5 ms·

Only somewhat related but I have a phone where the front camera mechanically pops up when it's used. I've noticed that by default, when I visit many websites, w

by dvno42 6y ago

Only somewhat related but I have a phone where the front camera mechanically pops up when it's used. I've noticed that by default, when I visit many websites, without notification the camera pops up and down quickly. After every Firefox update, I have to go into android settings and deny camera permissions. I've just assumed a page attempts to access the camera via JS but I'm not sure, it could also just be a bug in FF.

smnrchrds 6y ago
What phone do you use?
- dvno42 6y ago
  OnePlus 7 Pro
  - JshWright 6y ago
    Same here, with the same observed behavior.
monocasa 6y ago
I think a bunch of websites try to access the camera's metadata as a part of a fingerprinting mechanism. That's probably what you're seeing.
- amoshi 6y ago
  I thought so too, Xiaomi Mi 9T here with a popup camera mechanism. But then again, wouldn't the website have to ask for camera permissions? Or is there some permission-less approach like the one for evaluating MIDI devices which is used for fingerprinting?
  - kbrosnan 6y ago
    Yes this is ad network fingerpriting using navigator.mediaDevices.enumerateDevices(). [1] When called without permission it would return something like > videoinput: id = csO9c0YpAf274OuCPUA53CNE0YHlIr2yXCi+SqfBZZ8= > audioinput: id = RKxXByjnabbADGQNNZqLVLdmXlS0YkETYCIbg+XxnvM= > audioinput: id = r2/xw1xUPIyZunfV1lGrKOma5wTOvCkWfZ368XCndm0= and if the user has allowed access to the camera/mic > videoinput: FaceTime HD Camera (Built-in) id=csO9c0YpAf274OuCPUA53CNE0YHlIr2yXCi+SqfBZZ8= > audioinput: default (Built-in Microphone) id=RKxXByjnabbADGQNNZqLVLdmXlS0YkETYCIbg+XxnvM= > audioinput: Built-in Microphone id=r2/xw1xUPIyZunfV1lGrKOma5wTOvCkWfZ368XCndm0= [1] https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/enumerateDevices https://developer.mozilla.org/en-US/docs/Web/API/MediaDevice...
    - _jal 6y ago
      Having a mechanism to override built in JS functions would be great fun.
      - gruez 6y ago
        AFAIK you can already do that using content scripts that execute at document_start. A lot of anti-fingerprinting scripts use this already.
        _jal 6y ago
        Thanks for the tip, I did not know that.
    - sloshnmosh 6y ago
      That’s what I thought too as soon as I saw the title of this thread. My telco uses a heavily obfuscated script where all the variables are just a bunch of hex that uses every conceivable fingerprint technique in the book. Shockwave Flash, remote fonts, WebRTC, Silverlight, vector graphics, HTML5 cookies, hardware fingerprinting etc.
    - jacquesm 6y ago
      It's actually great to have a physical confirmation that such a fingerprint is being generated. This so called cookie-less tracking is not legal in some parts of the world because it bypasses consent which needs to be legally obtained.
kbrosnan 6y ago
That is a separate issue which is fixed in Firefox Beta as part of bug 1578073.
- cpeterso 6y ago
  Links to the fixed bug reports: https://bugzilla.mozilla.org/show_bug.cgi?id=1578073 https://bugzilla.mozilla.org/show_bug.cgi?id=1578073 https://github.com/mozilla-mobile/fenix/issues/4833 https://github.com/mozilla-mobile/fenix/issues/4833

by dvno42 6y ago

smnrchrds 6y ago

What phone do you use?

dvno42 6y ago
OnePlus 7 Pro
- JshWright 6y ago
  Same here, with the same observed behavior.

monocasa 6y ago

I think a bunch of websites try to access the camera's metadata as a part of a fingerprinting mechanism. That's probably what you're seeing.

amoshi 6y ago
I thought so too, Xiaomi Mi 9T here with a popup camera mechanism. But then again, wouldn't the website have to ask for camera permissions? Or is there some permission-less approach like the one for evaluating MIDI devices which is used for fingerprinting?
- kbrosnan 6y ago
  Yes this is ad network fingerpriting using navigator.mediaDevices.enumerateDevices(). [1] When called without permission it would return something like > videoinput: id = csO9c0YpAf274OuCPUA53CNE0YHlIr2yXCi+SqfBZZ8= > audioinput: id = RKxXByjnabbADGQNNZqLVLdmXlS0YkETYCIbg+XxnvM= > audioinput: id = r2/xw1xUPIyZunfV1lGrKOma5wTOvCkWfZ368XCndm0= and if the user has allowed access to the camera/mic > videoinput: FaceTime HD Camera (Built-in) id=csO9c0YpAf274OuCPUA53CNE0YHlIr2yXCi+SqfBZZ8= > audioinput: default (Built-in Microphone) id=RKxXByjnabbADGQNNZqLVLdmXlS0YkETYCIbg+XxnvM= > audioinput: Built-in Microphone id=r2/xw1xUPIyZunfV1lGrKOma5wTOvCkWfZ368XCndm0= [1] https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/enumerateDevices https://developer.mozilla.org/en-US/docs/Web/API/MediaDevice...
  - _jal 6y ago
    Having a mechanism to override built in JS functions would be great fun.
    - gruez 6y ago
      AFAIK you can already do that using content scripts that execute at document_start. A lot of anti-fingerprinting scripts use this already.
      - _jal 6y ago
        Thanks for the tip, I did not know that.
  - sloshnmosh 6y ago
    That’s what I thought too as soon as I saw the title of this thread. My telco uses a heavily obfuscated script where all the variables are just a bunch of hex that uses every conceivable fingerprint technique in the book. Shockwave Flash, remote fonts, WebRTC, Silverlight, vector graphics, HTML5 cookies, hardware fingerprinting etc.
  - jacquesm 6y ago
    It's actually great to have a physical confirmation that such a fingerprint is being generated. This so called cookie-less tracking is not legal in some parts of the world because it bypasses consent which needs to be legally obtained.

kbrosnan 6y ago

That is a separate issue which is fixed in Firefox Beta as part of bug 1578073.

cpeterso 6y ago
Links to the fixed bug reports: https://bugzilla.mozilla.org/show_bug.cgi?id=1578073 https://bugzilla.mozilla.org/show_bug.cgi?id=1578073 https://github.com/mozilla-mobile/fenix/issues/4833 https://github.com/mozilla-mobile/fenix/issues/4833