I agree that supercookies and header enrichment should be prevented whenever and however possible (e.g. header enrichment will be solved by requiring encryption à la Let's Encrypt), but fingerprinting is a lost battle that we should all give up on.
We will never be able to solve fingerprinting without upheaving the entire web platform as we know it. So many web APIs are simply not possible without exposing some UA capability and configuration variance. For example, it is impossible to support WebGL without exposing additional UA variance for fingerprinting.
Computers will always have varying capabilities and configurations, and developers will always need to consider some of them. A world without fingerprinting is a world without the modern web.
It only takes ~30 bits of entropy to uniquely fingerprint all ~3 billion internet users. We already expose this much variance entropy, and it is only going to increase as the web gets new features.
I implore you all to simply give up on fighting fingerprinting. Try to stop worrying about it, as there's almost nothing we can do short of the nuclear option of removing every API that exposes UA variance (which will make the web less useful).
We have already lost, and every new feature makes the hole a little deeper. The hole is already too steep to escape, so accept that you will be tracked by colluding websites whenever you browse the web.
---
The W3C page comes to roughly the same conclusion, but recommends a very drastic and dangerous solution: legislation. I fear that legislating this issue will legitimize only select pre-approved uses of UA variance entropy, and will hinder developer innovation in the long run. I'd rather be fingerprinted than be held back by legislation as to what browser data I'm allowed to read, and in what manner I can act on that data.
Please do not lobby for legislation in order to fix this problem. W3C's proposed solution will most likely only cause more harm than good. I would be deeply upset if "intent to fingerprint" became an actual crime.
One example of something useful that such legislation may make illegal is my navigator.hardwareConcurrency polyfill[1] that runs a timing attack on your CPU (not unlike "The Spy in the Sandbox" linked to in the W3C page) to figure out how many cores you have. This information is actually useful for optimizing heavy multi-threaded webapps, but it is also directly useful for fingerprinting. Future legislation could make it so that using my polyfill, even for benign purposes, counts as "intent to fingerprint".
People do not deserve jail time or fines based on if a tech illiterate jury judges you to harbor "intent to fingerprint". The future will be a very scary place for developers if you actually have to worry about this.
An alternative to DNT header might be a "Do Track" header: the browser generates a unique user ID instead of saving server-generated cookies. Users could control which sites receive their ID, manage multiple IDs, or they could reset their ID (like clearing cookies). Sites that still insist on active fingerprinting could be penalized by (opinionated) browsers with scary icons in address bar (like mixed content warnings).
I think there is still value in minimizing passive fingerprinting because it allows servers that don't serve active content (e.g. third-party image servers) to track users.
I think it is entirely reasonable to treat fingerprinting as ipso facto user hostile; that it is critical to the continued success of certain business models is reason enough to force abandonment of those models.
If we decide that preventing fingerprinting is a good, then yeah, certain technologies will be out of bounds. So? This is exactly the way a society works.
> header enrichment will be solved by requiring encryption à la Let's Encrypt
I doubt this is the case. How many bits can be manipulated in client TLS headers by a MITM without causing breakage? I find it hard to believe TLS leaves no room for malleability early on in the handshake.
This defeatist attitude is dangerous, especially when the solution is simple: just stop browsers from leaking >= ~30 bits of entropy.
Deprecate HTTP headers that leak entropy (like the user agent). Rewrite fields like If-Modified-Since so they can only express a value quantized into values no smaller than days. Remove JS APIs that leak information (like the ability to read CSS attributes). Impose stricter same-origin policies to eliminate 3rd-party cookies and javascript. Some people will complain that this breaks some use cases. Just as Dan Geer put it when discussing software liability, "Yes, please! That was exactly the idea."
Unless a platform puts user safety first - without exception - then it inevitably creates moral hazard. If for some reason this does not entirely fix the problem, then we apply the force of law - just like we do in every other area of society. If this concerns you, you should encourage self policing and removal of the business models based on any kind of fingerprinting, so no legal remedy is necessary.
