logoalt Hacker News

mrguyoramayesterday at 4:52 PM2 repliesview on HN

It tells you that you have a unique fingerprint.

It is not telling you that the test site has never seen you before, because the eff isn't storing your fingerprint for later analysis and tracking

It could actually tell you about which real tracking vendors are showing you as "Seen and tracked" so it's pretty annoying they don't do that.

If that site shows you as having a unique fingerprint, I guarantee you are being tracked across the web. I've seen the actual systems in usage, not the sales pitch. I've seen how effective these tools are, and I haven't even gotten a look at what Google or Facebook have internally. Even no name vendors that don't own the internet can easily track you across any site that integrates with them.

The fingerprint is just a set of signals that tracking providers are using to follow you across the internet. It's per machine for the most part, but if you have ever purchased something on the internet, some of the providers involved will have information like your name.

Here is what Google asks ecommerce platforms to send them as part of a Fraud Prevention integration using Recaptcha:

https://docs.cloud.google.com/recaptcha/docs/reference/rest/...


Replies

streetfighter64yesterday at 10:45 PM

> the EFF isn't storing your fingerprint for later analysis and tracking

Yes they are, quoting that very page:

> Your browser fingerprint appears to be unique among the 312,935 tested in the past 45 days

So clearly they store the information for at least 45 days. This raises the question what they actually mean by unique. If I change my IP and re-test, I get the same

> Your browser fingerprint appears to be unique among the 312,941 tested in the past 45 days

So does that mean that my fingerprint changed, and they can't track me anymore? Or do they mean to tell me that they still track me and I'm still as uniquely identified.

Their methodology and linked articles does not seem to answer this [0] [1]

It's all very complicated, because the fingerprinting needs to be unique enough to identify you while still being "persistent" enough not to identify you as somebody else if you change just one bit of it.

[0] https://www.eff.org/deeplinks/2010/01/primer-information-the...

[1] https://coveryourtracks.eff.org/about

iso1631yesterday at 6:31 PM

It must store the fingerprints to determine if I'm unique, otherwise everyone would be unique.

If it doesn't store the fingerprints then how does it tell the difference between

5 identical looking browsers connecting from 5 different IPs

1 browser connecting 5 times from 5 different IPs