Hacker News Reader

Comment by dmazzoni | Hacker News Reader

The essence seems to be that the web audio API has a lot of algorithms that do a lot of math, and every browser has a slightly different implementation, and the exact results depend on the operating system and cpu too. So if you use the web audio API to generate a small signal all browsers will generate something that's really close, but the tiny differences can be used to help tell them apart.

View on HN

But why would it vary in ways that are consistent run to run on one machine, but not consistent with the same process executed on another similar machine?

Every datapoint reduces the number of people it could belong to. CPU + browser + browser version + OS + major OS version can narrow it down by a lot.

Then add resolution, IP address location (which VPN they use is also a datapoint), which time they are active at, etc. and you can get a good almost-unique identifier.

Maybe we should make the browser implementations consistent to the point they can't be told apart. Alternatively, we can reduce the precision of the results so that the tiny differences are deleted.

Browser vendors already copy the Audio API code from each other, you can see it in their public GitHub repositories. It doesn't help.

that wouldn't help. you already know the browser and os through easier means

Like what? The voluntarily provided User-Agent? The browser is in control of that.

The browser in this adversarial scenario is also in control of the audio context too

Yet it is incredibly difficult to hide the underlying hardware or low level library differences. Not without slowing things down significantly.

Do you, as an end user, know how to change these settings compared to changing your user agent?

From the average user perspective those settings are equally impossible to change, as they neither know nor care that they even exist.

Reply on news.ycombinator.com