36 ms·
Bypassing Safari 17's advanced audio fingerprinting protection
- omnicognate 3y agoWhy am I supposed to want any website I visit to be able to render audio offline anyway?
- nox101 3y agohttps://wavacity.com/ https://wavacity.com/ ?
- omnicognate 3y agoAudacity's an awesome piece of software that I've used many times. Never once have I thought "by golly this thing should be a website, and my web browser should be made to expose an audio graph API to every website I visit to that it can be so!"
- jauntywundrkind 3y agoWe'll make sure we stop building software you could imagine then. /s There's value here. Other people are allowed to want more than you want.
- goodSteveramos 3y agoGet with the times. Your privacy must be sacrificed so some random web app you have never heard of can do something no website should be able to do at all. Or maybe that’s just a pretense and not the real reason Google keeps adding all these APIs. People seem to forget that ChromeOS is literally Google trying to turn every computer into a thin client for their services.
- nox101 3y agoI'm the opposite. I think website = sanboxed, native = pownage so whenever I can use a website version I often prefer it over a native app. I use photopea all the time now. it's available on every machine, even machines I don't have permission to install software on
- spookie 3y agoYou can sandbox native apps too. Hell, even run them in an airgapped virtual machine. I wouldn't trust a browser sandbox all that much given the high interest in subverting it.
- dannyw 3y agoWhat’s an easy way to sandbox apps on Windows? Sorry, I’d prefer to stick with my operating system, not install QubesOS.
- pcdoodle 3y agosandboxie was neat last time i tried it.
- EraYaN 3y agoWindows has a native sandboxing tech now: https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview https://learn.microsoft.com/en-us/windows/security/applicati...
- jakeogh 3y agoI firejail browsers specifically to stop them from playing audio, it's much easier than playing wack-a-mole with the browser settings.
- 15457345234 3y agoAnd they absolutely love that you, and every other user, sends them every original image you choose to edit So when you make a meme or whatever and repost it somewhere else, guess what, they know who did that!
- zuhsetaqi 3y agoA "sandbox" that can freely send anything it wants to any computer connected to the internet
- whywhywhywhy 3y ago> Audacity's an awesome piece of software It really isn't it's extremely janky and buggy, only use it as an absolute last resort.
- ninkendo 3y agoThere’s a push to make every single last thing a normal application can do, available to web apps through some half-standardized JavaScript API or another. Generally google comes up with use cases, implements it in chrome, and tries to call it a standard. Then everyone complains when Apple doesn’t implement these standards fast enough, and that Safari is “holding back the web” or “the new IE” because it’s not keeping up with every last feature Chrome implements. I would prefer websites just be websites and that we don’t have every single damned API available to whatever trashy site I accidentally click on, but I guess you and me are outliers here. Most people on HN seem to welcome every single JS API because web development is the only platform anyone seems to care about any more.
- jwells89 3y agoThings like this seem niche enough to safely put behind a permission dialog. 99.9% of sites/web apps have no legitimate need for this functionality.
- shuckles 3y agoPermissions dialogs solve for a problem product creators have and create more problems for users.
- ninkendo 3y agoThat’s how location services and notifications work today, and all it means is that websites just constantly nag me to enable them. Things like this make for a more annoying web all around, because now it’s just one more tool sites can use to track me and increase engagement. (Edit: sibling poster chuckles said it way better than I can.) If I had my way, JavaScript on the web would be limited to XMLHttpRequest and basic DOM manipulation and couldn’t do anything else. A totally separate “rich” JavaScript engine could be opted into by the user for any website that presents itself as an “application” like ones that legitimately want audio API’s like these. All these half-baked web app “standards” that google is forcing down our throats can be confined to that leper colony. Then the most important bit: browsers could let me completely disable the “rich” engine, and I can go back to having a sane web experience again.
