Hacker News new | past | comments | ask | show | jobs | submit login

A 1% browser (and Firefox is solidly above that) means approximately 6-7 bits of entropy. If Firefox's fingerprinting protection removes at least these many bits, then it's worth using Firefox.



This would only work in isolation, but there are other fingerprintable bits such as the IP address (which you can't hide).

IP address alone is already a very good identifier unless you share it with other people. If you do share it, then user-agent and browser fingerprint becomes the next thing. If other users on the same IP use Safari and you're the only one using Firefox then you are trivial to identify.


> but there are other fingerprintable bits such as the IP address (which you can't hide).

We're (collectively within privacy spaces) working on this. It's one of the reasons why I think the "VPNs are useless" debates are so disingenuous. Tor also has this problem (if you're the only person on your network connecting to Tor, that's a decent signal about things), and nobody argues that Tor is useless.

But I'll refer back to a point I've made a couple of times in the past: if you are in a boat with 5 holes on the bottom, and you want to patch those holes before the boat sinks, there is going to be a point in time where you have 2-3 holes patched and some holes are still leaking.

Figuring out a mass-market way to deal with IP addresses (hopefully using a better method than VPNs) is a real challenge. I'm encouraged by what Apple is doing with its private relay, I'm encouraged by some (not all, but some) of the work going on with P2P connections. But it's a tough problem. We don't want these systems to be opt-in or expensive, and we want to protect people from shady actors that can abuse them (see again, VPNs).

That being said, if the response is that we shouldn't care about fingerprinting because IP addresses are an unsolved problem (even though with significant work, they're not an unsolved problem, VPNs/Wireguard/etc do legitimately help here), it just seems really fatalistic and worthless to me as a perspective. Sites do fingerprinting today, they see value in it. If fingerprinting was worthless and all you needed was an agent and an IP address, sites wouldn't fingerprint; and yet they do. To me that's evidence enough that anti-fingerprinting matters, sites don't just look at the Firefox header and then call it a day and I don't think they would waste their time if the header alone gave them all the information they wanted.

More to the point, I regularly see people argue that we shouldn't be doing anything about IP addresses because fingerprinting exists, it's an extremely common argument about why relays/VPNs/Tor/DoH/ESNI don't matter. So there's a little bit of circular reasoning here; Firefox is pretty much doing the best job at anti-fingerprinting right now, but people don't care because of IP addresses. And then when you talk about IP addresses, people don't care because of fingerprinting. The reality is that you are currently on a boat with multiple holes, it is filling with water, and you need to start patching some of them.


Definitely, 6-7 bits might be enough to identify you. But Chrome allows for plenty of fingerprinting methods of its own. You can't just install add ons that disable the features or feed bogus data. Then you are the one guy who uses fingerprinting. Your only chance is to use software that is at least commonly used, and not enable options that are most of the time disabled.


That is also a good point -- if you are trying to get rid of fingerprinting vectors in Chrome, I vaguely suspect that is going to stick out more than using Firefox.

I don't have hard data to prove that, so I won't make a bold claim about it. But it seems illogical to me to say that you're using Chrome to blend in if you're also customizing Chrome (or using DeGoogled Chromium, Chromium itself, or a ton of extensions) in a way that makes it obvious you're a power user that cares about privacy.

In contrast, in Firefox having Ublock Origin installed is probably a bit more common than in Chrome, and turning on the anti-fingerprinting features standardizes a large percentage of your setup with anyone else who flips that bit in their Firefox settings. You can worry somewhat less that you're doing something that is completely unique with your anti-fingerprinting setup. But again, I would hesitate to make strong claims about that without more data.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: