9 ms·

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is qu

> Canvas Fingerprinting. They draw an image in the background using vector graphic commands. Afterwards they save the image to a rasterized PNG. This data is quite unique among different devices depending on settings and hardware. > They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream, which also differs from device to device. This really blew my mind. Correct me if almost all of them are doing this. If it is so, the congress hearing last year, all those privacy suits, all went into vain didn't they. (PS. bad english) :/

the_pwner224 7y ago
I've tried using addons like uMatrix in the past and always gave up, but this just convinced me to deal with the (minor-ish) annoyance they add. Canvas fingerprinting is somewhat well-known and there are browser extensions to block it. But if TikTok is doing audio fingerprinting then you can bet FB, Google, and everyone else are doing it too. JS is too feature-rich to be safely used & allowed.
- m463 7y ago
  I haven't found a way to block canvas fingerprinting. For some reason, I haven't been able to default to block in firefox. Even with CanvasBlocker the "check your fingerprint" sites still show a unique fingerprint (but canvasblocker has a ton of really obscure options that I don't understand)
  - dhimes 7y ago
    Could there be some way to randomize the canvas and audio fingerprints? An extension that obfuscates them in some sense by sending false signals? Edit: Perhaps overloading the toDataURL() function to add random noise. https://browserleaks.com/canvas#how-does-it-work https://browserleaks.com/canvas#how-does-it-work
    - rasz 7y ago
      window.HTMLCanvasElement.prototype.toDataURL = undefined; window.CanvasRenderingContext2D.prototype.getImageData = undefined; kills canvas fingerprinting
  - shakna 7y ago
    > Even with CanvasBlocker the "check your fingerprint" sites still show a unique fingerprint (but canvasblocker has a ton of really obscure options that I don't understand) It always be unique, because it's randomly generated. But every visit will have a completely different unique value, which means that the fingerprint from the canvas is a useless value.
  - iudqnolq 7y ago
    The setting in Firefox about:config privacy.resistFingerprinting includes mitigations for some canvas fingerprinting attacks. It's part of a push to bring into Firefox privacy features from the TOR project. https://wiki.mozilla.org/Security/Fingerprinting https://wiki.mozilla.org/Security/Fingerprinting
- rasz 7y ago
  From my quick research running if (navigator.mediaDevices) navigator.mediaDevices.enumerateDevices = undefined; userscript will kill audio fingerprinting, and in many cases just crash fingerprinting script
hombre_fatal 7y ago
99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups mean since so many major websites use these hacks, so the average user is just going to be conditioned to mindlessly click "Allow All" every time they pop up like UAC on Windows Vista, punishing the average person while doing nothing to enhance their security. Doesn't help that legislators are absolutely clueless here. For example, demonizing cookies when cookies are the most fair and transparent way to implement tracking, and leading to the first wave of pointless opt-in spam that plagues the internet. I'd rather they leave the internet alone and for browser vendors to step up for us. Of course, the problem also includes native apps like in TFA. I'm just more optimistic about clients that run in web browsers.
- qxnqd 7y ago
  Brave blocks cross-site canvas by default under their "Device recognition" option. You can also block first-party canvas access.
- dylz 7y ago
  > What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? In my experience, blocking these everywhere globally as a default will result in being banned from websites, trigger bullshit "fraud" invasive analytics, and all sorts of obnoxious fail-closed problems by invasive trackers. You will also be banned from most Distil-hosted sites for refusing to enable WebGL or return a canvas fingerprint. Ticketmaster, etc.
  - munk-a 7y ago
    Sounds great - especially if chrome could roll out default blocking of it. The EU (via GDPR) made a collective decision to disallow invasive privacy, if TickTock's response to that is to ban everyone in the EU and entirely lose the market that sounds good to me - teenagers will complain and people will shrug.
doh 7y ago
One thing that I can tell you is that they are using this to sign the request to their private API. They might be using for tracking it too (I never looked at that), but it's used to prevent their platform from being scraped.
JumpCrisscross 7y ago
Can, practically speaking, European governments enforce GDPR with ByteDance?
- yding 7y ago
  Yes. ByteDance does business in Europe and therefore is subject to EU law.
  - JumpCrisscross 7y ago
    > ByteDance does business in Europe and therefore is subject to EU law Legally, yes. Practically, I’m not sure the EU could block a major Chinese app from its market for fear of retaliation.
    - yding 7y ago
      India banned TikTok for a few months: https://www.cnn.com/2019/05/02/tech/tiktok-ban-india-users/index.html https://www.cnn.com/2019/05/02/tech/tiktok-ban-india-users/i...
    - sudosysgen 7y ago
      They just have to give it a massive fine. Then they can block it for failure to pay.
- Nextgrid 7y ago
  In practice they can't even be bothered to enforce it on EU and US companies so this is a lost cause.
JTon 7y ago
> They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream, which also differs from device to device. I don't understand. Can anyone unpack this concept for me? How does one generate a sound without a speaker or record without a mic.
- ldjb 7y ago
  I'm guessing they're using the Web Audio API which allows you to generate audio samples: https://developer.mozilla.org/en-US/docs/Web/API/Web_Audio_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Audio_A...
  - munk-a 7y ago
    And I assume that different audio drivers and software will produce minutely different outputs. It's also possible that they're queueing a sound to be played then canceling the sound after reading the raw computed signal out of the buffer. Sleezy sleezy crap.