- deleted 3y ago[deleted]
- balls187 3y agoFingerprint states that this service is for fraud detection, but they are actively discussing how they are circumventing browser privacy protections. So as a user my preference not to be fingerprinted or tracked takes a back seat in the name of fraud detection? So we should allow police to wiretap in the name of crime prevention?
- mostlysimilar 3y agoTale as old as time. Think of all of the legislative attacks on encryption in the name of protecting people.
- A4ET8a8uTh0 3y agoMy charitable take is that it does take both ends of the spectrum to arrive at a solution that does not exactly satisfy everyone, but is an acceptable place to stop the impossible arms race. The unfortunate reality is that we are nowhere the end of that race. Admittedly, that was the first time I read about fingerprinting in this manner and bypassing explicit privacy protections is definitely not something I would want for my future self ( or that my of my family ). In other words, I think you are right. Privacy probably needs to be codified. It may seem hard to do given existing entrenched interests, but you have to start somewhere. Not that long ago people thought buying people is 'just the way world works'. Things can change. Slowly, but they do.
- deleted 3y ago[deleted]
- neilv 3y ago> they are actively discussing how they are circumventing browser privacy protections. I'd love to see a successful prosecution as something like a US CFAA violation, setting a precedent that puts the fear of god into the widespread slimy side of our field. But I suspect it will have to be a non-US country leading that, because a lot of the US economy and power is now tied up in widespread slimy behavior of our field.
- kmlx 3y ago
- brookst 3y agoTl;dr: Apple’s implementation adds random, uniformly distributed noise, so running many samples one can back out the noise. Kind of a naive design but easily fixed.
- deleted 3y ago[deleted]
- modeless 3y agoPutting a node graph audio API in the browser was silly. It should have been just audio worklets.
- capitainenemo 3y agoWasn't Mozilla's proposed audio API simpler? AFAIK it was beaten out by Google's because people wanted a richer API and lower latencies. https://web.archive.org/web/20120505042746/https://developer.mozilla.org/en/Introducing_the_Audio_API_Extension https://web.archive.org/web/20120505042746/https://developer...
- spookie 3y agoDid people want lower latencies though? It seems a bit absurd given other compounding factors that have a play on that.
- jsheard 3y agoIIRC it turned out that way in large part because realtime audio is very sensitive to performance hitches, and idiomatic JS is hitchy by nature due to relying on garbage collection, so they wanted to hoist as much as possible up into native code provided by the browser. If WASM had existed at the time it would have been easier to make the case for just exposing a simple raw audio interface instead.
- capitainenemo 3y agoWell... Mozilla had ASM.js at the time. In part to showcase their superior performance with certain portions of JS compared to V8 - at the time I remember the things like console emulators preferring Mozilla's JS engine due to it offering more reliable performance than V8 on the tight loops and large switches. Mozilla was also demonstrating how their engine could offer comparable performance to Google NaCl in an image processing demo which was conceived to show how NaCL could cover limitations in V8 at the time. I wonder if we might well have had more traction with Mozilla's approach and ASM.js if V8 had had similar features. Oh well. Is what it is, and Mozilla (and Microsoft and Apple) did at least manage to get WASM which has been super useful even outside of browsers.
- pdntspa 3y ago[flagged]
- travisd 3y agoBased on the article, it sounds like this doesn't activate a device's microphone at all. If it did, most (all?) browsers would give a pop-up requesting permission for that.
- marcellus23 3y agoThis has nothing to do with the microphone...
- pdntspa 3y agoThen where are these audio samples coming from?
- echoangle 3y agoThis is using differences in the audio processing pipeline of the browser, they just use some input sound which could be taken from a file. The fingerprint is the slightly different output signal when applying filters to the input signal.
- pdntspa 3y agoHow is it possible that this produces enough variations to be usable without sampling some sort of audio source? The entire pipeline is digital, there is not any room for interference.
