Traitors

Why would you do this to us?

700 points · 84 comments · view on lemmy.world

84 Comments

otter@lemmy.ca · 75 pts · 21d (35 replies)

Unfortunately some of the stuff that allows fingerprinting falls into a convenience vs privacy argument. It allows a website / web app to make changes to display things more appropriately, or have helpful functionality. That's why when you use a browser that is very strict about fingerprinting, some stuff will break.

An even simpler example is the screen aspect ratio. On a small screen, you want to use as much of the space as you can, but that information can be used for fingerprinting. This was annoying on browsers like mullvad, before they updated the aspect ratio to something more modern.

That doesn't excuse companies that abuse that data for malicious fingerprinting.

valar@lemmy.ca · 41 pts · 21d (24 replies)

I'd rather have less interactive (or whathaveyou) websites than the fingerprinting. The trade wasn't worth it.

lauha@lemmy.world · 0 pts · 21d (23 replies)

You'd rather have your browser use the bandwidth to download all 500 language versions and 200 otherwise localized versions of the website and use some random language as default, maybe chinese or spanish for being the biggest languages.

bryndos@fedia.io · 21 pts · 21d (5 replies)

Is it possible for URL to request the one that i want? I feel like i remember different language versions of webpages from before browser fingerprinting - though I guess I don't know long ago it started.

Even so, it seems like it only needs to know my request as a one of 500 group. An individualised fingerprint of 1 in 10bn seems like overkill to me. Assuming that's what fingerprint means in this context.

lauha@lemmy.world · 12 pts · 21d (3 replies)

Be requesting the specific language site you are giving them the information anyway.

bryndos@fedia.io · 18 pts · 21d

I'm ok to give them 1 in 500 resolution (or whatever rough order of magnitude) to tell them i want to read the EN version. That's a lot less precise than 1 in 10 billion or whatever the fingerprint is.

cavitationfetishist01@quokk.au · 12 pts · 21d (1 reply)

Some browsers literally have a 'spoof is language to english' option to anti fingerprint. To hide in the horde.

And I'd rather DL 500 languages of actual content than 1mb of page and 2GB of ad shit.

Axolotl_cpp@feddit.it · 2 pts · 21d

Bold of you to assume that modern websites will not be 1gb of pages and 2gb of ads

bss03@infosec.pub · 10 pts · 21d

browser fingerprinting

Thing is, while it wasn't called "browser fingerprinting" immediately, it basically started as soon as JS was around. And feature-detection / media-queries actually make for better compatibility than just User-Agent strings (and other headers).

Content negotiation never really caught on, as best as I can tell. There's a number of headers that the client can send so that the server can select a version by language, content-type, and a few other things, but in all the web deployments I've ever done content-negotiation was never a consideration.

Almost any information can be abused.

Racoonwithbenefits@lemmy.zip · 6 pts · 21d (10 replies)
[ removed ]
victorz@lemmy.world · 10 pts · 21d (9 replies)

And which language would it start in, in order to offer you this list?

Imagine if every site did this, it would be so cumbersome. Worse than the cookie banners.

And either way, when you select the language, you've given them the fingerprinting data anyway. 😂 Completely pointless.

Honytawk@discuss.tchncs.de · 5 pts · 21d (7 replies)

The language that is chosen in the top level domain of the URL.

If it is a domain.es it is in Spanish.

If it is a domain.co.uk it is in English.

If it is a domain.it it is in Italian.

Or just the main language where the website is located. It isn't difficult to add a language icon somewhere at the top or bottom.

Nothing about it needs to track the user. The only info you give them is that you can speak a certain language. Not that it is your main language. Or that you can only understand one.

lauha@lemmy.world · 7 pts · 21d (5 replies)

But you are similarly revealing your language by going to said url.

gandalf_der_12te@feddit.org · 1 pts · 20d

yeah but now the website knows i speak english. that does not personally identify me. there are 5 billion people speaking english

ok nvm it's 1.5 billion, still a lot.

victorz@lemmy.world · 1 pts · 21d

Like the other person said, you've already become a data point by visiting the page.

