6 ms·

I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The

I am going to ask about a really basic question: what is fingerprinting? I had to dig around, from the paper is sounds like a stateless form of tracking. The audio example made sense: 1. the mic comes on, and it identifies a particular background noise. 2. I browse to another site, or a different page without a cookie. 3. The mic comes on again, matches the ambient noise and realizes I am the same person. Is that what you mean? If this is the case, how can the "canvas fingerprinting" work since I had to browse to a new page and all the old pixels from the previous page are no longer there. Anyway, if it is what I understand it to be, then it sounds very interesting. I bet some science fiction author wishes they had though to use it.

detaro 10y ago
Canvas fingerprinting uses differences in rendering e.g. of fonts. Output a text, hash resulting pixel values. Depending on exact version of the font(s) installed, anti-aliasing settings, default font sizes, operating system... you get slightly different results. So you don't rely on information stored on the device, but on repeatable behavior that differs between devices.
- projectramo 10y ago
  I thought that was "Canvas-Font Fingerprinting" But now I see that is just seeing which fonts are available. Thanks for the explanation. Its just hard to believe devices are so different. I would think most versions of iOS would have roughly the same set of fonts etc.
  - detaro 10y ago
    I would assume that iOS devices are quite hard to tell apart using most of these techniques, yes. But I also wouldn't be too surprised if there were something that works for them, some kind of cookie that isn't cleared by default or ...
    - mpeg 10y ago
      Yup HSTS supercookies or some kinds of network fingerprinting will work to distinguish between two otherwise identical iOS devices.
  - mediumdeviation 10y ago
    Actually, checking if a font is available does not require canvas (you can simply inject a piece of text into the page with a specific font stack set and check its width). Rather, what canvas is used for is to obtain the sub-pixel anti-aliasing of a given piece of text, which is different between browsers and OS even when the same font is present.
  - mikeash 10y ago
    Canvas fingerprinting by itself won't uniquely identify users. But the idea is that you can combine various different techniques, each one giving you more bits of uniqueness, until you have enough to do so. For example, say that canvas fingerprinting gives you one of 100 possibilities, and you combine it with other techniques that give you one of 10,000 possibilities, then combined (assuming they're not correlated) you get it to a million, letting you uniquely identify people with decent reliability from a decently large visitor pool.
    - jfoster 10y ago
      What are some unexpected things that would differ between two iPhones of the same model running the same versions of the software stack?
      - mikeash 10y ago
        Good question. I'm not particularly informed on this stuff, so take this with a grain of salt, but my understanding is that mobile devices in general and iPhones in particular are much harder to fingerprint reliably. Things like time zone, clock skew, and ping times might help differentiate users, but you probably can't get it down to a single person. I imagine there's still a use for fingerprinting which helps you differentiate groups of users even if you can't narrow it down to just one.
ronjouch 10y ago
> "how can the "canvas fingerprinting" work since I had to browse to a new page and all the old pixels from the previous page are no longer there" The linked page answers this: "Differences in font rendering, smoothing, anti-aliasing, as well as other device features cause devices to draw the image differently." Put differently, the function measureText(canvas full of text with various fonts and bizarre features with varying implementation) is a pretty good hashing function for a population of web users, because each of these web users have a pretty-unique [canvas rendering engine, underlying OS, installed fonts] combination. Combine several of these techniques (webrtc, audio, list of plugins installed and their version, etc), and you go from a "pretty unique" to a "guaranteed unique" hash, which you can follow across the web.
- projectramo 10y ago
  Thanks for the explanation. I missed it because I never though these settings could be that unique.
  - kbenson 10y ago
    Just imagine, if the audio stack exposes the volume level, that's roughly 7.5 bits of uniqueness to contribute to the 33 required to uniquely identity any person on Earth (not that you can expect it to be uniformly distributed, and thus fully usable).
    - mh- 10y ago
      that doesn't quite work since the volume level changes frequently.
      - kbenson 10y ago
        Yes, it's a poor example in that respect. I meant it more as an explanation of how different attributes of a source all contribute a little but to providing a unique identifier, but you are correct that it's much less useful if the attribute is not static.
crispyambulance 10y ago
