4 ms·

Fun fact: for quite a long time Chrome skipped over the user permission step in the Web MIDI spec, always allowing access and silently giving ad networks a list

Fun fact: for quite a long time Chrome skipped over the user permission step in the Web MIDI spec, always allowing access and silently giving ad networks a list of connected USB MIDI devices with no user consent: https://www.obsessivefacts.com/blog/2018-10-20-chrome-allows-enumeration-of-usb-devices.html https://www.obsessivefacts.com/blog/2018-10-20-chrome-allows... Here's what appeared on porn site xhamster.com once newer versions of Chromium got around to implementing the permission check (SFW-ish): https://www.obsessivefacts.com/images/blog/2020-04-04-the-javascript-black-hole/xhamster-cropped.png https://www.obsessivefacts.com/images/blog/2020-04-04-the-ja...

tyingq 6y ago
Guessing it was for additional browser fingerprinting.
- polycaster 6y ago
  That seems a bit far fetched.
  - rezmason 6y ago
    If this pun was intended, I'm phoning the World Court.
    - polycaster 6y ago
      Please, make the call.
  - dkersten 6y ago
    Why? All kinds of details are already being used for fingerprinting
  - tyingq 6y ago
    Not sure why that's more odd than other crazy fingerprinting techniques actually in use. Keep in mind no midi devices would need to be present for fingerprinting. Different failure modes, etc. Especially in the porn industry where the end users are likely using incognito mode or a VPN.
    - microtherion 6y ago
      I still don't understand how WebMIDI would be used for fingerprinting of the vast majority of users who don't have any MIDI devices connected to their machine.
      - windowsworkstoo 6y ago
        Because thats what you want when fingerprinting....the few users who have one connected gives you probably quite and accurate fingerprint for those users.
        admax88q 6y ago
        I'm sure there are fingerprint libraries that include every possible API that the browser provides. Does MIDI provide a good fingerprint alone? Probably not, but it can serve as a few more bits of information thrown into the mix when implementing fingerprinting. It's not like it would take many engineer hours to add it to an otherwise already functional fingerprinting system.
        scrollaway 6y ago
        It's far fetched to think that google added web midi in this way just for a couple of bits of entropy which are essentially worthless (no ad network cares about identifying like 0.01% of people, if even that. Yes it's very valuable entropy if you want to identify those people specifically, but who actually wants to do that?)
        tyingq 6y ago
        Well, in this case, a porn site wants to tie what it shows you to what you liked last time you visited. They aren't after your identity per se. They are after a conversion. And since you might be using incognito mode (no lingering cookies), they care about fingerprinting for that. Edit: I see the disconnect now. I'm not saying Google/chrome added the midi API for fingerprinting. I'm saying the screenshot way up this thread is an example of a site using it for that purpose.

tyingq 6y ago

Guessing it was for additional browser fingerprinting.

polycaster 6y ago
That seems a bit far fetched.
- rezmason 6y ago
  If this pun was intended, I'm phoning the World Court.
  - polycaster 6y ago
    Please, make the call.
- dkersten 6y ago
  Why? All kinds of details are already being used for fingerprinting
- tyingq 6y ago
  Not sure why that's more odd than other crazy fingerprinting techniques actually in use. Keep in mind no midi devices would need to be present for fingerprinting. Different failure modes, etc. Especially in the porn industry where the end users are likely using incognito mode or a VPN.
  - microtherion 6y ago
    I still don't understand how WebMIDI would be used for fingerprinting of the vast majority of users who don't have any MIDI devices connected to their machine.
    - windowsworkstoo 6y ago
      Because thats what you want when fingerprinting....the few users who have one connected gives you probably quite and accurate fingerprint for those users.
      - admax88q 6y ago
        I'm sure there are fingerprint libraries that include every possible API that the browser provides. Does MIDI provide a good fingerprint alone? Probably not, but it can serve as a few more bits of information thrown into the mix when implementing fingerprinting. It's not like it would take many engineer hours to add it to an otherwise already functional fingerprinting system.
        scrollaway 6y ago
        It's far fetched to think that google added web midi in this way just for a couple of bits of entropy which are essentially worthless (no ad network cares about identifying like 0.01% of people, if even that. Yes it's very valuable entropy if you want to identify those people specifically, but who actually wants to do that?)
        tyingq 6y ago
        Well, in this case, a porn site wants to tie what it shows you to what you liked last time you visited. They aren't after your identity per se. They are after a conversion. And since you might be using incognito mode (no lingering cookies), they care about fingerprinting for that. Edit: I see the disconnect now. I'm not saying Google/chrome added the midi API for fingerprinting. I'm saying the screenshot way up this thread is an example of a site using it for that purpose.