17 ms·

Are top websites using WebGL for fingerprinting?

413 points by jonatron 6y ago

theamk 6y ago
We need more of those “do you want to allow....” confirmations. They are trivial to accept in the rare cases when webgl is actually required (online game or something), but will introduce enough friction and “default off” behavior that sites should stop using them by default. This will probably help with security as well, there has been a fair share of webgl exploits as well.
- mdtusz 6y ago
  Yes, but also no. More granular browser API permissions would be fantastic, but the current interface for grant/deny in all the major browsers is annoying enough as is. The prompts need to be moved to a less in-your-face place, or at least have the option to be. I almost always find myself clicking "deny" because no, I don't want to give your recipe site permission to show notifications. Somewhat related is the new "sign in with Google" prompt I've been seeing on lots of websites. I accidentally clicked it when visiting the Seattle Times website and have been working inundated with spam emails even after clicking unsubscribe.
- keyringlight 6y ago
  The issue with this and all similar permission dialogs is that they often go the other way, you're training the user to just hit "allow" and swat the dialog away so they can get at the task/site they wanted. It's one thing to give the user options and ask for everything, but you've got to consider whether they've got the knowledge/context behind it to make a decision and whether it's presented in a way where they won't swat it away.
  - pitaj 6y ago
    I think this can be solved via UX. When the browser wants WebGL, notification privs, etc: 1. Pend the request 2. Notify the user "This site wants access to the WebGL graphics API to display complex graphics. This is disabled by default to prevent browser fingerprinting. If the site fails to work properly, click the lock icon and allow it." 3. Deny access until the user explicitly enables it on a temporary or permanent basis
  - johnyzee 6y ago
    It should simply be disabled until the user performs an action that requires it. I believe web audio works the same way.
  - theamk 6y ago
    Remember those things are non-blocking.. for users who do not care, it is just another bar at the top they can ignore and proceed with their life. Also from a "user privacy" point of view, this is still OK. Right now, disabling webgl is so rare it makes the user stand out a lot, and can be used as a tracking signal. Also, websites do not expect this to be disabled, and can break. But if a non-trivial fraction of the users (say 10%) start refusing WebGL, then websites have to keep working without it; and the fact that it is disabled can no longer be used as tracking indicator.
superkuh 6y ago
Most bare metal features introduced into what used to be browsers, but are now virtual machines for running applications, are and will be used for malicious purposes. The idea that you should allow random strangers to run code on your machine, especially this low level, is even more crazy than opening every email attachment you get.
- gfodor 6y ago
  How would you define bare-metal? WebGL is proxied via ANGLE, so there's no risk of crashing or other forms of leaky processes, which is typically the primary thing I think of when I worry about low-level APIs.
  - choeger 6y ago
    Regardless of how you define bare-metal, OP has a point here. Besides from bespoke web applications (which should be fully packages and signed, btw.), execution of turing-complete code inside the browser is pointless. At best, it helps to workaround certain limitations (bandwidth, browser quirks), or proves the UX of a page. But mostly it is just getting in the way or outright used against the user.
  - lifthrasiir 6y ago
    ANGLE is not a virtual machine but a translation layer from OpenGL ES (on which WebGL is based) to Direct3D. Inappropriate translation would result in a direct exploit unlike VM, since AFAIK there is no practical means to sandbox shaders. In some sense it is akin to JIT in a kernel which has the roughly same security ramification.
    - labawi 6y ago
      Don't forget bugs in the driver and/or GPU firmware.
      - TazeTSchnitzel 6y ago
        Note that most of a GPU driver runs in user mode, trapped inside the browser's process sandbox.
tombert 6y ago
Forgive a bit of ignorance on this, but I'm not 100% sure I know what browser fingerprinting actually is. I remember reading something by the DuckDuckGo founder mentioning that it could be a problem even if you use a VPN and incognito mode, but I had some trouble actually figuring out what that actually meant.
- bigdict 6y ago
  My understanding is it's simply checking the level of support for different Web APIs. Since that is invariant with respect to the route between you and the website, a VPN wouldn't save you from this.
- gfodor 6y ago
  It's when a site is able to take a variety of Javascript-accessible state that in isolation is benign (such as your reported graphics driver, as the case here) but together form a unique identifier for a user given the high dimensionality involved. This allows identifying users without their consent and avoids some methods of anti-tracking.
- meheleventyone 6y ago
  Some of the web APIs expose information that in aggregate can give an almost unique fingerprint to that device. Using fingerprinting techniques you can then track what the device is doing.
- dvfjsdhgfv 6y ago
  Basically, each browser has an unique set of features so each device can be uniquely identified and profiled across different domains, regardless if you block cookies, use incognito mode and other techniques.
- have_faith 6y ago
  Using the way that your browser renders a page to uniquely identify you amongst other visitors. This can take the form of measuring how your computer generates random numbers, timing how long it takes to compute certain things, minute differences in how your your gpu renders some pixels via webgl etc. With enough signals you can pierce through the noise.
w4rh4wk5 6y ago
Just noticed, why isn't there a site setting for WebGL in Chrome?
rizz0 6y ago
Title is misleading
- Gravyness 6y ago
  True, a better would be: "WebGL is used for fingerprinting on most major websites" But if we wanted to create click bait: "Most major website implement browser fingerprinting that completely disregard VPNs and the Browser's Incognito Mode" But I bet VPN companies wouldn't like that.
Gravyness 6y ago
I propose a "This website wants to use WebGL" browser dialog before returning `getContext("webgl")`
- seba_dos1 6y ago
  Exactly this. WebGL has plenty of legitimate use cases, but those won't really suffer much from such a dialog (as long as it's reasonably phrased).
  - nerdponx 6y ago
    Until poorly-constructed websites and/or 3rd-party ad spyware added by the marketing dept starts requiring it or the site breaks. Just like Javascript, third-party cookies, canvas, localstorage... Also Google runs the browser standards by way of their Chrome market share, and they would surely never implement something like this until they were confident that they didn't need WebGL for fingerprinting, at which point they'd just stop supporting WebGL entirely in favor of something that they invented. It's not Embrace Extend Extinguish with Google; it's more like Embrace Replace Extinguish.
  - kevingadd 6y ago
    You'd be surprised how many websites use WebGL now. You'd probably end up with some sort of whitelist like the Google one for web audio, otherwise end users would complain incessantly.
    - seba_dos1 6y ago