- echoangle 3y agoIt’s doing signal processing using floats, that can lead to differences in the result even if the implemented algorithm is identical. Float addition is not commutative so reordering some calculations, either in different implementations or with different compiler options, can lead to slightly different results. This just detects browser version and maybe OS/Architecture, the same browser binary should still give the same results between different devices with same hardware.
- zb3 3y ago[flagged]
- deleted 3y ago[deleted]
- h4x0rr 3y agoCan anyone explain why the results are different to begin with? E.g. why is this audio fingerprinting even possible in the first place?
- echoangle 3y agoProbably implementation details and compiler optimizations, float addition is not commutative for example. Implementing the same algorithm with the same formulas correctly can still lead to slightly different results
- saagarjha 3y agoFloating point addition is not commutative, but it is still consistent. Getting different results is usually the result of using alternative algorithms or relaxing standards (that may, for example, reorder terms).
- echoangle 3y agoI don’t think the web spec implemented by the browser specifies the order of every operation, only the algorithm. If safari and chrome devs implement the audio api based on the spec, there can still be minor floating point differences because of the way they implemented the same calculations. That’s why they can fingerprint your browser versions with this.
- Angostura 3y agoI would have thought it might have yielded a machine and OS identifier - but more user specific than that?
- echoangle 3y agoThat’s what it does, users on the same browser and same hardware should have identical fingerprints. It’s just one way of multiple to narrow down your fingerprint.
- gary_0 3y agoDoes this technique fingerprint based on hardware/driver/OS differences with audio processing, or just the browser software? I believe there are (or were, hopefully) similar techniques using <canvas> that exposed differences between the underlying graphics devices.
- dmazzoni 3y agoThis is similar. Audio algorithms often call OS functions and make use of CPU optimizations. One example they mentioned is the fast-fourier transform (FFT). All OS's include a version of that function but it tends to be optimized over time, and tends to behave differently on different CPUs depending on what SIMD instructions are available.
- stockhorn 3y agoDid I read this correctly and audio fingerprinting is mainly about identifiying the used browser version and OS or laptop, but it cant identify end-users in a stable way?
- mikepavone 3y agoMy phone running Firefox for Android produced the same results as the sample data for Firefox on Windows which does seem to fit with this largely being a browser identification scheme
- fbdab103 3y agoI think that is correct, but it still seems like an amount of leakage that could be further correlated with other another trick. There was previously a site which could indicate how globally unique your environment was (some combination of screen size, user-agent, fonts?, etc). Locking down to a specific hardware+browser configuration probably does a lot to remove anonymity.
- Crespyl 3y agoYou may be thinking of https://www.amiunique.org/fingerprint https://www.amiunique.org/fingerprint
- fbdab103 3y agoNot the one I used, but this one actually looks better. Just being Linux + Firefox is terrible for blending into the herd. Let alone everything else that leaks (having a desktop + GPU + good monitor basically destroys all remaining hope).
- lloeki 3y agoProbably was EFF's panopticlick, which has evolved into https://coveryourtracks.eff.org https://coveryourtracks.eff.org The about page has some history https://coveryourtracks.eff.org/about https://coveryourtracks.eff.org/about
- flenserboy 3y ago[flagged]
- deleted 3y ago[deleted]
- knodi 3y agoDoes disabling web audio beat this fingerprinting?
- arijun 3y agoI always assume that any difficult/annoying anti-fingerprint techniques make you more identifiable instead of less, since very few people do them.
- spookie 3y agoThis is why the Tor Browser attempts its best to only have one fingerprint. The more people use it, the more this argument looses its edge. Or so they say.
- Zuiii 3y agoMullvad browser tries to be the same, but for normal internet users. Perhaps it's time to switch over to it full-time.
- Einenlum 3y agoThis. That's why I feel we are all doomed regarding privacy. The only way we could maybe protect ourselves would be to all send manipulated but looking like plausible average data.
- ryan-c 3y agoDisabling it would be weird and therefore make you more identifiable.
