Rendered at 06:45:38 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
M95D 2 days ago [-]
> Protections that ship have to keep the web working
I don't agree. I activated most of the protections. If a site breaks, then I don't get to see it. That's OK. No big loss. Users should fight their FOMO.
somenameforme 2 days ago [-]
Agreed. Recently a number of 'news' sites have become hostile enough with the advertising/tracking/etc efforts that I'm now met with a page displaying nothing but "Please enable JS and disable any ad blocker" when visiting them. Especially in modern times, nothing much of value has been lost by simply removing them from my occasional browse list.
penguin_booze 20 hours ago [-]
Until that site is your bank's, hospital's, or tax authority's. The complains department (if any) is many miles away from the developer desks.
idinnoaname 16 hours ago [-]
Then you have the choice to change that. Change your financial instituion (or bank in person). Go to a different hospital (or use their self serve kiosk if you must). Elect politicians who will change the tax authority (or find a tax specialist who will do it for you).
Contrary to what many have come to falsly accept as inevitability, we do still have the power to make choices. The more often we as a whole forfeit the option to choose, the more likely our freedom to choose will be limited.
frenchsalmon 2 days ago [-]
Same, if a website requires less protection and I really want to see that content, I just make the effort to lower my config, with high suspicion tho.
1vuio0pswjnm7 2 days ago [-]
Lots of www users are getting fingerprinted no doubt
But it's not difficult to avoid giving away unnecessary details used to create fingerprints, it's just that few people care to do it
I don't use a browser to make HTTP requests, so I have almost full control over fingerprints. There's no Javascript, cookies, CSS or images. No graphics. I use different combinations of headers, usually only Host and Connection because that's all that's needed. I use different UA values if a UA header is required, I use various TLS libraries, I can manipulate the client hello
Of course anyone can collect a fingerprint but not all fingerprints indicate a worthy ad target
"OHTTP" sounds like the dumbest idea I have heard in a while. It does nothing to reduce the amounts of detail that users send that can be used to create fingerprints
dns_snek 2 days ago [-]
You have the most unique and traceable fingerprint of all. There are probably no more than a dozen people who do something like that in the entire world. Avoiding tracking requires blending in, just look at Tor Browser.
1vuio0pswjnm7 2 days ago [-]
"Blending in" is not the goal. Every internet user can be tracked. It's the nature of the computer network
The goal is to stop sending so many unnecessary details to so-called "tech" companies, intermediaries (middlemen) that have occupied the internet and engage in surveillance to support advertising services
The excessive details sent by the so-called "modern" browser, that they control (go figure), make it easier to market, sell and deliver advertising services
I don't use a browser to make HTTP requests
Advertising requires a popular browser
Every internet user can be tracked. IP address alone is usually enough
But IP address alone is not enough for today's online advertising. It needs a graphical browser, images, CSS, Javascript and so on. The complexity of these programs is a nightmare. Intricate behavioural surveillance of ad targets becomes possible
Tor is not generally used as a means to avoid advertising-related tracking that is accomplished using "fingerprinting". It could work for that but it's overkill
Using a "Tor Browser" (modified Firefox^1) that can show ads doesn't make much sense if the goal is to avoid ads
1. Mozilla, the source of Firefox, is "all-in" on internet advertising
What is the point of fingerprinting. (A: There could be multiple purposes.) If the purpose is tracking for internet advertising, then _internet advertising_ is the problem, not fingerprinting
Without the ability to advertise through a complex, popular so-called "modern" browser, tracking via "fingerprinting" becomes less valuable, perhaps even pointless
As such, the goal is to send fewer details and provide less potential for advertising and behavioural surveillance
If in doing that, every www user sends the exact same, minimum amount of detail with every HTTP request and thereby appears to "blend in", then maybe that's a useful side effect
But "blending in" alone doesn't stop advertising and behavioural surveillance. Perhaps it makes it less targeted, but it does not stop it. There is a reason that Firefox needs to be modified for Tor: it's a liability. The so-called "modern" browser has immense surface area and plethora of "features", e.g., a Javascript interpreter, that can be used for surveillance, fingerprinting and tracking, whether for advertising or anything else
I don't use it. The goal is not simply to "blend in". The goal is to deny the surface area, the "features", the excessive details sent, that can be used for online advertising and the fingerprinting and tracking that is _motivated by_ and associated with this advertising
As they say, "Don't feed the beast"
socalgal2 2 days ago [-]
so if your bank doesn't work. Do you switch banks? If your apartment portal doesn't work do you move? If your government sites don't work do you move countries?
