4 ms·

I can see how you would be led to believe that interpretation. Looking at the "fingerprinting" webapp however, details that sound is NOT actually recorded-- onl

I can see how you would be led to believe that interpretation. Looking at the "fingerprinting" webapp however, details that sound is NOT actually recorded-- only the uniqueness of your machine's audio processing stack. At least I hope that's the case. The idea of a microphone recording without permission upon visiting a website would cause quite a broo-ha-ha. https://audiofingerprint.openwpm.com/ https://audiofingerprint.openwpm.com/ > "This page tests browser-fingerprinting using the AudioContext and Canvas API. > Using the AudioContext API to fingerprint does not collect sound played or > recorded by your machine - an AudioContext fingerprint is a property of your > machine's audio stack itself. If you choose to see your fingerprint, we will > collect the fingerprint along with a randomly assigned identifier, your IP > Address, and your User-Agent and store it in a private database so that we can > analyze the effectiveness of the technique. We will not release the raw data > publicly. A cookie will be set in your browser to help in our analysis. We > also test a form of fingerprinting using Flash if you have Flash enabled."

projectramo 10y ago
Wow, so are mic settings that different on different on, say, different iOS devices? If you and I have the same model iPhone with the same model iOS, is the audio stack that different?
- vertex-four 10y ago
  Probably not - but basically, you add together your microphone stack with all the other data it can possibly find about your device, and that's your fingerprint. Check out https://panopticlick.eff.org https://panopticlick.eff.org - this will attempt to fingerprint your browser and see if it's unique.
  - jerf 10y ago
    If you'd like a lot more on this topic, check out https://33bits.org/sitemap/ https://33bits.org/sitemap/ and start clicking on the links.
- nickm50 10y ago
  I know iOS was just an example but just to clarify, the WebRTC spec isn't supported in-browser on iOS. To further clarify: it's not supported on iOS. As a developer, you can take advantage of the spec only if you're building a native app. There's frameworks that you can use if you do. But within Safari or Chrome you have zero WebRTC support. It's supported in modern versions of chrome on Android but won't be supported on iOS until apple does something about it.
  - kbenson 10y ago
    > But within Safari or Chrome you have zero WebRTC support. Chrome is just a skin on Safari for iOS, because Apple doesn't allow third party browsers, right? I would think FF (or any other browser) wouldn't be able to on iOS either, given that constraint.
englehardt 10y ago
Yes, no sound is recorded. Access to the user's mic isn't possible without a permission. If there are sections of the website or paper that seem to imply that, let me know and we'll clarify.
- Brakenshire 10y ago
  It seems strange that access to the audio stack isn't also behind the permission.
  - vox_mollis 10y ago
    Presumably, an application would need to enumerate audio capabilities before even offering the option.
  - crispyambulance 10y ago
    It does, and also as someone who has never heard of AudioContext before, I can't fathom why it would be necessary for a web application to generate an audio data stream that isn't output to speakers _AND_ _THEN_ analyze the result. What is the typical use case for AudioContext? The capabilities of AudioContext used in audio fingerprinting seem like they're beyond what is really necessary?
    - chatmasta 10y ago
      AudioContext is actually pretty cool. As far as I know, only Firefox supports it at the moment. But it allows you to work with audio streams in raw byteform, which means you can do advanced audio processing in client side javascript.
- hackuser 10y ago
  The front page [1] doesn't say either way, and I wondered the same thing when I read it. A few words or a link to an explanation would be helpful. [1] https://webtransparency.cs.princeton.edu/webcensus/index.html https://webtransparency.cs.princeton.edu/webcensus/index.htm...

projectramo 10y ago

Wow, so are mic settings that different on different on, say, different iOS devices? If you and I have the same model iPhone with the same model iOS, is the audio stack that different?

vertex-four 10y ago
Probably not - but basically, you add together your microphone stack with all the other data it can possibly find about your device, and that's your fingerprint. Check out https://panopticlick.eff.org https://panopticlick.eff.org - this will attempt to fingerprint your browser and see if it's unique.
- jerf 10y ago
  If you'd like a lot more on this topic, check out https://33bits.org/sitemap/ https://33bits.org/sitemap/ and start clicking on the links.
nickm50 10y ago
I know iOS was just an example but just to clarify, the WebRTC spec isn't supported in-browser on iOS. To further clarify: it's not supported on iOS. As a developer, you can take advantage of the spec only if you're building a native app. There's frameworks that you can use if you do. But within Safari or Chrome you have zero WebRTC support. It's supported in modern versions of chrome on Android but won't be supported on iOS until apple does something about it.
- kbenson 10y ago
  > But within Safari or Chrome you have zero WebRTC support. Chrome is just a skin on Safari for iOS, because Apple doesn't allow third party browsers, right? I would think FF (or any other browser) wouldn't be able to on iOS either, given that constraint.

englehardt 10y ago

Yes, no sound is recorded. Access to the user's mic isn't possible without a permission. If there are sections of the website or paper that seem to imply that, let me know and we'll clarify.

Brakenshire 10y ago
It seems strange that access to the audio stack isn't also behind the permission.
- vox_mollis 10y ago
  Presumably, an application would need to enumerate audio capabilities before even offering the option.
- crispyambulance 10y ago
  It does, and also as someone who has never heard of AudioContext before, I can't fathom why it would be necessary for a web application to generate an audio data stream that isn't output to speakers _AND_ _THEN_ analyze the result. What is the typical use case for AudioContext? The capabilities of AudioContext used in audio fingerprinting seem like they're beyond what is really necessary?
  - chatmasta 10y ago
    AudioContext is actually pretty cool. As far as I know, only Firefox supports it at the moment. But it allows you to work with audio streams in raw byteform, which means you can do advanced audio processing in client side javascript.
hackuser 10y ago
The front page [1] doesn't say either way, and I wondered the same thing when I read it. A few words or a link to an explanation would be helpful. [1] https://webtransparency.cs.princeton.edu/webcensus/index.html https://webtransparency.cs.princeton.edu/webcensus/index.htm...