5 ms·

Google +1 tracks mouse movements?

97 points by Gullanian 15y ago

sundae79 15y ago
Does the emperor wear any clothes?
tectonic 15y ago
According to the link, this is being used as a source of entropy to generate random numbers. Fascinating.
- palish 15y ago
  Hah! That's so simple, yet so brilliant.
  - obtino 15y ago
    Mouse movements have been long used as a source of entropy in desktop applications.
    - shadowfox 15y ago
      Indeed. Putty's keygen thing has been using it for quite a long time for example
      - snippyhollow 15y ago
        /dev/random too :) http://www.mail-archive.com/cryptography@c2.net/msg01708.html http://www.mail-archive.com/cryptography@c2.net/msg01708.htm...
      - deleted 15y ago
        [deleted]
    - Hawramani 15y ago
      I read that PGP did that in the 90's.
- willscott 15y ago
  Seems pretty reasonable to expect it to be this code from the apache shindig library: http://svn.apache.org/repos/asf/shindig/trunk/features/src/main/javascript/features/shindig.random/random.js http://svn.apache.org/repos/asf/shindig/trunk/features/src/m... From the file: This code implements a safer random() method that is seeded from screen width/height and (presumably random/unguessable) mouse movement, in an effort to create a better seed for random(). Its aim is to solve the problem of gadgets that are relying on secret RPC tokens to validate identity.
- sebkomianos 15y ago
  Aren't there a lot of patterns on how we interact with an interface? For example, most people on facebook move their pointers to check their notifications/new messages/friend requests. Wouldn't that produce a lot of "not so random" random numbers? (I am not looking to start a conversation on how random random numbers are, just curious on why they used this specific technique)
Palomides 15y ago
cute, but surely there are less intensive ways of generating random numbers?
- glimcat 15y ago
  I've always been a fan of using electronic noise. It's not complicated to build a device which does this. Weekend project to "hello world" scale if you're not too picky about specifics. Easiest way is probably with a webcam, which will also give you a pretty good bitrate. The general schema is to read out the bias noise. You do this by blocking out any incoming light to get dark noise + bias noise. Dark noise is an assumed static shift due to CCD characteristics, so read N frames of this and look for the median signal. Subtract that off and you've got the bias, or at least something that's close enough for a weekend project. Better version, start reading up on the math of noise sources in whatever device you want to use for a sensor. Also do an analysis of N samples to see how close the result comes to the expectation value given the type of noise involved and what deviation is expected at N samples.
  - baddox 15y ago
    There's no way to deploy this over the web, unless you use Flash to acquire their webcam video or audio.
    - deleted 15y ago
      [deleted]
    - glimcat 15y ago
      Packet latency, for example. The general idea is that there are many noise sources which technology normally needs to route around. To find random number sources, you reverse this.
      - pilif 15y ago
        Even something as simple as packet latency is really hard to get from JS. the timing functions you get from the browser are way too low resolution. Also the only network latency you can test for is doing an xmlhttp request as that's the only way o do any network communication (minus web sockets which arent generally available) Aside of that, you get no direct hardware access to measure and even if you would, there is still the timer resolution problem. Very recent browsers provide an API to get strong random numbers, but this is even less widely available than web sockets. So either you take the mouse movement or you use something like Java or Flash, or you use bad numbers.
brianshumate 15y ago
Seems like overall, it's definitely code to help thwart gaming of the +1 system, as there is already a cottage industry that offers (presumably) automated +1 clicking services for money.
anon543 15y ago
Google Analytics does it too, which makes approx. 85% of all web sites you visit.
- zobzu 15y ago
  adblock'd sites dont do it :)
victoriussecret 15y ago
I'm not sure how often research papers reflect reality, but Bing may be doing this as well, according to this Microsoft Research paper: http://jeffhuang.com/Final_CursorBehavior_CHI11.pdf http://jeffhuang.com/Final_CursorBehavior_CHI11.pdf
- antics 15y ago
  This is a very good paper, but it seems to approach mouse tracking specifically from the search perspective. Perhaps not extremely pertinent, but still super interesting.
known 15y ago
http://www.ghostery.com/ http://www.ghostery.com/ prevents it

