Cookies, in and of themselves, are not bad. Like any tool that can be misused, they're just being abused by a ton of really shitty people in an effort to try to enrich themselves at the expense of others. Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"
> Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Don't you people remember how it was done back when web browsers didn't have cookies, or could be configured to reject or ask for each cookie? The server software automatically added a PHPSESSID parameter to every link, containing the session identifier.
RFC 2109 predates anything that vaguely resembles PHP, and Netscape (thus, defacto, basically everyone using the internet), had cookies 3 years before the RFC.
Yet I am constantly flagged by various pages because Cloudflare decided I had some bot running at some point on my network. And my IP is fixed. Whatever EU is doing, it doesn't work.
You might have a residential proxy running somewhere on the network. The latest in botnets is bundling a proxy in with some TV torrent streaming app or whatever else that can run in the background and proxy malicious traffic from your residential IP. Services like cloudflare and crowdsec will keep a constantly updating list of the IP addresses that are actively sending bot traffic and blacklist them. If you can work out where the traffic is coming from and shut it down you should have this issue go away.
I have a similar issue. I see cloudflare checkboxes all the time. Google makes me fill out captchas all the time. Sometimes it decides I can’t search, sometimes cloudflare doesnt let me past the checkbox.
I’ve checked my network. I’ve monitored egress traffic. There is no residential proxy. I’m not on a VPN. If anything, services should be able to track me entirely by my home IP that doesn’t change that often.
My best guess is that I’ve committed the crime of not allowing third party cookies? Or maybe the crime of not being logged into a Google account 24/7. It’s not browser or device specific. My iPhone is just as likely to fail the cloudflare checkbox as my desktop with Firefox + uBlock.
I've committed the extreme crime of running no JS and clean cache of cookies.
Plus, something as simple as containerizing work/play/research reading, into different browsers, has provoked the Eye of Google to be cast on me
I haven't seen a YT ad in years while in lurk-only mode (no login), which is nice, but I also see cloudflare everywhere , which is not great.
One of the nicer things about LLMs, is that they arrived just in time to erase my dependency in search.
> they have always been about the tracking itself!
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
Point is that tracking isn't the only thing that's not "strictly necessary". And additionally that "strictly necessary" is tied to something specific: internet society service. That includes a very specific requirement: "Normally provided for remuneration". That's why e.g. public authorities should not (usually) be allowed to rely on it, public services are not often provided for remuneration in EU-law sense.
It also limits the exception in relation to e.g. employment.
Yep, and somehow there's always someone who thinks that the "Ah, but this is not a cookie!" is a loophole. It is not, he is just undereducated.
The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)
Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).
cloudflare (the cdn monopoly) interpretation of gdpr, is that clicking the "I'm not a bot" you are giving consent to fingerprint because they have to provide you a service you asked by clicking the button.
...it's something i hope no court will uphold. but we know what happens to european courts even looking sideways at American monopolies working as front for fiveeyes.
imo, eff should be starting trials to stress this instead of blogposts.
> See, the thing is, it’s not about you at all. It’s not really about the ads anymore either. Nobody cares about you. And if the police or your government happen to care, I’ll gladly take their money too.
> I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.
> And to the highest bidder it goes!
> What does that make you then? A gear? An ox? A volunteer?
This does absolutely nothing for me. If this resonates with you, can you explain?
I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.
Is the implication that the machine knows me so deeply that it doesn't matter if it connect my device ID to my name? That it knows me deeply as a person regardless of what identifiers are used?
If that's what meant, I have to say:
1. That's an absurd overestimation of the current capabilities of adtech
2. Even if it were true, I'm not sure I'd be that bothered by it? What I'm bothered by is what could be done with that intimate knowledge. And if the answer is just "show me the absolute most optimal ads", this doesn't really bother me.
I've been obfuscating my fingerprint with Brave for years, which I selected specifically because it was the browser I was able to do this with, based on my testing of 5 popular browsers, using https://coveryourtracks.eff.org/ as my benchmark.
It does mean that sites that uses 2FA (so every site nowadays) flag me as a coming from a new device each visit, and I have to have my phone nearby every time I want to use my computer, which is quite annoying. If you use GrapheneOS, you can obfuscate your phone too on WiFi networks (and sites, but GrapheneOS not needed for that, just Brave). You can't obfuscate yourself on cellular networks though, unless you have a ton of sim cards you rotate through.
For years, I've been practicing good privacy-hygiene in public. At my doctor's office, I always wear a Groucho Marx moustache to keep them guessing. Before I walk into my bank for a withdrawal, I team up with two of my friends, set them on my shoulders, and throw a trenchcoat over us! I made a fake ID with my birthday on July 4th and my weight as 98 pounds, but my pharmacy is now refusing to fill my prescriptions!
So what sort of benefits are you reaping from your anti-fingerprinting measures?
It’s really kind of pointless. They fingerprint you to target ads and that’s it. The valuable data that’s collected and sold can’t be hidden through fingerprint avoidance: anything you actually pay for. Sure there’s privacy cards, but the second you purchase a physical product you have to give up a delivery address and now they’ll just correlate all your disposable emails and privacy cards and whatever else.
Your only option is to never buy anything online and only pay cash.
> Your only option is to never buy anything online and only pay cash.
I probably wouldn't go as far as never buying anything online, but paying cash IRL should be something done by everyone to protect their privacy. There are a few other easy things that can massively improve your privacy with minor or no inconvenience: Linux on every PC/laptop, GrapheneOS on phone(s), uBlock on every browser (or a DNS-level sanitizer), car without cellular modem (pull the fuse), non-Google and non-Apple email (ideally your own server or a small provider in a friendly jurisdiction). Also, don't use social media and text over Signal instead. Of course, TVs and other home appliances should be kept off the Internet. Overall, those are some very minor sacrifices for anyone with a little bit of maturity. It's very far from living off the grid or anything like that.
> It’s really kind of pointless. They fingerprint you to target ads and that’s it.
That's a very early 2000s view of the issue. Ads are not what all the surveillance is for, it's just the publicly acceptable excuse for tracking you that companies love to use because nobody cares which ad they get shown. Being able to build a profile of which websites you visit can provide a ton of information about you and that data is increasingly being used offline. It stopped being about ads ages ago and now what you do online can impact your next job offer, what prices you pay, which policies companies apply to you, etc.
You can never limit all data collection. Going to the store and paying in cash will still have you tracked by Flock cameras. The point is just to limit what you can, where you can. Every scrap of data collected about you is going to eventually be used against you later by somebody. No point in giving them anymore ammo than you have to.
> So what sort of benefits are you reaping from your anti-fingerprinting measures?
A better question would be how are you being screwed over if you never bother to try to stop companies from collecting as much data as they possibly can about your private life? It can cost you a job offer, or cause you to pay more than your neighbor for the same products/services. It can get your data leaked, or sold to scammers. Companies use the data they collect on you for things as trial as deciding how long to you leave you on hold. The more data they have on you, the easier it becomes for them to use it against you.
Feel free to give companies every bit of personal data they want from you. They'll be thrilled to use that information at any time and in any way they think it will benefit them. Until we have laws against surveillance capitalism the only person looking out for your interests is you, but only if you can be bothered. It'll sure help companies take advantage of you if you can't.
Yeah, you know what? Life is far too short to live in fear and paranoia of the scenarios you suggest.
Anywhere I go in meatspace, people could be collecting data about me and my behavior. That has always been true since the beginning of time. An old lady can sit on her porch and take notes about my outfit, my comings and goings, and every driver who comes to my door. Today, they're saying that Target can definitely hear our WiFi/BT MACs as soon as we get into their store, and they see/track everything on camera everywhere inside. My Groucho Marx isn't going to hinder or change that!
All I can do, honestly, is be judicious about what sites I visit, and be forthright in my interactions. I should cultivate good relationships with trustworthy, reputable companies, and stay away from the rest. I cannot ultimately prevent the buying and selling behind the scenes. We cannot realistically prevent collection of everything possible.
I don't shop at Temu or Alibaba, and I don't search on Yandex. I checked my "About Me" on Amazon yesterday and it's shockingly bland and shallow. However I interact with Google, YouTube, Microsoft, and Cloudflare, it's a foregone conclusion that they know everything. My extensive 19-year history on Wikimedia projects is a shockingly rich treasure trove, if anything just my waking hours of every day since 2007! Your own karma score 22,495 in 14 years is probably a fantastic track record of when you were awake and using a computer. If you're so paranoid about Internet privacy, then you wouldn't be so willingly revealing that stuff in public.
I'm using adblocking DNS again, but awhile ago I sort of dropped the pretense of paranoia, because I understood its futility, and again, life's too short. If evil corpos want to do evil to me based on what they think they know, they can do their worst. I am a Christian man accustomed to suffering and infirmity. I got nothing to lose in this life, except integrity.
> I cannot ultimately prevent the buying and selling behind the scenes. We cannot realistically prevent collection of everything possible.
Yeah, but you can very easily _limit_ what is collected and sold behind the scenes just buy switching browsers, changing browser settings, or using a couple privacy extensions. A little goes a long way.
Your wit mad my day even though we probably won't agree. I appreciate your humor.
> So what sort of benefits are you reaping from your anti-fingerprinting measures?
Mostly pride on knowing that I'm preventing companies from doing to me exactly what I wouldn't consent to if they asked me outright.
Sure its just for ads (mostly). Sure the chances of my data leak leading to a personalized cyber attack are slim (I don't actually believe this but you might). Sure, [niche scenario] [non-zero probability] might be prevented. Sure there is a meatspace equivalent to the cyberspace invasion of privacy.
I wouldn't consent to stalking in meatspace, for any reason, and conveniently to my knowledge no one is stalking me physically. I dont consent to stalking in cyber space either, for any reason, and I do know that companies do, and they make it an unending uphill battle to let them know and force them to not be blatantly disrespectful. So I will make it as hard as possible, within what I think is reasonable, to make it useless or difficult for them to stalk me online.
