Should you disable cosmetic filtering to avoid uBo fingerprinting?

Privacy Questions
1

Read this article first How ad blockers can be used for browser fingerprinting - Fingerprint

Basically, the most efficient way to detect AdBlocker usage is by detectinf wheter known blocked css elements get blocked.

From a privacy perspective, hidding ads with css doesn’t actually achieve anything.

I noticed that on this https://fingerprintjs.github.io/blog-adblocker-fingerprinting-demo/?demo=filters, my techinque works, it said no blocker.

Ofc, there is another technique but the only one most websites will use is the css one. If my intuitiom is correct then, shouldnt we recommend everyone to do that?

2

To avoid fingerprinting you wanna look as much like other people as possible. As such, I would keep the default for cosmetic filtering.

1 Like
3

This doesnt make any sense as disabling cosmetic filtering will make it look like you have no adblocker.

4

The site can see what browser you are using and what extensions are included. What stands out more and is easier to fingerprint? Looking like everyone else that uses uBo that “appears” to have ad blocking or being one of the few that use uBo that don’t “appear” to have an ad blocker?

Hiding the fact that you use an ad blocker doesnt stop fingerprinting (and even then I’m not convinced that disabling that setting hides that you are ad blocking). Looking unique in a group of people is how tracking via fingerprinting works. Everything you change that makes you look different than others with the same browser and extensions makes you easier identify via fingerprinting.

5

this is silly, there are other ways to detect an adblocker, just use it to your full advantage.

sites cannot inherently see what extensions you’re using, only infer to an extent based off of detecting changes they may make.

4 Likes
6

Not really

1 Like
7

on firefox that’s true. But they can directly detect mv2 extensions on chromium. not sure about mv3, though.

1 Like
8

What ways are there to do this ?

9

Websites use both network and CSS baits for adblock detection. There are no papers researching which methods are used as “the only one most websites will use”.

For network baits, they simply can fetch/XHR ads/trackers connections and see if you are blocking them or not, or even a simple <script> tag for ads scripts with onerror attribute.

10

If you’re this concerned about fingerprinting, I think it might be a good idea to use a browser like Mullvad or Tor that actually does a good job protecting against it.

2 Likes
11

The article from fingerprint.com said only CSS detection was practical both from a network load perspective and from a perspective of not doing shady things if someone looks at the console.

I assumed they had expertise in what they are doing. But nowadays sites can fetch dozens of pages, so maybe their assumption is wrong.

Don’t we have studies on what are the techniques for fingerprint ? I mean in detailed terms, not just saying cookies, canvas, etc.

12

In reality, a lot of sites use network baits to detect adblock because CSS baits are easier to defuse (for example, even you know what to do with it, but with network baits I doubt you would know how to defuse them asides from allowing the connections). Those network detections are actually what uBO team deals with daily.

Bait networks can be really small in size. https://static.doubleclick.net/instream/ad_status.js only contains 1 line window.google_ad_status = 1;. Also many network filters are just the paths of the URLs, for example /baynote.js in EasyPrivacy can be used as 1st-party connection baits (no need to load 3rd-party to raise concerns) and with those generic names, you won’t know which ones are more suspicious among other 1st-party connections until investigating the codes more deeply than just opening the console anyways.

Don’t we have studies on what are the techniques for fingerprint ? I mean in detailed terms, not just saying cookies, canvas, etc.

I mean yes. But most of them focus on the techniques that generate higher entropy for fingerprints, rather than this one, which actually has pretty low entropy since there are only few blockers that most people use (AdblockPlus, uBO, Adguard…), assuming you are using default setings. Similar to why Tor Browser doesn’t bother to mask the OS in the user-agent since there are just a few OSes most people use.

It’s just once you are not using default settings, you become more different to many others, regardless of network or CSS or user-agent.