3 ms·

not really. webgl hardware parameters, canvas fingerprints, audio device fingerprints, javascript engine are pretty crazy. In addition if you use your device at

by qqqult 2y ago

not really. webgl hardware parameters, canvas fingerprints, audio device fingerprints, javascript engine are pretty crazy. In addition if you use your device at all you probably have other fingerprints like custom fonts installed by you or apps, extensions & similar. Not to mention IP and session data like you being logged in in different services that any website can check. Try visiting something like https://abrahamjuliot.github.io/creepjs/ https://abrahamjuliot.github.io/creepjs/ [1] on "identical" incognito mobile devices or desktops and you'll get completely different fingerprint ids [1] this isn't even the best fingerprint extraction out there, just an eas to use open source one, there are some crazy advanced techniques not implemented in it

ranger_danger 2y ago
> this isn't even the best fingerprint extraction out there, just an eas to use open source one, there are some crazy advanced techniques not implemented in it What IS the best tool? What other techniques do you know of that it doesn't it implement? > you being logged in in different services that any website can check how so?
- qqqult 2y ago
  > What IS the best tool? What other techniques do you know of that it doesn't it implement? The best fingerprinting tools aren't open source they're anti-botting services like CAPTCHA providers & probably ad networks. This particular service has implementations for several popular fignerprinting techniques but there are so many ways to measure the same thing that even if your fingerprint looks fine on one test a different test of the same measure could detect it as unique. For example a user font fingerprint could be implemented via JS tests, canvas rendering tests or CSS sheets (like in this paper). The tests that offer the highest degree of hardware variability and uniqueness that I've seen deal with rendering of test and images over canvas. > how so? By loading an image that can only be accessed if you're logged in your google / facebook / twitter accounts and checking if the image request returned an error. There's a repo that implements this for >30 different websites, but I can't remember it's name rn. I'll edit this comment later if I remember what it was called
  - ranger_danger 2y ago
    > an image that can only be accessed if you're logged in your google / facebook / twitter accounts I don't understand how this would work? Wouldn't there have to be some kind of cookie/storage that is accessible to third parties in order to know this? AFAIK this is exactly what angered people about Flash due to their use of cross-domain capable "super cookies".
    - qqqult 2y ago
      Here's one implementation: https://browserleaks.com/social#protection https://browserleaks.com/social#protection and https://robinlinus.github.io/socialmedia-leak/ https://robinlinus.github.io/socialmedia-leak/ Click the explanation & protection sections for info on how it works
      - ranger_danger 2y ago
        So I read the second link and it looks to me like this is a combination of problems: the browser ignoring SOP for images, and the website just happening to expose a way to abuse that fact to check if one is logged in. I think this also assumes you are not using any kind of isolation for your tabs. What I don't understand though, is how it could figure out that I am logged into google even though I have third-party cookies disabled.

by qqqult 2y ago

ranger_danger 2y ago

> this isn't even the best fingerprint extraction out there, just an eas to use open source one, there are some crazy advanced techniques not implemented in it What IS the best tool? What other techniques do you know of that it doesn't it implement? > you being logged in in different services that any website can check how so?

qqqult 2y ago
> What IS the best tool? What other techniques do you know of that it doesn't it implement? The best fingerprinting tools aren't open source they're anti-botting services like CAPTCHA providers & probably ad networks. This particular service has implementations for several popular fignerprinting techniques but there are so many ways to measure the same thing that even if your fingerprint looks fine on one test a different test of the same measure could detect it as unique. For example a user font fingerprint could be implemented via JS tests, canvas rendering tests or CSS sheets (like in this paper). The tests that offer the highest degree of hardware variability and uniqueness that I've seen deal with rendering of test and images over canvas. > how so? By loading an image that can only be accessed if you're logged in your google / facebook / twitter accounts and checking if the image request returned an error. There's a repo that implements this for >30 different websites, but I can't remember it's name rn. I'll edit this comment later if I remember what it was called
- ranger_danger 2y ago
  > an image that can only be accessed if you're logged in your google / facebook / twitter accounts I don't understand how this would work? Wouldn't there have to be some kind of cookie/storage that is accessible to third parties in order to know this? AFAIK this is exactly what angered people about Flash due to their use of cross-domain capable "super cookies".
  - qqqult 2y ago
    Here's one implementation: https://browserleaks.com/social#protection https://browserleaks.com/social#protection and https://robinlinus.github.io/socialmedia-leak/ https://robinlinus.github.io/socialmedia-leak/ Click the explanation & protection sections for info on how it works
    - ranger_danger 2y ago
      So I read the second link and it looks to me like this is a combination of problems: the browser ignoring SOP for images, and the website just happening to expose a way to abuse that fact to check if one is logged in. I think this also assumes you are not using any kind of isolation for your tabs. What I don't understand though, is how it could figure out that I am logged into google even though I have third-party cookies disabled.