Hacker News new | ask | show | jobs
by vehemenz 1956 days ago
Unfortunately, I think these studies are a bit naive because the proprietary, data-driven, probabilistic fingerprinting models used by Facebook and LinkedIn (to name two of the most elaborate fingerprinters) are years ahead of anything a few researchers could come up with.

1. Get a gazillion users on your site

2. Require a user account tied to a real person

3. Log IP, host, geolocation, and as many JavaScript/browser APIs as you can (there are hundreds at this point)

4. Among the fields you track, find the ones that ones that are the most stable and unique over time

5. Assign some probabilities to these fields to eliminate false positives

6. Generate personas for users for when they are at home, work, one their phone, etc.
4 comments
Supermancho 1956 days ago
> Log IP, host, geolocation, and as many JavaScript/browser APIs as you can (there are hundreds at this point)

That's fingerprinting, traditionally. Hence, the "Cookieless tracking" header right there on the page. If you are tying in other data, that's data aggregation for your business case and is fundamentally unrelated.

I mean, generating personas and whatever "false positives" mean, has nothing to do with fingerprinting. If you cant differentiate from an anon user to another, that's data too.

link
lazyjeff 1956 days ago
There's more subtle signals too. Luis Leiva is a researcher who has some work on mouse cursor trails as a fingerprinting technique, and ways to counteract it: https://www.researchgate.net/publication/348739714_My_Mouse_...
link
tjoff 1956 days ago
7. Try to figure out what to do with the data generated by step 3 through 6.

8. Give up and stop at 2 instead.

link
vehemenz 1952 days ago
Hah, yes. Although, once you have user account tied to a real person, it becomes much easier to analyze the data you generate with the fingerprinter.
link
weinzierl 1956 days ago
> Facebook and LinkedIn (to name two of the most elaborate fingerprinters) are years ahead of anything a few researchers could come up with.

Not only them. It is available to the masses[1] and I am afraid GDPR has given this trend a boost.

[1] https://fingerprintjs.com/

link