Parae 2 days ago [-]
I switched banks because their mobile app doesn't work with Murena /e/os on my Fairphone.
nofunsir 2 days ago [-]
US citizens are legally allowed in-person and traditional mail services for all the examples you listed. It boils down to coercion protection. You can't force me to contact google's servers if I don't want to, in order to access legally protected services.
account42 2 days ago [-]
I might consider moving if there was an "appartment portal" I had to use without it even breaking on my hardened browser.
M95D 2 days ago [-]
Yes, I did switch banks twice this year.
hahn-kev 2 days ago [-]
They'll probably say they just use cash
bikvfeee 2 days ago [-]
Cash is such an advanced technology that comes with tracing protection built in.
iamnothere 2 days ago [-]
Maybe use a little creativity? It’s ok to use more than one browser, you know. Or even more than one computer!
dt3ft 2 days ago [-]
> Your browser is not comparable to the dataset, so we have avoided showing you inaccurate results.
Yup. Because I use my own browser. Built from scratch with exception of V8, Stylo html5ever, and a few other bits and bobs. A fresh new rendering engine in Rust and all. Not a fork of any existing engine. Native support for uBlock Origin filter lists and custom filters. It scores above ~20 in speedometer as of today and covers WPT about 89%. Will be publishing it soon as permissive open source.
octoberfranklin 2 days ago [-]
And cloudflare, akamai, and hcaptcha lock you out of 80% of the Web.
dt3ft 2 days ago [-]
Nope. YouTube, for example, works like a charm. Settings allow users to select a user agent (chrome, edge, firefox, safari) or set a custom one.
antiremy 2 days ago [-]
YouTube isn’t really known for their bot protection afaik. You’re able to get through the Cloudflare interstitial and fully solve/submit hCaltchas? They run actual JS fingerprinting which is where I think something like this would show
lucas_t_a 2 days ago [-]
better said youtube does not block most bots on purpose, they do work after to cleanup botted engagement after the fact
herpdyderp 2 days ago [-]
I'm getting this too on main release Safari... because the test only handles Firefox.
aleksejs 2 days ago [-]
Given TFA, I have to assume you are bragging about being the most fingerprintable user on the Web.
dt3ft 2 days ago [-]
Correct, sticking out is not the best approach. The only protection users of any modern browser have (while still having usable APIs) is whitelisting which sites can request information like enumerating system fonts and serving every other site fake/random information, likely through addons. Say a fingerprinting mechanism wants to enumerate your system fonts, you look up your whitelist, and if it is not on it, browser serves it the most generic list (can be gathered from fingerprinting datasets like EFFs) or finetuning it until your score is as generic as possible. Essentially, blending in with the crowd. Having such whitelists would make browsing a bad visual experience, but hey, why not do what we can to make fingerprinting as difficult as it can be. I don't mind having this as a native feature which prompts the user as they browse, sample prompt: "this site would like to access the following information about your browser, will you allow it or serve it generic, the least fingerprintable set?".
fn-mote 2 days ago [-]
> I don't mind having this as a native feature which prompts the user as they browse, sample prompt: "this site would like to access the following information about your browser, will you allow it or serve it generic, the least fingerprintable set?".
Once this feature becomes common, sites will fingerprint using the delay to detect that the user was offered and clicked a permission in a dialog.
Really. This whole field is the devil’s work.
cryptonector 2 days ago [-]
Basically we need something like NoScript that also covers 20-questions API identification.
eszed 2 days ago [-]
Are there add-ons which do this?
3RTB297 2 days ago [-]
I get this on privacy-focused FF forks, then a lecture about the version.
For what it's worth, this test also can't get legitimate header info.
