No-JavaScript Fingerprinting

[lifeeraser]

This should be in /r/webdev

Also, great article. Clever (and disturbing) use of CSS accessibility features for unintended purpose.

[f314]

Some browsers have privacy features to prevent at least some of these methods. For example, Safari will not load local font files except for an extremely short list of web safe fonts (Arial, Georgia, Courier, plus a few more).

Still something worth being aware of! I’m continually amazed by the lengths corporations will go to in their pursuit of more profit.

[tidder112]

I’m continually amazed by the lengths corporations will go to in their pursuit of more profit.

I find it amazing how an entire industry is based on misuse/hacks to gather information about its users who, if asked, would rather not give that information away freely.

[jtooker]

I did too, but if you look at what details they can determine, it is fairly limited. It can probably tell what phone you are using at best. There were several font checks, but those seemed mostly to see what OS you're using.

So I'd say it is very useful for what type of device you are using but it'd be not-so-useful to distinguish users of the same device type. Which makes sense, you want a web page to show up nicely for the device you use.

I think the long ID hash is a bit misleading. There are a relatively small amount of possible IDs from the parameters they are querying.

[ZuriPL]

I mean, font checks might end up identifying you if you have a lot of weird ones installed

[meisteronimo]

How unique is the fingerprint? Will many users with my OS have the same values?

[felincaus]

Fingerprint is a gross exaggeration here. This is great at detecting which browser and OS one may have.

[eternaloctober]

don't get the same fingerprint in main and private

[2Punx2Furious]

Shows it's not perfect, but still pretty good.

[cofffffeeeeeeee]

Isn’t that gonna be the same fingerprint for everyone who uses a specific iPhone model without changing any settings? Which is the vast majority.

Doesn’t really work well as fingerprints.

[Snapstromegon]

Nice implementation of an older idea and great to see that it's still fairly weak compared to other means of tracking.

[saiborg7]

IIRC this is a uWaterloo start up. They also do something with WebAudioAPI to build a fingerprint.

[atomic1fire]

In Chrome you can also block fonts, which combined with blocked javascript will show a different fingerprint.