects (a micro community) got targeted by pedotrolls which lead to an awful time and now I associate people who are staunch no JS as pedos, I am not accusing you or anything but that is the impression it left on me. Ever since then I really don't care if the site doesn't work without JS, and if users can post stuff damn straight Javascript will be involved.

Unfortunately this idealistic principle (no JS) attracts the worst people.

You're on Tor? You have JS disabled? I might as well warm up fbi.gov/investigate/cyber for the probable report I'll have to do...

reply
Well, I find your comment pretty offensive. In the past I've had some pretty rough and disparaging comments from JavaScript fanboys but yours has to be the worst. Associating disabling JS with pedos is about as low as it gets. Where did you get those stats from, or are they just a figment of your imagination?

"Unfortunately this idealistic principle (no JS) attracts the worst people."

Again, how did you come to that opinion? Where's your evidence/stats? Generally comments like that come from web/JS programmers who've realized that client-side users have them stymied when they disable JS.

An additional reason I avoid JS is speed, webpages become blinding fast when there's no JS. Once one gets addicted to the great rendering speed there's no return. I'm not against JS per se, trouble is you JS programmers have weaponised it against users, webpages of 7, 10 and even 20MB are now commonplace. Presenting such slow massive pages to users is nothing other than abuse.

I do not use Tor.

BTW, I should point out that my views about JS and privacy abuse were formed from my years working in govt. surveillance where the stakes are very high.

reply
I came to my opinion through experience, I’m sorry you’re offended but I did say that I don’t imply that you’re a pedo but my stats sure show a pattern.

That does not change what I have dealt with. I am not a “JavaScript fanboy” remember I made a community that could work WITHOUT needing JavaScript and that lead to a bunch of grief for me which made me understand the extreme naivety of that original idealistic idea on the internet.

reply
The alternative is to install a binary that has full access to the computer.
reply
Chrome is a binary. What's your point?
reply
I assume it's something like: choosing to forego the protection of a battle-tested sandbox in favor of rawdogging random binaries off the internet would be insane.
reply
You can do plenty (like view port size) via just CSS.
reply
Even without JS, there is timing, HTTP headers, conditional CSS, etc.
reply
If everyone else you know has JavaScript turned on, congrats, you're still fingerprinted.
reply
If anyone else has JavaScript turned off you're fine (as long as you can account for all the other stuff like IP address).
reply
> identifying hardware,

> language

I dont think js is needed for either of those things.

reply