2 ms·

That does nothing but start an arms race. Fine, audio "works" but do you get noise? Can you read back the sounds you play? No, right? It doesn't work, QED.

by ajross 2mo ago

That does nothing but start an arms race. Fine, audio "works" but do you get noise? Can you read back the sounds you play? No, right? It doesn't work, QED. Now the platform needs to fake the noise. Likewise for any other hardware access you want, and most of them are harder. How do you fake local storage without storing anything? How do you fake Bluetooth access without virtualizing an entire device? Do you fake the screen dimensions to look like something else? Input latency? Where does it stop? No, "does this work" is among the easiest questions to answer in technology. We aren't going to win this war.

emctech 2mo ago
The best you can do on the modern web is reduce your fingerprint footprint, though it comes at a cost of websites breaking from JS disabling, or local time zone anonymisation.
drdexebtjl 2mo ago
> Can you read back the sounds you play? No, but you also can’t do that if the user approves your app’s permission to play audio, but has the volume permanently turned down to zero. > local storage Give the app a temporary, space-constrained store that isn’t shared with other apps. > bluetooth Don’t let apps access raw bluetooth signals, but instead ask the platform to display a pairing interface (possibly with a custom stylesheet), ask the platform to call you back when a specific device is in range, etc. > screen dimensions Not personal data. > input latency Fudge the numbers even when the user grants permission. This isn’t a war, it’s just engineering for the benefit and autonomy of the user, and not the platforms’ commercial interests.
- ajross 2mo ago
  > This isn’t a war Fingerprinting and other quasi-malware techniques being used by desirable third party software are absolutely a war, otherwise we wouldn't have this permission structure in place in the first place. And as much as you believe the contrary, Alibaba et. al. are 100% smarter than you about how to exploit these tricks and will win. > Not personal data. LOL
  - drdexebtjl 2mo ago
    I don’t appreciate the personal attack. You don’t know me. Permissions have nothing to do with preventing fingerprinting, they have to do with user control. Every permission you add that the app can inspect is one extra bit of fingerprint, so it’s actually worse. In TFA’s case, if the app was simply not hooked up to an actual audio sink, they would still be able to use this mechanism for fingerprinting, since it’s the processing pipeline itself that leaves the fingerprint. Note that the article isn’t calling out for fingerprinting specifically. I’m sure AliExpress does more fingerprinting than this. The problem is specifically that they’re interfering with multipoint Bluetooth audio.

by ajross 2mo ago

emctech 2mo ago

The best you can do on the modern web is reduce your fingerprint footprint, though it comes at a cost of websites breaking from JS disabling, or local time zone anonymisation.

drdexebtjl 2mo ago

> Can you read back the sounds you play? No, but you also can’t do that if the user approves your app’s permission to play audio, but has the volume permanently turned down to zero. > local storage Give the app a temporary, space-constrained store that isn’t shared with other apps. > bluetooth Don’t let apps access raw bluetooth signals, but instead ask the platform to display a pairing interface (possibly with a custom stylesheet), ask the platform to call you back when a specific device is in range, etc. > screen dimensions Not personal data. > input latency Fudge the numbers even when the user grants permission. This isn’t a war, it’s just engineering for the benefit and autonomy of the user, and not the platforms’ commercial interests.

ajross 2mo ago
> This isn’t a war Fingerprinting and other quasi-malware techniques being used by desirable third party software are absolutely a war, otherwise we wouldn't have this permission structure in place in the first place. And as much as you believe the contrary, Alibaba et. al. are 100% smarter than you about how to exploit these tricks and will win. > Not personal data. LOL
- drdexebtjl 2mo ago
  I don’t appreciate the personal attack. You don’t know me. Permissions have nothing to do with preventing fingerprinting, they have to do with user control. Every permission you add that the app can inspect is one extra bit of fingerprint, so it’s actually worse. In TFA’s case, if the app was simply not hooked up to an actual audio sink, they would still be able to use this mechanism for fingerprinting, since it’s the processing pipeline itself that leaves the fingerprint. Note that the article isn’t calling out for fingerprinting specifically. I’m sure AliExpress does more fingerprinting than this. The problem is specifically that they’re interfering with multipoint Bluetooth audio.