      Web Audio's autoplay block was implemented in a very poor way though, basically guaranteeing that existing content will be broken with the user having no way to unbreak it.
- gcoguiec 6y ago
  I definitely agree with you.
- deleted 6y ago
  [deleted]
talknewswale 6y ago
एमपी में शुक्रवार को कोरोना वायरस के सभी रेकॉर्ड टूट गए हैं। https://talknewswale.com/News_detils/124 https://talknewswale.com/News_detils/124
slashink 6y ago
Some of these are probably fingerprinting but the Twitch one isn't (I worked on the video system at Twitch for a number of years). "player-core-variant-....js" is the Javascript video player and it uses WebGL as a way to guess what video format the browser can handle. A lot of the times mobile android devices will say "I can play video X, Y, Z" but when sent a bitstream of Y it fails to decode it. WebGL allows you to get a good indication of the supported hardware features which you can use to guess what the actual underlying hardware decoder is. This is sadly the state of a lot of "lower end" mobile SoCs. They will pretend to do anything but in reality it just... doesn't.
- nerdponx 6y ago
  That said, surely this "functional" information can also be valuable fingerprinting data, no? What's stopping an enterprising data science team from pulling it into their data lake, using to build ad models for logged-out users, maybe submitting it to 3rd-party machine learning vendors, etc. and generally making it undeletable?
- kjrose 6y ago
  This is interesting. I can see how it could have legitimate uses to get around bad inplementations with stating what capabilities are possible. However that being said it's like fingerprinting to sort out what their system really has. Still an abuse of the system.
  - nerdponx 6y ago
    As per my sibling (cousin?) comment, pretty much any legitimate capability-determining data can be used for fingerprinting. This can only be solved with legislation, IMO. There is no way for an industry to self-regulate something like this, the candy bowl too big and the candy too sweet.
    - throwawgler87 6y ago
      To make fingerprinting illegal, you mean? Or were you thinking of some other way to solve the problem with regulation?
kjrose 6y ago
Does anyone know if brave browser blocks this at all?
- qart 6y ago
  It does not. Check here https://browserleaks.com/webgl https://browserleaks.com/webgl
ec109685 6y ago
Here's a site that will show you your fingerprint: https://browserleaks.com/webgl https://browserleaks.com/webgl
- SavantIdiot 6y ago
  I'm confused by this page. I ran it on two MBPros side by side and they got the same fingerprint. Did I miss something? EDIT: Safari and Chrome got the same prints on both machines, FireFox got two different prints. Huh?
  - tyingq 6y ago
    I would guess nobody uses webgl exclusively for fingerprinting, but rather, in combination with other things. Apple machines are notoriously homogeneous hardware wise. You can imagine there's a much wider spread of webgl fingerprints for android phones and non-apple desktops/laptops.
  - redandblack 6y ago
    fwiw - I got different webgl report hash values between refreshes on firefox. I do have webgl fingerprint disabling addon in firefox. edit - addon faq says it injects fake values
  - tgsovlerkhgsel 6y ago
    If all hardware and software is the same, you should get the same print. Which doesn't make the fingerprint globally unique, but unique enough to make you "one of these 10000 people" instead of "any of this billion people". Combine it with other data, and the combined set identifies you uniquely.
cyberlab 6y ago
Another compelling reason to have JS disabled by default. If you need to browse those sites listed on the page, consider having a dedicated laptop that would have a specific fingerprint separate from the machine you would do most of your daily browsing on, and compartment away those sites that are known to track you across the web. I actually rarely have to enable JS on pages now. Most JS-only sites can be find in places like https://news.ycombinator.com/show https://news.ycombinator.com/show where people showcase JS-only sites / apps. Most are innocuous enough and are not trying to track you though, so I sometimes turn on JS just to test them out. I have a dedicated laptop for Youtube, Reddit etc. I'm well aware that sites like Reddit track you via JS, so I compartment / silo sites like that with a dedicated machine.
- v8dev123 6y ago
  Disabling JS does nothing when you can do network level fingerprinting.
  - cyberlab 6y ago
    > when you can do network level fingerprinting Which can be addressed with a VPN. By insulating an IP away from other IPs you can stop IP correlation.
    - v8dev123 6y ago
      Network level fingerprinting has nothing to do with IPs. It works by using protocol artifacts. But VPN do migrate the problem.
      - cyberlab 6y ago
        I Googled it and I found these two articles that touch on it briefly: https://www.researchgate.net/figure/Network-level-DNS-Fingerprinting_fig1_345007931 https://www.researchgate.net/figure/Network-level-DNS-Finger... https://securitytrails.com/blog/cybersecurity-fingerprinting https://securitytrails.com/blog/cybersecurity-fingerprinting Is this the kind of tactic you mean?
fabian2k 6y ago
WebGL is a very useful feature, but the top sites by traffic are not exactly where I'd look for good examples of WebGL use. It is a bit more of a niche feature, but for some use cases you can't really replace it at all.
modulus1 6y ago
Author doesn't actually know what this information is being used for. Sure there can be a discussion about whether this information should be recorded at all (say, to determine if your site doesn't work on certain hardware), but claiming it _is_ fingerprinting is baseless.
stonesweep 6y ago
I've had WebGL disabled forever, I don't use Twitch (as the other comment describes a valid use for) and really have never missed having it enabled for many years. It's frequently included in "secure yourself" tuning guides: Firefox -> about:config -> webgl.disabled: true
- gherkinnn 6y ago
  Well that’s inconspicuous
  - stonesweep 6y ago
    It's been awhile, but IIRC the recommendation to disable it is based on security, not privacy. Other comments here explain it better than I could, not a programmer by trade.
- criddell 6y ago
  Ironically, disabling WebGL in a browser that typically has it on is itself a pretty valuable signal when fingerprinting.
tibiahurried 6y ago
They say .. don't be evil ... yeah sure!
qwertox 6y ago
The official registration page for vaccinations in Germany ( impfterminservice.de ) uses Akamai's Bot Manager, which in turn uses WebGL for fingerprinting. It does a lot more, computes timings of certain tasks and stuff, all in all, pretty impressive work, but it is doing fingerprinting. The privacy policy of the website doesn't mention this technique, which effectively is a replacement for cookies, nor the use of any of Akamai's services. It even CNAMEs Akamai. So basically Akamai's service is left out of this list for no reason at all. I stumbled upon this while trying to automate the querying for available slots to get notified via email, and one of the POST calls was sending my graphics card model to the server.
- userbinator 6y ago
  Have you told the government how this abuse of tech is making it less accessible and also a subtle privacy invasion? It's a bit disturbing that what would've probably been a simple HTML form a decade or two ago, and would still work just fine today, instead requires this extra crap.
mikeiz404 6y ago
