Hacker News Reader

Comment by hendi_ | Hacker News Reader

They wouldn't.

But the point of fingerprinting is that practically no two "browsers" are the same:

  - browser software and exact version
  - installed plugins
  - size of browser window
  - OS software and exact version (think of patches!)
  - language
  - time zone
  - screen resolution
  - ...
  - (and all the stuff mentioned in the submitted article!)

See the EFF's Panopticlick to see _how_ unique your browser is. Be sure to click the "Show full results for fingerprinting" after the test to see all things it considers.

[0] https://panopticlick.eff.org/

View on HN

But is any of this stuff stable enough to ensure a fingerprint -> user correlation which doesn't break every time? It's not very much use if all it does is create a unique fingerprint for each refresh?

Yes; the things I've mentioned above don't change on page refresh.

If you'd find some things do change too often to be relied upon you could either take that into account, or simply don't use that specific fingerprinting technique.

That doesn't really answer the question, because most of the factors you listed should be irrelevant for _audio_ fingerprinting.

It does.

> They wouldn't.

That's a pretty short answer, and it sounds wrong to me. Are you implying that browser version, OS type and version, and system architecture are all factors that matter for audio fingerprinting? If so, what would be the point of audio fingerprinting when you can just look at the user agent string?

Sorry, it seems I misunderstood your intention/question.

The `AudioContext` API exposes several details about the host which may depend on the hardware (sound card, sound chip), software stack (OS, on Linux e.g. PulseAudio vs. ALSA), sound driver and its versions, and connected periphery (speakers? headphones?).

Additionally, the audio API is used to generate a sound (which is muted before being played, but still generated before). Sound is hard, and so the browser vendors don't necessarily generate the "sound bits" themselves but ask the OS to so. Which might in fact ask its sound system to do so. Which might ask its sound driver...

Some of these properties are fairly common or likely to change often. But chances are that combined they give you more bits of information then say the simple user agent string (which is shared by thousands - if not more! - other browsers).

Reply on news.ycombinator.com