And yes, online things have affected my physical life, so these niche applications have occurred to me and my efforts have reduced the negative impacts, to a satisfactory level, and I will continue to kick against the pricks, because it works.
IMO The EFF test is very flawed because it only tests your uniqueness among the other visitors to that site, not the total possible uniqueness from all the bits of data.
I would bet money that Brave cannot defeat CreepJS. The only thing I've ever seen do it, ironically, is Safari in private mode.
Also just using your computer normally and visiting regular websites already tracks you regardless of your browser's privacy abilities, and I promise data brokers don't care what browser you use, your overall online behavior is still unique.
Wow, that is a seriously impressive demo. I wonder how it’s able to distinguish people using identical hardware and software versions (e.g., iPhones on the same iOS version). It was able to correlate my sessions across multiple independent ISPs, with a VPN, and with Apple’s extra tracking resistance in private mode.
The closest is the Mullvad browser which is like Tor browser but without the Tor network so websites load faster, but Mullvad brower also needs a VPN to fully protect you.
It’s a question of entropy. If your device is unusual in detectable ways, then the fingerprint has high entropy. But on my iPhone I suspect most of the things being fingerprinted are the same. How many other people get “smug koala”?
fingerprints pick up on all sorts of things that make you different enough combined with another signal, 33 bits can be enough to single you out from anyone else on the planet... iOS can be 10-15, and given a residential IP that's plenty - always mobile is more anonymous on the web but guess what's much worse? apps.
a native app with 0 permission prompts gets you more bits than web
No. Almost everybody using an iPhone is on the latest release, plus or minus one while updates are rolling out. For a given iOS release and hardware type almost all of those probes are highly correlated. No way there’s 30 bits of entropy in that. I doubt there’s even 10.
Now on a desktop PC sure I believe these fingerprints are highly descriptive. And in android land they probably work okay because of the diversity of products and configurations. But iPhones resist fingerprinting just because they all give the same answers.
I just said iOS can be 10-15, correlated with anything else it can easily be 30. Download an app and visit their support site and that's likely enough to narrow you down.
The web provides:
time zone
language and locale (accept-language header too)
iOS version
screen size and pixel ratio
text size
dark/light mode
reduced motion
ad blocker extensions for safari
An app provides (without additional permissions):
IDFA advertising ID (unique and cross app)
IDFV (vendor ID)
AdAttributionKit (which apple does obscure somewhat)
Battery level, charging state, volume, headphones
Various appearance settings again (font, dark/light, reduced motion)
Just slightly more permission granted via prompt can get you:
System boot time and uptime
Disk space
Keyboard languages and extensions
File timestamps
Then additional individual permissions (which people agree to all the time for specific use cases)... at this level they can single you out easily:
location
contacts
bluetooth
motion sensors
To Apple's credit they're trying to make fingerprinting more difficult and attempt to ban it entirely, but it's not at all impossible.
Couple different results than that across three refreshes on iOS w/iCloud Private Relay. Apple does work to do some randomization.
But at least the moment we start using websites the largest players will know it’s us. Nobody else swipes and types exactly like me on my screen size of iOS over the relay.
I worked in fraud prevention for years and device fingerprinting didn't stop fraud, but it reduced it by upping the up the cost. It is not hard to circumvent fingerprinting, but it still takes a non-zero amount of effort on behalf of the fraudster. Device fingerprints helped us identify and block or prevent a lot of low effort fraud and abuse on various platforms.
How do you tell the difference between a regular human trying to not have a perma-dossier versus a bot? The only winning move is not to play--er, not to have this kind of game in the first place.
You don't, you simply make both spend a few billion cpu cycles for it. The human will tolerate the one-time cost. The bot's owner won't because it's not scalable.
The problem isn't advertising, it's data harvesting and sale. Ads used to rent space on websites - totally reasonable. The whole industry around the purchase and sale of user data is what needs to be banned.
That's one perspective. Other are in different perspectives, like "anything that present something else than the very topic looked for is pure propaganda."
The spectre of possible interpretations is wide.
Some see only problems everywhere whatever the benefits might be, some see only new opportunities no matter the tragic outcomes, some see various blend of this and that.
Advertising and paid promotion in any form has never been ok. It has always been a cancer on society. That is what happens when you ignore a mild symptom until it metastasizes into something horrible. We need to ban it completely.
You can never get rid of advertising entirely. Ultimately people want to learn about new products and services and new companies that couldn't ever advertise anywhere would die off. It makes sense to support limitations on how and where ads are used though. Banning surveillance capitalism would solve a lot of the problems we have and would mean that a website about cars can still show ads about things people who go to car websites would typically be interested in and that's pretty much the only level of targeting we need.
> Ultimately people want to learn about new products and services
Maybe I'm just not a typical person, but I have never woken up in the morning and said to myself, "You know, I would just love for a corporation to help me learn about their new products and services today." Never. Not even once. When I want to learn about something, I will actively seek information out about it, and I'm not going to look to advertisements for impartial information. The purpose of advertising is never to inform. It's to bombard and saturate.
> Ultimately people want to learn about new products and services
Yes, and those people are free to visit equivalent of mail order catalog or go to the store or subscribe to consumer goods quality testing journal or to any of the enthusiast magazines about electronics or gardening or whatever where they perform independent testing and benchmarking or look up a video comparing ceiling fans across a century when they feel hot in the summer.
So yes, we should absolutely ban third party advertisements. People will still be able to discover good products.
> Ultimately people want to learn about new products and services and new companies that couldn't ever advertise anywhere would die off.
I want to learn about products that are useful to me, but not through ads. As it turns out, it is incredibly difficult to learn about new products that are useful, as those do not tend to show up in ads at all and even seeking them out is very difficult.
It's weird how no one has come together to make a website specifically designed around users finding product categories that will make their life better. For example, I didn't learn about height adjustable desks from an ad. Nor did I learn about balance boards from an ad. Or trackballs. Or essentially every other product that made my life better once I realized that product category exists.
Much as i hate being advertised to, i do like the existence of trade, and of new products. In the old days, you would take your products to market once a week on a cart, and the market would pass by your stall. That isn't how it works any more.
Generally, how can society discover new products and services?
I would be open to having some kind of directory that i could browse at my own convenience, but that's ultimately going to devolve to paid placement.
>Generally, how can society discover new products and services?
I'm surprised you can't imagine a society where the consumer would be the one recommending products and not the producer. Any entrepreneur can find one first consumer to test their new product. And that first consumer have access to a great communication network to recommend that products to their social network — it's called "the Internet". Social networks are a great platform for people to share interesting things to their friends, family, colleagues and also to people they don't actually know ("the Internet" can connect you to strangers). Such networks cost little to operate when the content is created by users, instead of producers and their intermediaries (people favors short, insightful written text instead of catchy commercial once detoxed).
Being born in the 1990s, I did experience that "Internet", when advertising networks didn't exist and when people intentionally interacted to make connections and actively look for information. They were happy to tell about things they discovered, with little to expect in return ("influencer", aka mercenary, wasn't a job yet).
Many products that are advertised are not positive.
We dont need more hair care or beauty products. Kids dont need to be worried about wearing the latest fashion or skin care product.
New products can be publicised via the old ways, magazine or visiting shops. Nobody needs to know the instant a new iphone is avialable, just let it happen by osmosis.
Consequences are deeper than the immediate cause. Advertising is at the heart that gives a lot of value to data harvesting and similar scams.
Data harvesting gains most of its value because they sell some or all data to businesses which wish to leverage that data in advertising. If they cant advertise they wont need most of the data, which should at the least reduce the problem significantly...
How would you enforce that? Who can be trusted with the ability to classify things as advertising and in so doing silence their critics?
The solution is explicit trust. Not fingerprints for users, but digital signatures for content. If it's not signed by somebody the user trusts, don't render it.
The user is the only one who can be trusted to approach that task without a conflict of interest.
That works if your ads have a physical location in space, like a billboard or a radio station, so that you have a place to go when you decide it's time to shut them down. You can't even get a stable URL for a web ad.
Oh I'm all for banning advertising, let's do that, it's terrible. We just have to be careful to not create an even bigger problem while we do so, and we should be prepared to have to fix the web in more fundamental ways as well.
I didnt say ban ALL advertising, its not practical to think its sensible to stop a pizzeria from putting a sign outside. Im simply saying third party advertising should be banned, aka no more ads on the internet from Google or Facebook for other companies. If Facebook wants to advertise Insta, thats fine. No more billboards up and down everywhere for this or that...
What badness could come out from banning advertising ? Can you think of a few examples ?
Agreed, let's not prevent people from putting a sign on their shop so people know what it is. There's gotta be a smarter line we can draw.
> No more billboards up and down everywhere for this or that...
But if "third party advertising" is the line, then it's ok as long as you own the billboard, right? So I can still sell you the billboard and you can put your own ad on it. That's just gonna create legal gymnastics, it's not gonna stop the billboards.
As for the web I think that progress means getting past the first/second/third party distinction. Websites are not places, they're data.
Users should have more power to remix or annotate the experience and share the result with other users. That means what was once second party data might appear later as third part data. If we create laws that converge on "third party" I worry we're going entrench the idea that somebody besides the user has a right to control the data, when it would be much better if we left that idea behind and put the power in the user's hands. Like, however it is that they're subjected to surveillance by cod that they didn't consent to run, let's fix that.
> But if "third party advertising" is the line, then it's ok as long as you own the billboard, right? So I can still sell you the billboard and you can put your own ad on it. That's just gonna create legal gymnastics, it's not gonna stop the billboards. And it would be the same with the web, people would find ways to muddy the waters about who is responsible for the ad being there such that the law no longer clearly applied.
I am not trying to write a complex law for my parliament or yours. Of course there are going to be a lot of details that need to be addressed as you are trying to quiz me about.