    - mmcwilliams 7y ago
      It was my understanding that these methods profile performance of the API which will execute at different speeds on different devices. The samples themselves shouldn't be different if they're using AudioBuffer and typed arrays.
      - sudosysgen 7y ago
        Time to add random delay and noise then.
        wizzwizz4 7y ago
        I believe Firefox adds random delays, if you enable one of the Tracking Protection settings.
tus88 7y ago
They don't if you have JavaScript disabled ;)
- bashinator 7y ago
  Is it even possible to use TikTok with noscript?
  - hkitdog 7y ago
    Yes, it’s possible
tyingq 7y ago
I remember being surprised at etag fingerprinting. http://lucb1e.com/rp/cookielesscookies/ http://lucb1e.com/rp/cookielesscookies/ Seems obvious once you read how it works. I suppose once you get your mind around how browsers leak and/or persist info, not much of it is surprising anymore.
yding 7y ago
This kind of fingerprinting is used across the industry for anti-fraud purposes. The problem is that it used to be good enough to block "known-bad" IPs but now with AWS and cloud services it's very easy for cybercriminals to get around IP blocks. For normal users, tracking can be done with cookies, so fingerprinting isn't really needed for normal users anyways (not entirely true if you're a totally bad actor, which is why browsers have been trying to block some of the more common ways to fingerprint). But for a script that spawns a thousand AWS instances to sign up 1000 bot accounts that can then be used to sell likes for example, it's pretty easy to tell that it's a script instance because all of them will behave in almost exactly the same way (processor performance, installed plugins, reported screen size, etc. etc.). An "alternative" to using fingerprints would be to use captchas instead, but bots have gotten much much better at solving captchas. So in fact, ReCaptcha will also use a number of fingerprinting techniques, which is why in many cases you can just click the check box instead of solving a captcha.
- kbenson 7y ago
  > it's pretty easy to tell that it's a script instance because all of them will behave in almost exactly the same way (processor performance, installed plugins, reported screen size, etc. etc.). Processor performance is variable based on the particular instance you are running on and how much load it is handling. At least at the level the remote side can see. Screen size is easily configured and/or randomized to some degree, or shifted between 10-20 common values. Plugins reported or actually allowed to run can be changed per instance. All this stuff is trivial with headless chrome and puppeteer, and even abstracted away using the stealth plugin for puppeteer[1]. And headless firefox through puppeteer is experimental All this fingerprinting is ridiculous and trivial for someone with any incentive to do so to defeat. 1: https://www.npmjs.com/package/puppeteer-extra-plugin-stealth https://www.npmjs.com/package/puppeteer-extra-plugin-stealth
  - saagarjha 7y ago
    > Screen size is easily configured and/or randomized to some degree, or shifted between 10-20 common values. I don't want my browser to keep changing its screen size. > All this fingerprinting is ridiculous and trivial for someone with any incentive to do so to defeat. I disagree. There are a number of efforts to defeat fingerprinting underway already and I think the fact that they haven't been able to eliminate it says volumes about how difficult of a problem this is.
meddlepal 7y ago
Congressional hearings are political theater. Theyre not meant to accomplish anything.
thepangolino 7y ago
The silliest bit is that all of this can be counteracted with fairly simple software countermeasures. The issue is mostly a UI/UX one.
namelosw 7y ago
Not defending anyone but I have to point out that fingerprinting sounds like finding a fingerprint that could identify an individual, but that not true. AFAIK browser fingerprinting (eg: Fingerprintjs2[0]) at least is nothing like fingerprints at all. It's not accurate and cannot identify a specific person. For websites like TikTok, the same fingerprint might points to 10k different people, instead of an individual. A most common use case is like 'Remember me' option when logging in if they haven't switched their device, but they actually can find other devices that have the same fingerprint. For example, the most widely used library Fingerprintjs2 uses all the factors that can be grab from the browser (Browser agent, CPU, OS, resolution, etc), and generate a hash from those factors. Even their 'pro' version can only claim 99.5% accuracy, though I doubt the number is actually even lower. For 1M people userbase, it's 5000 people for 0.5% of the population. [0]: https://github.com/Valve/fingerprintjs2 https://github.com/Valve/fingerprintjs2
- Nextgrid 7y ago
  Combined with other data points like usage patterns (how the user behaves on the site, which features they use, etc), IP address I'd be confident the resulting fingerprint can be unique.
- sjy 7y ago
  I’m not too sure what “99.5% accuracy” is supposed to mean, but sites like https://amiunique.org https://amiunique.org usually tell me that my browser fingerprint is unique. Seems rather like a real fingerprint to me, except that I have more than one.
  - wizzwizz4 7y ago
    You have more than one real fingerprint, too.
zaphirplane 7y ago
This is interesting because a cookie with a uuid is probably a better tracker, specially with shared computers. I know cookies can be deleted but expect the majority of their users wouldn’t be deleting cookies or using ad blockers
- codedokode 7y ago
  Cookies are isolated in private mode. Fingerprint and IP address remain the same.
deleted 7y ago
[deleted]
gengchun88 7y ago
Those techniques described here were pioneered by Facebook and Google. Basically they are (automatic) CAPTCHA. I still remember the news articles refering a patent Facebook filed about audio fingerprinting as the evidence of Facebook eavesdropping on the people. Also technologically with some encryption argorithms, a company can claim that they are not capable to identify user with the fingerprint. But in theory given enough data they still can.

