4 ms·
The problem is it’s getting the current time with relatively high precision, which is the same reason a developer would prefer it for non-nefarious uses. Once
by twoodfin 2y ago
The problem is it’s getting the current time with relatively high precision, which is the same reason a developer would prefer it for non-nefarious uses.
Once you have a high-precision timer, there are all sorts of aspects of the user’s system you can fingerprint by measuring how long some particular API dependent on device performance and/or state takes to execute.
Platform vendors long ago figured out not to hand out the list of available fonts, but it’s a couple orders of magnitude harder to be sure switching some text from Menlo to Helvetica doesn’t leak a fractional bit of information via device-dependent timing.
EDIT: Others noted it’s actually ticks since startup, which is probably good for a few bits all on its own if you are tracking users in close to real time.
- Waterluvian 2y agoIt’s amazing just how much we lose here, elsewhere, and in browsers, because we have to worry about fingerprinting.
- lesuorac 2y agoIt gets even more funny when you realize that devices & browsers let you set data per device that you can just retrieve later ... Why bother fingerprinting when you can just assign them an id and retrieve it later. https://developer.apple.com/documentation/devicecheck https://developer.apple.com/documentation/devicecheck https://engineering.deptagency.com/securely-storing-data-on-ios https://engineering.deptagency.com/securely-storing-data-on-... https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage https://developer.mozilla.org/en-US/docs/Web/API/Window/loca...