People may indeed deserve jail time (or other legal remedy) for stalking. Technical literacy does not except you from social responsibility. As for your concerns about a jury: the problems with our legal system are far broader than your concerns over "technical literacy. A lot of work is needed in that area, with great urgency. That aside, a jury is also not expected to be an expert in advanced kinematics when they hear a case involving cars that crashed into each other at an intersection. It is the responsibility of the lawyers involved to explain such technical details to the jury. My grandfather - a physicist who reconstructed accidents and a frequent expert witness - has given quite a few remedial lessons in physics from the witness box.
I understand the concern about having to worry about this kind of legal threat. It is scary, but you will learn to live with it, just like surgeons learn to live with the possibility of malpractice charges or civil engineers that could be liable if the building they design falls down. Really, the concerns of a developer shouldn't be that bad compared to the doctor or civil engineer who have to worry about people dying if they make some kinds of mistakes.
What I find a far scarier future would be the future where people are not only afraid to speak their mind out of fear of being recorded, but where they are afraid to even seek out knowledge because of the trail it leaves. Our judicial system certainly has problems, but I'll take it over de facto feudalism, where the only people that can freely speak their mind are the lords that control the aggregate databases of everything their peasants do.
By the way - while it certainly isn't perfect, the EFF's Panopticlick tool reports my browser as only leaking 14.03 bits of entropy. The user agent accounts for ~9 of those bits, and ~4 more bits from the HTTP accept headers. Both of those are trivially removable, and the remaining entropy would not be easily to fingerprint. I'm sure this analysis misses some entropy sources, but this should be sufficient to show that it is possible to fix this problem.
Panopticlick doesn't use everything available. WebGL alone adds an additional 5.11 bits of entropy[1]. Other things such as your local network address from WebRTC, core count, etc. all can add a lot more entropy for fingerprinting.
We will never be able to solve fingerprinting without upheaving the entire web platform as we know it. So many web APIs are simply not possible without exposing some UA capability and configuration variance. For example, it is impossible to support WebGL without exposing additional UA variance for fingerprinting.
Computers will always have varying capabilities and configurations, and developers will always need to consider some of them. A world without fingerprinting is a world without the modern web.
It only takes ~30 bits of entropy to uniquely fingerprint all ~3 billion internet users. We already expose this much variance entropy, and it is only going to increase as the web gets new features.
I implore you all to simply give up on fighting fingerprinting. Try to stop worrying about it, as there's almost nothing we can do short of the nuclear option of removing every API that exposes UA variance (which will make the web less useful).
We have already lost, and every new feature makes the hole a little deeper. The hole is already too steep to escape, so accept that you will be tracked by colluding websites whenever you browse the web.
---
The W3C page comes to roughly the same conclusion, but recommends a very drastic and dangerous solution: legislation. I fear that legislating this issue will legitimize only select pre-approved uses of UA variance entropy, and will hinder developer innovation in the long run. I'd rather be fingerprinted than be held back by legislation as to what browser data I'm allowed to read, and in what manner I can act on that data.
Please do not lobby for legislation in order to fix this problem. W3C's proposed solution will most likely only cause more harm than good. I would be deeply upset if "intent to fingerprint" became an actual crime.
One example of something useful that such legislation may make illegal is my navigator.hardwareConcurrency polyfill[1] that runs a timing attack on your CPU (not unlike "The Spy in the Sandbox" linked to in the W3C page) to figure out how many cores you have. This information is actually useful for optimizing heavy multi-threaded webapps, but it is also directly useful for fingerprinting. Future legislation could make it so that using my polyfill, even for benign purposes, counts as "intent to fingerprint".
People do not deserve jail time or fines based on if a tech illiterate jury judges you to harbor "intent to fingerprint". The future will be a very scary place for developers if you actually have to worry about this.
[1]: http://wg.oftn.org/projects/core-estimator/demo/