3RTB297 2 days ago [-]
I appreciate the effort put into this, but as fingerprinting tests go, this is missing key tests already part of other, more comprehensive fingerprinting methods. Even if we're talking FF/gecko engine only.
For starters, with access to JS, tests like CreepJS accurately collect real OS info via user agent that can't reliably be spoofed. This test only collects spoofed data in the header. Same with time zones, fonts, processor, and extensions running that change the page. No IP tracking, either. I can refresh the page and it thinks I'm on Mac OS in California, or Windows in Germany, neither of which are my location or OS.
This test didn't collect data from anyone with RFP on? A fingerprint with a hole in the middle is still a fingerprint. Why skip this (and lecture me about it) and still make the claim that only a small number of data points is all it takes to make a reliable fingerprint? Especially when it reliably gets so much wrong?
ranger_danger 1 days ago [-]
Agreed, I think this testing is deeply flawed... I've yet to see anything that either 1. studies CreepJS at all, or 2. can easily evade it in a FOSS browser
tomrittervg 1 days ago [-]
Signifyd, one of the modeled fingerprinters, took CreepJS and very lightly extended it (mentioned in the paper). So aside from changes CreepJS made since Signifyd incorporated it, it was included in the study.
gausswho 2 days ago [-]
Ran their fingerprinting test.
CSS Colours SelectedItem and SelectedItemText was the only problematic one, and uniquely identified me to less than 0.0054 of Linux users.
Why?
tomrittervg 2 days ago [-]
Lots of Linux display managers, lots of themes. Try changing your theme and see if it changes the value.
willis936 2 days ago [-]
Ah, yes, less than 0.0049% of users use checks notes 24-bit color.
_factor 2 days ago [-]
I wonder if this took into account GPU render-time fingerprinting? The minute timing differences in how you render an image are still used to identify you.
magicalhippo 2 days ago [-]
Recently did a WebGPU project and noticed Firefox polls GPU status on a 100ms timer, so you can't really use it for such as far as I can tell.
That said, Claude figured out that while Canvas copying of a loaded JPEG was out due to fingerprint resistance, it could copy it via WebGPU, so yeah...
LoganDark 2 days ago [-]
This reminds me of some fucking bullshit about how browsers silently store canvas pixel data as premultiplied and try to transparently convert everything you put in and everything you take out, but silently corrupt color values in the process.
Yea ended up with my own PNG decoder in JS due to such issues.
tomrittervg 2 days ago [-]
It does not - there are a lot of these sorts of techniques, but we specifically modeled what commercial fingerprinters do in the wild to provide a realistic number. I have not seen a commercial fingerprinter do those sorts of timing-based fingerprinting techniques. (Doesn't mean there isn't one, just that I've looked at more scripts that your average person and haven't seen it.)
_factor 2 days ago [-]
Oracle has a product that does just this commercially.
raphlinus 2 days ago [-]
If you can run compute shader code, the fingerprinting and side channel possibilities become very rich. [1] is one paper among many on this topic.
I did not really try that, but it seems to me that a user is easily identifiable by the sites he visits, click patterns, whatever. So, generally speaking, there is no way to escape fingerprinting unless you think about every click you make, which is not really feasible.
jbm 2 days ago [-]
I don't understand. I'm using a standard ios browser with no changes. When it checked my screen resolution, it claimed it was 0.0016% of the browser population.
This is a standard iphone running safari; how is that possible?
ZekeSulastin 2 days ago [-]
Their data was collected entirely from Firefox telemetry.
SiempreViernes 2 days ago [-]
did you try clicking on the highlighted property? that usually shows more details.
war-is-peace 2 days ago [-]
might be a bit futilistic of me, but mitigating browser fingerprinting always seems like a fight against entropy itself, there always seems to be a new meta
spend so long changing up settings only to find out there is some niche css rendering quirk that makes me unique to one in a trillion devices or something, and using any variant of linux really doesn't bode well for fitting into the crowd regardless
maybe time to start using a telegraph key and sounder connected directly to ethernet? or will the cadence of my tapping create a reconigzable pattern between sessions...
solarmist 2 days ago [-]
Oh, damn. I thought this was about the uniqueness of human fingerprints or similar.