I can see how you would be led to believe that interpretation. Looking at the "fingerprinting" webapp however, details that sound is NOT actually recorded-- only the uniqueness of your machine's audio processing stack. At least I hope that's the case. The idea of a microphone recording without permission upon visiting a website would cause quite a broo-ha-ha. https://audiofingerprint.openwpm.com/ https://audiofingerprint.openwpm.com/ > "This page tests browser-fingerprinting using the AudioContext and Canvas API. > Using the AudioContext API to fingerprint does not collect sound played or > recorded by your machine - an AudioContext fingerprint is a property of your > machine's audio stack itself. If you choose to see your fingerprint, we will > collect the fingerprint along with a randomly assigned identifier, your IP > Address, and your User-Agent and store it in a private database so that we can > analyze the effectiveness of the technique. We will not release the raw data > publicly. A cookie will be set in your browser to help in our analysis. We > also test a form of fingerprinting using Flash if you have Flash enabled."
- projectramo 10y ago
  Wow, so are mic settings that different on different on, say, different iOS devices? If you and I have the same model iPhone with the same model iOS, is the audio stack that different?
  - vertex-four 10y ago
    Probably not - but basically, you add together your microphone stack with all the other data it can possibly find about your device, and that's your fingerprint. Check out https://panopticlick.eff.org https://panopticlick.eff.org - this will attempt to fingerprint your browser and see if it's unique.
    - jerf 10y ago
      If you'd like a lot more on this topic, check out https://33bits.org/sitemap/ https://33bits.org/sitemap/ and start clicking on the links.
  - 10y ago
tremon 10y ago
what is fingerprinting? I don't know the research definition, but fingerprinting is a technique to uniquely track a user across multiple sites without a tracking beacon. The most basic form of fingerprinting is to use the browser-supplied headers (user agent, version, OS). Canvas fingerprinting works because identical browser versions across different machines may render slightly different, but consistent. IIUC, canvas fingerprinting doesn't rely on any pixels shown to the user or anything unique to the site, but if the same canvas is rendered exactly the same on two different sites, that's another indication that both visits were from the same user. I don't think the AudioContext fingerprinting uses the actual microphone: it uses the browser's (and possibly OS's) audio engine to generate an audio stream, then fingerprints the resulting data stream.
Fradow 10y ago
I'm going to answer the basic question: fingerprinting is about trying to identify your device as uniquely as possible using available APIs, in order to track you cross-site, without cookies. To do that, you first try to identify API that have different results depending on the browser or the device, and then track their result. For example, the User agent have some identifying information. It's not unique for each person, but you can start having a bit of identifying information. Do that with multiple APIs (available fonts, installed plugins ...), and you start having enough identifying informations to uniquely identify some browsers, without having an actual ID provided by the browser. To test your browser, you can visit https://panopticlick.eff.org/ https://panopticlick.eff.org/
- jordache 10y ago
  Which API reveals my system fonts to a website? Edit: The fingerprint test at https://panopticlick.eff.org/ https://panopticlick.eff.org/ shows my System Fonts
  - mpeg 10y ago
    You can't get installed fonts via javascript, but you can change the font of a known text and fingerprint the size to determine whether the font is installed or it defaulted to another font.
  - tangent128 10y ago
    I don't think you can enumerate them these days, but you can test for them by trying to use them in CSS (which font is used would affect the width of a span of text, use a wildly different fallback font and you can guess which is installed) or <canvas> (where you can inspect the actual pixels rendered).
    - Freak_NL 10y ago
      Or use @font-face and detect calls to a remote URL — which happens when the named local font is missing: @font-face { font-family: "Roboto"; src: local("Roboto"), url("https://example.com/user-does-not-have-roboto") format("woff2"); }
superuser2 10y ago
No. Microphone requires permission. Your browser can leak a ton of information about your computer silently: window size, screen resolution, pixel density, time zone, language, installed fonts, installed plugins, operating system and version, browser version, plugins and versions, etc. There are good reasons for all of this data to be available to JavaScript for legitimate purposes. The AND of all of these datapoints, however, may be unique (or close), particularly if you have ever done something like install a novelty font. The EFF runs a website that fingerprints you and tells you how unique your fingerprint is: [0] https://panopticlick.eff.org/tracker https://panopticlick.eff.org/tracker