Nothing about it needs to track the user. The only info you give them is that you can speak a certain language. Not that it is your main language. Or that you can only understand one.

Needs to, no, but they will. Regardless of whether or not it's your main language, you will be a data point by selecting your preferred display language. Unfortunately, of course.

Zarobi@aussie.zone · 1 pts · 21d

I already have to scroll past 20 options to get to Australia in country drop down lists lol

undefinedTruth@lemmy.zip · 5 pts · 21d

Dude, language detection is literally done with a simple HTTP header set by the browser. There is no need for all the other crap.

rhubarbe@tarte.nuage-libre.fr · 3 pts · 21d (4 replies)

I just go to /fr for French. That sounds like a non-issue.

lauha@lemmy.world · 1 pts · 21d (3 replies)

Then you just tell them your language anyway, but it's more cumbersome to you.

draco_aeneus@mander.xyz · 6 pts · 21d (2 replies)

As someone not in the USA, I cannot tell you how absolutely annoying and terrible it is when the website automatically selects a language/region for you. It happens so often.

"Oh, you have a Polish IP? Here is the whole website in Polish. Also, the address field will now only accept Polish addresses!". Nah bro, I just live near the border. I wish I could select language by adjusting the path, that would be so much better than what some sites do.

boonhet@sopuli.xyz · 7 pts · 21d (1 reply)

Your example isn't even the worst. Polish IP and Polish language.

I have an Estonian IP so I've had websites determine I want everything in Russian.

There was some website at one point that didn't even give me an option for English. Estonian IP? Okay, you speak Russian. You don't speak English. And we don't support Estonian.

IT'S NOT EVEN AN OFFICIAL LANGUAGE FOR THE COUNTRY WHERE MY IP ADDRESS IS LOCATED

ExcessShiv@lemmy.dbzer0.com · 1 pts · 21d

IT'S NOT EVEN AN OFFICIAL LANGUAGE FOR THE COUNTRY WHERE MY IP ADDRESS IS LOCATED

Nevertheless, you do actually understand a decent amount of Russian...and if you're old enough you are fluent.

undefinedTruth@lemmy.zip · 5 pts · 21d (1 reply)

Most of this stuff is done locally by the browser using media queries in CSS. There is no reason for that data to make its way to the server.

sage@lemmy.blahaj.zone · 1 pts · 20d

If your client can access it, it can sent it to server.

Zarobi@aussie.zone · -2 pts · 21d (7 replies)

Yeah exactly. A lot of features are like, let's design the website to perfectly suit your device. But then that means they know everything about your device, otherwise they can't design for it. Then, if they know everything about your device, bad actors will abuse that information. So the only solution is going back to shit websites, but nobody wants that, so we just kind of pretend that it's not a problem and compromise as best we can

Honytawk@discuss.tchncs.de · 12 pts · 21d (5 replies)

Don't speak for the lot of us.

I want to go back to websites that were actually just functional websites that did the thing they were designed to do and nothing more.

Zarobi@aussie.zone · 1 pts · 21d (2 replies)

Most people don't actually want that unfortunately. I agree with you but the numbers don't lie. People love bloated and annoying websites

AstralPath@lemmy.ca · 6 pts · 21d (1 reply)

Are you sure? Because I'd bet that people don't think about it enough to say they love it or hate it. Most people don't understand that the internet doesn't have to be this way. Its our job to enlighten them to that, I think.

gandalf_der_12te@feddit.org · 1 pts · 20d

i agree with everything besides "it's our job to ..."

boonhet@sopuli.xyz · 0 pts · 21d (1 reply)

Unfortunately people want things like websites being easily readable regardless of device form factor, language being automatically detected, ability to choose font families for readability... I know, people are idiots.

gandalf_der_12te@feddit.org · 2 pts · 20d

yeah that can all (except language) happen browser-side easily

and language, now the website knows i speak english. there's 1.5 billion people speaking english. that alone does not identify me.

kodevade@lemmy.zip · 9 pts · 21d

I kinda dont see a problem "boring" shitty websites that do its job. For example Wikipedia hasn't changed much and it's still my most used website, it gives me a good sense of familiarity and I know exactly what to find where

Maybe I am weird but I kinda preferr boring TBH

daannii@lemmy.world · 54 pts · 21d (5 replies)

Greed. Lack of ethics.

