7 ms·
Another interesting technique to fingerprint users online is called GPU Fingerprinting [1] (2022). Codenamed 'DrawnApart', the technique relies on WebGL to cou
by redbell 3y ago
Another interesting technique to fingerprint users online is called GPU Fingerprinting [1] (2022).
Codenamed 'DrawnApart', the technique relies on WebGL to count the number and speed of the execution units in the GPU, measure the time needed to complete vertex renders, handle stall functions, and more stuff
________________
1. https://www.bleepingcomputer.com/news/security/researchers-use-gpu-fingerprinting-to-track-users-online/ https://www.bleepingcomputer.com/news/security/researchers-u...
- chii 3y agobrowsers should come with a default software renderer, and behave like the mic and camera where the site will require user permission to release the hardware GPU render path.
- danbolt 3y agoI feel like the constraints could open up an interesting demoscene too.
- TylerE 3y agoDo you have any concept of how many gigawatts per day that would waste?
- avoid3d 3y agoVery pedantic but I’d want to know. A watt is a unit of power, which means gigawatts per day is a rate of change of power. If you want a unit of energy you need power multiplied by time not divided, so “gigawatt days” not “gigawatts per day”.
- Faaak 3y agoMaybe they meant "gigawatt-hours per day"
- protomolecule 3y agoWhich gives you power again, not work. "gigawatt-hours per day" = gigawatt/24
- stephen_g 3y agoIf you consider that watt hours is just a convenience unit for (3600) joules, then “1 gigawatt hour each day” correctly should be “3600 GJ/day” which works.
- geon 3y agoWhich is a reasonable metric.
- protomolecule 3y agoExpressed in an unreasonable way.
- Etheryte 3y agoGigawatt hours per day is just gigawatt hours per 24 hours, so just gigawatts but divided.
- deleted 3y ago[deleted]
- IAmGraydon 3y agoI’m not following. Why would disabling the GPU use more power? If anything, I would think it would reduce power consumption.
- TylerE 3y agoHardware implantations of things like graphics routines can be hundreds of time more efficient than software implementations running on general purpose CPUs. Try to decode mpeg video at HD resolution in software sometime.
- chii 3y agosurely, the user will be taught to enable the hardware for video if they start seeing stutter. Or the browser can prompt the user to switch to "high-end graphics" if it detects prolonged video decoding. If a website that has no obvious case for using the GPU, but is instead using it to fingerprint, then the user won't experience any slow downs from a software renderer (as it is usually done relatively quickly). If a website needs the GPU for their videos/graphics, but also incidentally wants to fingerprint you, you're shit out of luck in that case. But this is no worse than what we have current day.
- TylerE 3y agoOh expect users to understand this? The same people who have spent the past 40 years getting confused and worked up about cookies?
- pietro72ohboy 3y ago> Do you have any concept of how many gigawatts per day that would waste? It would still be way less than what large companies are burning on training proprietary LLMs. Do you think the ChatGPT model you use daily was the success at first go? And in that same world, consumers should not even try to protect themselves from GPU fingerprinting? > The same people who have spent the past 40 years getting confused and worked up about cookies? Stop with the condescension. It's not about being confused; it's about mitigating genuine privacy concerns. We're not idiots, and dismissing genuine worries won't make the issues disappear.
- dylan604 3y agoIs it anywhere close to the amount wasted on mining shadycoins?
- wannacboatmovie 3y agoJust a guess, 1.21 GW?
- sweetjuly 3y agobut nobody wants to use software rendering, that's the whole reason WebGL and WebGPU exist.
- matheusmoreira 3y agoThey should have thought of that before abusing these things to fingerprint us. Use of the GPU is a privilege and it can be revoked.
- Asmod4n 3y agoYou could just fingerprint the cpu then, every cpu behaves differently. Buy any number of the same CPU and you’ll see different aspects in every one of them.
- deleted 3y ago[deleted]
- Y_Y 3y agoThis is why high-resolution timers are bad, but a website doesn't have the same level of access to the CPU as it does with something like webGPU.
- kragen 3y agothere isn't a 'they' and an 'us' in this situation
- matheusmoreira 3y ago"They" refers to web developers. "Us" refers to users. We are the owners of the machines where their code will run. They have complete freedom on their servers. On my computer, I make the rules. They are lucky if I allow their code to run at all.
- vidarh 3y ago
- Dudhbbh3343 3y agoLibreWolf (a privacy focused modification of Firefox) disables WebGL by default for this reason.
- logicprog 3y agoLibreWolf does this, actually: it initially blocks websites from using WebGPU (and canvas) by default and then gives you a popup to grant them permission.
- dzhiurgis 3y agoIt’s almost like there should be a registry for naughty and nice websites and their capabilities
- cedws 3y agoWhat's the point? The capabilities of browsers are so vast they'll just find other ways to fingerprint. Privacy in browsers is a lost cause. It's a 30+ year old technology that has become ridiculously bloated in scope, with privacy and security only considered as an afterthought.
- wkat4242 3y agoIt's still possible to thwart it by random data into the fingerprint. Browsers should be capable of doing that without plugins ideally. A bit like Ad Nauseam that loads ads in an invisible sandbox and clicks on all of them to mess up their reporting.
- JohnFen 3y agoEntirely this. It's a huge part of why the portion of the web I'm willing to go to gets smaller and smaller over time.