I would hope the spirit of the ban would be that posters (lets call them that) must be on the same addresses. No solo signs across the road even if the McDonalds or Coke owns the wall or whatever. THis is also a great leveler, small businesses cant afford massive billboards, so if nobody can have them then it encourages competition.
I think you are forgetting how much extra costs like advertising force small businesses to lose. This is part of a process of slowing down the reduction in competition.
As another point, just think airbnb and similar platforms are contributing a major housing crisis all over the world. This problem needs to be slowed down. People didnt have airbnb and overseas trips and planning did work. The old travel system was more sustainable and had less impact on housing, so im more for the reversal and slowdown.
> I think that progress means getting past the first/second/third party distinction. Websites are not places, they're data.
Calling them anything doesnt change or fix the problems that have happened, like housing.
> That means what was once second party data might appear later as third part data. If we create laws that converge on "third party" I worry we're going entrench the idea that somebody besides the user has a right to control the user's experience. It would be much better if instead we left that idea behind.
Im not arguing to argue that there are other ways to try and fix other problems. Im just suggesting that those ideas are simply too hard and would take too long.
Banning third party advertising is the easiest way to get a quick win, that actually helps. Not claiming its perfect, not claiming it fixes everything, im just saying something needs to be done and this is the best for now.
Just stop and think about it, reducing advertising is actually a good thing in many ways.
Governments might not be able to ban an ad on the web, but they can make it illegal for companies that wish to trade in their country to use advertising.
Some people need to think a harder, life is a bit more complex, there are many ways to achieve the end goal.
Huh, it is different for me on every page refresh. No VPN, etc... just Firefox on Windows with uBlock, CanvasBlocker, and a PiHole. No persistent fingerprint for me!
I've seen anti-fingerprinting plugins and browser configs, etc, but they all seem to make you more interesting for not being fingerprintable, or for turning off a lot of features used in fingerprinting.
Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
You can forcefully disable hardware acceleration, that removes a few bits - though javascript can still guesstimate your CPU and memory.
For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.
First, see our blog post. Consult also other blog posts and other questions in this FAQ.
If you want to have the same fingerprint as many users, We suggest going for Tor Browser (do not install JShelter in Tor Browser).
If you want to make cross-site fingerprinting linkage hard, go for the Recommended JShelter level. If you want better protection for the real data at the cost of having the same fingerprint on different sites, go for the Strict JShelter level.
Keep NBS active.
If you want to detect and prevent fingerprinting attempts, use FPD.
Thanks. I tried this on Firefox for Android and each time I close the browser and load the page my fingerprint ID is different. So it seems to work. Have you had any sites break with this extension installed?
> Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
That's basically the ideal. It's become obvious that it's impossible to try to be identical. Web browsers are too leaky, and something will out you. You really don't want to try to blend in the "typical" users because none of them use ad blockers.
The reason is that the browser maker is interested to support tracking.
On the technical level there is no problem to block tracking - intriduce noise and make APIs unavailable until user permits to a web site. But that is not implemented.
The same with native applications. If your bank app requires you to share your location you can't spoof it. The makers of Android and iOS made spoofing of geo location impossible - you don't have that control, which means the phone is not your device. You have to give up your real location.
I have heard from some power users that Brave is one of the best browsers with regard to ad-blocking and privacy.
But I think I have read elsewhere that it receives money from ad companies to display only certain ads, which does not make me trust it.
Does anyone have facts or know where to find them?
These tests aren't reliable - Brave does randomise values but it ultimately doesn't do much to prevent fingerprinting, as many values remain static. For example, Brave still exposes your GPU model and driver version.
See Fingerprint.com, despite Brave's protections you'll likely find it works reliably.
I see so many misconceptions on HN about that coveryourtracks site. Neither of those results are ideal.
"randomized fingerprint" -> that's a bad result, it means the site can detect you're spoofing info
"unique fingerprint" -> this is good, ONLY IF you refresh and it still says "unique fingerprint", because it means the site sees you as a brand new visitor each visit, and doesn't detect any (what advertisers would call) nefarious behavior. however, if you visit again and the second time it says "nearly-unique fingerprint", that's a failed results because your two visits were linked
The ideal result you should aim for is "non-unique fingerprint". That means your device is indistinguishable from countless others. Blending in to the crowd is what you want.
The problem is Javascript and its implementation. Plain HTML does not offer nearly as many fingerprinting opportunities. It's basically IP + user agent, both of which can be spoofed. Javascript grants websites far too much power over the user's browser, including disabling selection/paste, identifying hardware, time zone, language, etc. None of this should be allowed by default, and things like hardware acceleration and whatnot should be explicitly allowed on a case-by-case basis.
The scope and amount of information that browsers hand over without the slightest shred of consent from the user or indication it’s happening is crazy.
Google's business model has been ads from the beginning. Search, gmail, drive, office, chrome, everything they do is just to drive ad revenue further.
They don't care about the user. Never have, and never will.
And the outcome we are seeing is what happens when a defunct state isn't able to protect citizens from conglomerates. That's what the Kartellamt or the FTC is supposed to be for.
> Nope. At least until 2008 I cared and Larry and Sergey cared quite a bit.
Not sure if I can't see this comment as anything else than hypocritical. It's always easier on the money receiving side, isn't it? How do you think the term malvertisement came to be?
AdMob is kind of the definition of inevitable Surveillance Capitalism and the prime example for necessary regulation through government.
It's a UX trade off. For non-adversarial websites it's very convenient for users because things just work without having to go through loads of permissions pop ups for every website, but of course this then makes this info a juicy target if you're trying to fingerprint someone.
But it is a design trade-off. The opposite case can be seem in the many websites asking to send you notifications, and the many flavours of cookie notices. When you have to ask the user permission to do anything and everything, the user gets annoyed and desensitized. They start allowing everything (my always collects dozens of notification-enabled websites if given the chance), and the point of asking for permission is lost.
How so? There seems a fairly inherent tension between having things just work by default and hiding surface area for fingerprinting behind permissions pop ups. For example say you go to a maps website, how do you decide whether to share the users location with the website? Or enable webGL functionality to render some fancy layout on the screen? As a user having to enable all that stuff per-website is annoying.
Sure, but at least native apps can only do that if I download and install them. If I do that, I’ve made a conscious decision that the tradeoff is worth the utility of the app. This limits the blast radius considerably.
On the web one is drive-by fingerprinted by sites they never once approved of or intended to visit thanks to the browser’s ability to redirect and embed without input from the user. The magnitude of the problem is far greater on the web.
I can't help but keep thinking that client-side scripting was a mistake. Sure, the web would be a lot more primitive without it, but I'm not convinced that wouldn't be for the best.
I assume it's something like: choosing to forego the protection of a battle-tested sandbox in favor of rawdogging random binaries off the internet would be insane.
My default is to run without JS and selectively enable it when absolutely necessary, so when I clicked on this story the page was prefaced with the following comment:
"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else.
From now on I’ll call you:…"
I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it. On rare occasions when I'm forced to use JS I'll cut-and-paste the URL into another browser.
I no longer use ad blockers as I just don't see ads with JS disabled. The other privacy precautions I take are the obvious ones such as no Google or social media accounts, flushing cookies at session's end, regularly randomize my IP and never let Chrome anywhere near my machines and make judicious use of multiple browsers (this is being written in Privacy Browser on Android).
Using NewPipe and sponsor block on PipePipe increases privacy and makes YouTube ad free.
Client-side scripting was a mistake which was obvious from the outset (or not severely limiting the reach of scripting engines).
What I find hard to understand is why alternative plugin JS engines haven't been developed that are under user control. Spoofing, randomizing and returning junk data to webservers would go a huge way towards stopping fingerprinting by websites.
I used to believe in that and would make sure all of my sites would work without Javascript until one of my projects (a micro community) got targeted by pedotrolls which lead to an awful time and now I associate people who are staunch no JS as pedos, I am not accusing you or anything but that is the impression it left on me. Ever since then I really don't care if the site doesn't work without JS, and if users can post stuff damn straight Javascript will be involved.
Unfortunately this idealistic principle (no JS) attracts the worst people.
You're on Tor? You have JS disabled? I might as well warm up fbi.gov/investigate/cyber for the probable report I'll have to do...
Well, I find your comment pretty offensive. In the past I've had some pretty rough and disparaging comments from JavaScript fanboys but yours has to be the worst. Associating disabling JS with pedos is about as low as it gets. Where did you get those stats from, or are they just a figment of your imagination?
"Unfortunately this idealistic principle (no JS) attracts the worst people."
Again, how did you come to that opinion? Where's your evidence/stats? Generally comments like that come from web/JS programmers who've realized that client-side users have them stymied when they disable JS.
An additional reason I avoid JS is speed, webpages become blinding fast when there's no JS. Once one gets addicted to the great rendering speed there's no return. I'm not against JS per se, trouble is you JS programmers have weaponised it against users, webpages of 7, 10 and even 20MB are now commonplace. Presenting such slow massive pages to users is nothing other than abuse.
I do not use Tor.
BTW, I should point out that my views about JS and privacy abuse were formed from my years in working in govt. surveillance where the stakes are very high.
I came to my opinion through experience, I’m sorry you’re offended but I did say that I don’t imply that you’re a pedo but my stats sure show a pattern.
That does not change what I have dealt with. I am not a “JavaScript fanboy” remember I made a community that could work WITHOUT needing JavaScript and that lead to a bunch of grief for me which made me understand the extreme naivety of that original idealistic idea on the internet.
> I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it.
I guess you use the web in quite a limited manner? (Or use that other browser quite a lot...?).
I've tried no JS various times over the years and always end up constantly whitelisting sites. It's even worse in 2026 and gets worse each year.
Banking, insurance, webmail, groceries, eBay, CAPTCHAs... not to mention what feels like 50% of the web that is behind either Cloudflare or similar, which almost always require Javascript.