- neilv 3y ago> Fingerprinting is used to identify bad actors when they want to remain anonymous. For example, when they want to sign in to your account or use stolen credit card credentials. Fingerprinting can identify repeat bad actors, allowing you to prevent them from committing fraud. However, many people see it as a privacy violation and therefore don’t like it. This doesn't seem to acknowledge the use of fingerprinting in intentional violation of the privacy of ordinary people, for marketing profiling and just selling them out because someone is willing to pay. On https://demo.fingerprint.com/ https://demo.fingerprint.com/ , they do start to hint at non-anti-fraud purposes, but the use case seems to be full of poo. (Logins or cookies are the way to do this. Anything else is trying to circumvent privacy mechanisms. And if they don't distinguish users perfectly, they're doubly violating privacy by then leaking private information between people.) > Personalization -- Improve user experience and boost sales by personalizing your website with Fingerprint device intelligence. Provide your visitors with their search history, interface customization, or a persistent shopping cart without having to rely on cookies or logins. Popup warning on "https://demo.fingerprint.com/personalization https://demo.fingerprint.com/personalization": > Heads up! -- Fingerprint Pro technology cannot be used to circumvent GDPR and other regulations and must fully comply with the laws in the jurisdiction. You should not implement personalization elements across incognito mode and normal mode because it violates the users expectations and will lead to a bad experience. -- This technical demo only uses incognito mode to demonstrate cookie expiration for non-technical folks. Sounds a bit like a disingenuous bad actor doing CYA while demonstrating their capabilities, nudge, nudge, wink, wink.
- deleted 3y ago[deleted]
- austinpena 3y agoTheir tool is priced too expensive to be used for marketing purposes in most cases.
- diebeforei485 3y agoBut all iPhones of the same model have the same processor. Every iPhone 15 Pro Max, of which Apple sells hundreds of millions, all have the same processor. Why do they have different results?
- Asmod4n 3y agoBuy the same CPU 10 times and benchmark them, they all score differently.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- om2 3y agoThey don’t. If you read this post carefully, it just claims to be able to tell Intel Macs from ARM Macs. It can also distinguish from older Safari versions that don’t have the fingerprinting protection.
- lotsofpulp 3y ago> Every iPhone 15 Pro Max, of which Apple sells hundreds of millions They sell ~200M iPhones per year, but I doubt most are the most expensive model.
- astrange 3y agoThey have different performance at different heat and battery levels.
- saagarjha 3y ago(This would of course require a different technique to uncover.)
- sshumaker 3y agoIt seems like rather than adding a random amount to each sample (which lets them compute a mean by recreating the same audio and extracting out the differences), Safari could instead add randomness that is based on a key that rotates every hour. (Function of audio sample and key, so the noise would be the same in a given session, but useless for tracking an hour later).
- tatersolid 3y agoWouldn’t it help if the noise added were deterministic based on origin? That way it can’t be averaged out by oversampling. So something like RNG_SEED = HMAC_SHA256(PERSISTENT_SECRET,Location.origin)
- Borealid 3y agoIf you averaged together ten such samples, you'd get something that approaches the true values from the device. The more samples you have, the closer it would get. Fixing this would require removing the information leak entirely, not just masking it under a layer of random deviations.
- tagCollector 3y ago[flagged]
- simondotau 3y agoThe grandparent post accounted for exactly that criticism. By having the source of randomness fixed for a limited time period, a fingerprinting algorithm wouldn't be able to gather enough unique samples for averaging to be useful. And given the extremely fine differences in the floating point numbers, any injected noise would so overwhelm the data that you'd need hundreds, perhaps thousands of samples in order for averaging to be useful.
- Einenlum 3y agoI expected this article to be published by some hackers or defenders of privacy like EFF, not by a company whose goal is to fingerprint people. Such dystopian times.
