3 ms·
1. Are ad companies ahead of the research and have been doing things like this all along? 2. In theory you can look at JavaScript served from ad sites and reve
by ikeboy 10y ago
1. Are ad companies ahead of the research and have been doing things like this all along?
2. In theory you can look at JavaScript served from ad sites and reverse engineer to see what they are tracking. Has anybody tried to make a database of which ad vendors run which things in browsers? (Similar to how malware is reverse engineered?)
- mpeg 10y agoYes and yes. Take a look at the work of Steven Englehardt around cookie syncing and gpu fingerprinting [0] [1] [0]: https://freedom-to-tinker.com/2014/08/07/the-hidden-perils-of-cookie-syncing/ https://freedom-to-tinker.com/2014/08/07/the-hidden-perils-o... [1]: https://freedom-to-tinker.com/2016/01/12/retrospective-look-at-canvas-fingerprinting/ https://freedom-to-tinker.com/2016/01/12/retrospective-look-...
- ikeboy 10y agoChecking what sites use specific techniques is not the same as reversing JS to find new techniques.
- mpeg 10y agoThere's no new techniques, this stuff all uses the same javascript APIs and that's what the crawlers that look for this stuff look for. People have been doing GPU fingerprinting since the canvas APIs were available, with accuracy rates of over 90%, this further refines it by exploiting subtle differences in 3D rendering via webgl but the API surface is pretty small And you really don't need to reverse JS, you can just run it in a controlled environment and hook into certain calls etc. not too different to how you'd do analysis of vm / packed binaries though some of the scripts that do this stuff will try to detect these sandboxed environments and deactivate themselves (google does that, for example, cause they run their fingerprinting inside a custom VM in javascript)