Fingerprint's company blog covers browser fingerprinting techniques, bot and fraud detection, and the limits of anti-fingerprinting defenses.
Commenters are hostile to the company, calling its tracking invasive, while others test its demo and say it overstates what it can identify.
Cookies are not the meta for tracking anymore. Fingerprinting [1] is highly effective across IPs and across incognito/browser profiles. Content blockers like Brave shields or uBlock Origin do not stop fingerprinting.
The only browsers I've found that defeat it on desktop are Mullvad and Tor Browser as well as all the antidetect browsers I've tried.
Disturbingly, fingerprint.com is not defeated by Tor browser on Android. We know fingerprinting is more effective on Mobile, and the recommendations say to use desktop for the most anonymity, so this isn't surprising.
Mullvad [2] and Tor browser are blocked from using or signing up for most websites because of IP reputation and the browser fingerprinting protections which make them look like VMs and bots. Unlike the antidetect browsers, they don't spend extensive resources on site compatibility and avoiding detection, which leaves most sites shaking you down for suspect fraud. Annoying, when the real fraudsters are passing through easily with anti detect browsers and residential IPs.
Antidetect browsers are used by marketers, web scrapers, social media account managers, ecom, among other low lifes. These use different browser profiles to avoid fingerprinting by isolating and randomizimg identifiers while constantly patching(use a few week old version and you'll see it gets detected as something to be blocked, not detected as in correlated cross profile, just blocked) to avoid detection. I'd like to see a privacy focused…
The Tor Browser won’t effectively stop fingerprinting, if anything it makes you more unique due to the low amount of people worldwide using it, and then you add points of data by using different DNS providers, extensions etc.
The Tor Browser as a privacy measure is likely no better than a normal browser with uBlock if you’re also using it like a “normal” browser, signing into the same accounts you always use etc. My opinion obviously but I dislike people recommending the Tor Browser as a lot of it’s primary benefits are lost if you’re just using it as a daily driver browser.
I always point people to https://fingerprint.com/ to see if their browser can defeat it. Most of the time you can’t without clearing cookies, changing device resolution, change VPN location etc. something the average person can’t/won’t do. Even JS aside there are a ton of different ways to track people based off even just getting server side data when a site’s stylesheet is fetched.
> A few years ago, intentionally fingerprinting or tracking your users without disclosure was spyware and unethical. Alas, here we are.
For over 15 years reCAPTCHA has relied on browser fingerprinting to help distinguish humans from bots. And fingerprintjs.com has been around for well more than a couple years.
That said, sniffing the browser extensions someone is using is NOT a common fingerprinting method used by my examples, but just saying fingerprinting itself without explicit disclosure has been around for quite a long time. It happens on literally every CAPTCHA service. I hate it of course, but the ship sailed a long time ago.
--
I like this demo for testing my browser's resilence against fingerprinting: https://fingerprint.com/demo/
Using something like this, which I would personally make illegal:
https://fingerprint.com/
I also tried setting privacy.resistFingerprinting = true in Firefox, but it's sad to see that most websites become unusable (most sites using canvas just render a green/purple mess), zooming in Google Maps is basically broken (skips several levels at a time), and like others have mentioned dark mode and time zones also stop working.
What a mess the (somewhat private) web is nowadays. The more I think about it, the more I am convinced legislating privacy is the only way out of this arms race we seem to be losing.
EDIT: Sorry, the parent post already included fingerprinting, missed that. Rant still stands though :)
Fingerprint - https://fingerprint.com/ | Bot Detection Researcher (TS, JS), Senior TPM (Mobile Device Intelligence) | Full Time | Remote
Fingerprint empowers developers to stop online fraud at the source. We work on turning radical new ideas in the fraud detection space into reality. Our products are developer-focused and our clients range from solo developers to publicly traded companies. 100% Remote, Global (GMT-8 to GMT+3), flexible schedule, competitive salary We are looking for:
Bot Detection Researcher (TS, JS), https://grnh.se/31ab73694us - Sr. TPM (Mobile Device Intelligence), https://grnh.se/a3deb22b4us
For those who are unaware of how big of a problem fingerprinting is, there is an EFF website [1]. EU cookie policy is nothing compared to this. There are libraries like fingerprintjs [2] which can generate a pretty stable visitor ID.
If you change or alter some browser APIs in order to make your browser less unique, some payment processors webs may stop working. And webs proxied through CloudFlare will constantly display "Checking if the site connection is secure" page, sometimes in an infinite loop where even solving their captchas won't help.
[1] https://coveryourtracks.eff.org/
[2] https://fingerprint.com/