I have found this extension helpful for helping mitigate WebGL fingerprinting on Firefox — https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerprint-defender/ https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerp... You can test its effectiveness here — https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/
- gruez 6y ago
  > I have found this extension helpful for helping mitigate WebGL fingerprinting on Firefox — https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerp https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerp... It might work for simple fingerprinting scripts, but not for anti-anti-fingerprinting scripts. See: https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/ https://palant.info/2020/12/10/how-anti-fingerprinting-exten.... Since you're already on firefox, you're probably better off enabling resistfingerprinting instead.
  - kristofferR 6y ago
    That blog post doesn't seem valid, that extension randomizes the fingerprint each time.
    - gruez 6y ago
      It fails the first section ("Barking the wrong tree"). If I install the addon and then run gl.getParameter.toString() I get "function () { window.top.postMessage(\"webgl-fingerprint-defender-alert\", '*'); // if (arguments[0] === 3415) return 0; else if (arguments[0] === 3414) return 24; else if (arguments[0] === 36348) return 30; else if (arguments[0] === 7936) return \"WebKit\"; else if (arguments[0] === 37445) return \"Google Inc.\"; else if (arguments[0] === 7937) return \"WebKit WebGL\"; else if (arguments[0] === 3379) return config.random.number([14, 15]); else if (arguments[0] === 36347) return config.random.number([12, 13]); else if (arguments[0] === 34076) return config.random.number([14, 15]); else if (arguments[0] === 34024) return config.random.number([14, 15]); else if (arguments[0] === 3386) return config.random.int([13, 14, 15]); else if (arguments[0] === 3413) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 3412) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 3411) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 3410) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 34047) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 34930) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 34921) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 35660) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 35661) return config.random.number([4, 5, 6, 7, 8]); else if (arguments[0] === 36349) return config.random.number([10, 11, 12, 13]); else if (arguments[0] === 33902) return config.random.float([0, 10, 11, 12, 13]); else if (arguments[0] === 33901) return config.random.float([0, 10, 11, 12, 13]); else if (arguments[0] === 37446) return config.random.item([\"Graphics\", \"HD Graphics\", \"Intel(R) HD Graphics\"]); else if (arguments[0] === 7938) return config.random.item([\"WebGL 1.0\", \"WebGL 1.0 (OpenGL)\", \"WebGL 1.0 (OpenGL Chromium)\"]); else if (arguments[0] === 35724) return config.random.item([\"WebGL\", \"WebGL GLSL\", \"WebGL GLSL ES\", \"WebGL GLSL ES (OpenGL Chromium\"]); // return getParameter.apply(this, arguments); }" without the addon I get "function getParameter() { [native code] }"
animex 6y ago
Chrome: Add "/path/to/chrome.exe" --disable-webgl Firefox: about:config webgl.disabled true Edge: easiest seems to be install Disable WebGL Chrome Extension Test your browser here FIRST, then disable and test again: https://testdrive-archive.azurewebsites.net/graphics/webglstresstest/ https://testdrive-archive.azurewebsites.net/graphics/webglst...
- fallingknife 6y ago
  Wouldn't this backfire since having webgl disabled is an outlier, and you will be fingerprinted that way?
  - KirillPanov 6y ago
    It's still a cohort much, much larger than one. I've had webgl disabled for almost two years now because I don't find that webgl provides no benefit that I care about, yet lets websites slow down my laptop and drain my battery. I disabled wasm a few months ago for the same reason. You are welcome to join my cohort!
alkonaut 6y ago
How is this possible at all? Don’t allow readout of canvas (or similar) at all without asking me if it’s ok. Problem solved. I don’t care if it becomes annoying on the off website that does have a valid use case for it. This just shouldn’t happen.
- kevingadd 6y ago
  Sadly this sort of readback is necessary for various features and scenarios, so disabling it across the board is a big hassle. Brave has an approach to this where they scramble the output some to undermine its usefulness for fingerprinting, at least.
  - alkonaut 6y ago
    Again - I don’t care if it’s a hassle. It should be a hassle. If I’m on a web based image editor I accept the readout, if I’m on YouTube I definitely don’t.
  - red_trumpet 6y ago
    > for various features and scenarios What would those be?
    - kevingadd 6y ago
      GPU compute (things like particle systems, video decoders, etc), video playback, UI compositing, etc
- hogFeast 6y ago
  There are some valid reasons for using fingerprinting. In the UK, gambling companies use fingerprinting to enforce exclusion lists (i.e. gambling addicts who self-exclude from gambling websites), and stop people from outside the UK gambling illegally (the latter is used generally, although desktop apps are generally more secure). I believe it is also used in online retail to combat bots (self-evidently, not everyone is doing this). I think it is a concern when websites use this kind of thing indiscriminately. I have worked in web development roles, and I have had devs tell me point blank (once, a lead dev) that fingerprinting is impossible whilst using products that expose their customers to fingerprinting...so it is important to be aware of it. But there are legitimate uses to fingerprinting specifically, exclusive of the APIs that some apps rely on certain features (i.e. WebGL). It is sometimes important to know who someone is.
f430 6y ago
i think they are because I used to google "enjo kosai love hotels" in 2015 and it used to show me several establishments but now they block the results saying it is offensive. since when the hell did Google an American corporation become the arbitrator of morality and truths? This fingerprinting is closely tied to this. The sad part is that the web scraping technology that I've been invited access to easily bypasses this.
biryani_chicken 6y ago
Is there an extension that blocks webgl until I click something like the old Flash blocking extensions?
viseztrance 6y ago
It's quite tough to know for certain if you're being fingerprinted. I worked on finding ways around fingerprinting at a previous job. The problem is that sites go out of their way to hide fingerprinting like performing it in an arbitrary redirect and then never do it again or only after using the site for a bit, and prefer doing it before an important operation like making a payment.
- da_big_ghey 6y ago
  Did you find any realistic way person can prevent being fingerprint? most idea i have seen, like a tor browsing, is focusing on changing fingerprint and not so much on making fingerprint non-unique. But it always are easy for to connect change fingerprint to former fingerprint, so what we are really need is blending in with same fingerprint as other persons.
  - akalsz 6y ago
    > most idea i have seen, like a tor browsing, is focusing on changing fingerprint and not so much on making fingerprint non-unique. Not sure if I exactly understand what you're trying to say here, but the Tor Browser itself certainly focuses on making its users' fingerprints identical. At least it's the only browser I know of that passes fingerprint tests (Panopticlick and friends) with JavaScript enabled.