And one of the things I love about it all the random science stuff I learn about mixed in with the tech news.
so-cal-schemer 2 days ago [-]
Always nice to see more research out of UCSD.
NooneAtAll5 2 days ago [-]
funny how enabling letterboxing causes me to be in "under 100 samples" category
btw, is pixelRatio controllable somehow? how do I set it to 1, most common value?
NooneAtAll5 2 days ago [-]
wtf is "Maximum touch points" ?
> The digitiser's touch-point count, uncollapsed.
my laptop does not have touch screen, why am I not at 0?
SiempreViernes 2 days ago [-]
Maybe it reports the resolution of the touchpad instead?
NooneAtAll5 2 days ago [-]
interesting how Windows and Mac are almost at 100% of DRM enabled, meanwhile linux is only at 33%
anyone knows why is that?
Karliss 2 days ago [-]
Users of open source operating system want to be in control of their computer, DRM vendors want the same -> to be control of user's computer, which is a problem. Nearly every DRM system involve heavily obfuscated closed source binary blobs, that's something neither the users nor distro maintainers want to touch if possible.
NooneAtAll5 2 days ago [-]
I wish I could select what OS to sort values for
see f.e. "Highlight" (Resolved value of the Highlight system colour keyword, as RRGGBB), which has bajillion different values for android - and I can't find the most common ones for linux
ape4 2 days ago [-]
I read they're not releasing the details - that seems good (for the public). Hopefully they're releasing it to privacy-friendly browser makers.
BrenBarn 2 days ago [-]
> Protections that ship have to keep the web working
I think we should reverse it. Websites that don't work with these protections shouldn't ship. Entities that make websites that try to do this kind of tracking should face legal consequences.
bikvfeee 2 days ago [-]
I use Mullvad browser. It's tor browser minus the tor connection.
m4ck_ 2 days ago [-]
Am I the only one that finds this stuff to be a little overblown? I get the feeling that advertisers and the like overstate their capabilities to sell their products. Like the audio fingerprint says less than 0.0049% of users have my value. But if I close my browser and re-run the test, I get a different value. How useful of a metric is that if it changes every time I visit?
I've had similar experiences on other fingerprint test tools - there's one that gives you a hash and will tell you if other users have the same fingerprint; but if I run the same test again from the same browser, I get a new hash and another "you're unique" message. If my browser can be uniquely identified for the purpose of tracking me, shouldn't these tests show the same fingerprint for each run?
usern20260720 2 days ago [-]
why can't my browser curl download an .html package, as a word processor would download a .doc file, instead of betraying my privacy by publishing even my underwear size?
stackghost 2 days ago [-]
Because the most popular browser is developed by a surveillance company.
vova_hn2 2 days ago [-]
I understand that the HN crowd is composed of many different people with radically different interests and opinions, so an "average HN opinion" would be mostly meaningless, but still...
I find it mildly amusing that HN both loudly complains about bots scraping their websites AND is very interested in user privacy.
The conflicting part is that user privacy automatically means that you cede any control over how exactly does the user accesses your resource. Whether they use a web browser or an automated scraper. Any attempt to analyze requests to tie different requests made by the same actor together automatically means privacy violation.
I don't have a good answer to this dilemma yet, I just thought that this is a curious observation and wanted to share.
bena 2 days ago [-]
On the face, yes, that is true. And it's what confused me about your post at first. Because I didn't see the connect between scraping and user privacy.
And yes, on the face, being able to determine whether a bot or a person is looking at your site is essentially trying to confirm some private information about the consumer.
But I think the dichotomy can be settled through the habits of consumption. Bots are impartial, greedy, and fast. They can consume resources faster than a human can. This could be a problem when trying to provide those same resources to humans.
Not to mention, the bots doing the scraping are doing so to put your content in their regurgitation machine. Which has been ruled as "not a copyright violation" due to "reasons". Whereas, a person who attempts to use your content without permission is liable for violating your copyright.
