2019-12-09 - Browser fingerprinting
-------------------------------------------------------------------
So after my last post i've been reading a bit more on browser 
fingerprinting. And currently the conclusion is; Woah, the tracking 
possibilies are even worse than i imagined them to be. 

I've enjoyed playing around with the sites browserleaks.com and 
amiunique.org. 

Over here, i learn that with Javascript enabled, it is possible to 
read battery status information through the battery api. I mean... 
COME ON!! Why on earth???  

https://www.w3.org/TR/battery-status/

The reason appears to be that it is handy for mobile uses and "app" 
developers whose apps are simply wrappers around webpages. And yes, 
for that use-case it is probably handy.... But it also messes up 
peoples privacy majorly.  As written earlier, i don't want to 
provide this type of information when browsing on the www.

Besides battery life, with Font fingerprinting, specifics on my 
installed fonts and the way they are rendered locally can be 
measured in detail. Giving a very device specific fingerprint.

Using the Canvas fingerprinting allows for the creation of a unique 
hash based on how your specific device's graphic card and driver 
plots pixels. 

With JS a whole bunch of browser features can be polled. For 
example to see if my browser supports a certain css feature (for 
example box-shadow or flexbox). The browserleaks site shows a nice 
example how a unique hash can be built based on this information.
 
In addition, with JS, my browser leaks information about my 
installed plug-ins, and through WebRTC information on my media 
devices (camera, microphone). It spills information on supported 
webGL specifics (again giving more information on my video card)


So all in all, the conclusion is; You WILL leave unique 
fingerprints when browsing the worldwide web with a modern browser. 
(Even when disabling Javascript altogether, because you will become 
a fairly unique little snowflake if you do that) 

In addition to this: You WILL be tracked. And honestly that sucks.

I do not understand why browser builders are the frontrunners to 
add all these nonsense features (like the battery life api, or 
geolocation, usb-access, or file-system api's), while at the same 
time they stumble over eachother to brag how their browsers are the 
best for maintaining privacy....

For the www, i'd like to see a no-frills browser which renders 
modern html, where all this poll-back telemetry nonsense is 
removed completely. So where the browser simply sends a very 
minimal http request, and the server returns a reply...

Anyway, digging through all this nonsense, makes me appreciate 
Gopher more and more :)