"I guess you use the web in quite a limited manner? (Or use that other browser quite a lot...?)."
In fact, I'm a very heavy internet user, always have been. Much of my web usage is pretty well automated, I use multiple browsers selected from an 'open with' app. This android, de-googled smartphone currently has four different browsers 'tailored' for specific types of sites and all flush clean after use (cookies etc. are never stored). And toggling airplane mode is the quickest way to change one's IP address.
What's important for me is to separate jobs, functions, etc. that are best processed on the internet from those on other media—SMS, voice telephone, eyeballing people in person (physically going to a store), etc.
This greatly reduces my need for services that use JS. By separating and processing jobs by type I automatically avoid many having to be handled by the web—for those JavaScript can't enter the picture even if one wanted to use it.
For example, I used to do internet banking but I'd never do so again on two accounts—security and that it undermines the use of cash. (A cashless society is the quintessential way to lose one's autonomy, ultimately it's a very dangerous move towards totalitarianism. That most people don't realize this, or if they do then they're prepared to trade it for convenience simply horrify me.)
That Big Tech has enshittified the net out of all recognition in recent years means I've no longer use for social media, Gmail or any Google services—goodbye all Google JS. In short, whilst I do purchase stuff online, I purchase most from shops for cash.
Most of my time on the net is confined to specialist tech sites and they're the ones least likely to use JS. Yes, I agree Cloudflare, etc. is an increasing problem but the web is so big there are usually alternatives. News is often syndicated, so when NYT and such make life difficult without JS, I just jump to the same story on another site where JS doesn't matter (such blocking nonsense is really a trivial non-issue for me). I've dozens more examples but by now you'll have gotten the gist.
Great how this is currently the 2nd highest comment despite completely ignoring the numerous fingerprinting techniques based on CSS alone (including one of the most famous fingerprinting methods by testing font support). Simply thanks to reflexive "JS=bad" upvotes.
I'm skeptical of this magic trick, maybe add a counter with the amount of times I logged in to the website. Otherwise lots of people can be identified by that hash.
I'm skeptical of this magic trick, maybe add a counter with the amount of times I logged in to the website. Or let me save some data to read it from another session. Otherwise lots of people can be identified by that hash, there's no proof that it is unique
I did want to add a counter and see how my script would perform in the wild! But that'd mean I have to store these fingerprints and that requires a bunch of formalities I don't want on my website.
Anyway, it's a simple script for the sake of demonstration. I'm sure you'll get a different hash on other browsers/devices.
Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes.
90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're mostly left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months).
What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.
The problem with this is the biggest, most important, and sketchiest data brokering services (credit monitoring) are all but entrenched in law at this point.
It typically required more direct sources of trust. If you were a grocery store, you might let customers you personally knew to be good for it, run up a 'tab' and settle on payday. If you were a bank, you might only lend to rich high-class people. You can find this all around the world today; the US is a standout for credit scoring and for access to credit. When a British person wants to sell their house, it has to happen on the same day that the buyer sells their old house, and the house they're moving into to be sold, and so on in a big same-day daisy-chain, until you hit someone who has enough cash for initial outlay. In Japan, up until very recently, you could expect your boss to co-sign your apartment lease (and your landlord to immediately escalate any routine matters to your boss).
I can't tell if this is sarcasm, or do you honestly consider credit for fast food a good thing. I hesitate because I know that in America people buy everything with credit (or at least a lot), so it's possible some people think like that. But obviously not buying fast food with credit is a good thing?
> It typically required more direct sources of trust. If you were a grocery store, you might let customers you personally knew to be good for it, run up a 'tab' and settle on payday. If you were a bank, you might only lend to rich high-class people.
You hit the nail on the head with the first statement. It required humans in the loop. It scaled linearly. Local branch managers had relationships with the people in their community, and knew who could and couldn't be trusted.
It was an imperfect system, where a human could be prejudiced against another human, and deny them access to credit.
Sometimes that would get discovered, and the human was held accountable for their actions, or had their actions upheld by a (org-chart-superior) human.
Similar to the imperfect system today, where the models a computer uses could be prejudiced against a human, and deny them access to credit. Dissimilar in that the model or the computer is rarely, if ever, held to account. "Computer says no" is a meme for a reason.
Poor people couldn't borrow and middle-class people paid really high interest rates. Credit ratings are pretty much what enabled the expansion of availability to everyone.
Yes, and then in the interim we invented having a hundred trillion dollars in GDP. I prefer having access to credit and so does everyone who owns a credit card. If you own a house, you didn't have its cash value when you bought it; neither your car, nor (most likely) your education. In the days of no borrowing, we solved the problem with ramshackle one-room buildings with dirt floors, handcarts and oxcarts, and the one book whose distributors desperately wanted everyone to have it for free.
> I prefer having access to credit and so does everyone who owns a credit card.
A good number of European countries have only half the poverty rates - the dirt floors and carts you're talking about - of the US yet barely use credit cards.
> If you own a house, you didn't have its cash value when you bought it;
> we solved the problem with ramshackle one-room buildings with dirt floors,
there is a fallacy here. People with access to debt bid up the price of an asset, like a house, against other peoples’ similar access to debt. Sans debt access, the solution was not necessarily a small ramshackle house. The fallacy is the belief that the same asset price - whether opulent or ramshackle house, wouldn’t adjust to the reduced level from the bidding environment. The differential cost of construction for a nicer house can be countenanced in the access-to-debt case, but that is second order.
Illustrative straw-man example: Suppose, once one had a parcel of land, that it was trivial to construct one’s ‘starter home’ the ramshackle house if you like. Get one’s family and friends to help build in exchange for future return favors. As one advances in life, rebuild to have something more opulent. The rub is in the parcel itself. Unlike the would-be house, it had no cost built-in, just whatever price the previous owner was willing to accept to release their parcel. That parcel’s (and those around it) price reflects the market’s access to debt, or lack of access to debt. In the market without access to debt, parcel pricing reflects which buyers have accrued more savings vs other buyers. In the market with access to debt, parcel pricing reflects who can access more debt (through the various means we know of today - down payment ability yes, which parallels the non-debt’s savings case, someone co-signing, long term expected future earning potential vs someone retired, the parcel itself put up as collateral, perhaps other non-immobile assets put up as collateral, like the family oxcart).
The point is that there isn’t necessarily a 1:1 coupling between market’s debt vs non-debt access and whether the construction is opulent vs ramshackle.
> People with access to debt bid up the price of an asset, like a house, against other peoples’ similar access to debt.
That might be true now, but it would not mean house prices would go down, it just means more people would rent.
Think about how these loans work right now... people with money they don't need right now loan that money to people who want a house but don't have the cash right now. The reason they loan that money is they want to earn a return, which they get in interest on the loan.
Let's say all consumer lending is banned, and you can't loan money to people to buy a house. Well, the people with that money still want a return, so they will invest it somewhere else. Where can they invest it?
Well, one option is they could buy houses and rent them out. Since they only have to compete with other people with money (since poorer people can't get a loan for their house), the price is going to be much lower than it is today, which means they can get a better return by buying the house and renting it out.
So now you are still in the same situation with house prices, but there is no way for you to get any part of that return.
> If you own a house, you didn't have its cash value when you bought it; neither your car, nor (most likely) your education
When I grew up I was told to not make debts if not needed. So many older people did indeed save up until they could afford a car or a house. Education was always mostly free where I lived.
Nowadays it seems like ordinary people would need to pay off a house their whole life and thus also need to keep income high enough to keep paying installments. This takes away so much freedom from people as they are trapped in their high paying jobs...
The houses cost more because they are bigger. An American house is typically more than double the size of a British house. Credit allows people of the same means to live better.
> Yes, and then in the interim we invented having a hundred trillion dollars in GDP.
And every now and then we have to rescue banks that are too big too fail at the cost of everyone else, because someone dreamed up a way to increase short term profits that involves giving loans to people who will never pay them back.
> neither your car,
Praising a trillion dollar GDP, but can't afford a used car.
There are a lot of people in the world who weren’t part of that “we”, and they were often the ones who ended up lending money to the people who did think it was evil.
I don’t think there is any rational argument that ALL lending is evil (there are certainly many categories of lending that have lots of arguments for its evilness)
If we don’t have credit, then the only people capable of starting a business, for example, are those who are already wealthy.
It feels onerous as an idea because bank statements, monthly bills, payslips, will bequests, stock vests and trades, bank robberies*, and investment income each have different ways of being tracked. At least most of these records of individual financial activity come with a PDF these days. It wasn’t that long ago that applying for a loan meant scanning in papers for your lender to review.
Computers are smarter now. Not only can they read documents (or at least match the shapes against shapes they’ve been told are real) but they can also understand the contents too (or at least match the words against ideas they’ve been told are real.)
There may well yet be a future Data Valhalla where individuals hold their life.zip themselves, and upload whatever bits of it are needed to get that Nordstrom store card / car financing / cheeseburger loan without having an intermediate credit agency.
*I feel there’s a kernel of a joke there about a bank robber asking for a receipt with the loot in anticipation of declaring it on their tax return.
you can only make jokes because your actual ideas arent serious in the slightest. you pollute the world with bullshit. you are a barking dog who thinks it is a human being.
I don't see how this works in reality - The issue is that users wouldn't upload negative information (e.g. county court judgements or the bank robbery from your example).
Credit isn't like insurance where these things can be checked later during a claim (which can then be denied) - you need to know the person is a bad-payer before you send them the ten thousand dollar loan as that affects the terms, not afterwards when they default and you can't get your money back.
For CCJs and bank robberies, you'd upload a clean sheet from the government that gives a list of all CCJs and criminal convictions (in the UK we have a system called DBS for criminal records).
Potentially, with loans or other things, some kind of technical solution could work. You could have a personal document that you control, and you give permission for companies to write to the document.