Now, if the position is "human users" have privacy, then we would need that critical piece of information before we decide whether to grant privacy to an entity. Also, the user is free to not use the resource if the rule is that we're allowed to determine whether they are human and the user doesn't want to share that information. As long as we don't pursue that information beyond what we've stated we're going to use it for, we can be said to be respecting the users' privacy. Also, if we don't disclose that information to other users or companies, we could still be said to be respecting the users' privacy, because information shared in confidence with us remains that way.
octoberfranklin 2 days ago [-]
Um, no.
Scrapers and bots put a ton of effort into anti-fingerprinting. Ordinary users? Zero.
Users care mainly about cross-site fingerprinting. Bot-fighting is concerned with single-site fingerprinting.
The good answer to your dilemma is x402: https://x402.org/ Nothing in life is free; you've been paying with your attention via ads, which is where the urge to fingerprint comes from (targeting). Agentic AI is rapidly killing web ads as a revenue source. It's time to stop kicking the can on micropayments.
Also, this article commits the common mistake of assuming that privacy means hiding in the largest possible cohort. That's bogus. You can also get privacy by belonging to many one-member cohorts -- i.e. fingerprint uniquely but differently to each site you visit and differently to a single site over longer timespans (like weeks). This is precisely what Brave's "farbling" does; farbled users have very unique fingerprints and yet they can't be tracked.
stackghost 2 days ago [-]
> The good answer to your dilemma is x402: https://x402.org/ Nothing in life is free; you've been paying with your attention via ads, which is where the urge to fingerprint comes from (targeting). Agentic AI is rapidly killing web ads as a revenue source. It's time to stop kicking the can on micropayments.
Never gonna happen. Why would I pay to access content before I can even determine if the content is worth paying for? And if you let me see the content before I pay, what’s my incentive for paying at all?
Micropayments as a concept is predicated upon the idea that people are producing content worth paying for.
The inconvenient truth is that the vast majority of the pre-LLM web was not worth paying a single cent for, and the problem is even worse today.
octoberfranklin 2 days ago [-]
> Never gonna happen.
Already happened. All the agentic API dealers support x402.
I already pay some thousanth-of-a-cent for every webpage (pre-LLM era included) that my agents pull, simply for the privilege of going through a proxy with a squeaky-clean IP reputation (the fact that they charge by the byte keeps it clean -- scrapers can't afford that cost due to scale). That payment goes to the proxy owner not the website, but the point remains: I'm happy to pay that cost to eliminate hassles and headaches.
All that remains is to plumb part of that payment through to the website in exchange for a hard no-botwall (which implies no tracking) guarantee. It'll happen, and the websites that refuse will become irrelevant.
The future is bright.
stackghost 1 days ago [-]
> All the agentic API dealers support x402.
Do OpenAI and Anthropic support it natively?
> All that remains is to plumb part of that payment through to the website in exchange for …
We have drawn two circles. All that remains is to draw the rest of the owl.
>I'm happy to pay that cost to eliminate hassles and headaches.
You being happy to pay a proxy service does not even remotely imply that x402 will solve any real problems.
I don't agree. I activated most of the protections. If a site breaks, then I don't get to see it. That's OK. No big loss. Users should fight their FOMO.
Contrary to what many have come to falsly accept as inevitability, we do still have the power to make choices. The more often we as a whole forfeit the option to choose, the more likely our freedom to choose will be limited.
