Em Adespoton

  • 0 Posts
  • 19 Comments
Joined 2 years ago
cake
Cake day: June 4th, 2023

help-circle

  • Remember that fingerprinting can be your friend… because it’s much easier to fake an online fingerprint than a real one.

    You can generate a unique fingerprint with each online interaction; this means that you will always have a unique identity.

    Or, you can ensure you always have the same fingerprint as a large number of other people.

    Think of it as the difference between using a different valid loyalty card each time you shop vs using one of the famous numbers that millions of other people are also using.

    Of course, in both circumstances, you do give up the benefits of being uniquely identifiable.








  • This is why using a local web proxy is a good idea; it can standardize those responses (or randomize them) no matter what you’re actually using.

    Personally, I keep JavaScript disabled by default specifically because of this, and turn on those features per-site. So if a website has a script that requires the accelerometer for what it does, that script gets to use it. Other sites keep asking for it? I suppress the requests on that site and if it fails to operate (throws one of those ad blocker or “you have JS disabled errors), I just stop going to the site.

    I’ve found that with everything disabled by default, browsing the web is generally a pleasant experience… until it isn’t.

    This of course requires using a JS management extension. What I’d really like to see is a browser that defaults to everything disabled, and if a site requests something, have the browser ask for permission to turn on the feature for that particular script, showing the URL for the script and describing what the code does that needs the permission. This seems like an obvious use for locally run AI models.


  • OAuth doesn’t require this. However, there are third party OAuth providers (cough MS) who already have the back end set up, so customers like Stripe just piggyback on the existing servers.

    So in this case, your server and Stripe’s server are the users, and the third party is the OAuth provider that authenticates them to each other.

    Seems to me Passkeys/Fido2 would make way more sense for this setup, but then Stripe would have to manage the technology stack themselves, and follow all the PCI DSS rules for storing/managing the information (because they do credit card processing).