  - viseztrance 6y ago
    I don't know how it can be fully prevented other than disabling javascript, but in my opinion firefox with "privacy.resistFingerprinting" is a good start, though you'll still stand out because few people are using it. I've seen a script that performed two canvas fingerprints - a complex, and a simpler one. The latter being so simple always returned the same value regardless of the browser, so it was there to see if you have altered the canvas value. That's why changing your fingerprint might still leave you trackable.
marchided 6y ago
Yes. All of them and the rest are liars.
crazygringo 6y ago
Sorry, but this is nonsense, as presented. There is zero evidence any of these are being used for fingerprinting, which is defined as building up an entire set of capabilities to uniquely identify a user. Essentially all of these seem to be attempting to identify the graphics card, and all of these could be related to feature detection for an embedded video player, for example. Feature detection is not fingerprinting. Fingerprinting is pretty easy to confirm, because it collects a large combination of data points (fonts installed, canvas rendering quirks, etc.) and either reports or hashes them all together. (That doesn't mean it's easy to find the code that does the fingerprinting, but once you've found it it's quite obvious what it's doing.) It is deeply irresponsible and misleading of the author to claim fingerprinting without looking for that type of combination. And slapping "No claims made about accuracy" at the top of the page isn't an excuse.
- MarblePillar 6y ago
  It appears that your null hypothesis embraces the benevolence of tech companies. Is this a reasonable assumption? How, after all, do they make their money?
  - crazygringo 6y ago
    It does no such thing. You could take literally any line of code and make an unfounded claim. "It calculates a hash, and fingerprints use hashes!" "It stores a variable, and analytics uses variables!" It's on the burden of the person making an accusation of bad behavior to actually demonstrate that. Otherwise it's no different from me declaring you're an evil hacker because you comment on Hacker News, guilty until proven innocent.
    - MarblePillar 6y ago
      Missing the point. The null hypothesis determines the "unfounded claim". For example, judicially, the null hypothesis is, "You are innocent until proven guilty in a court of law." Similarly, commercially, the null hypothesis is, "If it's profitable and mostly legal, corporations will compete to do it better." Fingerprinting is both profitable and legal. It is so profitable and so legal that today's most dominant corporations, entities representing trillions of dollars of value, are founded on its premise. The "unfounded claim", therefore, is yours. Or do you have any evidence that you are not being surveilled?
iamleppert 6y ago
This is why we really need to have some kind of source obfuscation when deploying these fingerprint codes. So we won’t get caught.
everdrive 6y ago
One thing that continues to confuse me is the fact that all this remains speculative. Surely on HN, there are people who have worked in FAANGs. Doesn't anyone have first hand knowledge of how tracking is performed at various websites, and whether people are really using webGL to track? And if so, how that's stored and correlated across different sites?
DDR0 6y ago
I added a little test for this to my blog, based on Facebook's function. https://ddr0.ca/blog-posts/11.Graphics_Card_Test.html https://ddr0.ca/blog-posts/11.Graphics_Card_Test.html So far, the only things which haven't reported my graphics card to me are the Tor browser (good), KHTML (good, but probably because it doesn't support WebGL), and Lynx (of course, no js). Firefox reported much less info than Chrome did.
onefortree 6y ago
What about the situations with banks or financial related field? I think a lot of people would prefer the site collect information to check for any irregularities on who is making accounts or logging in so they can be warned if anything stands out. Fraudulent accounts pass the cost to every other customer. Maybe I haven't thought of every situation but don't you want to be able to prevent odd behavior to an account?
youngtaff 6y ago
The sites that are looking for the GPU details may have been trying to detect which CPU an iOS device has - until Apple obscured the information it used to be pretty reliable way of discovering that
codezero 6y ago
I don't doubt this is a thing, but the place to look for anything concerning is information returned from these API calls going out over the wire. Very few places encrypt or obfuscate their network requests with anything but base64, URL encoding, or maybe puny code, I've seen a few others but nothing difficult to figure out.
deleted 6y ago
[deleted]
codewiz 6y ago
window.botguard on google.com could very well be a way to detect bots running WebDriver to impersonate humans. Since WebDriver is headless, there would be detectable differences in WebGL support. This would also explain why the code is "very obfuscated".
- mike_hearn 6y ago
  That's exactly what it is. BotGuard isn't designed for identifying individual users, that's what cookies are for. It's designed to detect programs that are pretending to be normal web browsers being used but which aren't (because they're scripts, or rendering engines being automated, etc).
cookiengineer 6y ago
As I'm repeating myself too often regarding this: the statistical norm is to be trackable. Every browser that isn't will get flagged. Privacy does only exist if you seem to look exactly like any other person visiting the website. That is why user agent, web apis, asset loading order and behaviours, http stack behaviours, tcp fingerprints all have to look like they came from the Browser Engine you're trying to identify with. If you don't, you're watched. It's as simple as that. Don't kid yourself into safety if you think that the Content-Security-Policy hack of adblockers work to prevent tracking and fingerprinting. Sure, you send less data, but less data means more obvious than the norm. As there was not a single concept that could fix this (in regards to looking like another Browser) I started to build my own "web filtering browser" [1] that is able to emulate fingerprinting, and sticks them to specific domains and their originating uncached CDN requests so that if you have the same IP for the same website, they cannot correlate it to ptevious visits. The most effective way to not get tracked is to not visit the website. And I think that there's a huge potential in offloading traffic to peers that have the same URL already in their caches. Peer-to-peer Browser Caches would fix so many issues on their own, I don't understand why nobody is doing that. To the end user it doesn't matter where the assets come from, as long as the website is rendered in the same way afterwards. [1] https://github.com/tholian-network/stealth https://github.com/tholian-network/stealth
- sixothree 6y ago
  I still think there is an opportunity for a hosted browser vpn type service or a generic contained browser. It would look like every other person because every other person uses the same setup.
  - cookiengineer 6y ago
    Except tracking services know about centralized VPN IP ranges that do not rotate. That's why everybody in algotrading switched to mobile apps and 3G/4G proxies that are installed on actual smartphones, and usually they have dozens of SIM cards laying around.
    - 6y ago
PostThisTooFast 6y ago
What is "fingerprinting" supposed to mean here?