Many years ago. I think it was like 2016-17 ish. I interviewed at a university for a grad program that's basically "psychology -engineering". Designing things to work with human psychology. Aka human factors psychology

(I ended up doing a different degree).

During this interview thing. I was there 2 days. It's like an event. You meet professors and tour labs. See what other grads are working on and you have lunch and dinner with current grads and professors.

So a professor was talking about developing tech to do eye tracking on phones. So they could see what you were looking at on the screen and for how long.

Now at this time I knew a little bit about eye tracking methods. Firstly I pointed out that it would be impossible for it to be very accurate without stabilizing the head (as is done in research), usually with a chin mount that holds the head still. But the guy said it didn't need to be that accurate as the intent was marketing. See what items people look at when scrolling on shopping apps/sites. And see how long they look at it.

I also pointed out that this was highly unethical because it's using physiological data to manipulate someone into spending money. Indiscriminately.

I said What about people with a shopping addiction.? Or kids using their parents credit cards. And you would be using this data to psychologically manipulate people for purchases but the data could be used in all sorts of other ways that really even more unethical.

The idea was that if someone showed interest by looking at an item longer then that item would be presented again by the app. Multiple times even. To encourage purchase.

Or to show items that were similar to try to seal the deal with what the person was finding appealing.

Possibly with price alterations to encourage purchase.

When I said again that this was obviously unethical. As a scientist our goal should not be to manipulate the public I was told "someone's going to do it, it might as well be us so we get paid for it".

I was very surprised that this came with chuckles and agreement from other students.

Another professor I talked to about her work was investigating devices that could help people drive who were hearing impaired. So it was quite the contrast.

I did not get offered a PhD position but they did offer me admission to their masters program that was 50k a year. Near D.C. 2 year program. (Combo positiond are typically "free" in a manner of speaking. Highly competitive but that's how it's done). I wasn't interested in paying them 200k for a master's (after taking loans for living expenses too).

I also learned later they don't even have masters/PhD program combos. Which is what it said on their website and I specifically applied to that. They also gave me a 2 week notice for the interview.

You ever buy a plane ticket 2 weeks ahead? $$$$$

They didn't reimburse me for that either. Which is customary for these interview invites. Typically travel and lodging is covered by the university. They had me stay in some graduates house. They had like 6 roommates.

Cheap-ass, greedy, no ethics, bastards.

GMU

Jankatarch@lemmy.world · 9 pts · 21d

Well at least I am pretty sure corruption in academia never had any long-term consequences for the population! /s

Natanox@discuss.tchncs.de · 5 pts · 21d (2 replies)

What you describe is being used by now. The permanent eye-tracking got low-level support on Snapdragon SoCs by 2023 (Snapdragon 8 Gen 3, "Sensing Hub"), the Honor Magic 6 phone advertised itself as able to "open apps by looking at them"; those desperate fucks really tried to sell this as a good thing to users. Though even this article eventually spilled the beans:

"Content Personalization: Adapt news feeds based on the focus and duration of your gaze."

They want you to think this is a good thing, but it's clearly dystopian. And already 3 years old, so by now they certainly found even more ways to make everyone miserable & manipulated.

The Google Assistant famously still listened to the microphone and uploaded data even if you tried to stop it, so I genuinely always recommend everyone to either flash your phone with GrapheneOS, CalyxOS, /e/OS or iodĂŠOS immediately or throw it away. Modern mainline phones are a health hazard.

daannii@lemmy.world · 1 pts · 21d

Yeah I keep a piece of tape over my front camera on my phone.

