Hacker News Reader

Comment by _factor | Hacker News Reader

I wonder if this took into account GPU render-time fingerprinting? The minute timing differences in how you render an image are still used to identify you.

View on HN

Recently did a WebGPU project and noticed Firefox polls GPU status on a 100ms timer, so you can't really use it for such as far as I can tell.

That said, Claude figured out that while Canvas copying of a loaded JPEG was out due to fingerprint resistance, it could copy it via WebGPU, so yeah...

This reminds me of some fucking bullshit about how browsers silently store canvas pixel data as premultiplied and try to transparently convert everything you put in and everything you take out, but silently corrupt color values in the process.

https://github.com/nagadomi/nunif/issues/32#issuecomment-153...

Yea ended up with my own PNG decoder in JS due to such issues.

It does not - there are a lot of these sorts of techniques, but we specifically modeled what commercial fingerprinters do in the wild to provide a realistic number. I have not seen a commercial fingerprinter do those sorts of timing-based fingerprinting techniques. (Doesn't mean there isn't one, just that I've looked at more scripts that your average person and haven't seen it.)

Oracle has a product that does just this commercially.

If you can run compute shader code, the fingerprinting and side channel possibilities become very rich. [1] is one paper among many on this topic.

[1]: https://dl.acm.org/doi/10.1145/3634737.3656283

Reply on news.ycombinator.com