Technology

The paper also mentions that it also takes downloading a 1GB OFPS file and JS in use.

This isn't so much "researchers can track you" so much as "it's theocratically possible with stock laptops and browsers, within limitations."

Sounds like a bunch of timing attacks could be rendered useless if access to an accurate timer required special permission. And without the permission, it either limited the resolution or added random jitter to any timer APIs.

I've done it with some apps/games by placing the folder in question on a separate drive/partition and using junction points (I use Junction Link Magic, but you can do it manually from command prompt) to basically create a ghost of the folder in the original location that routes everything to the new location.

You could create a small hidden partition just for the browser cache folder to reside on using this method.

software dev here.

I worked with a guy who was implementing application monitoring for clientside applications. think of it like google analytics for single page apps. he proposed we could require users install a browser plugin to make it easier to track and monitor the users on our app with the added benefit we could track them on other websites like our competition.

one person in a room of about 11 people spoke up about the implications of privacy and the backlash we might have from our user base when they find out that we basically just installed a keylogger in their browser.

the only thing that stopped this plan from going forward was the risk of losing users and potential revenue loss.

my point in all this is to answer your question. no, most people have stopped thinking about their actions and are just creating "solutions" to problems that don't exist.

I studied data mining (now machine learning) and statistics.

I’ve spent my career explicitly NOT plying my knowledge this way. I don’t know how people do it.

I’d say my deep knowledge on how to track people has made me pretty averse to a lot of online things.

You know you can build marketing attribution systems and advertising metrics without violating user privacy.

But advertisers really like the idea of invading privacy and they pay out the nose for it.

It is really hard to sort through job listings using ethics as your criteria.

Bet

And this is why you shouldn't use any browser based on Chromium, because where Google goes (implementing ever more invasive APIs) they all follow.

They better hope there isn't another pandemic. Cuz I am officially labeling that quantity of free time as "1 Degoogle". and if I ever get my hands on another fuckin degoogle I am going to degoogle all over my fucking house

Becau of the push for web apps to get around platform (and platform store) limitations.

e.g. Apple banned apps for vapes (not just talking about nic vapes but e.g. there's a number of cannabis flower vapourisers that use Bluetooth for fine tuned settings, those were forced to move over to web apps as the native apps simply got pulled), but also software like ESPHome is completely web based and needs access to raw USB devices to write the new firmware onto them, the list goes on.

Main issue seems to be that a lot of these APIs don't require explicit user approval. USB, Bluetooth does, but apparently accessing detailed system statistics doesn't? Make that make sense...

I'm not even sure I'd allow them to know my resolution...

Modern browsers are basically an OS of their own at this point. And, in fairness, for many users their actual OS is effectively just a means by which they access a browser. This is not even mentioning something like Chrome OS.

I’m not saying it’s a good idea or that it should be this way, but it is where we are.

If you don’t allow ReCaptcha access to your address book, the website will fail to load.

I wonder if librewolf has this option on by default

But only in private mode?

You don’t download the file. The JavaScript generates the file right on disk.

You also have to provide access to your computer so the attacker can produce labeled training data for the neural network that performs the pattern matching for the actual fingerprinting.

Because that's what they did in the paper: they got the data and performed the attack on the same machine. There's no evidence presented in the paper that this identification could be generalised to arbitrary machines and configurations without prior access.

So yes, this is a complete nothingburger.