4 ms·

I worked on browser fingerprinting and countermeasures during my PhD. In one paper, we showed that in the case of an anti canvas fingerprinting extension (canva

I worked on browser fingerprinting and countermeasures during my PhD. In one paper, we showed that in the case of an anti canvas fingerprinting extension (canvas defender I think) we were able to extract the seed used to randomise the canvas on each. Since by default the seed was constant, you could use it for tracking: https://hal.inria.fr/hal-01820197 https://hal.inria.fr/hal-01820197 (the paper also talks about other anti fingerprinting techniques). There is also a shorter version in a blog post: https://antoinevastel.com/tracking/2018/07/01/eval-canvasdef.html https://antoinevastel.com/tracking/2018/07/01/eval-canvasdef... (Evaluating the privacy implications of a canvas fingerprinting countermeasure)

TedDoesntTalk 6y ago
Why would they use a constant seed? How difficult is it to use a time stamp?
- extrapickles 6y ago
  Instead of timestamps, use the browsers built-in secure random number generator. Anything else can be guessed/computed.
  - deleted 6y ago
    [deleted]
- palant 6y ago
  Because any kind of predictable noise can be easily calculated and removed. And randomized noise that changes on each call can be removed by making the call multiple times and averaging out the values. So a constant noise value isn’t the worst possible idea, as long as it cannot be retrieved of course.
cookiengineer 6y ago
I have a dozen of questions... Did you also evaluate fingerprintjs in that context? Also, did you use css tracking techniques, too? Because there are hundreds of them, especially since the logical conditions spec. In my own Browser I'm trying to "fake" behaviours, so that it looks like an e.g. Chrome useragent is browsing the website. I'm also filtering a lot of CSS and HTML that could be abused to track users which is, honestly, a lot. Even the Accept header alone is enough to identify the engine. If you then use a clever webfont you'll have the navigator's version and OS identified due to antialiasing behaving differently... I'm also curious how you evaluated the fingerprintability...is there a project that you were using for that, which someone could maybe test their own browser against?
- h_anna_h 6y ago
  Which one is your browser? I would be interested in trying it.
  - cookiengineer 6y ago
    It's stealth [1] and the tl;dr is that I'm trying to build a browser that doesn't compromise on tracking, so it has to have a peer-to-peer cache and some intercepting features, such as rewriting files before the malicious parts reach the client. It's still very prototypical, so use with care. Lots of things don't work yet. [1] https://github.com/tholian-network/stealth https://github.com/tholian-network/stealth
- cookiengineer 6y ago
  (cannot edit) Nevermind my last question, I've found your project on github that you used to test the fingerprintability (fp-scanner) [1] and wanted to let others know. [1] https://github.com/antoinevastel/fpscanner https://github.com/antoinevastel/fpscanner
palant 6y ago
Nice research! Was that trick with mutation observers necessary however? If they add a constant noise vector, all you have to do is creating a canvas with known data, then call toDataURL() and compare what you get to the original data?

TedDoesntTalk 6y ago

Why would they use a constant seed? How difficult is it to use a time stamp?

extrapickles 6y ago
Instead of timestamps, use the browsers built-in secure random number generator. Anything else can be guessed/computed.
- deleted 6y ago
  [deleted]
palant 6y ago
Because any kind of predictable noise can be easily calculated and removed. And randomized noise that changes on each call can be removed by making the call multiple times and averaging out the values. So a constant noise value isn’t the worst possible idea, as long as it cannot be retrieved of course.

cookiengineer 6y ago

I have a dozen of questions... Did you also evaluate fingerprintjs in that context? Also, did you use css tracking techniques, too? Because there are hundreds of them, especially since the logical conditions spec. In my own Browser I'm trying to "fake" behaviours, so that it looks like an e.g. Chrome useragent is browsing the website. I'm also filtering a lot of CSS and HTML that could be abused to track users which is, honestly, a lot. Even the Accept header alone is enough to identify the engine. If you then use a clever webfont you'll have the navigator's version and OS identified due to antialiasing behaving differently... I'm also curious how you evaluated the fingerprintability...is there a project that you were using for that, which someone could maybe test their own browser against?

h_anna_h 6y ago
Which one is your browser? I would be interested in trying it.
- cookiengineer 6y ago
  It's stealth [1] and the tl;dr is that I'm trying to build a browser that doesn't compromise on tracking, so it has to have a peer-to-peer cache and some intercepting features, such as rewriting files before the malicious parts reach the client. It's still very prototypical, so use with care. Lots of things don't work yet. [1] https://github.com/tholian-network/stealth https://github.com/tholian-network/stealth
cookiengineer 6y ago
(cannot edit) Nevermind my last question, I've found your project on github that you used to test the fingerprintability (fp-scanner) [1] and wanted to let others know. [1] https://github.com/antoinevastel/fpscanner https://github.com/antoinevastel/fpscanner

palant 6y ago

Nice research! Was that trick with mutation observers necessary however? If they add a constant noise vector, all you have to do is creating a canvas with known data, then call toDataURL() and compare what you get to the original data?