Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

Unless the page has some feature that obviously uses accelerometer features, it’s 100% that, no cynicism necessary. This is a not-uncommon fingerprinting technique.


sort by: page size:

Image capture isn't the only fingerprinting technique: there are much simpler signals like patterns related to content navigation (just one example: tap vs swipe for advancing paginated content), and the combination of such signals can create a strong fingerprint

Yeah, it's just fingerprinting.

It's actually great to have a physical confirmation that such a fingerprint is being generated. This so called cookie-less tracking is not legal in some parts of the world because it bypasses consent which needs to be legally obtained.

Thanks for that perspective. As a web user, I'm aware of fingerprinting techniques but I've been wondering how prevalent the practice actually is.

There are a whole BUNCH of other ways available. In practice, no single thing is even close to 100% accurate, but once you have enough distinct indicators you can fingerprint to a pretty high level of accuracy (for many advertisers 80% accuracy is enough, and it's probably not worth spending lots of effort to go above 90%). Clock skew, for example, is slightly different on each device, but on a given device doesn't change that quickly. Mouse/finger movement patterns, TLS negotiation timings, etc, etc. There are even technologies able to track users across different devices, but it's been too long since I worked in this area to be able to speak confidently about the methods used to implement that.

Fingerprinting is scarily accurate now, strangely. https://fingerprint.com/

Sure but with fingerprinting that's only a minor nuisance to most advertisers and sites who are tracking you.

Isn't this just another way to fingerprint the user?

That's intentional.

Uncommon settings being exposed to websites makes fingerprinting much more reliable.


Website fingerprinting is still possible.

Yes. Upon reflection it's not that relevant to this discussion, but my point is that with just simple media queries, nefarious developers can use 1x1 tracking pixels (as background images, for example) to accomplish fingerprinting.

The actual paper is here and is an interesting read: http://synrg.csl.illinois.edu/papers/AccelPrint_NDSS14.pdf

Though really, regardless of how well the hardware sensor itself can be fingerprinted, one shouldn't share sensor data with channels you don't trust, as there's plenty of other opportunities to identify someone from the data and metadata involved when you share.


Agreed. This is for fingerprinting the user.

Yes. That is what I am guessing. If the app is opened close to the user's click, it might be fairly reliable. I think hasOffers and few of the other tracking companies do this. But I am sure branch has figured out a better way to fingerprint.

Looks like this publication is about hardware fingerprinting specifically

Which you could argue is kind of obvious too I guess cause you can fingerprint anything from someone’s writing style to someone’s installed fonts


The one thing stopping me from toggling this is the faint concern that it's a vector for fingerprinting. I'm sure it's rare enough that nobody's checking for it though.

Fingerprinting is hardly just advertising.

You're assuming advertisers will just give up fingerprinting technology? This tech sounds acceptable in a vacuum, but in the end it's just one more neat data point.

There's subtle ways to fingerprint someone, even how they move their mouse:

https://motherboard.vice.com/en_us/article/78k8pz/how-you-mo...

next

Legal | privacy