- deleted 3y ago[deleted]
- FragmentShader 3y agoI think web browsers should implement already an API that allows developers to track any user in a "private" way, by generating a unique hash using your computer specs or something, and make it different for each website. So, if you visit Google, your hash would be something like "h38kflak". If you're visiting twitter, the API would generate something different, so you won't be tracked across websites. That way, even if you clean your cookies, you can still be identified as the same user. The use case? Fraud detection and that kinda stuff. For example, you may create a web game where you allow users to play instantly without "creating" an account. So, an anonymous account would be created in the background, in order to log in. Any bad actor can just clear their cookies/storage to bypass a ban. IP banning isn't reliable, as multiple users may share an adress. It's a shame that we have to rely on web api hacks in order to fingerprint users for legitimate reasons, and that ends up in an eternal cat and mouse game, because anything you try today may be broken tomorrow.
- 14 3y agoBecause users do not want to be tracked or fingerprinted. I don't care about fraud detection and I am not a fraudster so why do I have to be tracked? There is no way that a feature like that would not get abused in one way or the other.
- DueDilligence 3y ago[dead]
- redbell 3y agoAnother interesting technique to fingerprint users online is called GPU Fingerprinting [1] (2022). Codenamed 'DrawnApart', the technique relies on WebGL to count the number and speed of the execution units in the GPU, measure the time needed to complete vertex renders, handle stall functions, and more stuff ________________ 1. https://www.bleepingcomputer.com/news/security/researchers-use-gpu-fingerprinting-to-track-users-online/ https://www.bleepingcomputer.com/news/security/researchers-u...
- chii 3y agobrowsers should come with a default software renderer, and behave like the mic and camera where the site will require user permission to release the hardware GPU render path.
- danbolt 3y agoI feel like the constraints could open up an interesting demoscene too.
- TylerE 3y agoDo you have any concept of how many gigawatts per day that would waste?
- avoid3d 3y agoVery pedantic but I’d want to know. A watt is a unit of power, which means gigawatts per day is a rate of change of power. If you want a unit of energy you need power multiplied by time not divided, so “gigawatt days” not “gigawatts per day”.
- Faaak 3y agoMaybe they meant "gigawatt-hours per day"
- protomolecule 3y ago
- spookie 3y agoThese predatory practices are getting out of hand. Props for them to expose this, even though they're the "bad actors" from my point of view.
- deleted 3y ago[deleted]
- sph 3y agoThey're not exposing anything, they're advertising their services. It was also posted by one of their employees. Funny how no one seems to notice that, and they're all praising the article.
- actualwitch 3y ago"Funniest" part is that this page also tries to establish a webrtc connection which i know because my firewall told me browser tried to connect via nat-stun port to some server. Webrtc is a common way to fingerprint vpn users because in some setups it leaks your real ip.
- jancsika 3y agoSomeone definitely correct me if I'm wrong, but the success of the fingerprinting workarounds here seem to boil down to the following choice wrt handling oscillator anti-aliasing in the Web Audio API spec: "There are several practical approaches that an implementation may take to avoid this aliasing. Regardless of approach, the idealized discrete-time digital audio signal is well defined mathematically. The trade-off for the implementation is a matter of implementation cost (in terms of CPU usage) versus fidelity to achieving this ideal. It is expected that an implementation will take some care in achieving this ideal, but it is reasonable to consider lower-quality, less-costly approaches on lower-end hardware." AFAICT this means that the OscillatorNode output they are exploiting here is almost guaranteed to not be deterministic across browsers (or even in the same browser on different hardware). The non-determinism is based on whatever anti-aliasing method is chosen by the browser (or, possibly, multiple paths within the same browser which could get chosen based on the underlying hardware). This includes changes/fixes to the same anti-aliasing algos. I don't really understand this choice of relegating anti-aliasing to the browser given that: a) any high-quality audio app/library will want full control over how the signals they generate avoid aliasing and will not use these stock oscillators anyway, or b) the kinds of web applications that would accept arbitrary anti-aliasing algos (and the consequent browser-dependent discrepancies therein) probably wouldn't care whether the aliasing algo is hardcoded SIMD instructions or some 20MB javascript web audio helper framework 1: https://webaudio.github.io/web-audio-api/#OscillatorNode https://webaudio.github.io/web-audio-api/#OscillatorNode Edit: clarification Edit 2: more clarifications. :) Edit 3: I wonder if the same kind of solution could be used here as was used by Hixie to standardize the HTML5 parser. Namely, just have some domain expert specify an exact, deterministic algo for anti-aliasing that works well enough, then have all the browsers use that going forward. I'd bet the only measurable perf hit would be to tutorials that show how to use the web audio api to generate signals from the stock anti-aliased oscillators. :)
- pillusmany 3y agoQuality anti-aliasing is expensive. So you want to allow the implementation to decide how much to spend on it depending on available compute, battery and so on.
