---
# System prepended metadata

title: Anti-Fingerprinting Breakout 13-09-2023

---

# Anti-Fingerprinting Breakout 13-09-2023

Shubie Panicker (Hooli Anti-fingerprinting team)

[slides](https://docs.google.com/presentation/d/1ab0N_LPHUmangtPw-I1_JTnt2Lc1lCasRseQbik6h6g/edit?resourcekey=0-y1es1Rp6eLmegHy3nezAjw#slide=id.p)

- Scope
    - Out: 
        - use-cases disrupted by anti-fingerprinting
        - UX and mediation needs
- Context
    - moz def and chrome def of x-site tracking
    - browser by browser; DDG list, disconnect, etc
    - tracker lists as "pragmatic" first step, but incremental and even application industrywide will take time
        - duckduckgo dominant
    - def(success): 3
        - users "have protections" (going well)
        - industry change, i.e. devrel
            - incentive problem; "pave the well lit path"
            - "lacking clear stance and policy for the web"
        - regulators empowered
            - role of policy not discussed much
- building blocks
    - xsite threat
    - data purpose
        - "is there a 'greater gain' from the data, such as anti-fraud service, security" (?)
    - data practice
        - GDPR stuff
- "user perspective"
    - user harm = ?
        - how hard is it for user to "take corrective action"? currently, very
    - user value
- Interupt: John - per-site user recall is a problem for us, too? 
    - E.g. if you visit a site in private mode and come back in normal node
- ranking priorities
    1. ad targeting/fraud/msrmnt
    2. analytics and audience msrmnt
    3. social - comment/share
    4. tag manager
    5. ...
- emerging de facto tolerance thresholds: purpose legitimacy (ads always bad, payment always good); "browser already doing this today"
    - some guy: is there a standard for declared data purpose?
        - "no standard yet; i'm building a case for one, but i see tracker lists already doing this ad hoc"
- ben savage: safari already has a tool to strip tracking params from URLs; google's trackers are not stripped by that tool-- why? did they disclose something to safari? 
- declarations in the wild
    - [my co] is not tracking for [purpose]
    - [my co] is exclusively doing [x and y]
- "we are already in the policy game"
- Q&A
    - Gerard (south afr guy): Web Payment POV: 3Secure takes a long time to rollout, and was built on then-current fingerprinting standards, and will take 4 years to upgrade not to be based on fping
        - in the meantime, we're stuck getting adoption "in an iFrame that's there FOR fingerprinting"
    - brian may (dstillery) - wellknown list, appealable/fine-tune-configurable by user, etc
    - ??: policies versus procedures? is tracking list the policy or the procedure you're proposing?
    - John: Lots of tactics going into browsers AREN'T list-based; would fping breaking speed up the processes of adoption for 3Secure?
    - French guy: Bad actors dodge identity mechanism; allowlist better than blocklist? Blocklist seems a bad first stop
        - contrarian: Don't new sites with zero reputation have a hurdle/delay? not quick or cheap to move through burner U
    - Ben (Moz guy) - cross-site isn't consensual and browsers have rebranded and tweaked the 1st party/3rd party boundary a lot lately... policy infrastructure
        - policy-based approach reduces to a list of the entire internet
- Dev Declaration slide - machine-readable, browser-friendly; regulators can come after you
    - dev tooling when
    - scope of privacy label? some of this is urgent
        - short-form and long-form manifest
            - apple SDK manifest and nutrition labels
- Q&A
    - Sam - "detection pipeline" - this looks like adblocking arms race, except with a less-reliable oracle; what's progress on detection look like?
    - Sameer: offer of collab, love to work on a use-case-focused work stream; Gerard - web payments & anti-fraud collab session tomorrow!
    - brian may - blocklist applied per-API or total?
    - matt finkel - tracking and lists are off-topic; i wanna know how browsers block fping
    - nick doty - out of band enforcement ? i'm willing to work on that, since i think that's gonna get more important when circumvention grows
        - gerard - app stores force declarations per app; browser could get user intervention based on declarations (i.e. this site says its tracking you for payment purposes); I'm fine with that friction if it builds a longterm path to compliance