413 points by jonatron 6y ago

We need more of those “do you want to allow....” confirmations. They are trivial to accept in the rare cases when webgl is actually required (online game or something), but will introduce enough friction and “default off” behavior that sites should stop using them by default. This will probably help with security as well, there has been a fair share of webgl exploits as well.

mdtusz 6y ago
Yes, but also no. More granular browser API permissions would be fantastic, but the current interface for grant/deny in all the major browsers is annoying enough as is. The prompts need to be moved to a less in-your-face place, or at least have the option to be. I almost always find myself clicking "deny" because no, I don't want to give your recipe site permission to show notifications. Somewhat related is the new "sign in with Google" prompt I've been seeing on lots of websites. I accidentally clicked it when visiting the Seattle Times website and have been working inundated with spam emails even after clicking unsubscribe.
keyringlight 6y ago
The issue with this and all similar permission dialogs is that they often go the other way, you're training the user to just hit "allow" and swat the dialog away so they can get at the task/site they wanted. It's one thing to give the user options and ask for everything, but you've got to consider whether they've got the knowledge/context behind it to make a decision and whether it's presented in a way where they won't swat it away.
- pitaj 6y ago
  I think this can be solved via UX. When the browser wants WebGL, notification privs, etc: 1. Pend the request 2. Notify the user "This site wants access to the WebGL graphics API to display complex graphics. This is disabled by default to prevent browser fingerprinting. If the site fails to work properly, click the lock icon and allow it." 3. Deny access until the user explicitly enables it on a temporary or permanent basis
- johnyzee 6y ago
  It should simply be disabled until the user performs an action that requires it. I believe web audio works the same way.
- theamk 6y ago
  Remember those things are non-blocking.. for users who do not care, it is just another bar at the top they can ignore and proceed with their life. Also from a "user privacy" point of view, this is still OK. Right now, disabling webgl is so rare it makes the user stand out a lot, and can be used as a tracking signal. Also, websites do not expect this to be disabled, and can break. But if a non-trivial fraction of the users (say 10%) start refusing WebGL, then websites have to keep working without it; and the fact that it is disabled can no longer be used as tracking indicator.

superkuh 6y ago

Most bare metal features introduced into what used to be browsers, but are now virtual machines for running applications, are and will be used for malicious purposes. The idea that you should allow random strangers to run code on your machine, especially this low level, is even more crazy than opening every email attachment you get.

gfodor 6y ago
How would you define bare-metal? WebGL is proxied via ANGLE, so there's no risk of crashing or other forms of leaky processes, which is typically the primary thing I think of when I worry about low-level APIs.
- choeger 6y ago
  Regardless of how you define bare-metal, OP has a point here. Besides from bespoke web applications (which should be fully packages and signed, btw.), execution of turing-complete code inside the browser is pointless. At best, it helps to workaround certain limitations (bandwidth, browser quirks), or proves the UX of a page. But mostly it is just getting in the way or outright used against the user.
- lifthrasiir 6y ago
  ANGLE is not a virtual machine but a translation layer from OpenGL ES (on which WebGL is based) to Direct3D. Inappropriate translation would result in a direct exploit unlike VM, since AFAIK there is no practical means to sandbox shaders. In some sense it is akin to JIT in a kernel which has the roughly same security ramification.
  - labawi 6y ago
    Don't forget bugs in the driver and/or GPU firmware.
    - TazeTSchnitzel 6y ago
      Note that most of a GPU driver runs in user mode, trapped inside the browser's process sandbox.

tombert 6y ago

Forgive a bit of ignorance on this, but I'm not 100% sure I know what browser fingerprinting actually is. I remember reading something by the DuckDuckGo founder mentioning that it could be a problem even if you use a VPN and incognito mode, but I had some trouble actually figuring out what that actually meant.

bigdict 6y ago
My understanding is it's simply checking the level of support for different Web APIs. Since that is invariant with respect to the route between you and the website, a VPN wouldn't save you from this.
gfodor 6y ago
It's when a site is able to take a variety of Javascript-accessible state that in isolation is benign (such as your reported graphics driver, as the case here) but together form a unique identifier for a user given the high dimensionality involved. This allows identifying users without their consent and avoids some methods of anti-tracking.
meheleventyone 6y ago
Some of the web APIs expose information that in aggregate can give an almost unique fingerprint to that device. Using fingerprinting techniques you can then track what the device is doing.
dvfjsdhgfv 6y ago
Basically, each browser has an unique set of features so each device can be uniquely identified and profiled across different domains, regardless if you block cookies, use incognito mode and other techniques.
have_faith 6y ago
Using the way that your browser renders a page to uniquely identify you amongst other visitors. This can take the form of measuring how your computer generates random numbers, timing how long it takes to compute certain things, minute differences in how your your gpu renders some pixels via webgl etc. With enough signals you can pierce through the noise.

w4rh4wk5 6y ago

Just noticed, why isn't there a site setting for WebGL in Chrome?

rizz0 6y ago

Title is misleading

Gravyness 6y ago
True, a better would be: "WebGL is used for fingerprinting on most major websites" But if we wanted to create click bait: "Most major website implement browser fingerprinting that completely disregard VPNs and the Browser's Incognito Mode" But I bet VPN companies wouldn't like that.

Gravyness 6y ago

I propose a "This website wants to use WebGL" browser dialog before returning `getContext("webgl")`

seba_dos1 6y ago
Exactly this. WebGL has plenty of legitimate use cases, but those won't really suffer much from such a dialog (as long as it's reasonably phrased).
- nerdponx 6y ago
  Until poorly-constructed websites and/or 3rd-party ad spyware added by the marketing dept starts requiring it or the site breaks. Just like Javascript, third-party cookies, canvas, localstorage... Also Google runs the browser standards by way of their Chrome market share, and they would surely never implement something like this until they were confident that they didn't need WebGL for fingerprinting, at which point they'd just stop supporting WebGL entirely in favor of something that they invented. It's not Embrace Extend Extinguish with Google; it's more like Embrace Replace Extinguish.
- kevingadd 6y ago
  You'd be surprised how many websites use WebGL now. You'd probably end up with some sort of whitelist like the Google one for web audio, otherwise end users would complain incessantly.
  - seba_dos1 6y ago
    Web Audio's autoplay block was implemented in a very poor way though, basically guaranteeing that existing content will be broken with the user having no way to unbreak it.
gcoguiec 6y ago
I definitely agree with you.
deleted 6y ago
[deleted]

talknewswale 6y ago

एमपी में शुक्रवार को कोरोना वायरस के सभी रेकॉर्ड टूट गए हैं। https://talknewswale.com/News_detils/124 https://talknewswale.com/News_detils/124

slashink 6y ago

Some of these are probably fingerprinting but the Twitch one isn't (I worked on the video system at Twitch for a number of years). "player-core-variant-....js" is the Javascript video player and it uses WebGL as a way to guess what video format the browser can handle. A lot of the times mobile android devices will say "I can play video X, Y, Z" but when sent a bitstream of Y it fails to decode it. WebGL allows you to get a good indication of the supported hardware features which you can use to guess what the actual underlying hardware decoder is. This is sadly the state of a lot of "lower end" mobile SoCs. They will pretend to do anything but in reality it just... doesn't.