With a loan, for example, if I give you a loan, I can also append to your document that I've loaned you the money; for every payment you make, I write to the log to say you've made a payment. If you stop making payments, I stop writing to the log. This would be cryptographically signed by me, so it can't be forged.
When you want to take out another loan, you can proactively share your document, the bank can see everything written on the log, and make a decision based on that.
Without some sort of central authority, surely this is just vulnerable to a rollback attack?
i.e. if I am a bad actor, and had just defaulted on a loan, why would the next document I send not be my copy of the previous 'clean' record before I got that loan?
Or what prevents me from sending out the same copy of the document to 10 other parties and getting 10 loans concurrently?
These are the sort of scenarios that the existing credit agencies prevent.
> i.e. if I am a bad actor, and had just defaulted on a loan, why would the next document I send not be my copy of the previous 'clean' record before I got that loan?
If you had defaulted on a loan, there would be payments missing from your file
Naively, credit is if you can pay, and if you will pay.
For the latter it’s whether you’ve had a judgment against you, which is a matter of public record.
For the former it’s based on how much money you have and what you spend, including on servicing existing debt. Lying about this would be fraud. In that sense, my proposal does indeed open up a new avenue for fraud but I don’t think that’s the same as it being unworkable!
So what. Maybe it is corrosive to society to provide unsecured credit willynilly. Yes, it makes the banks giant amounts of money, but IMHO consumer credit should only be a thing for two classes of assets (that can be repo'd easy-ish) real estate and vehicles.
The Western governments have horribly failed of caring for their people - cost of living are exploding, and at the moment way too many people are papering over that with unsecured credits backed by their data being free to exploit, and everyone else not willing of doing that is increasingly locked out of existence.
You send them digitally signed statements from other lenders (who are legally required to give them for free with accurate info) or independent rating agencies, they evaluate them and make a decision. They can have their own model or license one from FICO.
That does mean banks can't know if you lie by omission and hide some unpaid bills, but they can raise the evidence requirements to compensate and I think everyone deserves a second chance.
Well, there are multiple approaches, but here's one that worked well for me: when I purchased a home in the country where I now live, and the mortgage lender asked for a credit report from the (high-privacy) country where I lived the longest, what they got was a letter from that country's central bank listing the penalties for requesting that information. Up to and including jail time.
Suddenly the credit report was no longer a prerequisite to the mortgage.
Wouldn't this make credit riskier for lenders, reducing access to credit in general and thus making housing less accessible especially to working people?
Not asking polemically, I just have never studied economics and wonder if my intuition here is flawed
I think the actual trade-off is between average acceptable risk at society level.
Some societies prefer huge risks for huge benefits, in those one (might) need a more detailed credit reports because everything is faster, people accept huge risks and the situation can suddenly change.
Some societies prefer more stability. Lower risks, lower surprises. Less opportunities, everything is slower, people can't even take that many risks, simpler histories will do th trick.
From what I notice though, housing seems to be a problem in both types of societies, irrespective on how credits are given, because there are other things involved (regulation, NIMBY, housing used as value, airbnb, geography, etc).
Actually a good question, and in practice: no it doesn't, not significantly. Aside from 2008-style systemic failures across the board, the risk is non-correlated across borrowers, and hedged through the collateral of the property itself anyway, whose deed remains with the lender until the mortgage is paid off. In practice, due diligence regarding the borrower's present finances seems plenty. This seems especially true where there's a decent social safety net that reduces the occurrences of individual bankruptcies.
And anecdotally, despite the aforementioned letter, we got top market rates on our mortgage.
Worth noting that 2008 occurred in part because mortgages were seen as entirely risk-free in aggregate, even as credit reports were already a thing in the US at the time.
As far as I can tell, credit reports are more a tool that lets lenders wring more money out of borrowers in confidence that their competitors will not undercut them, since the borrowers carry their credit reports with them.
You are so full of BS it's scary.
No credit report is a non-starter at any financial institution that wants to stay in business. They won't be giving you a loan unless they know you are wealthy e.g. own 17 investment properties already.
'High-privacy' countries is code for 'tax-haven', and 'my money in the Cayman Islands' means your bank is about to run afoul of AML and KYC laws if they give you a loan. And this is the whole world: doing business with America means adopting their financial posture i.e. penalties for doing business with money launderers.
Friend, it makes me so sad that you can't when imagine how much better off your life could be if you managed to fight for and secure the same rights others did. I sincerely hope you'll get to find out for yourself.
That is rad. Is your high-privacy country friendly to immigrants? Asking for a friend...
But for real. You say you no longer live there, so I'm assuming you left for more opportunities. My wife and I are interested in countries with opportunities for engineers and privacy. Bonus points if there is engineering research opportunities.
I'm afraid it isn't much, and getting worse fast. You can still just turn up if you have EU citizenship, and the place legitimately isn't without merits, but the personal rights acquired over centuries of social combat and the odd monarchial beheadings are vanishing fast, as far as I can tell. There's a reason we fucked off outta there.
If you have the immense luxury of picking your destination, the Netherlands or much of Scandinavia seem to remain the best options.
I don't really know what you expect, people are obviously going to want to know your credit history when they're lending to you. If you can't tell what loans someone has, they could have opened a hundred different accounts and used the money in the casino.
on what basis do you believe this about fonts? my guess would be that the average user doesn’t install or remove fonts often if ever, but it’s only a guess
Depending on the browser new fonts can be downloaded and installed automatically. I'd bet most people have a lot more than just the default fonts that came with their OS installed.
A small list of websites that install their custom fonts can cause you to picked out of a crowd even when other things (like your IP) change. The centralization of the internet probably helps a bit here, but I'm guessing that most people go to smaller websites at least occasionally rather than just spending all their time on a handful of social media sites.
One intereting part about installed fonts is that many enterprise companies buy specific fonts. Then they are rolled out to all their devices, and sometimes at least one of them will have the company name as part of it's name.
Is there any way to link this data over longer periods of time?
A lot of data can change over days, weeks, but if you can maintain an accurate fingerprint with tinier changes, and granted you have consistent visits from the user, could you just keep up?
Especially if one service is tapped into several websites, and can continually keep up with smaller data changes and distribute that info. Is this possible? In practice anywhere?
I'm thinking that you just need one website where you can associate a given fingerprint to a specific user and then tracking its activity around the web becomes easy.
Let's say I'm logged in a famous search engine, they associate my fingerprint X to my account A. If they then encounter fingerprint X anywhere else, there is a good chance it was me, A, doing it.
If the next day I get fingerprint Y, it gets attached to A as well and the tracking information follows it.
I was thinking about the literal fingerprint sensor a device has. Imagine a "prove youre not a bot" challenge and the finger scanner pulls up. What a nightmare, reminds me when a website asked me if I want to login with windows hello (facescan)
That is different though. That site is just creating a passkey and storing in your keychain (or windows equivalent). Windows hello unlocks the keychain. It can be your face, fingerprint, usb key, 4 digit pin anything. Chrome already uses this. You’re not sending your face to that website nor to microsoft, I hope.
> Every time this resurfaces I like to remind people that this is mostly impractical and not how things actually work at the commercial level.
Sorry, but that's simply not true. It's actually the default way of how people eg track people across installs in app stores ever since they started removing that feature.
On the other hand, browsers don't need to share all this data at all. Sure, IP address can't be hidden, but from your example, installed fonts and volume settings? Why should that be shared at all? Sure, for example for a teams meeting, but you'd have to allow the use of microphones or that, youtube for example doesn't need to know how loud you're listening to a video.
18 months ago Google publicly stated they were going to start using browser fingerprint data to track users, a reversal of their 2019 policy on it because it was considered too invasive.
There's a fingerprint demo on github called JSCreep (https://abrahamjuliot.github.io/creepjs/) that used to keep your fingerprint profile for 90 days and show you how many times you visited. Worked extremely well, and is still around, but no longer uses the API to retain fingerprint data, so you have to track your hash yourself. It would easily track most browsers across changes in IP address. Only Mullvad, Brave, or Tor would not leave an easily tracked fingerprint.
The demo presented in the royfish.dev link is easily foiled by browser extensions that scramble fingerprint data, the presence of which would itself be detected by more sophisticated profilers and used to define the fingerprint. I can refresh the page and get a new hash and adjective-animal name with the same IP. JSCreep sticks firm to the same hash for me, even with a new IP address and some spoofed browser data.
368 comments
[ 0.23 ms ] story [ 27.6 ms ] threadAt {{job}} we did briefly consider rolling out fingerprint.com, but settled on ja3/ja4 at the CDN layer.
Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"
Don't you people remember how it was done back when web browsers didn't have cookies, or could be configured to reject or ask for each cookie? The server software automatically added a PHPSESSID parameter to every link, containing the session identifier.
Same thing the other way: no need to have a banner for a simple login cookie which isn't being used for privacy-invading tracking purposes.
I’ve checked my network. I’ve monitored egress traffic. There is no residential proxy. I’m not on a VPN. If anything, services should be able to track me entirely by my home IP that doesn’t change that often.
My best guess is that I’ve committed the crime of not allowing third party cookies? Or maybe the crime of not being logged into a Google account 24/7. It’s not browser or device specific. My iPhone is just as likely to fail the cloudflare checkbox as my desktop with Firefox + uBlock.
I haven't seen a YT ad in years while in lurk-only mode (no login), which is nice, but I also see cloudflare everywhere , which is not great.
One of the nicer things about LLMs, is that they arrived just in time to erase my dependency in search.
This should be absolutely illegal, one entity is capable of making my life extra difficult and there's no one to appeal to.
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
The thing the site is doing that isn’t “strictly necessary” is always tracking.
It also limits the exception in relation to e.g. employment.
The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)
Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).
...it's something i hope no court will uphold. but we know what happens to european courts even looking sideways at American monopolies working as front for fiveeyes.
imo, eff should be starting trials to stress this instead of blogposts.
