Skip to content

Commit

Permalink
[!!!][FEATURE] Enrich fingerprint hash with IP address
Browse files Browse the repository at this point in the history
Tracking purely based on device fingerprinting lead to some issues,
namely mobile browsers working more towards sandboxing requests so
that device hashes end up being the same across the same line of
devices. This makes individual tracking unreliable and in the case
of Lux leads to some leads that contain several different people
in them.

This change enriches the fingerprint with the users IP address
and hashes it again, leading to a more unique identification
value.

Negative impact of this change:
* (BREAKING) Previously identified users can't be identified anymore,
  as the calculated fingerprint value has changed.
* Compared to before, we now create _more_ unique users than before,
  as IP addresses (usually) change on the regular for home connections
  or when switching wi-fi/cellular networks.

Related: https://projekte.in2code.de/issues/67221
  • Loading branch information
pixeldesu committed Oct 15, 2024
1 parent 2358785 commit 7d3cd72
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion Classes/Domain/Model/Fingerprint.php
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
use In2code\Lux\Exception\FingerprintMustNotBeEmptyException;
use In2code\Lux\Utility\BackendUtility;
use In2code\Lux\Utility\EnvironmentUtility;
use In2code\Lux\Utility\IpUtility;
use TYPO3\CMS\Core\Utility\GeneralUtility;
use WhichBrowser\Parser;

Expand Down Expand Up @@ -52,7 +53,7 @@ public function setValue(string $value): self
if (strlen($value) === 33) {
$this->setType(self::TYPE_STORAGE);
}
$this->value = $value;
$this->value = hash('sha256', $value . IpUtility::getIpAddress());
return $this;
}

Expand Down

3 comments on commit 7d3cd72

@Mabahe
Copy link

@Mabahe Mabahe commented on 7d3cd72 Nov 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pixeldesu @einpraegsam
I am very surprised about such a breaking change. All fingerprints become useless at a stroke.
How about an option for the old behavior?
It would also be possible to find the user based on the hash without IP in the fingerprints and then update the hash with IP on the fly, right? Of course, incorrect assignments are possible, but they exist anyway.

@einpraegsam
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that's correct. Maybe @lefloe can explain the breaking changes here.

@lefloe
Copy link
Contributor

@lefloe lefloe commented on 7d3cd72 Dec 2, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your feedback. We are aware of the data loss. Due to this update. Nevertheless, we had to evaluate several risks:

  1. Risk of incorrect assignment of IP address hash (especially in accordance to GDPR regulations "right for correct data")
  2. Unidentified persons can only be recognized in a relatively short period of time (e.g. changed browser version)
  3. Old entries are still useful for web analysis purposes

We understand that breaking changes cause inconveniences, and we try to avoid these.
But as Web tracking is a dynamic field, we'll need to adjust our methods accordingly.

Please sign in to comment.