But why would any browser accept access to those metadata so freely? I get that programming languages can find out about the environment they are operating in, but why would a browser agree to something like reading installed fonts or extensions without asking the user first? I understand why Chrome does this, but all of the mayor ones and even Firefox?
Because the data used in browser fingerprinting is also used to render pages. Example: a site needs to know the size of browser window to properly fit all design elements.
Just for an example that isn’t visible to the user: the server needs to know how it can communicate responses to the browser.
So it’s not just “what fonts do you have”, it also needs to know "what type of image can you render? What type of data compression do you speak? Can I hold this connection open for a few seconds to avoid having to spend a bunch of time establishing a new connection? We all agree that basic text can be represented using 7-bit ASCII, but can you parse something from this millennium?”.
Beyond that there’s all the parameters of the actual connection that lives beneath http. What tls ciphers do you support? What extensions?
The exposure of the basic information needed to make a request reveals information which may be sufficient to significantly track a user.
I know that it has that in theory, but my Firefox just reached a lower score on https://coveryourtracks.eff.org/ (which was posted in this threat, thanks!) than a Safari. Firefox has good tracking protection but has an absolute unique fingerprint, was 100% identifiable as the first on the site, as to Safari, which scored a bit less in tracking but had a not unique fingerprint.
But why would any browser accept access to those metadata so freely? I get that programming languages can find out about the environment they are operating in, but why would a browser agree to something like reading installed fonts or extensions without asking the user first? I understand why Chrome does this, but all of the mayor ones and even Firefox?
Because the data used in browser fingerprinting is also used to render pages. Example: a site needs to know the size of browser window to properly fit all design elements.
Just for an example that isn’t visible to the user: the server needs to know how it can communicate responses to the browser.
So it’s not just “what fonts do you have”, it also needs to know "what type of image can you render? What type of data compression do you speak? Can I hold this connection open for a few seconds to avoid having to spend a bunch of time establishing a new connection? We all agree that basic text can be represented using 7-bit ASCII, but can you parse something from this millennium?”.
Beyond that there’s all the parameters of the actual connection that lives beneath http. What tls ciphers do you support? What extensions?
The exposure of the basic information needed to make a request reveals information which may be sufficient to significantly track a user.
I fucking hate this. Let me zoom, stop reacting and centering omfg.
Firefox has built-in tracking protection.
I know that it has that in theory, but my Firefox just reached a lower score on https://coveryourtracks.eff.org/ (which was posted in this threat, thanks!) than a Safari. Firefox has good tracking protection but has an absolute unique fingerprint, was 100% identifiable as the first on the site, as to Safari, which scored a bit less in tracking but had a not unique fingerprint.
Probably because Safari is default macOS and most people leave it at default settings. I doubt Apple is doing anything special here.
Apple is doing good on the privacy browser front because it makes the data they collect more valuable