nerdponx 6y ago
That said, surely this "functional" information can also be valuable fingerprinting data, no? What's stopping an enterprising data science team from pulling it into their data lake, using to build ad models for logged-out users, maybe submitting it to 3rd-party machine learning vendors, etc. and generally making it undeletable?
kjrose 6y ago
This is interesting. I can see how it could have legitimate uses to get around bad inplementations with stating what capabilities are possible. However that being said it's like fingerprinting to sort out what their system really has. Still an abuse of the system.
- nerdponx 6y ago
  As per my sibling (cousin?) comment, pretty much any legitimate capability-determining data can be used for fingerprinting. This can only be solved with legislation, IMO. There is no way for an industry to self-regulate something like this, the candy bowl too big and the candy too sweet.
  - throwawgler87 6y ago
    To make fingerprinting illegal, you mean? Or were you thinking of some other way to solve the problem with regulation?

kjrose 6y ago

Does anyone know if brave browser blocks this at all?

qart 6y ago
It does not. Check here https://browserleaks.com/webgl https://browserleaks.com/webgl

ec109685 6y ago

Here's a site that will show you your fingerprint: https://browserleaks.com/webgl https://browserleaks.com/webgl

SavantIdiot 6y ago
I'm confused by this page. I ran it on two MBPros side by side and they got the same fingerprint. Did I miss something? EDIT: Safari and Chrome got the same prints on both machines, FireFox got two different prints. Huh?
- tyingq 6y ago
  I would guess nobody uses webgl exclusively for fingerprinting, but rather, in combination with other things. Apple machines are notoriously homogeneous hardware wise. You can imagine there's a much wider spread of webgl fingerprints for android phones and non-apple desktops/laptops.
- redandblack 6y ago
  fwiw - I got different webgl report hash values between refreshes on firefox. I do have webgl fingerprint disabling addon in firefox. edit - addon faq says it injects fake values
- tgsovlerkhgsel 6y ago
  If all hardware and software is the same, you should get the same print. Which doesn't make the fingerprint globally unique, but unique enough to make you "one of these 10000 people" instead of "any of this billion people". Combine it with other data, and the combined set identifies you uniquely.

cyberlab 6y ago

Another compelling reason to have JS disabled by default. If you need to browse those sites listed on the page, consider having a dedicated laptop that would have a specific fingerprint separate from the machine you would do most of your daily browsing on, and compartment away those sites that are known to track you across the web. I actually rarely have to enable JS on pages now. Most JS-only sites can be find in places like https://news.ycombinator.com/show https://news.ycombinator.com/show where people showcase JS-only sites / apps. Most are innocuous enough and are not trying to track you though, so I sometimes turn on JS just to test them out. I have a dedicated laptop for Youtube, Reddit etc. I'm well aware that sites like Reddit track you via JS, so I compartment / silo sites like that with a dedicated machine.

v8dev123 6y ago
Disabling JS does nothing when you can do network level fingerprinting.
- cyberlab 6y ago
  > when you can do network level fingerprinting Which can be addressed with a VPN. By insulating an IP away from other IPs you can stop IP correlation.
  - v8dev123 6y ago
    Network level fingerprinting has nothing to do with IPs. It works by using protocol artifacts. But VPN do migrate the problem.
    - cyberlab 6y ago
      I Googled it and I found these two articles that touch on it briefly: https://www.researchgate.net/figure/Network-level-DNS-Fingerprinting_fig1_345007931 https://www.researchgate.net/figure/Network-level-DNS-Finger... https://securitytrails.com/blog/cybersecurity-fingerprinting https://securitytrails.com/blog/cybersecurity-fingerprinting Is this the kind of tactic you mean?

fabian2k 6y ago

WebGL is a very useful feature, but the top sites by traffic are not exactly where I'd look for good examples of WebGL use. It is a bit more of a niche feature, but for some use cases you can't really replace it at all.

modulus1 6y ago

Author doesn't actually know what this information is being used for. Sure there can be a discussion about whether this information should be recorded at all (say, to determine if your site doesn't work on certain hardware), but claiming it _is_ fingerprinting is baseless.

stonesweep 6y ago

I've had WebGL disabled forever, I don't use Twitch (as the other comment describes a valid use for) and really have never missed having it enabled for many years. It's frequently included in "secure yourself" tuning guides: Firefox -> about:config -> webgl.disabled: true

gherkinnn 6y ago
Well that’s inconspicuous
- stonesweep 6y ago
  It's been awhile, but IIRC the recommendation to disable it is based on security, not privacy. Other comments here explain it better than I could, not a programmer by trade.
criddell 6y ago
Ironically, disabling WebGL in a browser that typically has it on is itself a pretty valuable signal when fingerprinting.

tibiahurried 6y ago

They say .. don't be evil ... yeah sure!

qwertox 6y ago

The official registration page for vaccinations in Germany ( impfterminservice.de ) uses Akamai's Bot Manager, which in turn uses WebGL for fingerprinting. It does a lot more, computes timings of certain tasks and stuff, all in all, pretty impressive work, but it is doing fingerprinting. The privacy policy of the website doesn't mention this technique, which effectively is a replacement for cookies, nor the use of any of Akamai's services. It even CNAMEs Akamai. So basically Akamai's service is left out of this list for no reason at all. I stumbled upon this while trying to automate the querying for available slots to get notified via email, and one of the POST calls was sending my graphics card model to the server.

