Web Fingerprinting Is Worse Than I Thought

A couple of weeks ago the FingerprintJS site was showing more than a dozen of sessions for me, which were clearly not mine. Today, from another country, no past sessions were shown at all. Thus, I have serious doubts about the reliability of the service with browsers implementing fingerprinting protections.

Years from now, we'll have to ask ourselves: was the web improved or made worse by JavaScript?

And then people wonder why Safari doesn't just blindly implement whatever new web API Chrome has begun inflicting on the world… Not to say Safari is necessarily doing enough to prevent this yet (the demo shows they aren't), just to say that by carefully reviewing the proposed APIs, Safari has a fighting chance against such fingerprinting services. Chrome clearly doesn't, and neither would Safari if they got goaded into following Chrome.

Note that this includes rejecting the proposed API design if necessary: often APIs leak fingerprinting information not just by implementation, but by design, in that even a careful implementation of the API couldn't help but leak information by documented usage of the API.

@Pierre I feel like this is a straw man. I don’t see people wondering why Safari doesn’t blindly implement every API. They wonder why it takes so long for the ones that already have traction. For the main things that people care about, my impression is that Safari eventually implements them pretty much the same way, which shows that they weren’t delayed over privacy. And then we have results like this that show that the end result is that Safari is fingerprintable, too. And other browsers like Brave that are arguably better on privacy and yet more compatible. So I think the burden of proof is on those claiming that Safari delays are helping privacy. It’s the same thing with energy. People just assume that if there’s a feature Safari doesn’t implement it’s because of battery life—and then Safari does eventually implement it and there’s no evidence presented that the delay led to a much more efficient implementation.

[…] me so much that I was still thinking about it this morning waking up. I’m talking about a post on Michael Tsai’s blog, where he quotes Bitestring’s article: Fingerprinting is worse than I thought. Everything in this […]

I will readily concede that criticism of Safari runs the gamut from NPR's eminently reasonable, experience-backed feedback that Safari ought to correctly implement what it claims to implement at http://blog.apps.npr.org/2021/08/31/joy-generator.html , to completely insane demands.

But that does not mean "lack of platform integration API" criticism of Safari is fringe. For instance, every single instance of criticism of Safari that claims Apple is "crippling" its browser, especially on iOS, in order to prevent the web from competing with native apps implies Safari is lacking APIs to leverage platform features. Do I really need to point out specific examples of such criticism? And every time this criticism is made to specify what kind of API they would like access to, assuming they even bother to do that, it turns out the API (at least at the time) had not made much in the way of standardization, and often was objected by Firefox too, typically on privacy grounds.

Apple ought to better communicate on their intents. And I too am wary of Apple's warped incentives, especially with regard to its iOS and Mac app stores and the revenue they collect from them, which is why I am looking at web apps as a way to circumvent Gatekeeper. But if the criticism that Apple cripples Safari as a way to prevent competition to the native APIs had any grounds, Safari wouldn't implement "downloading" synthesized files… yet it turns out it does. And I am just as much wary of Google introducing web features with little to no regard for the impact on end user privacy in general and avenues for fingerprinting in particular. Apple ought to better explain how what they are doing (and not doing) protects privacy, but we ought to demand from Google how their new APIs are not ruining our expectations of privacy: even if I am not using Chrome, my correspondents may for instance, and Google (and others…) could learn a lot about me from them.