detaro 10y ago

Canvas fingerprinting uses differences in rendering e.g. of fonts. Output a text, hash resulting pixel values. Depending on exact version of the font(s) installed, anti-aliasing settings, default font sizes, operating system... you get slightly different results. So you don't rely on information stored on the device, but on repeatable behavior that differs between devices.

projectramo 10y ago
I thought that was "Canvas-Font Fingerprinting" But now I see that is just seeing which fonts are available. Thanks for the explanation. Its just hard to believe devices are so different. I would think most versions of iOS would have roughly the same set of fonts etc.
- detaro 10y ago
  I would assume that iOS devices are quite hard to tell apart using most of these techniques, yes. But I also wouldn't be too surprised if there were something that works for them, some kind of cookie that isn't cleared by default or ...
  - mpeg 10y ago
    Yup HSTS supercookies or some kinds of network fingerprinting will work to distinguish between two otherwise identical iOS devices.
- mediumdeviation 10y ago
  Actually, checking if a font is available does not require canvas (you can simply inject a piece of text into the page with a specific font stack set and check its width). Rather, what canvas is used for is to obtain the sub-pixel anti-aliasing of a given piece of text, which is different between browsers and OS even when the same font is present.
- mikeash 10y ago
  Canvas fingerprinting by itself won't uniquely identify users. But the idea is that you can combine various different techniques, each one giving you more bits of uniqueness, until you have enough to do so. For example, say that canvas fingerprinting gives you one of 100 possibilities, and you combine it with other techniques that give you one of 10,000 possibilities, then combined (assuming they're not correlated) you get it to a million, letting you uniquely identify people with decent reliability from a decently large visitor pool.
  - jfoster 10y ago
    What are some unexpected things that would differ between two iPhones of the same model running the same versions of the software stack?
    - mikeash 10y ago
      Good question. I'm not particularly informed on this stuff, so take this with a grain of salt, but my understanding is that mobile devices in general and iPhones in particular are much harder to fingerprint reliably. Things like time zone, clock skew, and ping times might help differentiate users, but you probably can't get it down to a single person. I imagine there's still a use for fingerprinting which helps you differentiate groups of users even if you can't narrow it down to just one.

ronjouch 10y ago

> "how can the "canvas fingerprinting" work since I had to browse to a new page and all the old pixels from the previous page are no longer there" The linked page answers this: "Differences in font rendering, smoothing, anti-aliasing, as well as other device features cause devices to draw the image differently." Put differently, the function measureText(canvas full of text with various fonts and bizarre features with varying implementation) is a pretty good hashing function for a population of web users, because each of these web users have a pretty-unique [canvas rendering engine, underlying OS, installed fonts] combination. Combine several of these techniques (webrtc, audio, list of plugins installed and their version, etc), and you go from a "pretty unique" to a "guaranteed unique" hash, which you can follow across the web.

projectramo 10y ago
Thanks for the explanation. I missed it because I never though these settings could be that unique.
- kbenson 10y ago
  Just imagine, if the audio stack exposes the volume level, that's roughly 7.5 bits of uniqueness to contribute to the 33 required to uniquely identity any person on Earth (not that you can expect it to be uniformly distributed, and thus fully usable).
  - mh- 10y ago
    that doesn't quite work since the volume level changes frequently.
    - kbenson 10y ago
      Yes, it's a poor example in that respect. I meant it more as an explanation of how different attributes of a source all contribute a little but to providing a unique identifier, but you are correct that it's much less useful if the attribute is not static.

