Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Fingerprinting is a problem, and it's difficult to address. There's been some discussion around mechanisms for disabling features to make the browser signature less unique, but it's a very tough problem.

Take a look at https://trac.webkit.org/wiki/Fingerprinting for some discussion around what would be required. It's very, very nontrivial.



otoh, you need a browser signature if you want to avoid CSRF attacks.


No, to reliably protect your application from cross site request forgery attacks you usually use auth tokens in the request.

So even if there might be a browser-signature based solution for CSRF protection, there is a very solid alternative, which I think is the best practice anyway.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: