<story><title>The Web Never Forgets: Persistent Tracking Mechanisms In The Wild</title><url>https://securehomes.esat.kuleuven.be/~gacar/persistent/index.html</url></story><parent_chain></parent_chain><comment><author>lifeisstillgood</author><text>Tl;dr wow, just wow.&lt;p&gt;So we have three fingerprint mechanisms:
One I had not even heard of or frankly suspected, but it explains a lot about why many designers who strive for pixel perfection are constantly frustrated. The original paper is fascinating (cseweb.ucsd.edu&amp;#x2F;~hovav&amp;#x2F;dist&amp;#x2F;canvas.pdf) but one simple takeaway - testing 300 different user systems (Mechanical Turk - quite clever) a simple sentence in Arial rendered 50 different ways!  So by combining different renderings (like sentences, drawing a line on a canvas element) they find that user systems - hardware, drivers etc, give off different results unique enough to tag you.&lt;p&gt;I would be interested in their results on iPhones (in fact any one interested in a quick experiment here in HN?)&lt;p&gt;And cookies - the synching cookies where fucking trackers collaborate and share &amp;#x2F; copy each other&amp;#x27;s ids, and ever cookies where they store a cookie in JavaScript&amp;#x2F;cookie and anywhere else and keep respawning.&lt;p&gt;Little fuckers&lt;p&gt;I propose two solutions:&lt;p&gt;Cookies should be limited to no more than 128bits - enough to store one randomly generated UUID.  Screw the backward compatibility.&lt;p&gt;And we should be able to only allow signed hashed JavaScript to run on our machines.  For example I want to only allow say bootstrap and some overlay and a config or data file.  No one gets to run unsigned js on my machine?&lt;p&gt;Have I just reinvented Microsoft code signing?&lt;p&gt;But boy I am in a bad mood</text></comment>
<story><title>The Web Never Forgets: Persistent Tracking Mechanisms In The Wild</title><url>https://securehomes.esat.kuleuven.be/~gacar/persistent/index.html</url></story><parent_chain></parent_chain><comment><author>bsilvereagle</author><text>HTTPSwitchBoard [1] seems to a decent job of blocking most (not all) of these methods. I currently have it configured to only allow scripts from the domain I&amp;#x27;m visiting and quite a few of the methods mentioned rely on scripts&amp;#x2F;cookies hosted by third party websites. Granted, switchboard is far from foolproof but it&amp;#x27;s a step in the right direction.&lt;p&gt;[1] &lt;a href=&quot;https://github.com/gorhill/httpswitchboard&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;gorhill&amp;#x2F;httpswitchboard&lt;/a&gt;</text></comment>