> I look at all this data and I don’t see people. I see patterns. Patterns emerging out of patterns. A living, digital fractal state of the economy, society and human psyche. The crystal ball of the 21st century and it’s made of silicon! That’s the product.
> And to the highest bidder it goes!
> What does that make you then? A gear? An ox? A volunteer?
This does absolutely nothing for me. If this resonates with you, can you explain?
I can understand worry about a tyrannical government, and if you have something like a gambling addiction I can understand about ads. But the meta-level privacy fear about deidentified patterns - I just plain don't get it.
It's truly totally ok with me, yes.
(I get the non-anonymized concerns, or risk of becoming non-anonymized, that's not what I'm confused about)
Is the implication that the machine knows me so deeply that it doesn't matter if it connect my device ID to my name? That it knows me deeply as a person regardless of what identifiers are used?
If that's what meant, I have to say: 1. That's an absurd overestimation of the current capabilities of adtech 2. Even if it were true, I'm not sure I'd be that bothered by it? What I'm bothered by is what could be done with that intimate knowledge. And if the answer is just "show me the absolute most optimal ads", this doesn't really bother me.
That's why the quote I highlighted confuses me.
It does mean that sites that uses 2FA (so every site nowadays) flag me as a coming from a new device each visit, and I have to have my phone nearby every time I want to use my computer, which is quite annoying. If you use GrapheneOS, you can obfuscate your phone too on WiFi networks (and sites, but GrapheneOS not needed for that, just Brave). You can't obfuscate yourself on cellular networks though, unless you have a ton of sim cards you rotate through.
So what sort of benefits are you reaping from your anti-fingerprinting measures?
Your only option is to never buy anything online and only pay cash.
I probably wouldn't go as far as never buying anything online, but paying cash IRL should be something done by everyone to protect their privacy. There are a few other easy things that can massively improve your privacy with minor or no inconvenience: Linux on every PC/laptop, GrapheneOS on phone(s), uBlock on every browser (or a DNS-level sanitizer), car without cellular modem (pull the fuse), non-Google and non-Apple email (ideally your own server or a small provider in a friendly jurisdiction). Also, don't use social media and text over Signal instead. Of course, TVs and other home appliances should be kept off the Internet. Overall, those are some very minor sacrifices for anyone with a little bit of maturity. It's very far from living off the grid or anything like that.
That's a very early 2000s view of the issue. Ads are not what all the surveillance is for, it's just the publicly acceptable excuse for tracking you that companies love to use because nobody cares which ad they get shown. Being able to build a profile of which websites you visit can provide a ton of information about you and that data is increasingly being used offline. It stopped being about ads ages ago and now what you do online can impact your next job offer, what prices you pay, which policies companies apply to you, etc.
You can never limit all data collection. Going to the store and paying in cash will still have you tracked by Flock cameras. The point is just to limit what you can, where you can. Every scrap of data collected about you is going to eventually be used against you later by somebody. No point in giving them anymore ammo than you have to.
A better question would be how are you being screwed over if you never bother to try to stop companies from collecting as much data as they possibly can about your private life? It can cost you a job offer, or cause you to pay more than your neighbor for the same products/services. It can get your data leaked, or sold to scammers. Companies use the data they collect on you for things as trial as deciding how long to you leave you on hold. The more data they have on you, the easier it becomes for them to use it against you.
Feel free to give companies every bit of personal data they want from you. They'll be thrilled to use that information at any time and in any way they think it will benefit them. Until we have laws against surveillance capitalism the only person looking out for your interests is you, but only if you can be bothered. It'll sure help companies take advantage of you if you can't.
Anywhere I go in meatspace, people could be collecting data about me and my behavior. That has always been true since the beginning of time. An old lady can sit on her porch and take notes about my outfit, my comings and goings, and every driver who comes to my door. Today, they're saying that Target can definitely hear our WiFi/BT MACs as soon as we get into their store, and they see/track everything on camera everywhere inside. My Groucho Marx isn't going to hinder or change that!
All I can do, honestly, is be judicious about what sites I visit, and be forthright in my interactions. I should cultivate good relationships with trustworthy, reputable companies, and stay away from the rest. I cannot ultimately prevent the buying and selling behind the scenes. We cannot realistically prevent collection of everything possible.
I don't shop at Temu or Alibaba, and I don't search on Yandex. I checked my "About Me" on Amazon yesterday and it's shockingly bland and shallow. However I interact with Google, YouTube, Microsoft, and Cloudflare, it's a foregone conclusion that they know everything. My extensive 19-year history on Wikimedia projects is a shockingly rich treasure trove, if anything just my waking hours of every day since 2007! Your own karma score 22,495 in 14 years is probably a fantastic track record of when you were awake and using a computer. If you're so paranoid about Internet privacy, then you wouldn't be so willingly revealing that stuff in public.
I'm using adblocking DNS again, but awhile ago I sort of dropped the pretense of paranoia, because I understood its futility, and again, life's too short. If evil corpos want to do evil to me based on what they think they know, they can do their worst. I am a Christian man accustomed to suffering and infirmity. I got nothing to lose in this life, except integrity.
Yeah, but you can very easily _limit_ what is collected and sold behind the scenes just buy switching browsers, changing browser settings, or using a couple privacy extensions. A little goes a long way.
> So what sort of benefits are you reaping from your anti-fingerprinting measures?
Mostly pride on knowing that I'm preventing companies from doing to me exactly what I wouldn't consent to if they asked me outright.
Sure its just for ads (mostly). Sure the chances of my data leak leading to a personalized cyber attack are slim (I don't actually believe this but you might). Sure, [niche scenario] [non-zero probability] might be prevented. Sure there is a meatspace equivalent to the cyberspace invasion of privacy.
I wouldn't consent to stalking in meatspace, for any reason, and conveniently to my knowledge no one is stalking me physically. I dont consent to stalking in cyber space either, for any reason, and I do know that companies do, and they make it an unending uphill battle to let them know and force them to not be blatantly disrespectful. So I will make it as hard as possible, within what I think is reasonable, to make it useless or difficult for them to stalk me online.
And yes, online things have affected my physical life, so these niche applications have occurred to me and my efforts have reduced the negative impacts, to a satisfactory level, and I will continue to kick against the pricks, because it works.
I would bet money that Brave cannot defeat CreepJS. The only thing I've ever seen do it, ironically, is Safari in private mode.
Also just using your computer normally and visiting regular websites already tracks you regardless of your browser's privacy abilities, and I promise data brokers don't care what browser you use, your overall online behavior is still unique.
https://abrahamjuliot.github.io/creepjs/
a native app with 0 permission prompts gets you more bits than web
Now on a desktop PC sure I believe these fingerprints are highly descriptive. And in android land they probably work okay because of the diversity of products and configurations. But iPhones resist fingerprinting just because they all give the same answers.
The web provides:
time zone language and locale (accept-language header too) iOS version screen size and pixel ratio text size dark/light mode reduced motion ad blocker extensions for safari
An app provides (without additional permissions):
IDFA advertising ID (unique and cross app) IDFV (vendor ID) AdAttributionKit (which apple does obscure somewhat) Battery level, charging state, volume, headphones Various appearance settings again (font, dark/light, reduced motion)
Just slightly more permission granted via prompt can get you:
System boot time and uptime Disk space Keyboard languages and extensions File timestamps
Then additional individual permissions (which people agree to all the time for specific use cases)... at this level they can single you out easily: location contacts bluetooth motion sensors
To Apple's credit they're trying to make fingerprinting more difficult and attempt to ban it entirely, but it's not at all impossible.
But at least the moment we start using websites the largest players will know it’s us. Nobody else swipes and types exactly like me on my screen size of iOS over the relay.
The spectre of possible interpretations is wide.
Some see only problems everywhere whatever the benefits might be, some see only new opportunities no matter the tragic outcomes, some see various blend of this and that.
Maybe I'm just not a typical person, but I have never woken up in the morning and said to myself, "You know, I would just love for a corporation to help me learn about their new products and services today." Never. Not even once. When I want to learn about something, I will actively seek information out about it, and I'm not going to look to advertisements for impartial information. The purpose of advertising is never to inform. It's to bombard and saturate.
We also cant get rid of cancer, it doesnt mean we shoudl close down all hospitals.
Yes, and those people are free to visit equivalent of mail order catalog or go to the store or subscribe to consumer goods quality testing journal or to any of the enthusiast magazines about electronics or gardening or whatever where they perform independent testing and benchmarking or look up a video comparing ceiling fans across a century when they feel hot in the summer.
So yes, we should absolutely ban third party advertisements. People will still be able to discover good products.
I want to learn about products that are useful to me, but not through ads. As it turns out, it is incredibly difficult to learn about new products that are useful, as those do not tend to show up in ads at all and even seeking them out is very difficult.
It's weird how no one has come together to make a website specifically designed around users finding product categories that will make their life better. For example, I didn't learn about height adjustable desks from an ad. Nor did I learn about balance boards from an ad. Or trackballs. Or essentially every other product that made my life better once I realized that product category exists.
What a myopic view. Also, the world is very much filled with shades of gray. I’m certain this dichotomy is indeed a false one.
Generally, how can society discover new products and services?
I would be open to having some kind of directory that i could browse at my own convenience, but that's ultimately going to devolve to paid placement.
I'm surprised you can't imagine a society where the consumer would be the one recommending products and not the producer. Any entrepreneur can find one first consumer to test their new product. And that first consumer have access to a great communication network to recommend that products to their social network — it's called "the Internet". Social networks are a great platform for people to share interesting things to their friends, family, colleagues and also to people they don't actually know ("the Internet" can connect you to strangers). Such networks cost little to operate when the content is created by users, instead of producers and their intermediaries (people favors short, insightful written text instead of catchy commercial once detoxed).
