Painting fingerprinting as vulnerability exploit is your own very biased and very out-of-norm framing.

SiempreViernes 5 hours ago | parent | next [-]

Instead of trying convince-by-assertion, maybe you could try offering an actual objection to the argument raised up-thread?

On what basis do you claim that software developers, who did not establish a means of for third parties to get a stable identifier, nevertheless intended that fingerprinting techniques should work?

▲

fc417fc802 an hour ago | parent | next [-]

> Instead of trying convince-by-assertion

TBF the idea that any and all fingerprinting falls under the umbrella of exploiting a vulnerability was also presented as an assertion. At least personally I think it's a rather absurd notion.

Certainly you can exploit what I would consider a vulnerability to obtain information useful for fingerprinting. But you can also assemble readily available information and I don't think that doing so is an exploit though in most cases it probably qualifies as an unfortunate oversight on the part of the software developer.

▲

strbean 4 hours ago | parent | prev [-]

There's a pretty big difference between:

1) wanting functionality that isn't provided and working around that

and

2) restoring such functionality in the face of countermeasures

The absence of functionality isn't a clear signal of intent, while countermeasures against said functionality is.

And then there is the distinction between the intent of the software publisher and the intent of the user. There is a big ethical difference between "Mozilla doesn't want advertisers tracking their users" and "those users don't want to be tracked". If these guys want to draw the line at "if there is a signal from the user that they want privacy, we won't track them", I think that's reasonable.

	▲	maltelau 3 hours ago \| parent \| next [-]
		The presence of the "Do Not Track" header was a pretty clear indicator of the intent of the user. Fingerprinting persisted exactly in the face of such countermeasures.
	▲	fc417fc802 an hour ago \| parent \| prev [-]
		Even if the intent is clear I don't think the act of reading an available field qualifies as exploiting a vulnerability. IMO you need to actually work around a technical measure intended to stop you for it to qualify as an exploit.

▲

foltik 5 hours ago | parent | prev [-]

How would you frame it?