A strip. Because there are usually other cameras you can't see. Idk which they use but yeah. This tech was already in development 10 years ago. It definitely is common on most phones and apps by now.

gandalf_der_12te@feddit.org · 0 pts · 20d

actually, what i've learned is that some people (probably the majority?) actually like being shown ads. that is, i believe, because many people have no inherent purpose of life. so they need to be told why they exist by someone else ("you must consume" is the message of ads. it gives people a purpose in life).

gandalf_der_12te@feddit.org · 1 pts · 20d

I also pointed out that this was highly unethical because it’s using physiological data to manipulate someone into spending money. Indiscriminately.

I said What about people with a shopping addiction.? Or kids using their parents credit cards. And you would be using this data to psychologically manipulate people for purchases but the data could be used in all sorts of other ways that really even more unethical.

marketing is highly unethical in general. however, your points are kinda invalid. sure, children can use their parents' credit cards, but they can also burn the money with a lighter. children can do stupid things, and ideally such a purchase would be illegal and the parents eligible for a refund. or you would need a password to authenticate etc.

however what is a real problem is that advertisement poisons our environment. when you step out on the street, there's ads everywhere. you can't go anywhere where there's no ads. the consequence is that your head is trapped in an eternal cobweb of "consume, consume, consume". you must consume, there is nothing else to do. that is the true horror that modern marketing has brought to us. psychologically hacking the brain to make us think about buying stuff all the time.

Hawk@lemmy.dbzer0.com · 37 pts · 21d (6 replies)

We once ran a trial at work for a lead generation software.

It could show who visited your website, what company they worked for, how to contact them, their socials and even a video of exactly where they pointed and clicked their mouse.

No sign up required, all by fingerprinting.

Shit was creepy as fuck, glad we don't use it anymore.

It also made me realize fingerprinting is almost impossible to avoid. There's so many little things gathered to identify you, it seems unavoidable to be traced.

siravious@lemmy.world · 21 pts · 21d (3 replies)

Yep, and add the OS itself spying with an unremovable universal ID, by a company who proactively reports on you, and wtf moments really turn surreal.

Katana314@lemmy.world · 8 pts · 21d (2 replies)

It upsets me that in working with webpages, I regularly look at “all” the network traffic going to a website - and clearly Microsoft’s GUID is hiding somewhere it won’t even show.

InFerNo@lemmy.ml · 3 pts · 21d

It might be stored locally, then shared with a call home through telemetry after which Microsoft then sells it as "anonymized" data, which is then again recombined with other sets by the buyer to recreate your profile.

I read that they can combine 3 anonymized datasets to fairly accurately identify a person.

siravious@lemmy.world · 1 pts · 20d

Jfc… I had no idea

Digit@lemmy.wtf · 5 pts · 21d

Fuckit, lets all go install templeOS.

LodeMike@lemmy.today · 2 pts · 20d

Tor Browser is the only real defense.

zr0@lemmy.dbzer0.com · 29 pts · 21d

Oh god. I had to save this image and now I will use the sticker version of it everywhere.

0x0@lemmy.zip · 15 pts · 21d (1 reply)

Just following orders.™

87Six@lemmy.zip · 15 pts · 21d (4 replies)

They didn't really develop it, it just kinda happened, because browsers send so much goddamn data to the servers

perishthethought@piefed.social · 8 pts · 21d (3 replies)

Sorry but, that's BS. Coders developed it. I should be punching multiple coders but someone somewhere made this happen. They could have said no.

filcuk@feddit.uk · 8 pts · 21d (2 replies)

No, this is BS and not how the real world works. If would be fine if you've left it as a meme. Developers (in corps) don't decide what they'll work on.

perishthethought@piefed.social · 15 pts · 21d (1 reply)
Digit@lemmy.wtf · 5 pts · 21d

