6 ms·

I would like to know 1. How consistent the output is on a given device (is it 100% deterministic and will always produce the same fingerprint?) 2. How big is

I would like to know 1. How consistent the output is on a given device (is it 100% deterministic and will always produce the same fingerprint?) 2. How big is the variance across devices (how good of a fingerprint it is). The article doesn't really do much at digging into that, which really is the most important thing if you want to use it as a fingerprint. I'm not quite sure why different devices would generate different output, other than differences in floating point computation.

o-__-o 7y ago
An AudioContext provides properties of your machine's audio stack to JavaScript as an API https://developer.mozilla.org/en-US/docs/Web/API/AudioContext https://developer.mozilla.org/en-US/docs/Web/API/AudioContex... Everything is different for every version of firmware, hardware, driver revision, etc. it’s like enumerating fonts, it combined with other fingerprinting techniques provides a very unique snapshot of you. Eff’s panapticlick provides an audio fingerprinting example. There exist plugins which will provide some entropy to your fingerprint which also changes over time. That helps a little, but any changes you make really makes you stick out like a sore thumb (your audioprofile becomes even more unique)
- MisterTea 7y ago
  FFS why is this information exposed to a goddamn website?
  - Kalium 7y ago
    Details like knowing how much latency to expect can be important for some use-cases, such as if you're trying to time things to occur at the same moment to the user.
    - amluto 7y ago
      There’s an obvious solution: don’t allow websites to record or play audio, and don’t expose any of this until permission is granted. As a major side benefit, websites will stop randomly playing audio without permission.
      - missingrib 7y ago
        The obvious solution is just to disable javascript unless you trust the site
        MisterTea 7y ago
        And then the site totally fails. I'm no fan of JS either but the amount of sites that use JS is now close to 100%. So you either stay paranoid and the web breaks or you eat the shit sandwich. Pure lunacy.
        jacquesm 7y ago
        > And then the site totally fails. That's ok. Then I have the option to weigh whether the risk is worth it or rather not. 9 out of 10 times it is not, in rare cases I will allow the js to execute.
        waste_monk 7y ago
        Not viable for the majority of users. How do you explain to one of these "I'm not good with computers haha" types what a CDN is and why Taboola CDN shouldn't be allowed but Akamai should be otherwise things Won't Work Right. Even if they're capable of learning [1] why should they care, when all these security measures actively make their life harder? Blocking audio and other fingerprintable surfaces by default, with a "click here to enable audio / video" and a "remember my choice on this site in future" is the only way it can possibly work, because 99% of users will only ever go for the laziest option. We need to have protections for them that work regardless of (or in spite of) their skill level. [1] https://www.nngroup.com/articles/computer-skill-levels/ https://www.nngroup.com/articles/computer-skill-levels/
        gpderetta 7y ago
        Possibly curated, subscribable whitelists?
      - brigandish 7y ago
  - tantalor 7y ago
    Please don't post shallow dismissals, especially of other people's work. A good critical comment teaches us something. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - o-__-o 7y ago
    I thought that then looked at OscillatorNode and it allows you to essentially load a waveform into memory and/or generate your own. This means you can run a legit multitrack recorder or a synth from your web browser. I had a requirement for this 10 years ago, but Requires java extensions on the users browser
    - MisterTea 7y ago
      Not to be overly negative but thats lunacy. What you described is best served as a native application. Web browsers were supposed to be information viewing programs. Not virtual machines. I know it makes portable applications easy but the smash a VM into a text viewer is such a horribly broken idea and is why we have this security nightmare.
      - o-__-o 7y ago
        Nothing about this is a virtual machine. It is an API that exposes a lower-level Audio interface. I don't need to spawn a virtual machine or mess with any DLLs or figure out libraries because I can simply load a browser. Nothing is saying this needs to be on a remote server, it can be a local .html file for all it matters. But hey some of us still run around with MS-DOS 5.22 on that new Spectre-ridden, rowhammer-ready i7 because DOS/4GW is hella stable.
      - tiborsaas 7y ago
        > Web browsers were supposed to be information viewing programs. True if we stopped thinking at 1996. I don't know how to tell you but browsers become application platforms not document delivery vehicles in the last 20 years.
    - cloudking 7y ago
      There's plenty of sites doing this already like https://soundtrap.com https://soundtrap.com
- sriku 7y ago
  I think this is mistaken. The device API supposedly provides this, but the info you get is always generic due to fingerprinting protection. Also, AudioContext is expected to be active only when created within a user action like a button click. Otherwise it doesn't run (implemented in Safari). This is a pain - on the one hand, the browser vendors and w3c are locking down API capabilities to prevent fingerprinting and timing based security hacks, but these are interfering with genuine needs to provide audio functionality. For example, you can't determine whether the user has 3 audio devices connected and prompt them to select one for output. So you really can't build desktop quality audio systems with webaudio and siblings.
  - danShumway 7y ago
    > Also, AudioContext is expected to be active only when created within a user action like a button click. I really hate the user-action restriction as a security measure, because it's ridiculously easy to bypass[0], particularly on Chrome. It's privacy theater -- annoying for legitimate developers, but easy for malicious actors to get around. Putting this stuff behind a permission or sandboxing it somehow would be better for both end-users and developers. As it stands, we just get fewer webaudio applications online from legitimate developers, and they all move to native platforms where it's even easier to fingerprint users. And the malicious sites that don't move to native just fingerprint anyway because we're using bad, opaque metrics for consent. [0]: https://danshumway.com/blog/chrome-autoplay/demo/ https://danshumway.com/blog/chrome-autoplay/demo/
    - deleted 7y ago
      [deleted]
  - Mirioron 7y ago
    >For example, you can't determine whether the user has 3 audio devices connected and prompt them to select one for output. Frankly, this really should be handled by the browser. JavaScript really shouldn't have any business messing with that.
    - sriku 7y ago
- deleted 7y ago
  [deleted]

