I think it's both. It wasn't a problem when browsers were simple content display engines, but now that they are full VMs for application software, they need some of that capability just to function. FWIW, I think this was a mistake, but the genie is out of the bottle.

I suppose one technical mitigation might be a permissions dialog when a script requests access to a high-risk API like canvas or WebGL. But that's unfortunately something that won't work for most users, who will just click through the dialog.

Making it a technical problem means it’s an arms race forever. Making it a regulation problem, if done right, can simply end the arms race.

Not to mention the big players on the users’ team in the technical arms race (google, ms, apple) are also advertising companies.

By all means let’s solve it from the technical side - but also lets regulate privacy so everyone gets it not just people paranoid/technical enough to use the latest/best privacy respecting tools.

This information can be relevant for a site that needs to know your capabilities. No need to render some canvas if your client is a text browser.

It isn't trivial to craft legislation to separate these use cases, but it also is far from impossible if there would be political will to do it.

I think the latter is far more interested in surveillance of users where tracking is one building block.

And of course legislation is needed to criminalize tracking without user consent. It would just be an internet stalking law being applied.

… which is why it is so frustrating (and damning) that Firefox does not make it simple to block all of these measurements.

To whatever degree this is, indeed, a technical problem. There’s a simple choke point that is being intentionally unutilized.

Why can't it be made illegal? And from the article, a very succinct explanation as to why browsers will never be fingerprint-resilient:

> Chromium (Chrome) is built by Google, an advertisement company which tracks its users for showing relevant ads. So naturally it doesn’t have any inbuilt protection against fingerprinting.

there are some more or less legit causes for fingerprinting. like bot protection or to identifying scammers that just create another account when previous is banned.

whether this is justified is of course subjective

People with ideas are a dying breed. The west doesn't have a fraction of the idealism of the 80s and 90s

The core issue is that politically you gain nearly no votes and definitely no money by running with regulation as a pillar of your campaign.

In fact, doing so will often times end up bringing donations from relevant industries directly to your opponent.

Now, this system of perverse incentive and legal bribery should be fixed at the constitutional level but thats a gigantic can of worms.

In the current system there are two methods that can circumvent the issue. The first is one deployed by the likes of Elizabeth Warren; run your campaign on a broad array of "fighting for your constituents" and don't get specific until you see already elected and drafting a bill.

The second path is underutilized and should be done more: lie out your ass to the moneyed interests. Take their money, make them promises, eat at their fancy dinners, befriend them, laugh at their awful jokes. Then just fucking dunk on them in the legislature, as quietly as possible. Make a big show of being forced to, keep the charade going as long as possible.

The inverse of this has been done a lot recently, with Sinema, with Fetterman. But the good version is quite rare, and a good opportunity to make our country a better place.

Key notes: tough to do in bigger positions because they're rarely the first public office seats people hold, so track records build. Tough to do in many districts because voters can be rubes who actively agree with the corporations stomping on their nards. Tough to do if you make too large of a profile(not really a concern).

Yes, it’s probably worse to have unenforced regulations than no regulations.

Since fingerprinting is mostly client side, it should be detectable. If you serve a web page with a fingerprinting script, that should be an automatic big fine.

TIL, thanks! The usual convention of calling them "cookie dialogues" sure obfuscates that.

So does that mean that fingerprint.com, which records your fingerprint without asking for your consent, is operating illegally?