userbinator 6y ago
Have you told the government how this abuse of tech is making it less accessible and also a subtle privacy invasion? It's a bit disturbing that what would've probably been a simple HTML form a decade or two ago, and would still work just fine today, instead requires this extra crap.

mikeiz404 6y ago

I have found this extension helpful for helping mitigate WebGL fingerprinting on Firefox — https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerprint-defender/ https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerp... You can test its effectiveness here — https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/

gruez 6y ago
> I have found this extension helpful for helping mitigate WebGL fingerprinting on Firefox — https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerp https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerp... It might work for simple fingerprinting scripts, but not for anti-anti-fingerprinting scripts. See: https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/ https://palant.info/2020/12/10/how-anti-fingerprinting-exten.... Since you're already on firefox, you're probably better off enabling resistfingerprinting instead.
- kristofferR 6y ago
  That blog post doesn't seem valid, that extension randomizes the fingerprint each time.
  - gruez 6y ago
    It fails the first section ("Barking the wrong tree"). If I install the addon and then run gl.getParameter.toString() I get "function () { window.top.postMessage(\"webgl-fingerprint-defender-alert\", '*'); // if (arguments[0] === 3415) return 0; else if (arguments[0] === 3414) return 24; else if (arguments[0] === 36348) return 30; else if (arguments[0] === 7936) return \"WebKit\"; else if (arguments[0] === 37445) return \"Google Inc.\"; else if (arguments[0] === 7937) return \"WebKit WebGL\"; else if (arguments[0] === 3379) return config.random.number([14, 15]); else if (arguments[0] === 36347) return config.random.number([12, 13]); else if (arguments[0] === 34076) return config.random.number([14, 15]); else if (arguments[0] === 34024) return config.random.number([14, 15]); else if (arguments[0] === 3386) return config.random.int([13, 14, 15]); else if (arguments[0] === 3413) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 3412) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 3411) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 3410) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 34047) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 34930) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 34921) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 35660) return config.random.number([1, 2, 3, 4]); else if (arguments[0] === 35661) return config.random.number([4, 5, 6, 7, 8]); else if (arguments[0] === 36349) return config.random.number([10, 11, 12, 13]); else if (arguments[0] === 33902) return config.random.float([0, 10, 11, 12, 13]); else if (arguments[0] === 33901) return config.random.float([0, 10, 11, 12, 13]); else if (arguments[0] === 37446) return config.random.item([\"Graphics\", \"HD Graphics\", \"Intel(R) HD Graphics\"]); else if (arguments[0] === 7938) return config.random.item([\"WebGL 1.0\", \"WebGL 1.0 (OpenGL)\", \"WebGL 1.0 (OpenGL Chromium)\"]); else if (arguments[0] === 35724) return config.random.item([\"WebGL\", \"WebGL GLSL\", \"WebGL GLSL ES\", \"WebGL GLSL ES (OpenGL Chromium\"]); // return getParameter.apply(this, arguments); }" without the addon I get "function getParameter() { [native code] }"

animex 6y ago

Chrome: Add "/path/to/chrome.exe" --disable-webgl Firefox: about:config webgl.disabled true Edge: easiest seems to be install Disable WebGL Chrome Extension Test your browser here FIRST, then disable and test again: https://testdrive-archive.azurewebsites.net/graphics/webglstresstest/ https://testdrive-archive.azurewebsites.net/graphics/webglst...

fallingknife 6y ago
Wouldn't this backfire since having webgl disabled is an outlier, and you will be fingerprinted that way?
- KirillPanov 6y ago
  It's still a cohort much, much larger than one. I've had webgl disabled for almost two years now because I don't find that webgl provides no benefit that I care about, yet lets websites slow down my laptop and drain my battery. I disabled wasm a few months ago for the same reason. You are welcome to join my cohort!

alkonaut 6y ago

How is this possible at all? Don’t allow readout of canvas (or similar) at all without asking me if it’s ok. Problem solved. I don’t care if it becomes annoying on the off website that does have a valid use case for it. This just shouldn’t happen.

kevingadd 6y ago
Sadly this sort of readback is necessary for various features and scenarios, so disabling it across the board is a big hassle. Brave has an approach to this where they scramble the output some to undermine its usefulness for fingerprinting, at least.
- alkonaut 6y ago
  Again - I don’t care if it’s a hassle. It should be a hassle. If I’m on a web based image editor I accept the readout, if I’m on YouTube I definitely don’t.
- red_trumpet 6y ago
  > for various features and scenarios What would those be?
  - kevingadd 6y ago
    GPU compute (things like particle systems, video decoders, etc), video playback, UI compositing, etc
hogFeast 6y ago
There are some valid reasons for using fingerprinting. In the UK, gambling companies use fingerprinting to enforce exclusion lists (i.e. gambling addicts who self-exclude from gambling websites), and stop people from outside the UK gambling illegally (the latter is used generally, although desktop apps are generally more secure). I believe it is also used in online retail to combat bots (self-evidently, not everyone is doing this). I think it is a concern when websites use this kind of thing indiscriminately. I have worked in web development roles, and I have had devs tell me point blank (once, a lead dev) that fingerprinting is impossible whilst using products that expose their customers to fingerprinting...so it is important to be aware of it. But there are legitimate uses to fingerprinting specifically, exclusive of the APIs that some apps rely on certain features (i.e. WebGL). It is sometimes important to know who someone is.

f430 6y ago

i think they are because I used to google "enjo kosai love hotels" in 2015 and it used to show me several establishments but now they block the results saying it is offensive. since when the hell did Google an American corporation become the arbitrator of morality and truths? This fingerprinting is closely tied to this. The sad part is that the web scraping technology that I've been invited access to easily bypasses this.

biryani_chicken 6y ago

Is there an extension that blocks webgl until I click something like the old Flash blocking extensions?

viseztrance 6y ago

It's quite tough to know for certain if you're being fingerprinted. I worked on finding ways around fingerprinting at a previous job. The problem is that sites go out of their way to hide fingerprinting like performing it in an arbitrary redirect and then never do it again or only after using the site for a bit, and prefer doing it before an important operation like making a payment.