the_pwner224 7y ago

I've tried using addons like uMatrix in the past and always gave up, but this just convinced me to deal with the (minor-ish) annoyance they add. Canvas fingerprinting is somewhat well-known and there are browser extensions to block it. But if TikTok is doing audio fingerprinting then you can bet FB, Google, and everyone else are doing it too. JS is too feature-rich to be safely used & allowed.

m463 7y ago
I haven't found a way to block canvas fingerprinting. For some reason, I haven't been able to default to block in firefox. Even with CanvasBlocker the "check your fingerprint" sites still show a unique fingerprint (but canvasblocker has a ton of really obscure options that I don't understand)
- dhimes 7y ago
  Could there be some way to randomize the canvas and audio fingerprints? An extension that obfuscates them in some sense by sending false signals? Edit: Perhaps overloading the toDataURL() function to add random noise. https://browserleaks.com/canvas#how-does-it-work https://browserleaks.com/canvas#how-does-it-work
  - rasz 7y ago
    window.HTMLCanvasElement.prototype.toDataURL = undefined; window.CanvasRenderingContext2D.prototype.getImageData = undefined; kills canvas fingerprinting
- shakna 7y ago
  > Even with CanvasBlocker the "check your fingerprint" sites still show a unique fingerprint (but canvasblocker has a ton of really obscure options that I don't understand) It always be unique, because it's randomly generated. But every visit will have a completely different unique value, which means that the fingerprint from the canvas is a useless value.
- iudqnolq 7y ago
  The setting in Firefox about:config privacy.resistFingerprinting includes mitigations for some canvas fingerprinting attacks. It's part of a push to bring into Firefox privacy features from the TOR project. https://wiki.mozilla.org/Security/Fingerprinting https://wiki.mozilla.org/Security/Fingerprinting
rasz 7y ago
From my quick research running if (navigator.mediaDevices) navigator.mediaDevices.enumerateDevices = undefined; userscript will kill audio fingerprinting, and in many cases just crash fingerprinting script