- chrisbrandow 3y agoThis is gross.
- FabHK 3y agoYeah. Can't believe these guys are proud of it! On the other hand, I did clear my browser cache and switched on the VPN, and they mis-identified me as a new visitor. Still, despicable business model.
- mavamaarten 3y agoExactly my thoughts. Interesting, but gross. I wonder why audio API's are even available without giving a website permission? It feels like this could easily be fixed with a simple "This site would like to use your sound devices"-dialog.
- gorgoiler 3y agoI assumed a level of irony here, from fingerprint.com. It’s like if a website popped up popularising loopholes to get around tax burdens as an attempt to disgust the world into closing those loopholes. Even if that’s wishful thinking, there’s still immense virtue in publishing this research and getting it out in the open. If an article gets published explaining how a particular brand of green backpack helps with shoplifting do we worry that everyone’s going to shoplift more? I’d err more on the side of knowing shops are more likely to catch on to the tactic.
- shuckles 3y agoUnfortunately in this case, the website does content marketing with known, easy to fix vulnerabilities presumably to put competition out of business while keeping unknown, harder to fix vulnerabilities as part of their "pro" products.
- IceHegel 3y agoIt raises the question of whether the current networking stack is the one we want to have for the next 100 years. The internet in its current form has ruined a lot of the dream of personal computing because companies (and the state) are so asymmetrically powerful versus individuals. Should it be possible for my technology to send data to a server without my explicit approval?
- YouAreADork 3y ago[flagged]
- saagarjha 3y agoI feel like these days (especially given the recent focus on side channel attacks) it is basically a given that adding uniform noise to something that leaks data does not work, because you can always take more samples and remove the noise. Why did Safari add this? I understand that needing more samples is definitely an annoyance to fingerprinting efforts, but as this post shows it's basically always surmountable in some form or the other.
- lapcat 3y ago> Why did Safari add this? A lot of Apple's "privacy" features nowadays are marketing. It's privacy theater. What matters is whether they can tell a plausible story to the public, not whether is technically effective.
- shuckles 3y agoIs iCloud Private Relay theatre? 3rd party cookie blocking? What specific features do you allege exist just to mislead the general public?
- deleted 3y ago[deleted]
- lapcat 3y ago> Is iCloud Private Relay theatre? https://fingerprint.com/blog/ios15-icloud-private-relay-vulnerability/ https://fingerprint.com/blog/ios15-icloud-private-relay-vuln... > 3rd party cookie blocking? It's very funny that you should ask this question in response to an article about fingerprinting without cookies. But yes, there are various workaround to use 1st party cookies or other storage to take the place of 3rd party cookies. Perhaps the worst is the Safari "Privacy Report", which has always been misleading: https://www.simoahava.com/privacy/intelligent-tracking-prevention-ios-14-ipados-14-safari-14/ https://www.simoahava.com/privacy/intelligent-tracking-preve...
