4 ms·

I've no idea whether it works, but they misidentified many apps I don't have installed (Postman, Express VPN, Notion, Figma, Hotspot Shield) It does do the pop

I've no idea whether it works, but they misidentified many apps I don't have installed (Postman, Express VPN, Notion, Figma, Hotspot Shield) It does do the popup for VSCode asking if I want to open links there, which I do have installed.

yjftsjthsd-h 5y ago
Yeah, it gave me quite a list of programs, including xcode and itunes, which is fascinating on a Linux box... they list 20 programs they think I have installed, of which I actually have 2. I'm not sure why it would be so inaccurate, but I feel better...
- nolok 5y ago
  > I'm not sure why it would be so inaccurate, but I feel better... I don't think you understood the core of the issue: it's not about identifying which applications you have installed, it's about always getting the same result for the same user. If all your browsers serve the same results, you are trackable, no matter if those results are good or not.
  - filmfact 5y ago
    I think the implication is that this is far fewer bits of entropy than the authors indicate. Four bits (in isolation), are not a meaningful identifer.
    - nolok 5y ago
      It's not four, the fact that the others applications are reliably detected as not present are additional bits.
dathinab 5y ago
I guess (and just that), that this can happen if there are overlaps in the scheme handlers. I.e. there are some schemas which lets say XCode handles but which also some other program handles.
- buggeryorkshire 5y ago
  Yeah makes sense if it's the schema handlers. I'd just not be as assertive if I was them that something was installed if there was overlap.
  - dathinab 5y ago
    It also doesn't work at all under Chromium for Linux no idea why but the result is complete garbage.
    - valve1 5y ago
      yeah, chrome/chromium on linux not tested at all, mostly because nobody on the team is using linux. We tested it on MacOS Big Sur and a bit of Windows. Full table of what was tested here: https://github.com/fingerprintjs/external-protocol-flooding#target-browsers https://github.com/fingerprintjs/external-protocol-flooding#... dathinab

yjftsjthsd-h 5y ago

Yeah, it gave me quite a list of programs, including xcode and itunes, which is fascinating on a Linux box... they list 20 programs they think I have installed, of which I actually have 2. I'm not sure why it would be so inaccurate, but I feel better...

nolok 5y ago
> I'm not sure why it would be so inaccurate, but I feel better... I don't think you understood the core of the issue: it's not about identifying which applications you have installed, it's about always getting the same result for the same user. If all your browsers serve the same results, you are trackable, no matter if those results are good or not.
- filmfact 5y ago
  I think the implication is that this is far fewer bits of entropy than the authors indicate. Four bits (in isolation), are not a meaningful identifer.
  - nolok 5y ago
    It's not four, the fact that the others applications are reliably detected as not present are additional bits.

dathinab 5y ago

I guess (and just that), that this can happen if there are overlaps in the scheme handlers. I.e. there are some schemas which lets say XCode handles but which also some other program handles.

buggeryorkshire 5y ago
Yeah makes sense if it's the schema handlers. I'd just not be as assertive if I was them that something was installed if there was overlap.
- dathinab 5y ago
  It also doesn't work at all under Chromium for Linux no idea why but the result is complete garbage.
  - valve1 5y ago
    yeah, chrome/chromium on linux not tested at all, mostly because nobody on the team is using linux. We tested it on MacOS Big Sur and a bit of Windows. Full table of what was tested here: https://github.com/fingerprintjs/external-protocol-flooding#target-browsers https://github.com/fingerprintjs/external-protocol-flooding#... dathinab