Hacker News Reader

Hacker News

Comment by projectramo | Hacker News Reader

Parent Full thread

projectramo

I am going to ask about a really basic question: what is fingerprinting?

I had to dig around, from the paper is sounds like a stateless form of tracking.

The audio example made sense:

1. the mic comes on, and it identifies a particular background noise.

2. I browse to another site, or a different page without a cookie.

3. The mic comes on again, matches the ambient noise and realizes I am the same person.

Is that what you mean? If this is the case, how can the "canvas fingerprinting" work since I had to browse to a new page and all the old pixels from the previous page are no longer there.

Anyway, if it is what I understand it to be, then it sounds very interesting. I bet some science fiction author wishes they had though to use it.

View on HN

I can see how you would be led to believe that interpretation. Looking at the "fingerprinting" webapp however, details that sound is NOT actually recorded-- only the uniqueness of your machine's audio processing stack. At least I hope that's the case. The idea of a microphone recording without permission upon visiting a website would cause quite a broo-ha-ha.

https://audiofingerprint.openwpm.com/

    > "This page tests browser-fingerprinting using the AudioContext and Canvas API. 
    > Using the AudioContext API to fingerprint does not collect sound played or
    > recorded by your machine - an AudioContext fingerprint is a property of your
    >  machine's audio stack itself. If you choose to see your fingerprint, we will
    >  collect the fingerprint along with a randomly assigned identifier, your IP
    > Address, and your User-Agent and store it in a private database so that we can
    > analyze the effectiveness of the technique. We will not release the raw data 
    > publicly. A cookie will be set in your browser to help in our analysis. We
    > also test a form of fingerprinting using Flash if you have Flash enabled."

Wow, so are mic settings that different on different on, say, different iOS devices? If you and I have the same model iPhone with the same model iOS, is the audio stack that different?

Probably not - but basically, you add together your microphone stack with all the other data it can possibly find about your device, and that's your fingerprint.

Check out https://panopticlick.eff.org - this will attempt to fingerprint your browser and see if it's unique.

If you'd like a lot more on this topic, check out https://33bits.org/sitemap/ and start clicking on the links.

I know iOS was just an example but just to clarify, the WebRTC spec isn't supported in-browser on iOS. To further clarify: it's not supported on iOS.

As a developer, you can take advantage of the spec only if you're building a native app. There's frameworks that you can use if you do. But within Safari or Chrome you have zero WebRTC support.

It's supported in modern versions of chrome on Android but won't be supported on iOS until apple does something about it.

> But within Safari or Chrome you have zero WebRTC support.

Chrome is just a skin on Safari for iOS, because Apple doesn't allow third party browsers, right? I would think FF (or any other browser) wouldn't be able to on iOS either, given that constraint.

Yes, no sound is recorded. Access to the user's mic isn't possible without a permission. If there are sections of the website or paper that seem to imply that, let me know and we'll clarify.

It seems strange that access to the audio stack isn't also behind the permission.

Presumably, an application would need to enumerate audio capabilities before even offering the option.

It does, and also as someone who has never heard of AudioContext before, I can't fathom why it would be necessary for a web application to generate an audio data stream that isn't output to speakers _AND_ _THEN_ analyze the result.

What is the typical use case for AudioContext?

The capabilities of AudioContext used in audio fingerprinting seem like they're beyond what is really necessary?

AudioContext is actually pretty cool. As far as I know, only Firefox supports it at the moment. But it allows you to work with audio streams in raw byteform, which means you can do advanced audio processing in client side javascript.

The front page [1] doesn't say either way, and I wondered the same thing when I read it. A few words or a link to an explanation would be helpful.

[1] https://webtransparency.cs.princeton.edu/webcensus/index.htm...

Thanks, I've added a clarification.

> "how can the "canvas fingerprinting" work since I had to browse to a new page and all the old pixels from the previous page are no longer there"

The linked page answers this: "Differences in font rendering, smoothing, anti-aliasing, as well as other device features cause devices to draw the image differently."

Put differently, the function measureText(canvas full of text with various fonts and bizarre features with varying implementation) is a pretty good hashing function for a population of web users, because each of these web users have a pretty-unique [canvas rendering engine, underlying OS, installed fonts] combination.

Combine several of these techniques (webrtc, audio, list of plugins installed and their version, etc), and you go from a "pretty unique" to a "guaranteed unique" hash, which you can follow across the web.

Thanks for the explanation. I missed it because I never though these settings could be that unique.

Just imagine, if the audio stack exposes the volume level, that's roughly 7.5 bits of uniqueness to contribute to the 33 required to uniquely identity any person on Earth (not that you can expect it to be uniformly distributed, and thus fully usable).

that doesn't quite work since the volume level changes frequently.

Yes, it's a poor example in that respect. I meant it more as an explanation of how different attributes of a source all contribute a little but to providing a unique identifier, but you are correct that it's much less useful if the attribute is not static.

I'm going to answer the basic question: fingerprinting is about trying to identify your device as uniquely as possible using available APIs, in order to track you cross-site, without cookies.

To do that, you first try to identify API that have different results depending on the browser or the device, and then track their result. For example, the User agent have some identifying information. It's not unique for each person, but you can start having a bit of identifying information. Do that with multiple APIs (available fonts, installed plugins ...), and you start having enough identifying informations to uniquely identify some browsers, without having an actual ID provided by the browser.