- fh9302 3y ago
- exabrial 3y agoI'm really ready to just be "that guy" that browses with JS disabled.
- tagCollector 3y ago[flagged]
- chii 3y agoIt's exactly such reasons why TOR browsers would have JS disabled. As the internet gets more and more hostile, this will become more and more correct.
- DaSHacka 3y agoGood luck, I recently gave up that fight after needing to disable it to view the content of nearly every single website I visited. It's not even just cloudflare and similar DDOS checks, but now even things that should just be in the HTML of the page are loaded with JS.
- FabHK 3y agoGood luck. It's amazing how little of today's web is good old HTML. A while ago I visited a website that used Markup - but that wasn't compiled into HTML and then statically served, oh no - it was rendered in JS client side. WTF.
- rgmerk 3y agoThe problem is that that by being "that guy" you're probably giving them 10 bits or more of identification. If they can just scrape a few more bits from somewhere they'll have you uniquely identified. But, yeah, these guys can get on Golgafrinchan Ark B with the rest of the adtech industry as far as I am concerned.
- timeon 3y agoI need to be more offline then.
- kmlx 3y ago
- tagCollector 3y ago[flagged]
- dannyw 3y agoI look forward to the day the EU makes fingerprinting illegal.
- deleted 3y ago[deleted]
- wdr1 3y agoDefining fingerprinting in a legal terms is fairly difficult. Most regulators would also likely consider fingerprinting for certain use cases as acceptable. E.g., detecting abuse, fraud, CP, etc.
- agos 3y agolet's just make fingerprinting for advertising illegal, and then go from there
- zuhsetaqi 3y agoHow is that difficult? Anything that is stored to recognise a user on two different devices/sites is fingerprinting.
- Spivak 3y agoOh no my session cookie! Remember Me On This Device: Not today Satan! Use code LINUS for immediate jail-time. Find My iPhone — You mean find my digital privacy regulator. I think the only way you're gonna swing it legally is by intention.
- Zuiii 3y agoWhat's key here is consent. (the real kind, not the EULA kind) If you knowingly opt into being identified (like ticking an unticked "remember me" box that clearly explains the precise purpose of the identification) then it is okay. If some asshat decides to do it without your informed, clear, and uncompelled consent, throw the fucker in the slammer. It's not that complicated.
- 3y ago
- iamleppert 3y agoCouldn’t you just replace the prototype of the Audio API to return back whatever you wanted? The difficulty would be in getting enough fingerprints for your desired imitation but the article itself seems to have that information.
- demondemidi 3y agoI really don’t see how this can come up with more than a few thousand unique combinations. Browser type x browser version x os version x accelerator version x … what else? That doesn’t seem like enough variation to create anything remotely unique. I don’t get it.
- water-data-dude 3y agoCombinatorics is a harsh mistress
- ano-ther 3y agoSo they say this is for fraud prevention and that all other uses need consent. On their front page they tell me how often I have visited and that my incognito mode does not prevent their tracking. Isn’t that “other use”? > Does Fingerprint Pro require consent? > Our technology is intended to be used for fraud detection only; for this case, no user consent is required. However, any use outside of fraud detection must comply with GDPR user consent rules.
- pradn 3y agoWait, is it just me, or is it not wild that there's a company openly advertising their fingerprinting services? Their landing page implies it's primarily for fraud detection / abuse prevention. But one of their customer testimonials is from Neiman Marcus boasting they increased the number of repeat customers they could identify. > "With the adoption of Fingerprint, we can now recognize and personalize approximately 23% of total visits to NeimanMarcus.com, up from the previous baseline of 8-10%." Of course, these companies have always been around. But this post reads like it threads the line between "our product defeats Apple's futile defenses" and "we care so much about user privacy we're white-hat cracking Apple's defenses". And another "between-the-lines" joke is that this site doesn't throw up a cookie dialog when you load it. What a joke! "We don't need cookies to track you, haha!"