Hacker News new | ask | show | jobs
by Cider9986 4 hours ago
Cookies are not the meta for tracking anymore. Fingerprinting [1] is highly effective across IPs and across incognito/browser profiles. Content blockers like Brave shields or uBlock Origin do not stop fingerprinting.

The only browsers I've found that defeat it on desktop are Mullvad and Tor Browser as well as all the antidetect browsers I've tried.

Disturbingly, fingerprint.com is not defeated by Tor browser on Android. We know fingerprinting is more effective on Mobile, and the recommendations say to use desktop for the most anonymity, so this isn't surprising.

You still aren't completely de-anonymized if you are tracked across browser sessions and websites because that doesn't link back to your real identity, but it's damn easier because all it takes is one mistake and all that activity is tied to your identity. It would also allow an adversary to target you specifically with an exploit, but obviously this is not in most peoples threat model.

Mullvad [2] and Tor browser are blocked from using or signing up for most websites because of IP reputation and the browser fingerprinting protections which make them look like VMs and bots. Unlike the antidetect browsers, they don't spend extensive resources on site compatibility and avoiding detection, which leaves most sites shaking you down for suspect fraud. Annoying, when the real fraudsters are passing through easily with anti detect browsers and residential IPs.

Antidetect browsers are used by marketers, web scrapers, social media account managers, ecom, among other low lifes. These use different browser profiles to avoid fingerprinting by isolating and randomizimg identifiers while constantly patching(use a few week old version and you'll see it gets detected as something to be blocked, not detected as in correlated cross profile, just blocked) to avoid detection.

I'd like to see a privacy focused antidetect browser, but perhaps open source makes it easier for the fingerprinters to find detections.

Brave shields blocks cookie popups by default, so I'd recommend Brave browser to everyone who's annoyed by them. I assume uBlock has a list that does this as well. I remember reading recently that the vast majority of websites don't even abide by the cookie popups, and content blocks like Brave Shields or uBlock Origin block the cookies anyway.

[1] https://fingerprint.com

[2] Essentially Tor Browser without the Tor network built in for better usability on the web. Because VPN IPs have better reputation than Tor exit nodes.

Can be used with any VPN, but most users will use Mullvad VPN giving a larger crowd. Mullvad has a browser extension which, when connected to Mullvad VPN on your computer, allows you to choose what ever server/IP you'd like and also offers a randomized per website and session option.

Mullvad and Tor are always incognito mode so tabs and logins are lost on close. Mullvad is working on a persistent mode, so I'm looking forward to that usability improvement.

2 comments

Neither GDPR rules against tracking nor “cookie banners” are limited to cookies, so it’s unfortunate that “cookie banner” became a popular term since it means these discussions always waste time on “you can be tracked without cookies”
> It would also allow an adversary to target you specifically with an exploit, but obviously this is not in most peoples threat model.

I saw that at the organizational level back in like 2015. Unless you were running the exact browser/os/extension combo that the organization they were targeting (multinational defense contractor in this case, i.e. a target worth the effort) was running on the corporate workstations the JS wouldn't run. And even if you forced it to the payload endpoint wouldn't like it.