FingerprintJS Blog

FingerprintJS | JavaScript Engineering Team Lead, DevOps Engineer | Full Time | Remote |https://fingerprintjs.com/ FingerprintJS empowers developers to stop online fraud at the source. We work on turning radical new ideas in the fraud detection space into reality. Our products are developer-focused and our clients range from solo developers to publicly traded companies. Some of our customers include Target, checkout.com, coinbase, and eBay just to name a few. 100% Remote, Global (GMT-8 to GMT+3), flexible schedule, direct contract, competitive salary We are looking for: DevOps Engineer: https://grnh.se/70ca0e824us JavaScript Engineering Team Lead: https://grnh.se/e675f8ed4us

I haven't check Firefox's fingerprint resistance but Bromite's is very effective against https://fingerprintjs.com/ at least.

FingerprintJS | Multiple Roles | 100% Remote | Full-time/Contract | https://fingerprintjs.com Backed by Craft Ventures, FingerprintJS empowers developers to stop online fraud at the source. We are a globally dispersed, 100% remote company with a strong open-source focus. Our flagship open source project is FingerprintJS (15.3K stars on GitHub). Perks: Work from anywhere, competitive pay, stock options, $600 annual learning budget, Macbook M1 Pro provided, 20 Days paid time off, Unlimited Sick Time. Senior JavaScript Developer (Fullstack) -- https://grnh.se/c36b3d7f4us Senior Golang Backend Engineer -- https://grnh.se/df9daec84us

Powered by Supabase and Fingerprint.js https://github.com/altilunium/sy https://fingerprintjs.com/ Please, post responsibly.

> Facebook and LinkedIn (to name two of the most elaborate fingerprinters) are years ahead of anything a few researchers could come up with. Not only them. It is available to the masses[1] and I am afraid GDPR has given this trend a boost. [1] https://fingerprintjs.com/

FingerprintJS | Fully remote (anywhere in the world) | Full-time | https://fingerprintjs.com/ We are a VC-funded open-source first startup working on browser fingerprinting for preventing online fraud. Flexible hours, transparent culture, challenging work. It's good people! Postings: • Full-stack TypeScript developer • Senior Golang Engineer https://fingerprintjs.breezy.hr/

>Windows lol most people pay money for windows (even against their will if they want to buy a laptop for example) and still get ads and telemetry cranked to the max. What's up with that? >Android Another bad example. In a less shitty world where the majority share of the global mobile OS duopoly isn't owned by a glorified surveillance company, the support of a device would be covered by, and only by the sale price of the device. Which wouldn't be such a huge cost if Android better had engineered HAL and better standards so every device could update from the same repo tree. >if you have to pay for everything then you'll leave even more of a trail on what you did. This is my problem with Kagi[0](frequently posted here). This is more of the fault of the current global payment infrastructure than any ordinary tech company's. But if you think that the current ad infested browsing experience makes you any more private I have bad news for you. Namely fingerprintJS[1]. You might be asking what are my solution's to these problems. And my answer is that I have no idea. The only thing I know is that I'm seriously jaded with the current {mono,duo}poly ridden state of tech. [0]: https://kagi.com/ (currently throwing internal server error lol) [1]: https://fingerprintjs.com/

Oh I don't actually disable WASM. Those are just different scripts that can apply to pages when a filter matches. I disable sendBeacon everywhere with `*##+js(disable-sendBeacon.js)` but the others I don't use or only use on a specific site. I believe I added the WASM removal just to test how a particular site's fallback would work when it wasn't present. That said, disabling WASM probably reduces your browser fingerprinting bits. I bet fingerprintjs[0] uses it. UBO already has a built-in set of powerful scripts[1], but I just wrote my own for fun. I think I could have done this by just using the built-in ones. edit: This filter does the same thing just using the built in `set` script, but won't log to console: *##+js(set, navigator.sendBeacon, trueFunc) [0] - https://fingerprintjs.com/demo/ [1] - https://github.com/gorhill/uBlock/wiki/Resources-Library

The actual blogpost is here https://fingerprintjs.com/blog/disabling-javascript-wont-stop-fingerpr… basically they use CSS trickery together with server-side stuff. It's pretty clever. @font-face { font-family: 'Helvetica'; src: local('Helvetica'), url('/signal/(token)/fontHelvetica') format('truetype'); } to detect font (which detects OS), and @media (featureX: value1) { .css_probe_42 { background: url('/signal/(token)/featureX/value1'); } } to detect browser features (which detects browser)

I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed. There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get "response"), which is definitely something which can be used for fingerprinting. Which reminds me of fingerprinting by tiny differences in the audio API provided by browsers [0]. Super interesting, but also a bit depressing. Also works for things like canvases and WebGL. EFF allows you to check how fingerprintable your browser is [1]. Do note that the results may not be very accurate. [0]: https://fingerprintjs.com/blog/audio-fingerprinting/ [1]: https://coveryourtracks.eff.org

> https://fingerprintjs.com/blog/audio-fingerprinting/ > It is particularly useful to identify malicious visitors attempting to circumvent tracking Ah yes, the visitor trying to not be tracked is the malicious one. Barf.

Not that this is a reputable source, but https://fingerprintjs.com/blog/browser-fingerprinting-techniques/ suggests that fingerprinting a media device requires the site to have camera permissions. Which is also what I would expect. But perhaps I’m just too hopeful

Comment thread [1] from post "Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor" [2] from about five weeks ago. [1] https://news.ycombinator.com/item?id=27145911 [2] https://fingerprintjs.com/blog/external-protocol-flooding/

5 minute exercise to try - Download Tor https://www.torproject.org/download/ Go to your site, and see if you think it works - https://fingerprintjs.com/demo (Also notice how Tor changes the screen size everytime you open it)

https://fingerprintjs.com/demo shows that Tor can still be fingerprinted and uniquely identified across IP addresses. Your Javascript (navigator) user-agent and timezone are some of the dead giveaways as they leak the true values.