28 replies

1. Matt Wilcox 2 min later

   @zachleat Hahaahahahaaaaaaa!

   *wipes tear away*

   hahahahaaaaaahaaha

   *doubles over*

   hahahugh ugh aaa aaaaa

   Good one! Good one!

   1. Zach Leatherman 22 min later

      @mattwilcox our analytics indicate that you in fact wiped two tears away

      here are some ads for sanitary wipes

2. Stuart Langridge 29 min later

   @zachleat mostly yes. There is a bit of pushback because it's useful to identify fraud sometimes (I was surprised at this too, which is why I put it in https://web.dev/learn/privacy/fingerprinting), but I think browser makers certainly, in general, would claim that they're against fingerprinting. Whether they actually are, rather than being against the appearance of it, or against specific features which they then claim to drop for fingerprinting reasons, or against anyone except them doing it, is another question.

   1. Zach Leatherman 39 min later

      @sil *whew* yeah.

      What kind of fraud do you have in mind there?

      1. Stuart Langridge 43 min later

         @zachleat Basically, identifying bots pretending to be a person. There is a lot of double-talk on this front, with companies selling all sorts of fingerprinting products which claim they're there to detect automated account setup and so on, but then also have a big paragraph which says "oh and also you can tell if the same user has come back even if they delete all their cookies! if you would perchance find this useful for your ad tech!" (just search for "web fingerprinting fraud detection")

         1. Stuart Langridge 44 min later

            @zachleat but I am told that this is not *entirely* disingenuous and the fraud detection stuff is actually useful, sometimes, even if the products being sold do at least some of the time use it as a figleaf to encourage user tracking across sessions in a way that compromises privacy.

         2. Zach Leatherman 49 min later

            @sil What a mess.

3. Alex Russell 3 hr later

   @zachleat The terms of this debate are regrettably stupid.

   The question isn't "is fingerprinting bad?", the operative question is "can fingerprinting be reasonably avoided?"

   The answer is "no" in the short run, and "absolutely not" over moderate time periods. Which means we're now in management/risk tradeoff territory.

   But *some* vendors are actively misleading folks about which question we are trying to answer.

   1. Alex Russell 3 hr later

      @zachleat BTW, this is not a defense of 3P cookies. They should probably disappear. And the work on sign-in substitutes has been exemplary.

      What's extremely frustrating about this is that some parties want to sell us the idea that you can just buy privacy (usually for the price of a new phone) because they'll make fingerprinting impossible.

      But that's not how ANY of this works.

      1. Alex Russell 3 hr later

         @zachleat In reality, fingerprinting is about subdividing users into small buckets in order to *reidentify without consent. *But users do lots of things on their devices, and there are *many* ways for entropy to leak. And the consent line is pretty fungible too.

         The largest technical barriers to removing reidentifiers are intrinsic device properties (screen size, density, a11y settings, etc.). And the vendors pushing "privacy" aren't levelling with anyone about those.

         1. Alex Russell 3 hr later

            @zachleat In reality, the way you'd attack this stuff is to:

            - always run in a VM to cap/fix clock rate and CPU core count
            - disallow JIT
            - cap memory to a low amount via VM
            - never allow HW-accelerated video encode/decode
            - only allow a fixed set of window sizes and DPI
            - always route through a single (or a small number of) VPN egress nodes

            1. Alex Russell 3 hr later

               @zachleat Oh, and forget keyboard or touch input. Users are pretty unique. But nobody's selling that. Instead, they're selling "make life inconvenient for certain pervasive collectors in the short run".

               This is fundamentally ineffective because all it does is elongate the time window for reidentification. Also, because it would push folks into native apps, where the fingerprinting situation is *dire*, despite the OS vendors nominally "reviewing" native apps.

               1. Alex Russell 3 hr later

                  @zachleat So, if this is kayfabe, we have a few questions on the other side of it:

                  - does all of this stuff do *nothing*?
                  - why are "privacy people" so excited about it?
                  - what's a real solution?

                  1. Alex Russell 3 hr later

                     @zachleat The last one is the simplest: a real fucking privacy law.

                     BTW, you can tell that this *is* kayfabe, or at least hugely dishonest marketing, because the same companies that are trying to sell you a new phone (because privacy!) are *NOT* lobbying hard to get toothsome privacy laws passed.

                     If they were, I'd have some respect for the short-run interventions as stop-gaps. But that's not what's happening.

                     1. Alex Russell 3 hr later

                        @zachleat Apple is *absolutely* spending more money lobbying to prevent you from having a choice in browsers (including browsers that might offer better privacy) than they are to try to get strong privacy legislation passed.

                        Apple is spending WAY more to defeat right-to-repair legislation than they are to build a pro-privacy legislation constituency.

                        And they're spending obscenely more on misleading ads and billboards w/ dodgy privacy claims than lobbying to end unauthorized reidentification.

                        1. Alex Russell 3 hr later

                           @zachleat So back to the first question: what does this stuff *do*?

                           Admitting that reidentification is always going to be possible over a long enough time horizon (because privacy != security; neither are binary, but privacy leans into the time dimension which breaks brains), what interventions about silent tracking/reidentification mechanisms do, in practice, is fire-and-motion towards the largest, most pervasive collectors.

                           It's like IDFA/ATT; not a solution to tracking, but an inconvenience

                           1. Alex Russell 3 hr later

                              @zachleat Does annoying the people whose business models depend on tracking help users? Well, it certainly can make some of the creepy middlemen less effective in the short run. But not the long run. And if you're happy to be on a "buy this new phone because privacy!" upgrade treadmill...OK? But it's not a solution.

                              1. Alex Russell 3 hr later

                                 @zachleat So why are "privacy advocates" going along with this?

                                 First, they're (rightly) happy to see some of the worst collectors lives made harder.

                                 Second, some of them are truly confused about the threat model (do better!)

                                 And third, some hope that they can pivot from arguments about collection to the important debate over time, so long as privacy is seen to be important.

                                 But what Apple and others have done is to redefine privacy, not pivot. A devil's bargain.

                                 1. Alex Russell 3 hr later

                                    @zachleat Anyway, it's long past time for folks to stop having this debate at the level phone vendors want you to have it at.

                                    The only way to get privacy in practice is for data recombining to become painful and expensive. To turn data at rest about users into radioactive waste, not an asset to be minded. That requires changes to the law.

                                    1. Private reply 4 hr later
                                    2. Zach Leatherman 7 hr later

                                       @slightlyoff Alex this would make for a wonderful blog post 😅👀

                                       1. Alex Russell 8 hr later

                                          @zachleat Considering it. Particularly as I forgot to mention that these same companies are allowing FB and others to shove in-app browsers into your experience, enabling levels of tracking that would make any honest browser vendor blanche.

                                          It's duplicitous in the extreme.

                                          1. Alex Russell 1 day later

                                             @zachleat Oh look:

                                             https://infrequently.org/2024/07/misfire/

                                             1. Zach Leatherman 2 days later

                                                @slightlyoff excellent—thank you!

                                                also TIL the word kayfabe and what an incredible word it is 🏆

               2. Private reply 10 hr later
                  1. Private reply 10 hr later
         2. Private reply 3 hr later
            1. Private reply 3 hr later