hombre_fatal 7y ago

99% of websites we visit do not need canvas or sound. And the few websites that do can explain why you should click "Allow" when they prompt you for access. What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? I suppose one reason is that you would immediately unleash opt-in spam on your users that don't know what these pop-ups mean since so many major websites use these hacks, so the average user is just going to be conditioned to mindlessly click "Allow All" every time they pop up like UAC on Windows Vista, punishing the average person while doing nothing to enhance their security. Doesn't help that legislators are absolutely clueless here. For example, demonizing cookies when cookies are the most fair and transparent way to implement tracking, and leading to the first wave of pointless opt-in spam that plagues the internet. I'd rather they leave the internet alone and for browser vendors to step up for us. Of course, the problem also includes native apps like in TFA. I'm just more optimistic about clients that run in web browsers.

qxnqd 7y ago
Brave blocks cross-site canvas by default under their "Device recognition" option. You can also block first-party canvas access.
dylz 7y ago
> What's a charitable reason that stops even a supposedly privacy-concerned niche browser like Brave from implementing opt-ins for these things? In my experience, blocking these everywhere globally as a default will result in being banned from websites, trigger bullshit "fraud" invasive analytics, and all sorts of obnoxious fail-closed problems by invasive trackers. You will also be banned from most Distil-hosted sites for refusing to enable WebGL or return a canvas fingerprint. Ticketmaster, etc.
- munk-a 7y ago
  Sounds great - especially if chrome could roll out default blocking of it. The EU (via GDPR) made a collective decision to disallow invasive privacy, if TickTock's response to that is to ban everyone in the EU and entirely lose the market that sounds good to me - teenagers will complain and people will shrug.

doh 7y ago

One thing that I can tell you is that they are using this to sign the request to their private API. They might be using for tracking it too (I never looked at that), but it's used to prevent their platform from being scraped.

JumpCrisscross 7y ago

Can, practically speaking, European governments enforce GDPR with ByteDance?

yding 7y ago
Yes. ByteDance does business in Europe and therefore is subject to EU law.
- JumpCrisscross 7y ago
  > ByteDance does business in Europe and therefore is subject to EU law Legally, yes. Practically, I’m not sure the EU could block a major Chinese app from its market for fear of retaliation.
  - yding 7y ago
    India banned TikTok for a few months: https://www.cnn.com/2019/05/02/tech/tiktok-ban-india-users/index.html https://www.cnn.com/2019/05/02/tech/tiktok-ban-india-users/i...
  - sudosysgen 7y ago
    They just have to give it a massive fine. Then they can block it for failure to pay.
Nextgrid 7y ago
In practice they can't even be bothered to enforce it on EU and US companies so this is a lost cause.

JTon 7y ago

> They also use audio fingerprinting to identify visitors. This doesn’t mean they actually use your microphone or speaker. Instead they generate a sound internally and record the bitstream, which also differs from device to device. I don't understand. Can anyone unpack this concept for me? How does one generate a sound without a speaker or record without a mic.

ldjb 7y ago
I'm guessing they're using the Web Audio API which allows you to generate audio samples: https://developer.mozilla.org/en-US/docs/Web/API/Web_Audio_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Audio_A...
- munk-a 7y ago
  And I assume that different audio drivers and software will produce minutely different outputs. It's also possible that they're queueing a sound to be played then canceling the sound after reading the raw computed signal out of the buffer. Sleezy sleezy crap.
  - mmcwilliams 7y ago
    It was my understanding that these methods profile performance of the API which will execute at different speeds on different devices. The samples themselves shouldn't be different if they're using AudioBuffer and typed arrays.
    - sudosysgen 7y ago
      Time to add random delay and noise then.
      - wizzwizz4 7y ago
        I believe Firefox adds random delays, if you enable one of the Tracking Protection settings.

tus88 7y ago

They don't if you have JavaScript disabled ;)

bashinator 7y ago
Is it even possible to use TikTok with noscript?
- hkitdog 7y ago
  Yes, it’s possible

tyingq 7y ago

I remember being surprised at etag fingerprinting. http://lucb1e.com/rp/cookielesscookies/ http://lucb1e.com/rp/cookielesscookies/ Seems obvious once you read how it works. I suppose once you get your mind around how browsers leak and/or persist info, not much of it is surprising anymore.

