Most traffic on the web is from "bots" not browsers.
These "fingerprint" analyses all seem to fail to account for that fact.
"Bots" generally do not run Javascript.
The more information the client sends, the easier it is to create a more complex "fingerprint" and the more difficult it is for users to "copy" this fingerprint.
GET / HTTP/1.1
Host: firstartytrackersimulator.org
Connection: close
No Javascript.
Of course, anyone can make a fingerprint from those three headers. However it is quite generic and very easy for any user to "copy".
Many website operators incorrectly assume this must be a "bot".
I can use a "modern" web browser that tries to send all sorts of information, but because I use a localhost-bound forward proxy that deletes, adds and/or modifies headers, these three headers are all the remote website will ever see.
The question is, what advertiser is seriously going to spend time and effort to try to show ads to a person who only sends three generic headers and does not run Javascript. There is little value in tracking such users if they do not convert.
I find the more you try to protect your identity, preserve your privacy, protect your security the less sites want you to visit. You get stuck behind CloudFlare interactive prompts (as half the planet seems to be using CloudFlare in some way) whilst it tries to work out if you’re a bot. The other sites either assume you’re an attacker and say bye, or try and stick you in some kind of CAPTCHA tar-pit. In short the web becomes unusable the better you get at this.
Indeed. This is one of the greatest (and most under-appreciated) irritations of the whole CDN revolution: if you're a site serving 1e6 (or 1e9!) people, and trying to tell humans/computers apart via statistical means, the tail of the "human/computer" distribution really matters. Most site operators also don't seem to realise that the same human appears at the outskirts of the human/computer classification each time, and therefore comes to mightily hate Cloudfare (etc).
My partner uses -- for work -- a vanilla Google Chrome on Windows browsing life. I use, for work, FF on Linux, usually behind a VPN or two in a different country to where we are.
I see maybe....100, maybe, 1000 times more captchas than she does? Embedded reCaptcha JS code on a page inevitably shows me fifteen pages of traffic lights and lets hers go through. Often sites geo-IP me (incorrectly) to the wrong location. It's a very far cry from the HTML 1.0 days. And nobody outside of HN even understands why this is a thing, and an annoying thing at that!
Well, I do not send the minimum as a privacy measure. I do it for speed and efficiency. Because I am so often using netcat, tcpclient or the like to make requests, I have learnt that most headers browsers send are totally unnecessary. I have had the opposite experience to what you describe. The web is really fast. Cloudflare especially. They offer ESNI, which I do use for privacy. No point in encrypting DNS if we ignore SNI. I make all requests to Cloudflare using an ESNI-enabled openssl as a backend for the forward proxy. Very rare to encounter the CAPTCHA. I am more annoyed by AWS who require SNI but offer no ESNI service.
Honestly, to me the web feels unusable if I try to use a "modern" graphical browser with Javascript and a DNS resolver enabled. The way most people use the web, I guess. To me it feels like a tar-pit. I do some basic stuff like banking, etc. that way, but for recreational use, I do not use the major browsers.
The problem I descibe is that barriers get in the way the more you try and protect your privacy or security. It's not a speed issue - the web works very fast with me using NoScript and uBlock Origin. It's just lots of sites now longer like you visting or treat you as an attacker - you're soft blocked. If you ramp it up, even more of the web becomes a pain to use: e.g. using privoxy/polipo/squid, pi-holes, vpns etc, removing or changing headers, screen sizes and geolocation, timezone etc etc to make you less fingerprintable. Of course all you're really doing now is making yourself stand out like a sore-thumb.
The web is even faster when I'm using telnet/openssl s_client -connect, but that's not the point is it or even a fair comparison? I just want to browse the web without being tracked and categorised/labelled. It seems that's too much to ask.
Regarding CDN/Caching:
Google made a change[1] to how caching works which also has some CDN impact.
Instead of saving a resource with its full URL only, they have added two more bits of data to the saved information. Chrome saves the top-level site and the current-frame site next to the full URL of the cached resource. The browser uses the information to determine whether it should serve resources from the cache or not.
That's true; but it misses the point. If some bot visits some website, that doesn't expose me to being tracked. It might expose the bot to being tracked. It's when I visit a site, using my real browser, that tracking becomes an issue.
"Bots", i.e., clients that are not graphical browsers running Javascript, never have to see ads. "Bots" do not get tracked; they generally do not run Javascript or store cookies. Users do, generally. This is because users generally agree to run company-sponsored browsers that, whether intentional or not, use default features and settings that cater to web advertising and tracking. Thus, if the objective is to avoid ads and tracking, so-called "bots" must be doing something right. That is the point being made here.
These "fingerprint" analyses all seem to fail to account for that fact.
"Bots" generally do not run Javascript.
The more information the client sends, the easier it is to create a more complex "fingerprint" and the more difficult it is for users to "copy" this fingerprint.
No Javascript.Of course, anyone can make a fingerprint from those three headers. However it is quite generic and very easy for any user to "copy".
Many website operators incorrectly assume this must be a "bot".
I can use a "modern" web browser that tries to send all sorts of information, but because I use a localhost-bound forward proxy that deletes, adds and/or modifies headers, these three headers are all the remote website will ever see.
The question is, what advertiser is seriously going to spend time and effort to try to show ads to a person who only sends three generic headers and does not run Javascript. There is little value in tracking such users if they do not convert.