Alas, but, tragedy of commons and game theory [(and FOMO)] have us racing to the bottom (~ along with a dozen other things impeding an effective collective bargaining, or any of the other things that would otherwise allow us to have nice things).

gravitas_deficiency@sh.itjust.works · 14 pts · 21d (1 reply)

SalmiakDragon@feddit.nu · 2 pts · 21d

How nice that the gif let's you know where it's from!

mariusafa@lemmy.sdf.org · 8 pts · 20d

Unfortunately there are many developers that apply the Banality of Evil to their doings.

inari@piefed.zip · 7 pts · 21d

Class traitors

iterable@sh.itjust.works · 6 pts · 21d

Get CanvasBlocker on Firefox

video@lemmy.world · 6 pts · 21d (3 replies)
video@lemmy.world · 1 pts · 20d

Big duh you two. Obviously.

But that is not the world you are in. So my suggestion is to help in our current world.

kernoorlog@altgag.net · 1 pts · 21d

yes i rather have that websitesd dont need to know i live on the moon fucking hun=mans wanting to know if im huiman is just bulshit

cavitationfetishist01@quokk.au · 1 pts · 21d

Shouldn't be anything to help with is point.

Digit@lemmy.wtf · 6 pts · 21d

Is there a queue?

architectonas@lemmy.world · 5 pts · 21d (11 replies)

How does it work?

unexposedhazard@discuss.tchncs.de · 17 pts · 21d (10 replies)

https://amiunique.org/fingerprint

Lots of little pieces of data about your setup. Combined together they create a combination that is extremely unique and allows companies to track you across the web.

tja@sh.itjust.works · 7 pts · 21d (7 replies)

Yes! You are unique among the 5376518 fingerprints in our entire dataset.

Nice

boonhet@sopuli.xyz · 3 pts · 21d (4 replies)

Ideally you want to be not unique though. Being unique means you're easy to track

diaphragmwp@discuss.tchncs.de · 5 pts · 21d (3 replies)

Yes! You are unique among the 5376714 fingerprints in our entire dataset.

Delete site data, F5

Yes! You are unique among the 5376715 fingerprints in our entire dataset.

d00ery@lemmy.world · 2 pts · 21d (1 reply)

Interesting. So if it registers your browser as unique every time then it can't link your visits together.

diaphragmwp@discuss.tchncs.de · 4 pts · 21d

resistfingerprinting go brrrrrr

gandalf_der_12te@feddit.org · 1 pts · 20d

yeah i've made the same experience. they don't seem to actually store the fingerprint across each site visit? or they do but it changes continuously. in which case, good job firefox ❤️

Holytimes@sh.itjust.works · 1 pts · 21d (1 reply)

The entire point is you don't want to be unique. The fact you are is extremely bad.

architectonas@lemmy.world · 5 pts · 21d

oh no

0x0@lemmy.zip · 1 pts · 21d

I've never not been unique in any of those sites....

SkunkWorkz@lemmy.world · 3 pts · 21d (4 replies)

It’s more likely that a scientist invented it than an average coder.

perishthethought@piefed.social · 3 pts · 21d (3 replies)

As a coder myself, I can say: we as a group need to learn to say no more often.

Holytimes@sh.itjust.works · 5 pts · 21d (2 replies)

You're fired. We'll just hire someone from India for $0.03 a week.

We can dream about getting billions of people to all agree to stop undercutting each other. It's a nice dream

0x0@lemmy.zip · 2 pts · 21d

We can dream about getting billions of people to all agree to stop undercutting each other. It’s a nice dream

The conditioning is working. Don't unionize.

gandalf_der_12te@feddit.org · 1 pts · 20d

the problem is that even if you convince 5 million people to join your union and raise your wages, the other 295 million people in the country are then gonna take the opportunity to undercut you, which leads you to be fired as "too expensive" and other people to take your job.

Tollana1234567@lemmy.today · 1 pts · 20d

its a datamining tool, and used aggressively by reddit to overban people.