da_big_ghey 6y ago
Did you find any realistic way person can prevent being fingerprint? most idea i have seen, like a tor browsing, is focusing on changing fingerprint and not so much on making fingerprint non-unique. But it always are easy for to connect change fingerprint to former fingerprint, so what we are really need is blending in with same fingerprint as other persons.
- akalsz 6y ago
  > most idea i have seen, like a tor browsing, is focusing on changing fingerprint and not so much on making fingerprint non-unique. Not sure if I exactly understand what you're trying to say here, but the Tor Browser itself certainly focuses on making its users' fingerprints identical. At least it's the only browser I know of that passes fingerprint tests (Panopticlick and friends) with JavaScript enabled.
- viseztrance 6y ago
  I don't know how it can be fully prevented other than disabling javascript, but in my opinion firefox with "privacy.resistFingerprinting" is a good start, though you'll still stand out because few people are using it. I've seen a script that performed two canvas fingerprints - a complex, and a simpler one. The latter being so simple always returned the same value regardless of the browser, so it was there to see if you have altered the canvas value. That's why changing your fingerprint might still leave you trackable.

marchided 6y ago

Yes. All of them and the rest are liars.

crazygringo 6y ago

Sorry, but this is nonsense, as presented. There is zero evidence any of these are being used for fingerprinting, which is defined as building up an entire set of capabilities to uniquely identify a user. Essentially all of these seem to be attempting to identify the graphics card, and all of these could be related to feature detection for an embedded video player, for example. Feature detection is not fingerprinting. Fingerprinting is pretty easy to confirm, because it collects a large combination of data points (fonts installed, canvas rendering quirks, etc.) and either reports or hashes them all together. (That doesn't mean it's easy to find the code that does the fingerprinting, but once you've found it it's quite obvious what it's doing.) It is deeply irresponsible and misleading of the author to claim fingerprinting without looking for that type of combination. And slapping "No claims made about accuracy" at the top of the page isn't an excuse.

MarblePillar 6y ago
It appears that your null hypothesis embraces the benevolence of tech companies. Is this a reasonable assumption? How, after all, do they make their money?
- crazygringo 6y ago
  It does no such thing. You could take literally any line of code and make an unfounded claim. "It calculates a hash, and fingerprints use hashes!" "It stores a variable, and analytics uses variables!" It's on the burden of the person making an accusation of bad behavior to actually demonstrate that. Otherwise it's no different from me declaring you're an evil hacker because you comment on Hacker News, guilty until proven innocent.
  - MarblePillar 6y ago
    Missing the point. The null hypothesis determines the "unfounded claim". For example, judicially, the null hypothesis is, "You are innocent until proven guilty in a court of law." Similarly, commercially, the null hypothesis is, "If it's profitable and mostly legal, corporations will compete to do it better." Fingerprinting is both profitable and legal. It is so profitable and so legal that today's most dominant corporations, entities representing trillions of dollars of value, are founded on its premise. The "unfounded claim", therefore, is yours. Or do you have any evidence that you are not being surveilled?

iamleppert 6y ago

This is why we really need to have some kind of source obfuscation when deploying these fingerprint codes. So we won’t get caught.

everdrive 6y ago

One thing that continues to confuse me is the fact that all this remains speculative. Surely on HN, there are people who have worked in FAANGs. Doesn't anyone have first hand knowledge of how tracking is performed at various websites, and whether people are really using webGL to track? And if so, how that's stored and correlated across different sites?

DDR0 6y ago

I added a little test for this to my blog, based on Facebook's function. https://ddr0.ca/blog-posts/11.Graphics_Card_Test.html https://ddr0.ca/blog-posts/11.Graphics_Card_Test.html So far, the only things which haven't reported my graphics card to me are the Tor browser (good), KHTML (good, but probably because it doesn't support WebGL), and Lynx (of course, no js). Firefox reported much less info than Chrome did.

onefortree 6y ago

What about the situations with banks or financial related field? I think a lot of people would prefer the site collect information to check for any irregularities on who is making accounts or logging in so they can be warned if anything stands out. Fraudulent accounts pass the cost to every other customer. Maybe I haven't thought of every situation but don't you want to be able to prevent odd behavior to an account?

youngtaff 6y ago

The sites that are looking for the GPU details may have been trying to detect which CPU an iOS device has - until Apple obscured the information it used to be pretty reliable way of discovering that

codezero 6y ago

I don't doubt this is a thing, but the place to look for anything concerning is information returned from these API calls going out over the wire. Very few places encrypt or obfuscate their network requests with anything but base64, URL encoding, or maybe puny code, I've seen a few others but nothing difficult to figure out.

deleted 6y ago

[deleted]

codewiz 6y ago

window.botguard on google.com could very well be a way to detect bots running WebDriver to impersonate humans. Since WebDriver is headless, there would be detectable differences in WebGL support. This would also explain why the code is "very obfuscated".

mike_hearn 6y ago
That's exactly what it is. BotGuard isn't designed for identifying individual users, that's what cookies are for. It's designed to detect programs that are pretending to be normal web browsers being used but which aren't (because they're scripts, or rendering engines being automated, etc).

cookiengineer 6y ago

As I'm repeating myself too often regarding this: the statistical norm is to be trackable. Every browser that isn't will get flagged. Privacy does only exist if you seem to look exactly like any other person visiting the website. That is why user agent, web apis, asset loading order and behaviours, http stack behaviours, tcp fingerprints all have to look like they came from the Browser Engine you're trying to identify with. If you don't, you're watched. It's as simple as that. Don't kid yourself into safety if you think that the Content-Security-Policy hack of adblockers work to prevent tracking and fingerprinting. Sure, you send less data, but less data means more obvious than the norm. As there was not a single concept that could fix this (in regards to looking like another Browser) I started to build my own "web filtering browser" [1] that is able to emulate fingerprinting, and sticks them to specific domains and their originating uncached CDN requests so that if you have the same IP for the same website, they cannot correlate it to ptevious visits. The most effective way to not get tracked is to not visit the website. And I think that there's a huge potential in offloading traffic to peers that have the same URL already in their caches. Peer-to-peer Browser Caches would fix so many issues on their own, I don't understand why nobody is doing that. To the end user it doesn't matter where the assets come from, as long as the website is rendered in the same way afterwards. [1] https://github.com/tholian-network/stealth https://github.com/tholian-network/stealth

sixothree 6y ago
I still think there is an opportunity for a hosted browser vpn type service or a generic contained browser. It would look like every other person because every other person uses the same setup.
- cookiengineer 6y ago
  Except tracking services know about centralized VPN IP ranges that do not rotate. That's why everybody in algotrading switched to mobile apps and 3G/4G proxies that are installed on actual smartphones, and usually they have dozens of SIM cards laying around.
  - 6y ago

PostThisTooFast 6y ago

What is "fingerprinting" supposed to mean here?