- cross-posted to:
- [email protected]
- [email protected]
- cross-posted to:
- [email protected]
- [email protected]
When you post on reddit, instagram etc. you’re giving the company your valuable data. (And it often is valuable, you put your thoughts into it and all that). Consider if you take 15 minutes to create value content, you’d get paid $5 or sth if you were doing it commercially. Now all that value is donated to big tech companies. (that’s the only reason why they have value at all.)
So what’s the problem with that? The problem is that reddit and others can instantaneously put your years-long effort behind a paywall. I’m not joking. Look at these:
when i want to see content on reddit (for research) or instagram (for local community) they don’t allow me to see the data that users have contributed. Reddit claims that it blocks VPNs for “security reasons”, meanwhile i’m using VPNs in browser’s incognito mode to not be tracked. Instagram wants you to sign in sothat they amass more users and can take leverage of the network effect even more.
I can understand restricting who can post to limit bot activity, but reading must always be possible. After all, it’s our data. That’s exactly what happens when you give your data to big companies to “communicate with other people”: your data becomes a source of income for them, at our expense.
Those aren’t paywalls.
That’s not what a VPN or incognito modes do.
Reddit sucks for a number of reasons, but your internet literacy also kinda sucks.
They are. You pay with you being tracked, profiled, your data etc for advertisement and other uses. That’s what these “free” services use to monetise the user.
Yea but thats not what a paywall actually is.
well it feels like one
Toy companies don’t expect kids to spend their own money on the products they learn of though targeted advertising.
Ok, but a cash register isnt a paywall. A paywall is a specific thing with an actual definition.
And you believe that definition isn’t exchange of funds for goods and/or services?
Why?
The concept of “paying for something” isn’t limited to “paying with fiat money/currency”. One can “pay for something” by “paying with their attention/time”, one can “pay for something” by “paying with PII” (personally-identifiable information), both situations of which are present in both Reddit’s and Meta’s “Sign up to read this”.
Sure, Reddit and Instagram/Facebook are “free” insofar the user isn’t required to do any kind of bank/credit card/cash/cryptocurrency payment, but the user ends up paying with all the time they spend in these platforms while seeing (thus, giving part of their attention span) advertisement, and also hand personal data.
When it comes to PII, even if the user set up a pseudonym and a generic PFP, the user is still handing, even if unbeknownst to the user themselves, their preferences, opinions, etc. Even lurkers end up handing PII whenever they stop at certain posts to read/see it (thus, signaling one’s preferences) or use specific search queries (again, signaling one’s preference).
The incognito mode may not prevent tracking (especially because of the IP address), but rotating VPNs may do. Notice I used the word “may”, not “will do”, because of the behavioral tracking I mentioned earlier, as well as other technical aspects (DNS leaking, browser fingerprinting, etc).
People who can afford being an actor/actress and performing very convincing alt-personas behind a VPN IP address could theoretically fool platforms enough for the person not to be tracked by their gait… except this dramaturgical skill is a behavioral tell (gait) itself. And the usage of a VPN-assigned IP address is another tell.
[email protected]
VPNs prevent the site from attaching an IP address to the site visit, and incognito mode means that browser cookies routinely get scrapped.
While this is a popular selling point that VPN providers like to advertise, it’s pretty misleading in terms of what this actually means with regards to tracking. Realistically, this does almost nothing to prevent sites from tracking you. They don’t see you at your home IP as “John Smith” and see you on your VPN as “Hans Schneider”, instead they see you at your home IP as “John Smith” and on your VPN as “still John Smith, but either traveling in Germany or using a European VPN”.
Advertisers have tens of thousands of individual data points on nearly every single person who uses the internet at all for any purpose. All a VPN does is obfuscate ONE data point. That’s less than 1% effectiveness at hiding your identity from advertisers. A VPN does basically nothing against all the other fingerprinting methods advertisers have.
Think of using a VPN like speaking into a walkie-talkie: your voice comes out at a different location, but if the person on the other end already knows what your voice sounds like, then they still know who you are, just not necessarily where you are. Unless you’re taking other efforts to mask your voice, the walkie-talkie isn’t protecting your identity in any way. Likewise with a VPN, if you go to the same sites from the same devices and log into the same accounts and otherwise engage in the same online behavior, the VPN is only hiding where you are, but it’s still trivially easy for an advertiser to determine who you are.
This is a bit of a pet peeve of mine, because VPN providers harp on this idea so hard in their advertisements that it tricks people into thinking VPNs are capable of things that they just simply are not.
A few browser extensions can help with that further. UBlockOrigin, NoScripts, CanvasBlocker, Privacy Badger, Consent-O-Matic, etc. Maybe Decentraleyes but I don’t fully understand that one yet.
Then there’s DNS proxying and/or DoH, and a variety of other settings that can be tweaked for maximum privacy.
Any one of these things alone will leave holes, but putting them all together can significantly reduce your trackability and fingerprint. Of course it’s a trade-off because some of these will break websites, but most allow granular exceptions so you can still use the sites you need.
In any case, a VPN is an important part of that, but the main purpose is to make it harder for your ISP to track you. Obscuring your IP from web hosts is just a bonus.
https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/
Firefox Multi-Account Containers lets you keep parts of your online life separated into color-coded tabs. Cookies are separated by container, allowing you to use the web with multiple accounts and integrate Mozilla VPN for an extra layer of privacy.
yeah i get your point but that’s not what i meant. i’m using VPNs to do google searches, for example, in incognito browsing tab. so google knows the 10k searches i did, but it cannot connect them to each other, as session cookies between them are deleted each time i close the browser (which is about every few minutes). and i don’t log in to any account in the incognito tab either, so it can’t use account identities as fixed points either. and it cannot associate the queries by IP address either.
edit:
after seeing this website … https://amiunique.org/fingerprint i get what you mean now. i have to think about this.