o-__-o 7y ago

An AudioContext provides properties of your machine's audio stack to JavaScript as an API https://developer.mozilla.org/en-US/docs/Web/API/AudioContext https://developer.mozilla.org/en-US/docs/Web/API/AudioContex... Everything is different for every version of firmware, hardware, driver revision, etc. it’s like enumerating fonts, it combined with other fingerprinting techniques provides a very unique snapshot of you. Eff’s panapticlick provides an audio fingerprinting example. There exist plugins which will provide some entropy to your fingerprint which also changes over time. That helps a little, but any changes you make really makes you stick out like a sore thumb (your audioprofile becomes even more unique)

MisterTea 7y ago
FFS why is this information exposed to a goddamn website?
- Kalium 7y ago
  Details like knowing how much latency to expect can be important for some use-cases, such as if you're trying to time things to occur at the same moment to the user.
  - amluto 7y ago
    There’s an obvious solution: don’t allow websites to record or play audio, and don’t expose any of this until permission is granted. As a major side benefit, websites will stop randomly playing audio without permission.
    - missingrib 7y ago
      The obvious solution is just to disable javascript unless you trust the site
      - MisterTea 7y ago
        And then the site totally fails. I'm no fan of JS either but the amount of sites that use JS is now close to 100%. So you either stay paranoid and the web breaks or you eat the shit sandwich. Pure lunacy.
        jacquesm 7y ago
        > And then the site totally fails. That's ok. Then I have the option to weigh whether the risk is worth it or rather not. 9 out of 10 times it is not, in rare cases I will allow the js to execute.
        waste_monk 7y ago
        Not viable for the majority of users. How do you explain to one of these "I'm not good with computers haha" types what a CDN is and why Taboola CDN shouldn't be allowed but Akamai should be otherwise things Won't Work Right. Even if they're capable of learning [1] why should they care, when all these security measures actively make their life harder? Blocking audio and other fingerprintable surfaces by default, with a "click here to enable audio / video" and a "remember my choice on this site in future" is the only way it can possibly work, because 99% of users will only ever go for the laziest option. We need to have protections for them that work regardless of (or in spite of) their skill level. [1] https://www.nngroup.com/articles/computer-skill-levels/ https://www.nngroup.com/articles/computer-skill-levels/
        gpderetta 7y ago
        Possibly curated, subscribable whitelists?
    - brigandish 7y ago
- tantalor 7y ago
  Please don't post shallow dismissals, especially of other people's work. A good critical comment teaches us something. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- o-__-o 7y ago
  I thought that then looked at OscillatorNode and it allows you to essentially load a waveform into memory and/or generate your own. This means you can run a legit multitrack recorder or a synth from your web browser. I had a requirement for this 10 years ago, but Requires java extensions on the users browser
  - MisterTea 7y ago
    Not to be overly negative but thats lunacy. What you described is best served as a native application. Web browsers were supposed to be information viewing programs. Not virtual machines. I know it makes portable applications easy but the smash a VM into a text viewer is such a horribly broken idea and is why we have this security nightmare.
    - o-__-o 7y ago
      Nothing about this is a virtual machine. It is an API that exposes a lower-level Audio interface. I don't need to spawn a virtual machine or mess with any DLLs or figure out libraries because I can simply load a browser. Nothing is saying this needs to be on a remote server, it can be a local .html file for all it matters. But hey some of us still run around with MS-DOS 5.22 on that new Spectre-ridden, rowhammer-ready i7 because DOS/4GW is hella stable.
    - tiborsaas 7y ago
      > Web browsers were supposed to be information viewing programs. True if we stopped thinking at 1996. I don't know how to tell you but browsers become application platforms not document delivery vehicles in the last 20 years.
  - cloudking 7y ago
    There's plenty of sites doing this already like https://soundtrap.com https://soundtrap.com
sriku 7y ago
I think this is mistaken. The device API supposedly provides this, but the info you get is always generic due to fingerprinting protection. Also, AudioContext is expected to be active only when created within a user action like a button click. Otherwise it doesn't run (implemented in Safari). This is a pain - on the one hand, the browser vendors and w3c are locking down API capabilities to prevent fingerprinting and timing based security hacks, but these are interfering with genuine needs to provide audio functionality. For example, you can't determine whether the user has 3 audio devices connected and prompt them to select one for output. So you really can't build desktop quality audio systems with webaudio and siblings.
- danShumway 7y ago
  > Also, AudioContext is expected to be active only when created within a user action like a button click. I really hate the user-action restriction as a security measure, because it's ridiculously easy to bypass[0], particularly on Chrome. It's privacy theater -- annoying for legitimate developers, but easy for malicious actors to get around. Putting this stuff behind a permission or sandboxing it somehow would be better for both end-users and developers. As it stands, we just get fewer webaudio applications online from legitimate developers, and they all move to native platforms where it's even easier to fingerprint users. And the malicious sites that don't move to native just fingerprint anyway because we're using bad, opaque metrics for consent. [0]: https://danshumway.com/blog/chrome-autoplay/demo/ https://danshumway.com/blog/chrome-autoplay/demo/
  - deleted 7y ago
    [deleted]
- Mirioron 7y ago
  >For example, you can't determine whether the user has 3 audio devices connected and prompt them to select one for output. Frankly, this really should be handled by the browser. JavaScript really shouldn't have any business messing with that.
  - sriku 7y ago
deleted 7y ago
[deleted]