yding 7y ago

This kind of fingerprinting is used across the industry for anti-fraud purposes. The problem is that it used to be good enough to block "known-bad" IPs but now with AWS and cloud services it's very easy for cybercriminals to get around IP blocks. For normal users, tracking can be done with cookies, so fingerprinting isn't really needed for normal users anyways (not entirely true if you're a totally bad actor, which is why browsers have been trying to block some of the more common ways to fingerprint). But for a script that spawns a thousand AWS instances to sign up 1000 bot accounts that can then be used to sell likes for example, it's pretty easy to tell that it's a script instance because all of them will behave in almost exactly the same way (processor performance, installed plugins, reported screen size, etc. etc.). An "alternative" to using fingerprints would be to use captchas instead, but bots have gotten much much better at solving captchas. So in fact, ReCaptcha will also use a number of fingerprinting techniques, which is why in many cases you can just click the check box instead of solving a captcha.

kbenson 7y ago
> it's pretty easy to tell that it's a script instance because all of them will behave in almost exactly the same way (processor performance, installed plugins, reported screen size, etc. etc.). Processor performance is variable based on the particular instance you are running on and how much load it is handling. At least at the level the remote side can see. Screen size is easily configured and/or randomized to some degree, or shifted between 10-20 common values. Plugins reported or actually allowed to run can be changed per instance. All this stuff is trivial with headless chrome and puppeteer, and even abstracted away using the stealth plugin for puppeteer[1]. And headless firefox through puppeteer is experimental All this fingerprinting is ridiculous and trivial for someone with any incentive to do so to defeat. 1: https://www.npmjs.com/package/puppeteer-extra-plugin-stealth https://www.npmjs.com/package/puppeteer-extra-plugin-stealth
- saagarjha 7y ago
  > Screen size is easily configured and/or randomized to some degree, or shifted between 10-20 common values. I don't want my browser to keep changing its screen size. > All this fingerprinting is ridiculous and trivial for someone with any incentive to do so to defeat. I disagree. There are a number of efforts to defeat fingerprinting underway already and I think the fact that they haven't been able to eliminate it says volumes about how difficult of a problem this is.

meddlepal 7y ago

Congressional hearings are political theater. Theyre not meant to accomplish anything.

thepangolino 7y ago

The silliest bit is that all of this can be counteracted with fairly simple software countermeasures. The issue is mostly a UI/UX one.

namelosw 7y ago

Not defending anyone but I have to point out that fingerprinting sounds like finding a fingerprint that could identify an individual, but that not true. AFAIK browser fingerprinting (eg: Fingerprintjs2[0]) at least is nothing like fingerprints at all. It's not accurate and cannot identify a specific person. For websites like TikTok, the same fingerprint might points to 10k different people, instead of an individual. A most common use case is like 'Remember me' option when logging in if they haven't switched their device, but they actually can find other devices that have the same fingerprint. For example, the most widely used library Fingerprintjs2 uses all the factors that can be grab from the browser (Browser agent, CPU, OS, resolution, etc), and generate a hash from those factors. Even their 'pro' version can only claim 99.5% accuracy, though I doubt the number is actually even lower. For 1M people userbase, it's 5000 people for 0.5% of the population. [0]: https://github.com/Valve/fingerprintjs2 https://github.com/Valve/fingerprintjs2

Nextgrid 7y ago
Combined with other data points like usage patterns (how the user behaves on the site, which features they use, etc), IP address I'd be confident the resulting fingerprint can be unique.
sjy 7y ago
I’m not too sure what “99.5% accuracy” is supposed to mean, but sites like https://amiunique.org https://amiunique.org usually tell me that my browser fingerprint is unique. Seems rather like a real fingerprint to me, except that I have more than one.
- wizzwizz4 7y ago
  You have more than one real fingerprint, too.

zaphirplane 7y ago

This is interesting because a cookie with a uuid is probably a better tracker, specially with shared computers. I know cookies can be deleted but expect the majority of their users wouldn’t be deleting cookies or using ad blockers

codedokode 7y ago
Cookies are isolated in private mode. Fingerprint and IP address remain the same.

deleted 7y ago

[deleted]

gengchun88 7y ago

Those techniques described here were pioneered by Facebook and Google. Basically they are (automatic) CAPTCHA. I still remember the news articles refering a patent Facebook filed about audio fingerprinting as the evidence of Facebook eavesdropping on the people. Also technologically with some encryption argorithms, a company can claim that they are not capable to identify user with the fingerprint. But in theory given enough data they still can.