Being born in the 1990s, I did experience that "Internet", when advertising networks didn't exist and when people intentionally interacted to make connections and actively look for information. They were happy to tell about things they discovered, with little to expect in return ("influencer", aka mercenary, wasn't a job yet).
We dont need more hair care or beauty products. Kids dont need to be worried about wearing the latest fashion or skin care product.
New products can be publicised via the old ways, magazine or visiting shops. Nobody needs to know the instant a new iphone is avialable, just let it happen by osmosis.
Data harvesting gains most of its value because they sell some or all data to businesses which wish to leverage that data in advertising. If they cant advertise they wont need most of the data, which should at the least reduce the problem significantly...
The solution is explicit trust. Not fingerprints for users, but digital signatures for content. If it's not signed by somebody the user trusts, don't render it.
The user is the only one who can be trusted to approach that task without a conflict of interest.
Hospitals are not perfect, people die, with your l;ogic we should close down them all.
Doing nothing and keeping advertising keeps a negative situation alive.
What badness could come out from banning advertising ? Can you think of a few examples ?
> No more billboards up and down everywhere for this or that...
But if "third party advertising" is the line, then it's ok as long as you own the billboard, right? So I can still sell you the billboard and you can put your own ad on it. That's just gonna create legal gymnastics, it's not gonna stop the billboards.
As for the web I think that progress means getting past the first/second/third party distinction. Websites are not places, they're data.
Users should have more power to remix or annotate the experience and share the result with other users. That means what was once second party data might appear later as third part data. If we create laws that converge on "third party" I worry we're going entrench the idea that somebody besides the user has a right to control the data, when it would be much better if we left that idea behind and put the power in the user's hands. Like, however it is that they're subjected to surveillance by cod that they didn't consent to run, let's fix that.
I am not trying to write a complex law for my parliament or yours. Of course there are going to be a lot of details that need to be addressed as you are trying to quiz me about.
I would hope the spirit of the ban would be that posters (lets call them that) must be on the same addresses. No solo signs across the road even if the McDonalds or Coke owns the wall or whatever. THis is also a great leveler, small businesses cant afford massive billboards, so if nobody can have them then it encourages competition.
I think you are forgetting how much extra costs like advertising force small businesses to lose. This is part of a process of slowing down the reduction in competition.
As another point, just think airbnb and similar platforms are contributing a major housing crisis all over the world. This problem needs to be slowed down. People didnt have airbnb and overseas trips and planning did work. The old travel system was more sustainable and had less impact on housing, so im more for the reversal and slowdown.
> I think that progress means getting past the first/second/third party distinction. Websites are not places, they're data.
Calling them anything doesnt change or fix the problems that have happened, like housing.
> That means what was once second party data might appear later as third part data. If we create laws that converge on "third party" I worry we're going entrench the idea that somebody besides the user has a right to control the user's experience. It would be much better if instead we left that idea behind.
Im not arguing to argue that there are other ways to try and fix other problems. Im just suggesting that those ideas are simply too hard and would take too long.
Banning third party advertising is the easiest way to get a quick win, that actually helps. Not claiming its perfect, not claiming it fixes everything, im just saying something needs to be done and this is the best for now.
Just stop and think about it, reducing advertising is actually a good thing in many ways.
Some people need to think a harder, life is a bit more complex, there are many ways to achieve the end goal.
The article's points still stand, but the trick didn't work this one time.
This is backwards. The antitrust concerns of removing 3rd party cookies led to them developing alternatives.
Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.
https://jshelter.org/faq/#what-jshelter-configuration-should... :
First, see our blog post. Consult also other blog posts and other questions in this FAQ.
If you want to have the same fingerprint as many users, We suggest going for Tor Browser (do not install JShelter in Tor Browser). If you want to make cross-site fingerprinting linkage hard, go for the Recommended JShelter level. If you want better protection for the real data at the cost of having the same fingerprint on different sites, go for the Strict JShelter level. Keep NBS active. If you want to detect and prevent fingerprinting attempts, use FPD.
That's basically the ideal. It's become obvious that it's impossible to try to be identical. Web browsers are too leaky, and something will out you. You really don't want to try to blend in the "typical" users because none of them use ad blockers.
On the technical level there is no problem to block tracking - intriduce noise and make APIs unavailable until user permits to a web site. But that is not implemented.
The same with native applications. If your bank app requires you to share your location you can't spoof it. The makers of Android and iOS made spoofing of geo location impossible - you don't have that control, which means the phone is not your device. You have to give up your real location.
Using Brave EFF reports that I have a randomized fingerprint.
Using Firefox or Edge EFF reports I have a unique fingerprint
See Fingerprint.com, despite Brave's protections you'll likely find it works reliably.
I love that things like this are coming too light. But, I fucking cannot understand how anyone would’ve ever thought this was OK.
They made some improvements August this year
https://brave.com/privacy-updates/38-webgl-webgpu-fingerprin...
"randomized fingerprint" -> that's a bad result, it means the site can detect you're spoofing info
"unique fingerprint" -> this is good, ONLY IF you refresh and it still says "unique fingerprint", because it means the site sees you as a brand new visitor each visit, and doesn't detect any (what advertisers would call) nefarious behavior. however, if you visit again and the second time it says "nearly-unique fingerprint", that's a failed results because your two visits were linked
The ideal result you should aim for is "non-unique fingerprint". That means your device is indistinguishable from countless others. Blending in to the crowd is what you want.
Google's business model has been ads from the beginning. Search, gmail, drive, office, chrome, everything they do is just to drive ad revenue further.
They don't care about the user. Never have, and never will.
And the outcome we are seeing is what happens when a defunct state isn't able to protect citizens from conglomerates. That's what the Kartellamt or the FTC is supposed to be for.
Not sure if I can't see this comment as anything else than hypocritical. It's always easier on the money receiving side, isn't it? How do you think the term malvertisement came to be?
AdMob is kind of the definition of inevitable Surveillance Capitalism and the prime example for necessary regulation through government.
The company as a whole also really stopped caring at some point and are now following the “do be evil” paradigm
How so? There seems a fairly inherent tension between having things just work by default and hiding surface area for fingerprinting behind permissions pop ups. For example say you go to a maps website, how do you decide whether to share the users location with the website? Or enable webGL functionality to render some fancy layout on the screen? As a user having to enable all that stuff per-website is annoying.
Maybe there's some other way Im missing?
On the web one is drive-by fingerprinted by sites they never once approved of or intended to visit thanks to the browser’s ability to redirect and embed without input from the user. The magnitude of the problem is far greater on the web.
> language
I dont think js is needed for either of those things.
"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else.
From now on I’ll call you:…"
I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it. On rare occasions when I'm forced to use JS I'll cut-and-paste the URL into another browser.
I no longer use ad blockers as I just don't see ads with JS disabled. The other privacy precautions I take are the obvious ones such as no Google or social media accounts, flushing cookies at session's end, regularly randomize my IP and never let Chrome anywhere near my machines and make judicious use of multiple browsers (this is being written in Privacy Browser on Android).
Using NewPipe and sponsor block on PipePipe increases privacy and makes YouTube ad free.
Client-side scripting was a mistake which was obvious from the outset (or not severely limiting the reach of scripting engines).
What I find hard to understand is why alternative plugin JS engines haven't been developed that are under user control. Spoofing, randomizing and returning junk data to webservers would go a huge way towards stopping fingerprinting by websites.
Unfortunately this idealistic principle (no JS) attracts the worst people.
You're on Tor? You have JS disabled? I might as well warm up fbi.gov/investigate/cyber for the probable report I'll have to do...
"Unfortunately this idealistic principle (no JS) attracts the worst people."
Again, how did you come to that opinion? Where's your evidence/stats? Generally comments like that come from web/JS programmers who've realized that client-side users have them stymied when they disable JS.
An additional reason I avoid JS is speed, webpages become blinding fast when there's no JS. Once one gets addicted to the great rendering speed there's no return. I'm not against JS per se, trouble is you JS programmers have weaponised it against users, webpages of 7, 10 and even 20MB are now commonplace. Presenting such slow massive pages to users is nothing other than abuse.
I do not use Tor.
BTW, I should point out that my views about JS and privacy abuse were formed from my years in working in govt. surveillance where the stakes are very high.
That does not change what I have dealt with. I am not a “JavaScript fanboy” remember I made a community that could work WITHOUT needing JavaScript and that lead to a bunch of grief for me which made me understand the extreme naivety of that original idealistic idea on the internet.
I guess you use the web in quite a limited manner? (Or use that other browser quite a lot...?).
I've tried no JS various times over the years and always end up constantly whitelisting sites. It's even worse in 2026 and gets worse each year.
Banking, insurance, webmail, groceries, eBay, CAPTCHAs... not to mention what feels like 50% of the web that is behind either Cloudflare or similar, which almost always require Javascript.
In fact, I'm a very heavy internet user, always have been. Much of my web usage is pretty well automated, I use multiple browsers selected from an 'open with' app. This android, de-googled smartphone currently has four different browsers 'tailored' for specific types of sites and all flush clean after use (cookies etc. are never stored). And toggling airplane mode is the quickest way to change one's IP address.
What's important for me is to separate jobs, functions, etc. that are best processed on the internet from those on other media—SMS, voice telephone, eyeballing people in person (physically going to a store), etc.
This greatly reduces my need for services that use JS. By separating and processing jobs by type I automatically avoid many having to be handled by the web—for those JavaScript can't enter the picture even if one wanted to use it.
For example, I used to do internet banking but I'd never do so again on two accounts—security and that it undermines the use of cash. (A cashless society is the quintessential way to lose one's autonomy, ultimately it's a very dangerous move towards totalitarianism. That most people don't realize this, or if they do then they're prepared to trade it for convenience simply horrify me.)
That Big Tech has enshittified the net out of all recognition in recent years means I've no longer use for social media, Gmail or any Google services—goodbye all Google JS. In short, whilst I do purchase stuff online, I purchase most from shops for cash.
