2

A webpage of a bank, where I get redirected to make a payment for my ticket, uses fingerprint2.js. The webpage doesn't work at all when I'm using AdBlock extension in my browser and fingerprint2.js is blocked.

When I turn off AdBlock, fingerprint2.js gets loaded well and the webpage works properly.

I don't want to be tracked by fingerprint2.js. Since it's required for functionality, how can I mitigate that? Can I let it load and yet disable or mess up its functionality?

5
  • How are you sure that this is used for tracking? Given that this is a payment site it is not unlikely it is used for security, i.e. to make sure that ths is an actual browser, to bind cookies to the specific browser in order to prevent stealing the session etc. Nov 4, 2018 at 19:19
  • @SteffenUllrich github.com/Valve/fingerprintjs2
    – forest
    Nov 5, 2018 at 2:44
  • @forest: I've found this too. But, it is only a script to fingerprint the browser. The fingerprint can be used for binding sessions to a specific browser for security reasons or it can be used for privacy-invading tracking. While the OP assumes that it is used for tracking there is nothing in the question which even attempts to prove this. And given that the script is mandatory I doubt that it is used for tracking. Nov 5, 2018 at 3:50
  • @SteffenUllrich I think it's a safe assumption that the fingerprints submitted are logged, which indeed contributes to tracking, or at least makes it possible. But you are right that it could also be used entirely to check for signatures of automation, with the fingerprints all being discarded after use.
    – forest
    Nov 5, 2018 at 3:53
  • 1
    This is the fatal flaw of device fingerprinting for users. Its use is typically opaque to users, and they typically have no way to block it without compromising site features (especially if it's server-side), but it is used extensively for both fraud protection AND online surveillance. There's no way to know what it's being used for, it's a rare company that will make a firm statement, or even mention it at all, in its data use policy.
    – pseudon
    Nov 6, 2018 at 14:49

1 Answer 1

2

Assuming you are referring to this project which exposes a fingerprinting library under that name, the only effective way to avoid fingerprinting without blocking the script is to use a browser that has a common fingerprint. Unfortunately, browsers have so many fingerprints that the only reliable way to do this would be to use the Tor Browser, which enforces a uniform fingerprint among all users. This may be a problem on financial sites as they may block connections from anonymity services.

If you want to get your hands dirty, you could write a userscript that bypasses the fingerprinting script. You would need to find out how exactly the website is using that script. For example, if it just looks for a fingerprint in the form of a hash and will refuse to work if one is not uploaded, your userscript could instead upload a dummy hash. This requires you have at least a basic understanding of JavaScript.

1
  • 1
    Apple claims that Safari 12 on iOS and macOS significantly reduce fingerprinting ("Safari now thwarts this by only sharing a simplified system profile" apple.com/safari), though I have yet to see any implementation detail or entropy reduction data.
    – pseudon
    Nov 6, 2018 at 14:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .