4 ms·

I thought so too, Xiaomi Mi 9T here with a popup camera mechanism. But then again, wouldn't the website have to ask for camera permissions? Or is there some per

by amoshi 6y ago

I thought so too, Xiaomi Mi 9T here with a popup camera mechanism. But then again, wouldn't the website have to ask for camera permissions? Or is there some permission-less approach like the one for evaluating MIDI devices which is used for fingerprinting?

kbrosnan 6y ago
Yes this is ad network fingerpriting using navigator.mediaDevices.enumerateDevices(). [1] When called without permission it would return something like > videoinput: id = csO9c0YpAf274OuCPUA53CNE0YHlIr2yXCi+SqfBZZ8= > audioinput: id = RKxXByjnabbADGQNNZqLVLdmXlS0YkETYCIbg+XxnvM= > audioinput: id = r2/xw1xUPIyZunfV1lGrKOma5wTOvCkWfZ368XCndm0= and if the user has allowed access to the camera/mic > videoinput: FaceTime HD Camera (Built-in) id=csO9c0YpAf274OuCPUA53CNE0YHlIr2yXCi+SqfBZZ8= > audioinput: default (Built-in Microphone) id=RKxXByjnabbADGQNNZqLVLdmXlS0YkETYCIbg+XxnvM= > audioinput: Built-in Microphone id=r2/xw1xUPIyZunfV1lGrKOma5wTOvCkWfZ368XCndm0= [1] https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/enumerateDevices https://developer.mozilla.org/en-US/docs/Web/API/MediaDevice...
- _jal 6y ago
  Having a mechanism to override built in JS functions would be great fun.
  - gruez 6y ago
    AFAIK you can already do that using content scripts that execute at document_start. A lot of anti-fingerprinting scripts use this already.
    - _jal 6y ago
      Thanks for the tip, I did not know that.
- sloshnmosh 6y ago
  That’s what I thought too as soon as I saw the title of this thread. My telco uses a heavily obfuscated script where all the variables are just a bunch of hex that uses every conceivable fingerprint technique in the book. Shockwave Flash, remote fonts, WebRTC, Silverlight, vector graphics, HTML5 cookies, hardware fingerprinting etc.
- jacquesm 6y ago
  It's actually great to have a physical confirmation that such a fingerprint is being generated. This so called cookie-less tracking is not legal in some parts of the world because it bypasses consent which needs to be legally obtained.
- amoshi 6y ago
  Thanks for this, seems to confirm my suspicions. The camera popup happened quite often on Glassdoor, which I remember once blocking me for some time after I blocked their canvas fingerprinting attempts. Just checked and that seems to no longer be there. Disappointing state of affairs overall.
- gruez 6y ago
  It doesn't look too fingerprintable. The ids seems to change once you closed all the tabs belonging to a site (on firefox), on on reload (chromium) so the max they can fingerprint is how many devices of each type you have. the site I used to test: https://browserleaks.com/webrtc https://browserleaks.com/webrtc
  - monocasa 6y ago
    Number and type of devices are still useful for fingerprinting when combined with other sources of information. That's how modern fingerprinting tends to work. A few bits here, a few bits there, all combined.

by amoshi 6y ago

kbrosnan 6y ago

Yes this is ad network fingerpriting using navigator.mediaDevices.enumerateDevices(). [1] When called without permission it would return something like > videoinput: id = csO9c0YpAf274OuCPUA53CNE0YHlIr2yXCi+SqfBZZ8= > audioinput: id = RKxXByjnabbADGQNNZqLVLdmXlS0YkETYCIbg+XxnvM= > audioinput: id = r2/xw1xUPIyZunfV1lGrKOma5wTOvCkWfZ368XCndm0= and if the user has allowed access to the camera/mic > videoinput: FaceTime HD Camera (Built-in) id=csO9c0YpAf274OuCPUA53CNE0YHlIr2yXCi+SqfBZZ8= > audioinput: default (Built-in Microphone) id=RKxXByjnabbADGQNNZqLVLdmXlS0YkETYCIbg+XxnvM= > audioinput: Built-in Microphone id=r2/xw1xUPIyZunfV1lGrKOma5wTOvCkWfZ368XCndm0= [1] https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/enumerateDevices https://developer.mozilla.org/en-US/docs/Web/API/MediaDevice...

_jal 6y ago
Having a mechanism to override built in JS functions would be great fun.
- gruez 6y ago
  AFAIK you can already do that using content scripts that execute at document_start. A lot of anti-fingerprinting scripts use this already.
  - _jal 6y ago
    Thanks for the tip, I did not know that.
sloshnmosh 6y ago
That’s what I thought too as soon as I saw the title of this thread. My telco uses a heavily obfuscated script where all the variables are just a bunch of hex that uses every conceivable fingerprint technique in the book. Shockwave Flash, remote fonts, WebRTC, Silverlight, vector graphics, HTML5 cookies, hardware fingerprinting etc.
jacquesm 6y ago
It's actually great to have a physical confirmation that such a fingerprint is being generated. This so called cookie-less tracking is not legal in some parts of the world because it bypasses consent which needs to be legally obtained.
amoshi 6y ago
Thanks for this, seems to confirm my suspicions. The camera popup happened quite often on Glassdoor, which I remember once blocking me for some time after I blocked their canvas fingerprinting attempts. Just checked and that seems to no longer be there. Disappointing state of affairs overall.
gruez 6y ago
It doesn't look too fingerprintable. The ids seems to change once you closed all the tabs belonging to a site (on firefox), on on reload (chromium) so the max they can fingerprint is how many devices of each type you have. the site I used to test: https://browserleaks.com/webrtc https://browserleaks.com/webrtc
- monocasa 6y ago
  Number and type of devices are still useful for fingerprinting when combined with other sources of information. That's how modern fingerprinting tends to work. A few bits here, a few bits there, all combined.