But it's not difficult to avoid giving away unnecessary details used to create fingerprints, it's just that few people care to do it
I don't use a browser to make HTTP requests, so I have almost full control over fingerprints. There's no Javascript, cookies, CSS or images. No graphics. I use different combinations of headers, usually only Host and Connection because that's all that's needed. I use different UA values if a UA header is required, I use various TLS libraries, I can manipulate the client hello
Of course anyone can collect a fingerprint but not all fingerprints indicate a worthy ad target
"OHTTP" sounds like the dumbest idea I have heard in a while. It does nothing to reduce the amounts of detail that users send that can be used to create fingerprints
The goal is to stop sending so many unnecessary details to so-called "tech" companies, intermediaries (middlemen) that have occupied the internet and engage in surveillance to support advertising services
The excessive details sent by the so-called "modern" browser, that they control (go figure), make it easier to market, sell and deliver advertising services
I don't use a browser to make HTTP requests
Advertising requires a popular browser
Every internet user can be tracked. IP address alone is usually enough
But IP address alone is not enough for today's online advertising. It needs a graphical browser, images, CSS, Javascript and so on. The complexity of these programs is a nightmare. Intricate behavioural surveillance of ad targets becomes possible
Tor is not generally used as a means to avoid advertising-related tracking that is accomplished using "fingerprinting". It could work for that but it's overkill
Using a "Tor Browser" (modified Firefox^1) that can show ads doesn't make much sense if the goal is to avoid ads
1. Mozilla, the source of Firefox, is "all-in" on internet advertising
What is the point of fingerprinting. (A: There could be multiple purposes.) If the purpose is tracking for internet advertising, then _internet advertising_ is the problem, not fingerprinting
Without the ability to advertise through a complex, popular so-called "modern" browser, tracking via "fingerprinting" becomes less valuable, perhaps even pointless
As such, the goal is to send fewer details and provide less potential for advertising and behavioural surveillance
If in doing that, every www user sends the exact same, minimum amount of detail with every HTTP request and thereby appears to "blend in", then maybe that's a useful side effect
But "blending in" alone doesn't stop advertising and behavioural surveillance. Perhaps it makes it less targeted, but it does not stop it. There is a reason that Firefox needs to be modified for Tor: it's a liability. The so-called "modern" browser has immense surface area and plethora of "features", e.g., a Javascript interpreter, that can be used for surveillance, fingerprinting and tracking, whether for advertising or anything else
I don't use it. The goal is not simply to "blend in". The goal is to deny the surface area, the "features", the excessive details sent, that can be used for online advertising and the fingerprinting and tracking that is _motivated by_ and associated with this advertising
As they say, "Don't feed the beast"
Yup. Because I use my own browser. Built from scratch with exception of V8, Stylo html5ever, and a few other bits and bobs. A fresh new rendering engine in Rust and all. Not a fork of any existing engine. Native support for uBlock Origin filter lists and custom filters. It scores above ~20 in speedometer as of today and covers WPT about 89%. Will be publishing it soon as permissive open source.
Once this feature becomes common, sites will fingerprint using the delay to detect that the user was offered and clicked a permission in a dialog.
Really. This whole field is the devil’s work.
For what it's worth, this test also can't get legitimate header info.
For starters, with access to JS, tests like CreepJS accurately collect real OS info via user agent that can't reliably be spoofed. This test only collects spoofed data in the header. Same with time zones, fonts, processor, and extensions running that change the page. No IP tracking, either. I can refresh the page and it thinks I'm on Mac OS in California, or Windows in Germany, neither of which are my location or OS.
This test didn't collect data from anyone with RFP on? A fingerprint with a hole in the middle is still a fingerprint. Why skip this (and lecture me about it) and still make the claim that only a small number of data points is all it takes to make a reliable fingerprint? Especially when it reliably gets so much wrong?
CSS Colours SelectedItem and SelectedItemText was the only problematic one, and uniquely identified me to less than 0.0054 of Linux users.
Why?
That said, Claude figured out that while Canvas copying of a loaded JPEG was out due to fingerprint resistance, it could copy it via WebGPU, so yeah...
https://github.com/nagadomi/nunif/issues/32#issuecomment-153...
[1]: https://dl.acm.org/doi/10.1145/3634737.3656283
This is a standard iphone running safari; how is that possible?
spend so long changing up settings only to find out there is some niche css rendering quirk that makes me unique to one in a trillion devices or something, and using any variant of linux really doesn't bode well for fitting into the crowd regardless
maybe time to start using a telegraph key and sounder connected directly to ethernet? or will the cadence of my tapping create a reconigzable pattern between sessions...
btw, is pixelRatio controllable somehow? how do I set it to 1, most common value?