Most of my time on the net is confined to specialist tech sites and they're the ones least likely to use JS. Yes, I agree Cloudflare, etc. is an increasing problem but the web is so big there are usually alternatives. News is often syndicated, so when NYT and such make life difficult without JS, I just jump to the same story on another site where JS doesn't matter (such blocking nonsense is really a trivial non-issue for me). I've dozens more examples but by now you'll have gotten the gist.
https://en.wikipedia.org/wiki/CSS_fingerprinting
On Safari, fingerprinting doesn't survive in incognito mode. Same with Firefox.
Good thing I use different computers for different purposes, though it looks like using different browsers seems sufficient.
Different computers doesn't solve a lot of fingerprinting methods as well.
Anyway, it's a simple script for the sake of demonstration. I'm sure you'll get a different hash on other browsers/devices.
Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes.
90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're mostly left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months).
What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.
You hit the nail on the head with the first statement. It required humans in the loop. It scaled linearly. Local branch managers had relationships with the people in their community, and knew who could and couldn't be trusted.
It was an imperfect system, where a human could be prejudiced against another human, and deny them access to credit.
Sometimes that would get discovered, and the human was held accountable for their actions, or had their actions upheld by a (org-chart-superior) human.
Similar to the imperfect system today, where the models a computer uses could be prejudiced against a human, and deny them access to credit. Dissimilar in that the model or the computer is rarely, if ever, held to account. "Computer says no" is a meme for a reason.
A good number of European countries have only half the poverty rates - the dirt floors and carts you're talking about - of the US yet barely use credit cards.
> we solved the problem with ramshackle one-room buildings with dirt floors,
there is a fallacy here. People with access to debt bid up the price of an asset, like a house, against other peoples’ similar access to debt. Sans debt access, the solution was not necessarily a small ramshackle house. The fallacy is the belief that the same asset price - whether opulent or ramshackle house, wouldn’t adjust to the reduced level from the bidding environment. The differential cost of construction for a nicer house can be countenanced in the access-to-debt case, but that is second order.
Illustrative straw-man example: Suppose, once one had a parcel of land, that it was trivial to construct one’s ‘starter home’ the ramshackle house if you like. Get one’s family and friends to help build in exchange for future return favors. As one advances in life, rebuild to have something more opulent. The rub is in the parcel itself. Unlike the would-be house, it had no cost built-in, just whatever price the previous owner was willing to accept to release their parcel. That parcel’s (and those around it) price reflects the market’s access to debt, or lack of access to debt. In the market without access to debt, parcel pricing reflects which buyers have accrued more savings vs other buyers. In the market with access to debt, parcel pricing reflects who can access more debt (through the various means we know of today - down payment ability yes, which parallels the non-debt’s savings case, someone co-signing, long term expected future earning potential vs someone retired, the parcel itself put up as collateral, perhaps other non-immobile assets put up as collateral, like the family oxcart).
The point is that there isn’t necessarily a 1:1 coupling between market’s debt vs non-debt access and whether the construction is opulent vs ramshackle.
That might be true now, but it would not mean house prices would go down, it just means more people would rent.
Think about how these loans work right now... people with money they don't need right now loan that money to people who want a house but don't have the cash right now. The reason they loan that money is they want to earn a return, which they get in interest on the loan.
Let's say all consumer lending is banned, and you can't loan money to people to buy a house. Well, the people with that money still want a return, so they will invest it somewhere else. Where can they invest it?
Well, one option is they could buy houses and rent them out. Since they only have to compete with other people with money (since poorer people can't get a loan for their house), the price is going to be much lower than it is today, which means they can get a better return by buying the house and renting it out.
So now you are still in the same situation with house prices, but there is no way for you to get any part of that return.
When I grew up I was told to not make debts if not needed. So many older people did indeed save up until they could afford a car or a house. Education was always mostly free where I lived.
Nowadays it seems like ordinary people would need to pay off a house their whole life and thus also need to keep income high enough to keep paying installments. This takes away so much freedom from people as they are trapped in their high paying jobs...
And every now and then we have to rescue banks that are too big too fail at the cost of everyone else, because someone dreamed up a way to increase short term profits that involves giving loans to people who will never pay them back.
> neither your car,
Praising a trillion dollar GDP, but can't afford a used car.
I don’t think there is any rational argument that ALL lending is evil (there are certainly many categories of lending that have lots of arguments for its evilness)
If we don’t have credit, then the only people capable of starting a business, for example, are those who are already wealthy.
It feels onerous as an idea because bank statements, monthly bills, payslips, will bequests, stock vests and trades, bank robberies*, and investment income each have different ways of being tracked. At least most of these records of individual financial activity come with a PDF these days. It wasn’t that long ago that applying for a loan meant scanning in papers for your lender to review.
Computers are smarter now. Not only can they read documents (or at least match the shapes against shapes they’ve been told are real) but they can also understand the contents too (or at least match the words against ideas they’ve been told are real.)
There may well yet be a future Data Valhalla where individuals hold their life.zip themselves, and upload whatever bits of it are needed to get that Nordstrom store card / car financing / cheeseburger loan without having an intermediate credit agency.
*I feel there’s a kernel of a joke there about a bank robber asking for a receipt with the loot in anticipation of declaring it on their tax return.
Credit isn't like insurance where these things can be checked later during a claim (which can then be denied) - you need to know the person is a bad-payer before you send them the ten thousand dollar loan as that affects the terms, not afterwards when they default and you can't get your money back.
Potentially, with loans or other things, some kind of technical solution could work. You could have a personal document that you control, and you give permission for companies to write to the document.
With a loan, for example, if I give you a loan, I can also append to your document that I've loaned you the money; for every payment you make, I write to the log to say you've made a payment. If you stop making payments, I stop writing to the log. This would be cryptographically signed by me, so it can't be forged.
When you want to take out another loan, you can proactively share your document, the bank can see everything written on the log, and make a decision based on that.
i.e. if I am a bad actor, and had just defaulted on a loan, why would the next document I send not be my copy of the previous 'clean' record before I got that loan?
Or what prevents me from sending out the same copy of the document to 10 other parties and getting 10 loans concurrently?
These are the sort of scenarios that the existing credit agencies prevent.
If you had defaulted on a loan, there would be payments missing from your file
For the latter it’s whether you’ve had a judgment against you, which is a matter of public record.
For the former it’s based on how much money you have and what you spend, including on servicing existing debt. Lying about this would be fraud. In that sense, my proposal does indeed open up a new avenue for fraud but I don’t think that’s the same as it being unworkable!
* The majority of missed payments and defaults don't end up as CCJ's, as often these are settled or just happen without going to court.
* Fraud being illegal doesn't stop people committing fraud on you. The idea is to prevent yourself from getting frauded.
The Western governments have horribly failed of caring for their people - cost of living are exploding, and at the moment way too many people are papering over that with unsecured credits backed by their data being free to exploit, and everyone else not willing of doing that is increasingly locked out of existence.
That does mean banks can't know if you lie by omission and hide some unpaid bills, but they can raise the evidence requirements to compensate and I think everyone deserves a second chance.
Suddenly the credit report was no longer a prerequisite to the mortgage.
Not asking polemically, I just have never studied economics and wonder if my intuition here is flawed
Some societies prefer huge risks for huge benefits, in those one (might) need a more detailed credit reports because everything is faster, people accept huge risks and the situation can suddenly change.
Some societies prefer more stability. Lower risks, lower surprises. Less opportunities, everything is slower, people can't even take that many risks, simpler histories will do th trick.
From what I notice though, housing seems to be a problem in both types of societies, irrespective on how credits are given, because there are other things involved (regulation, NIMBY, housing used as value, airbnb, geography, etc).
And anecdotally, despite the aforementioned letter, we got top market rates on our mortgage.
Worth noting that 2008 occurred in part because mortgages were seen as entirely risk-free in aggregate, even as credit reports were already a thing in the US at the time.
As far as I can tell, credit reports are more a tool that lets lenders wring more money out of borrowers in confidence that their competitors will not undercut them, since the borrowers carry their credit reports with them.
But for real. You say you no longer live there, so I'm assuming you left for more opportunities. My wife and I are interested in countries with opportunities for engineers and privacy. Bonus points if there is engineering research opportunities.
If you have the immense luxury of picking your destination, the Netherlands or much of Scandinavia seem to remain the best options.
A lot of data can change over days, weeks, but if you can maintain an accurate fingerprint with tinier changes, and granted you have consistent visits from the user, could you just keep up?
Especially if one service is tapped into several websites, and can continually keep up with smaller data changes and distribute that info. Is this possible? In practice anywhere?
Let's say I'm logged in a famous search engine, they associate my fingerprint X to my account A. If they then encounter fingerprint X anywhere else, there is a good chance it was me, A, doing it. If the next day I get fingerprint Y, it gets attached to A as well and the tracking information follows it.
Does this make sense?
Sorry, but that's simply not true. It's actually the default way of how people eg track people across installs in app stores ever since they started removing that feature.
https://www.malwarebytes.com/blog/news/2025/02/google-now-al...
There's a fingerprint demo on github called JSCreep (https://abrahamjuliot.github.io/creepjs/) that used to keep your fingerprint profile for 90 days and show you how many times you visited. Worked extremely well, and is still around, but no longer uses the API to retain fingerprint data, so you have to track your hash yourself. It would easily track most browsers across changes in IP address. Only Mullvad, Brave, or Tor would not leave an easily tracked fingerprint.
The demo presented in the royfish.dev link is easily foiled by browser extensions that scramble fingerprint data, the presence of which would itself be detected by more sophisticated profilers and used to define the fingerprint. I can refresh the page and get a new hash and adjective-animal name with the same IP. JSCreep sticks firm to the same hash for me, even with a new IP address and some spoofed browser data.
Indeed. I checked this website a few hours ago and got one fingerprint. Just rechecked and got another.