crispyambulance 10y ago

I can see how you would be led to believe that interpretation. Looking at the "fingerprinting" webapp however, details that sound is NOT actually recorded-- only the uniqueness of your machine's audio processing stack. At least I hope that's the case. The idea of a microphone recording without permission upon visiting a website would cause quite a broo-ha-ha. https://audiofingerprint.openwpm.com/ https://audiofingerprint.openwpm.com/ > "This page tests browser-fingerprinting using the AudioContext and Canvas API. > Using the AudioContext API to fingerprint does not collect sound played or > recorded by your machine - an AudioContext fingerprint is a property of your > machine's audio stack itself. If you choose to see your fingerprint, we will > collect the fingerprint along with a randomly assigned identifier, your IP > Address, and your User-Agent and store it in a private database so that we can > analyze the effectiveness of the technique. We will not release the raw data > publicly. A cookie will be set in your browser to help in our analysis. We > also test a form of fingerprinting using Flash if you have Flash enabled."

projectramo 10y ago
Wow, so are mic settings that different on different on, say, different iOS devices? If you and I have the same model iPhone with the same model iOS, is the audio stack that different?
- vertex-four 10y ago
  Probably not - but basically, you add together your microphone stack with all the other data it can possibly find about your device, and that's your fingerprint. Check out https://panopticlick.eff.org https://panopticlick.eff.org - this will attempt to fingerprint your browser and see if it's unique.
  - jerf 10y ago
    If you'd like a lot more on this topic, check out https://33bits.org/sitemap/ https://33bits.org/sitemap/ and start clicking on the links.
- 10y ago

tremon 10y ago

what is fingerprinting? I don't know the research definition, but fingerprinting is a technique to uniquely track a user across multiple sites without a tracking beacon. The most basic form of fingerprinting is to use the browser-supplied headers (user agent, version, OS). Canvas fingerprinting works because identical browser versions across different machines may render slightly different, but consistent. IIUC, canvas fingerprinting doesn't rely on any pixels shown to the user or anything unique to the site, but if the same canvas is rendered exactly the same on two different sites, that's another indication that both visits were from the same user. I don't think the AudioContext fingerprinting uses the actual microphone: it uses the browser's (and possibly OS's) audio engine to generate an audio stream, then fingerprints the resulting data stream.

Fradow 10y ago

I'm going to answer the basic question: fingerprinting is about trying to identify your device as uniquely as possible using available APIs, in order to track you cross-site, without cookies. To do that, you first try to identify API that have different results depending on the browser or the device, and then track their result. For example, the User agent have some identifying information. It's not unique for each person, but you can start having a bit of identifying information. Do that with multiple APIs (available fonts, installed plugins ...), and you start having enough identifying informations to uniquely identify some browsers, without having an actual ID provided by the browser. To test your browser, you can visit https://panopticlick.eff.org/ https://panopticlick.eff.org/

jordache 10y ago
Which API reveals my system fonts to a website? Edit: The fingerprint test at https://panopticlick.eff.org/ https://panopticlick.eff.org/ shows my System Fonts
- mpeg 10y ago
  You can't get installed fonts via javascript, but you can change the font of a known text and fingerprint the size to determine whether the font is installed or it defaulted to another font.
- tangent128 10y ago
  I don't think you can enumerate them these days, but you can test for them by trying to use them in CSS (which font is used would affect the width of a span of text, use a wildly different fallback font and you can guess which is installed) or <canvas> (where you can inspect the actual pixels rendered).
  - Freak_NL 10y ago
    Or use @font-face and detect calls to a remote URL — which happens when the named local font is missing: @font-face { font-family: "Roboto"; src: local("Roboto"), url("https://example.com/user-does-not-have-roboto") format("woff2"); }

superuser2 10y ago

No. Microphone requires permission. Your browser can leak a ton of information about your computer silently: window size, screen resolution, pixel density, time zone, language, installed fonts, installed plugins, operating system and version, browser version, plugins and versions, etc. There are good reasons for all of this data to be available to JavaScript for legitimate purposes. The AND of all of these datapoints, however, may be unique (or close), particularly if you have ever done something like install a novelty font. The EFF runs a website that fingerprints you and tells you how unique your fingerprint is: [0] https://panopticlick.eff.org/tracker https://panopticlick.eff.org/tracker