> The digitiser's touch-point count, uncollapsed.
my laptop does not have touch screen, why am I not at 0?
anyone knows why is that?
see f.e. "Highlight" (Resolved value of the Highlight system colour keyword, as RRGGBB), which has bajillion different values for android - and I can't find the most common ones for linux
I think we should reverse it. Websites that don't work with these protections shouldn't ship. Entities that make websites that try to do this kind of tracking should face legal consequences.
I've had similar experiences on other fingerprint test tools - there's one that gives you a hash and will tell you if other users have the same fingerprint; but if I run the same test again from the same browser, I get a new hash and another "you're unique" message. If my browser can be uniquely identified for the purpose of tracking me, shouldn't these tests show the same fingerprint for each run?
I find it mildly amusing that HN both loudly complains about bots scraping their websites AND is very interested in user privacy.
The conflicting part is that user privacy automatically means that you cede any control over how exactly does the user accesses your resource. Whether they use a web browser or an automated scraper. Any attempt to analyze requests to tie different requests made by the same actor together automatically means privacy violation.
I don't have a good answer to this dilemma yet, I just thought that this is a curious observation and wanted to share.
And yes, on the face, being able to determine whether a bot or a person is looking at your site is essentially trying to confirm some private information about the consumer.
But I think the dichotomy can be settled through the habits of consumption. Bots are impartial, greedy, and fast. They can consume resources faster than a human can. This could be a problem when trying to provide those same resources to humans.
Not to mention, the bots doing the scraping are doing so to put your content in their regurgitation machine. Which has been ruled as "not a copyright violation" due to "reasons". Whereas, a person who attempts to use your content without permission is liable for violating your copyright.
Now, if the position is "human users" have privacy, then we would need that critical piece of information before we decide whether to grant privacy to an entity. Also, the user is free to not use the resource if the rule is that we're allowed to determine whether they are human and the user doesn't want to share that information. As long as we don't pursue that information beyond what we've stated we're going to use it for, we can be said to be respecting the users' privacy. Also, if we don't disclose that information to other users or companies, we could still be said to be respecting the users' privacy, because information shared in confidence with us remains that way.
Scrapers and bots put a ton of effort into anti-fingerprinting. Ordinary users? Zero.
Users care mainly about cross-site fingerprinting. Bot-fighting is concerned with single-site fingerprinting.
The good answer to your dilemma is x402: https://x402.org/ Nothing in life is free; you've been paying with your attention via ads, which is where the urge to fingerprint comes from (targeting). Agentic AI is rapidly killing web ads as a revenue source. It's time to stop kicking the can on micropayments.
Also, this article commits the common mistake of assuming that privacy means hiding in the largest possible cohort. That's bogus. You can also get privacy by belonging to many one-member cohorts -- i.e. fingerprint uniquely but differently to each site you visit and differently to a single site over longer timespans (like weeks). This is precisely what Brave's "farbling" does; farbled users have very unique fingerprints and yet they can't be tracked.
Never gonna happen. Why would I pay to access content before I can even determine if the content is worth paying for? And if you let me see the content before I pay, what’s my incentive for paying at all?
Micropayments as a concept is predicated upon the idea that people are producing content worth paying for.
The inconvenient truth is that the vast majority of the pre-LLM web was not worth paying a single cent for, and the problem is even worse today.
Already happened. All the agentic API dealers support x402.
I already pay some thousanth-of-a-cent for every webpage (pre-LLM era included) that my agents pull, simply for the privilege of going through a proxy with a squeaky-clean IP reputation (the fact that they charge by the byte keeps it clean -- scrapers can't afford that cost due to scale). That payment goes to the proxy owner not the website, but the point remains: I'm happy to pay that cost to eliminate hassles and headaches.
All that remains is to plumb part of that payment through to the website in exchange for a hard no-botwall (which implies no tracking) guarantee. It'll happen, and the websites that refuse will become irrelevant.
The future is bright.
Do OpenAI and Anthropic support it natively?
> All that remains is to plumb part of that payment through to the website in exchange for …
We have drawn two circles. All that remains is to draw the rest of the owl.
>I'm happy to pay that cost to eliminate hassles and headaches.
You being happy to pay a proxy service does not even remotely imply that x402 will solve any real problems.