FingerprintJS Blog

>Windows

lol most people pay money for windows (even against their will if they want to buy a laptop for example) and still get ads and telemetry cranked to the max. What's up with that?

>Android

Another bad example. In a less shitty world where the majority share of the global mobile OS duopoly isn't owned by a glorified surveillance company, the support of a device would be covered by, and only by the sale price of the device. Which wouldn't be such a huge cost if Android better had engineered HAL and better standards so every device could update from the same repo tree.

>if you have to pay for everything then you'll leave even more of a trail on what you did.

This is my problem with Kagi[0](frequently posted here). This is more of the fault of the current global payment infrastructure than any ordinary tech company's. But if you think that the current ad infested browsing experience makes you any more private I have bad news for you. Namely fingerprintJS[1].

You might be asking what are my solution's to these problems. And my answer is that I have no idea. The only thing I know is that I'm seriously jaded with the current
{mono,duo}poly ridden state of tech.

[0]: https://kagi.com/ (currently throwing internal server error lol)

[1]: https://fingerprintjs.com/

Oh I don't actually disable WASM. Those are just different scripts that can apply to pages when a filter matches. I disable sendBeacon everywhere with `*##+js(disable-sendBeacon.js)` but the others I don't use or only use on a specific site. I believe I added the WASM removal just to test how a particular site's fallback would work when it wasn't present. That said, disabling WASM probably reduces your browser fingerprinting bits. I bet fingerprintjs[0] uses it.

UBO already has a built-in set of powerful scripts[1], but I just wrote my own for fun. I think I could have done this by just using the built-in ones.

edit: This filter does the same thing just using the built in `set` script, but won't log to console:

*##+js(set, navigator.sendBeacon, trueFunc)

[0] - https://fingerprintjs.com/demo/

[1] - https://github.com/gorhill/uBlock/wiki/Resources-Library

I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed.

There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get "response"), which is definitely something which can be used for fingerprinting.

Which reminds me of fingerprinting by tiny differences in the audio API provided by browsers [0]. Super interesting, but also a bit depressing. Also works for things like canvases and WebGL.

EFF allows you to check how fingerprintable your browser is [1]. Do note that the results may not be very accurate.

[0]: https://fingerprintjs.com/blog/audio-fingerprinting/

[1]: https://coveryourtracks.eff.org

FingerprintJS | JavaScript Engineering Team Lead, DevOps Engineer | Full Time | Remote |https://fingerprintjs.com/

FingerprintJS empowers developers to stop online fraud at the source. We work on turning radical new ideas in the fraud detection space into reality. Our products are developer-focused and our clients range from solo developers to publicly traded companies. Some of our customers include Target, checkout.com, coinbase, and eBay just to name a few.
100% Remote, Global (GMT-8 to GMT+3), flexible schedule, direct contract, competitive salary

We are looking for:

DevOps Engineer: https://grnh.se/70ca0e824us

JavaScript Engineering Team Lead: https://grnh.se/e675f8ed4us

FingerprintJS | Multiple Roles | 100% Remote | Full-time/Contract | https://fingerprintjs.com

Backed by Craft Ventures, FingerprintJS empowers developers to stop online fraud at the source. We are a globally dispersed, 100% remote company with a strong open-source focus. Our flagship open source project is FingerprintJS (15.3K stars on GitHub).

Perks: Work from anywhere, competitive pay, stock options, $600 annual learning budget, Macbook M1 Pro provided, 20 Days paid time off, Unlimited Sick Time.

Senior JavaScript Developer (Fullstack) -- https://grnh.se/c36b3d7f4us
Senior Golang Backend Engineer -- https://grnh.se/df9daec84us

The actual blogpost is here

https://fingerprintjs.com/blog/disabling-javascript-wont-stop-fingerprinting/

basically they use CSS trickery together with server-side stuff.

It's pretty clever.

@font-face
{
font-family: 'Helvetica';
src: local('Helvetica'),
url('/signal/(token)/fontHelvetica')
format('truetype');
}

to detect font (which detects OS), and

@media (featureX: value1)
{
.css_probe_42
{
background: url('/signal/(token)/featureX/value1');
}
}

to detect browser features (which detects browser)