To test your browser, you can visit https://panopticlick.eff.org/

Which API reveals my system fonts to a website?

Edit: The fingerprint test at https://panopticlick.eff.org/ shows my System Fonts

You can't get installed fonts via javascript, but you can change the font of a known text and fingerprint the size to determine whether the font is installed or it defaulted to another font.

I don't think you can enumerate them these days, but you can test for them by trying to use them in CSS (which font is used would affect the width of a span of text, use a wildly different fallback font and you can guess which is installed) or <canvas> (where you can inspect the actual pixels rendered).

Or use @font-face and detect calls to a remote URL — which happens when the named local font is missing:

    @font-face {
      font-family: "Roboto";
      src: local("Roboto"), url("https://example.com/user-does-not-have-roboto") format("woff2");
    }

Flash provides an API for that.

Edit: Disable Flash or make it click-to-activate and https://panopticlick.eff.org/ shouldn't list your fonts anymore.

I never understood panopticlick, even when I repeatedly visit it, it always tells me that

"Your browser fingerprint appears to be unique among the 135,054 tested so far."

Shouldn't it tell me that my browser is not unique during my 10th attempt considering it has recorded my previous attempts. This warning actually never changes, regardless of duration between consecutive attempts. That can only mean that the panopticlick is flawed or my browser signature is in constant flux (which would essentially make it useless from tracking perspective.)

I thought the same thing, so I did a bit of digging.

Turns out they put a bunch of tracking cookies on your machine without asking you (it is mentioned in the about page though), which seem rather naughty for an organisation promoting online privacy.

When I removed all 4 of them, I get down to being "almost unique". I'm currently down to having the same fingerprint as 1 in 45132.3333333 browsers.

This is confusing, my incorrect assumption was 1 out n browsers meant n = total numbers of browsers evaluated by panopticlick. Rather what they mean is 1 out of k, where k is determined by unique bits. There might be other factor such as entropy of each fingerprint.

How are two sites sharing this fingerprint information in a way that says "yup, this is the same guy?" Like is there some sot of cabal of evil advertising companies running a bunch of sites, or what?

Yes.

No. Microphone requires permission.

Your browser can leak a ton of information about your computer silently: window size, screen resolution, pixel density, time zone, language, installed fonts, installed plugins, operating system and version, browser version, plugins and versions, etc. There are good reasons for all of this data to be available to JavaScript for legitimate purposes. The AND of all of these datapoints, however, may be unique (or close), particularly if you have ever done something like install a novelty font. The EFF runs a website that fingerprints you and tells you how unique your fingerprint is:

[0] https://panopticlick.eff.org/tracker

Canvas fingerprinting uses differences in rendering e.g. of fonts. Output a text, hash resulting pixel values. Depending on exact version of the font(s) installed, anti-aliasing settings, default font sizes, operating system... you get slightly different results. So you don't rely on information stored on the device, but on repeatable behavior that differs between devices.

I thought that was "Canvas-Font Fingerprinting"

But now I see that is just seeing which fonts are available.

Thanks for the explanation. Its just hard to believe devices are so different. I would think most versions of iOS would have roughly the same set of fonts etc.

I would assume that iOS devices are quite hard to tell apart using most of these techniques, yes. But I also wouldn't be too surprised if there were something that works for them, some kind of cookie that isn't cleared by default or ...

Yup HSTS supercookies or some kinds of network fingerprinting will work to distinguish between two otherwise identical iOS devices.

Actually, checking if a font is available does not require canvas (you can simply inject a piece of text into the page with a specific font stack set and check its width). Rather, what canvas is used for is to obtain the sub-pixel anti-aliasing of a given piece of text, which is different between browsers and OS even when the same font is present.

Canvas fingerprinting by itself won't uniquely identify users. But the idea is that you can combine various different techniques, each one giving you more bits of uniqueness, until you have enough to do so. For example, say that canvas fingerprinting gives you one of 100 possibilities, and you combine it with other techniques that give you one of 10,000 possibilities, then combined (assuming they're not correlated) you get it to a million, letting you uniquely identify people with decent reliability from a decently large visitor pool.

What are some unexpected things that would differ between two iPhones of the same model running the same versions of the software stack?

Good question. I'm not particularly informed on this stuff, so take this with a grain of salt, but my understanding is that mobile devices in general and iPhones in particular are much harder to fingerprint reliably. Things like time zone, clock skew, and ping times might help differentiate users, but you probably can't get it down to a single person. I imagine there's still a use for fingerprinting which helps you differentiate groups of users even if you can't narrow it down to just one.

what is fingerprinting?

I don't know the research definition, but fingerprinting is a technique to uniquely track a user across multiple sites without a tracking beacon.

The most basic form of fingerprinting is to use the browser-supplied headers (user agent, version, OS). Canvas fingerprinting works because identical browser versions across different machines may render slightly different, but consistent. IIUC, canvas fingerprinting doesn't rely on any pixels shown to the user or anything unique to the site, but if the same canvas is rendered exactly the same on two different sites, that's another indication that both visits were from the same user.

I don't think the AudioContext fingerprinting uses the actual microphone: it uses the browser's (and possibly OS's) audio engine to generate an audio stream, then fingerprints the resulting data stream.

Reply on news.ycombinator.com