97 points by Gullanian 15y ago

sundae79 15y ago

Does the emperor wear any clothes?

tectonic 15y ago

According to the link, this is being used as a source of entropy to generate random numbers. Fascinating.

palish 15y ago
Hah! That's so simple, yet so brilliant.
- obtino 15y ago
  Mouse movements have been long used as a source of entropy in desktop applications.
  - shadowfox 15y ago
    Indeed. Putty's keygen thing has been using it for quite a long time for example
    - snippyhollow 15y ago
      /dev/random too :) http://www.mail-archive.com/cryptography@c2.net/msg01708.html http://www.mail-archive.com/cryptography@c2.net/msg01708.htm...
    - deleted 15y ago
      [deleted]
  - Hawramani 15y ago
    I read that PGP did that in the 90's.
willscott 15y ago
Seems pretty reasonable to expect it to be this code from the apache shindig library: http://svn.apache.org/repos/asf/shindig/trunk/features/src/main/javascript/features/shindig.random/random.js http://svn.apache.org/repos/asf/shindig/trunk/features/src/m... From the file: This code implements a safer random() method that is seeded from screen width/height and (presumably random/unguessable) mouse movement, in an effort to create a better seed for random(). Its aim is to solve the problem of gadgets that are relying on secret RPC tokens to validate identity.
sebkomianos 15y ago
Aren't there a lot of patterns on how we interact with an interface? For example, most people on facebook move their pointers to check their notifications/new messages/friend requests. Wouldn't that produce a lot of "not so random" random numbers? (I am not looking to start a conversation on how random random numbers are, just curious on why they used this specific technique)

Palomides 15y ago

cute, but surely there are less intensive ways of generating random numbers?

glimcat 15y ago
I've always been a fan of using electronic noise. It's not complicated to build a device which does this. Weekend project to "hello world" scale if you're not too picky about specifics. Easiest way is probably with a webcam, which will also give you a pretty good bitrate. The general schema is to read out the bias noise. You do this by blocking out any incoming light to get dark noise + bias noise. Dark noise is an assumed static shift due to CCD characteristics, so read N frames of this and look for the median signal. Subtract that off and you've got the bias, or at least something that's close enough for a weekend project. Better version, start reading up on the math of noise sources in whatever device you want to use for a sensor. Also do an analysis of N samples to see how close the result comes to the expectation value given the type of noise involved and what deviation is expected at N samples.
- baddox 15y ago
  There's no way to deploy this over the web, unless you use Flash to acquire their webcam video or audio.
  - deleted 15y ago
    [deleted]
  - glimcat 15y ago
    Packet latency, for example. The general idea is that there are many noise sources which technology normally needs to route around. To find random number sources, you reverse this.
    - pilif 15y ago
      Even something as simple as packet latency is really hard to get from JS. the timing functions you get from the browser are way too low resolution. Also the only network latency you can test for is doing an xmlhttp request as that's the only way o do any network communication (minus web sockets which arent generally available) Aside of that, you get no direct hardware access to measure and even if you would, there is still the timer resolution problem. Very recent browsers provide an API to get strong random numbers, but this is even less widely available than web sockets. So either you take the mouse movement or you use something like Java or Flash, or you use bad numbers.

brianshumate 15y ago

Seems like overall, it's definitely code to help thwart gaming of the +1 system, as there is already a cottage industry that offers (presumably) automated +1 clicking services for money.

anon543 15y ago

Google Analytics does it too, which makes approx. 85% of all web sites you visit.

zobzu 15y ago
adblock'd sites dont do it :)

victoriussecret 15y ago

I'm not sure how often research papers reflect reality, but Bing may be doing this as well, according to this Microsoft Research paper: http://jeffhuang.com/Final_CursorBehavior_CHI11.pdf http://jeffhuang.com/Final_CursorBehavior_CHI11.pdf

antics 15y ago
This is a very good paper, but it seems to approach mouse tracking specifically from the search perspective. Perhaps not extremely pertinent, but still super interesting.

known 15y ago

http://www.ghostery.com/ http://www.ghostery.com/ prevents it