Zagorath

Absolutely horrid feature. Supposedly it’s to protect vulnerable people’s privacy if they post in certain communities, but if they truly wanted that to be how it’s used, they’d have limited the ability to apply the feature only to subreddits where mods have specifically coordinated with the admins to get approved as places where vulnerable people are posting. Or, and here’s a shocker, they could just rely on the tried-and-tested method of using alt accounts. Instead, bots and trolls just hide their entire post history from people.

Now, supposedly, mods can see the full, unhidden history of any user who has recently posted in their subreddits. Which is good. But the number of other good-faith users being obstructed by this change is huge. It’s overall a massive failure from Reddit.

I agree with you about dropdown menus being something that could/should be natively available to HTML, but I’m less convinced about form submission. Sure, if we assume everything is happy path it’s a great idea, but a system needs to be robust enough to handle a variety of cases. Maybe you want to redirect a user to a log-on page if they get back a 401, or present an explanation if they get a 403. A 5XX should usually display some sort of error message to the user. A 201 probably needs to add an element into the page, while a 200 might do nothing, or might alter something on the page.

With the huge range of possible paths and desired effects, it pretty quickly becomes apparent that designing an HTML & CSS–only spec that can meet the needs is infeasible. There’s definitely a case to be made that JavaScript has become too powerful and can do too many potentially dangerous or privacy-invading things. And maybe a new range of permissions could be considered to limit a lot of that at a more fundamental level. But what we’re talking about here with the form submission stuff is the real bare-bones basic stuff JavaScript was designed to make easier—alter the contents of web pages on the fly in response to user actions. And it’s really, really good at that.

• Your operating system
• Your CPU architecture

Agree. No reason they should have this.

• Your JS interpreter’s version and build ID

I can see a reasonable argument for this being allowed. Feature detection should make this unnecessary, but it doesn’t seem to be fully supported yet.

• Plugins & Extensions

This is clearly a break of the browser sandbox and should require explicit permission at the very least (if not be blocked outright…I’m curious what the legitimate uses for these would be).

• Accelerometer and gyroscope & magnetic field sensor

Should probably be tied to location permission, for the sake of a simple UX.

• Proximity sensor

Definitely potential legitimate reasons for this, but it shouldn’t be by default.

• Keyboard layout

As someone who uses a non-QWERTY (and non-QWERTY-based) layout, this is one I have quite a stake in. The bottom line is that even without directly being able to obtain this, a site can very easily indirectly obtain it anyway, thanks to the difference between event.code and event.key. And that difference is important, because there are some cases where it’s better to use one or the other. A browser-based game, for example, probably wants to use event.code so the user can move around based on where WASD would be on a QWERTY keyboard, even though as a Dvorak user, for me that would be <AOE. But keyboard shortcuts like J and K for “next”/“previous” item should usually use event.key.

There could/should be a browser setting somewhere, or an extension, that can hide this from sites. But it is far too useful, relative to its fingerprinting value, to restrict for ordinary users.

how sensors are used to fingerprint you, I think it has to do with manufacturing imperfections that skew their readings in unique ways

It’s also simple presence detection. “You have a proximity sensor” is a result not every browser will have, so it helps narrow down a specific browser.