I think you are overestimating the capacity and will of advertisers to actually identify people like that. The data may be available for it in theory, but it’s unlikely they built the systems to make it happen because they don’t really have much economical interest to do so. They care about market segments, not individuals.
I had to work a bit on this kind of things. Most of those systems are really shitty and ineffective.
The little advertisers aren’t the scary ones. It’s Meta, Alphabet and Amazon that are scary and absolutely do fingerprint in this way. That said, the scale of these systems really does roll right past the individual user, unless someone really cares about YOU, but unless you’re doing something wrong, they don’t really give a shit. CSAM, illicit substances, amd more could probably be pretty easily rooted out by these systems, but that wouldn’t make-line-go-up so it doesn’t happen.
So how would one acquire the obfuscation they are seeking for? Making advertisers don’t know who you are for everything you visit. Is it possible?
Uss the Librewolf browser. You need to turn off reduceFingerprinting and turn on WebGL to make some sites work, but even then if you go to CreepJS you will see that compared to Chrome, there is much less information like battery level, actual core/RAM count, etc for sites to use. And the browser has uBlock Origin to block ads and trackers, although turn off the Quick Fixes list as it might break YT bot protection and shadowban comments.
Not the OP you asked, but realisticly, your single best option is not giving any data. Use settings to prevent cross-site tracking in your browser where available, but really just post as little information as possible. The less you reveal, the less they will know.
Try this while on a VPN and in incognito mode: https://amiunique.org/fingerprint
I bet you’ll be surprised at the methods companies use to fingerprint you - browser agent, Do Not Track enabled/disabled, timezone, screen size… not accepting cookies is also a data point to filter you by.
wtf. why does my browser send such an uniquely identifying token. wtf
(there’s more to the right of it, i cut it to preserve privacy)
WTF
TIL. the way trackers can do stuff
Opens your eyes quite a bit, heh? It’s like you start seeing the matrix. Then you think of your friends and family, the “normies”, and realize they have zero chance. We have all become a cog in this advertising machine.
NoScripts and CanvasBlocker can help reduce your fingerprints.
Basically, most websites these days run javascript to harvest this info from your device. Sometimes they even integrate it into their basic functionality so that it breaks the site if you block it.
thats good. but it doesnt cover behavioral fingerprints(indications).
fyi i have seen some moderately effective tools that help to fight against this. but generally rare. people understimate how much their data is worth and the amount of development, that companies are willing to invest to break every privacy tool
Are those things like mouse jigglers? It seems those would only work if enough people use them to create a blanket of obscurity.
Isn’t there any hardware that just… doesn’t log this stuff in a way that’s retrievable by backend server scripts?
Analogy
Imagine a restaurant where diners place orders through a discreet slot on the kitchen door.
Now, the diner adds a bizarre request: “Please serve the food, but I never want you to know you ever cooked it.” In practice, the chef can’t fulfill this—once he’s touched the ingredients and used the stove, his hands are inevitably stained, and the kitchen’s heat tells the story. Likewise, when a web user asks a server to fetch data, the server must process the request, so it inevitably knows it handled that request, even if it can’t tie it back to the individual’s identity.
Ad‑blockers, cookies, IP addresses, user‑agents, and browser signatures are like the various “fingerprints” a diner might leave on the restaurant’s doorstep:
Just as no chef can truly be blind to the fact that he cooked a dish, a web service inevitably knows it processed a request, and the “fingerprints” left behind (cookies, IP, user‑agent, etc.) let it—or any intermediary—recognize or track the diner unless the diner takes strong steps (like using a cloak or wiping the floor) to hide those traces.
https://f-droid.org/packages/com.fauxx.full
I think that’s an overly reductive analogy. Of course the backend web server knows what it processed on its own hardware, but it doesn’t need to know the IP that the request originated from (if using a VPN) and it certainly doesn’t need to fingerprint the browser with hidden scripts.
Likewise, the browser probably doesn’t even need to make that information available to those scripts. There are extensions to block some of it, but apparently not all. And blocking some things can break some websites.
But there’s no reason the chef in the back should be running a forensic analysis on the fingerprints on the ticket, the footprints on the dining room floor, or the crumbs swept up at the end of the day. And if you suspect that they will do this, then it should take be overly complicated to wear gloves, and maybe some boot covers, and possibly a full hazmat suit if you’re really worried about dropping crumbs and dander.
Not that all that should be necessary, because it shouldn’t be standard practice for web servers to collect all this data to begin with…
Deleted my previous comment - you’re right, it’s not able to identify the screen resolution etc without JavaScript.
Unfortunately I’m still fingerprinted though - no JavaScript is itself an identifiable marker.
Damn, that sucks. We really do live in a dystopian hellscape…
deleted by creator
Damn, that sucks. We really do live in a dystopian hellscape…
It absolutely is. I’ve verified this by toggling the VPN off and wallah access is restored.
That’s because Reddit bans VPN IP addresses. You still have an IP address when using a VPN, and VPN IPs aren’t exactly secret information. Reddit blocks all the VPNs they know of with an ever-updating blacklist.
Yes, that’s what was said…
Please tell me this is a joke/reference.
Not a reference, just a little BoneAppleTea for breakfast 😉