3 ms·

They wouldn't. But the point of fingerprinting is that practically no two "browsers" are the same: - browser software and exact version - installed plugin

by hendi_ 10y ago

They wouldn't. But the point of fingerprinting is that practically no two "browsers" are the same: - browser software and exact version - installed plugins - size of browser window - OS software and exact version (think of patches!) - language - time zone - screen resolution - ... - (and all the stuff mentioned in the submitted article!) See the EFF's Panopticlick to see _how_ unique your browser is. Be sure to click the "Show full results for fingerprinting" after the test to see all things it considers. [0] https://panopticlick.eff.org/ https://panopticlick.eff.org/

dao- 10y ago
That doesn't really answer the question, because most of the factors you listed should be irrelevant for _audio_ fingerprinting.
- hendi_ 10y ago
  It does. > They wouldn't.
  - dao- 10y ago
    That's a pretty short answer, and it sounds wrong to me. Are you implying that browser version, OS type and version, and system architecture are all factors that matter for audio fingerprinting? If so, what would be the point of audio fingerprinting when you can just look at the user agent string?
    - hendi_ 10y ago
      Sorry, it seems I misunderstood your intention/question. The `AudioContext` API exposes several details about the host which may depend on the hardware (sound card, sound chip), software stack (OS, on Linux e.g. PulseAudio vs. ALSA), sound driver and its versions, and connected periphery (speakers? headphones?). Additionally, the audio API is used to generate a sound (which is muted before being played, but still generated before). Sound is hard, and so the browser vendors don't necessarily generate the "sound bits" themselves but ask the OS to so. Which might in fact ask its sound system to do so. Which might ask its sound driver... Some of these properties are fairly common or likely to change often. But chances are that combined they give you more bits of information then say the simple user agent string (which is shared by thousands - if not more! - other browsers).
richardwhiuk 10y ago
But is any of this stuff stable enough to ensure a fingerprint -> user correlation which doesn't break every time? It's not very much use if all it does is create a unique fingerprint for each refresh?
- hendi_ 10y ago
  Yes; the things I've mentioned above don't change on page refresh. If you'd find some things do change too often to be relied upon you could either take that into account, or simply don't use that specific fingerprinting technique.

by hendi_ 10y ago

dao- 10y ago

That doesn't really answer the question, because most of the factors you listed should be irrelevant for _audio_ fingerprinting.

hendi_ 10y ago
It does. > They wouldn't.
- dao- 10y ago
  That's a pretty short answer, and it sounds wrong to me. Are you implying that browser version, OS type and version, and system architecture are all factors that matter for audio fingerprinting? If so, what would be the point of audio fingerprinting when you can just look at the user agent string?
  - hendi_ 10y ago
    Sorry, it seems I misunderstood your intention/question. The `AudioContext` API exposes several details about the host which may depend on the hardware (sound card, sound chip), software stack (OS, on Linux e.g. PulseAudio vs. ALSA), sound driver and its versions, and connected periphery (speakers? headphones?). Additionally, the audio API is used to generate a sound (which is muted before being played, but still generated before). Sound is hard, and so the browser vendors don't necessarily generate the "sound bits" themselves but ask the OS to so. Which might in fact ask its sound system to do so. Which might ask its sound driver... Some of these properties are fairly common or likely to change often. But chances are that combined they give you more bits of information then say the simple user agent string (which is shared by thousands - if not more! - other browsers).

richardwhiuk 10y ago

But is any of this stuff stable enough to ensure a fingerprint -> user correlation which doesn't break every time? It's not very much use if all it does is create a unique fingerprint for each refresh?

hendi_ 10y ago
Yes; the things I've mentioned above don't change on page refresh. If you'd find some things do change too often to be relied upon you could either take that into account, or simply don't use that specific fingerprinting technique.