Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS • Hacker News Board

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#31

Post by Terr_ » Sun, Jul 12, 2026, 10:03 PM UTC

chaboud wrote: post #17

amelius wrote: post #14

Can't we make fingerprinting illegal, as in, jailtime illegal? Would not solve everything but still help a lot.

I'd rather penalize the application than the technique. Windows was rumored to long have "quirks" that would do better things for apps that had bugs that the OS ended up fixing instead of the app. Javascript systems have long had polyfills for varied browser feature comparability gaps. Whether you agree with these, making probing detection via fingerprinting illegal would take away this lever. Making surreptitious tr…

Yeah, the problem is how the data is kept and abused afterwards.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#32

Post by thepasch » Sun, Jul 12, 2026, 10:03 PM UTC

akersten wrote: post #20

amelius wrote: post #14

Can't we make fingerprinting illegal, as in, jailtime illegal? Would not solve everything but still help a lot.

Why should it be illegal for me to recognize the way you walk into my store, even though you're wearing a mask and a trenchcoat? Some vague sense of indignation? Yeah, tracking bad, I get it, but are whatever damages that kind of legislation would prevent (probably nothing measurable) really more important than fixing the easy, in our face social problems that politicians could instead be focusing on?

> Why should it be illegal for me to recognize the way you walk into my store

If you did it in just your store, that wouldn't be a problem. The correct analogy, however, is "why should it be illegal for me to attach a perfectly traceable and invisible air-tag to you when you enter my store, without your explicit consent, and subsequently follow and document your every movement no matter where you go, as long as that location has a business relationship with my store, and also my store is the most popular chain on the planet that has business relationships with basically any relevant business that exists." And I don't think the answer to this one shouldn't be particularly difficult to arrive at.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#33

Post by d1ss0nanz » Sun, Jul 12, 2026, 10:05 PM UTC

reactordev wrote: post #24

jeroenhd wrote: post #13

Earlier quoted context omitted.

> Most users aren't spoofing their user agent headers to be a different operating system. The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.

The Internet is a cesspool of scams now

Always was.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#34

Post by sanxiyn » Sun, Jul 12, 2026, 10:06 PM UTC

qurren wrote: post #22

just inject this with your favorite JS injection plugin let oldTanh = Math.tanh; Math.tanh = x => oldTanh(x) + Math.random()/10000000;

The article addresses this: search for "No noise".

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#35

Post by chjj » Sun, Jul 12, 2026, 10:07 PM UTC

qurren wrote: post #22

just inject this with your favorite JS injection plugin let oldTanh = Math.tanh; Math.tanh = x => oldTanh(x) + Math.random()/10000000;

it's elegant, but i prefer:

    Math.tanh = Math.random;

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#36

Post by joahnn_s » Sun, Jul 12, 2026, 10:07 PM UTC

codedokode wrote: post #29

amelius wrote: post #14

Can't we make fingerprinting illegal, as in, jailtime illegal? Would not solve everything but still help a lot.

Why don't you ask browser developers to stop adding features helping fingerprinting? Browsers even have some API for tracking ad clicks (attribution API or something) and user interests tracking API which nobody of the users needs.

The thing is that's not done on purpose and too hard to figure out how this has an impact underneath, if you read the v8 commit https://chromium.googlesource.com/v8/v8/+/c1486295ae5bcb0f8f... it's on a complete good faith

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#37

Post by torginus » Sun, Jul 12, 2026, 10:08 PM UTC

sjrd wrote: post #4

I guess that's one more good reason to push for correctly rounded transcendental functions. I recently learned that they're basically solved now. [1] [1] https://arith2026.org/program.html (2nd keynote)

I never understood why fixed precision, and integer math isn't more popular. In engineering, we used fixed point all the time, it ran on much simpler hardware and the error is mathematically easy to model. IEEE 754 floats are not only suspect when it comes to theory, but are often outperformed with integers smaller than the mantissa (so less than 24 bits of int can beat a 32 bit float), when it comes to things like loss of precision.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#38

Post by akersten » Sun, Jul 12, 2026, 10:10 PM UTC

thepasch wrote: post #32

akersten wrote: post #20

Earlier quoted context omitted.

Why should it be illegal for me to recognize the way you walk into my store, even though you're wearing a mask and a trenchcoat? Some vague sense of indignation? Yeah, tracking bad, I get it, but are whatever damages that kind of legislation would prevent (probably nothing measurable) really more important than fixing the easy, in our face social problems that politicians could instead be focusing on?

> Why should it be illegal for me to recognize the way you walk into my store If you did it in just your store , that wouldn't be a problem. The correct analogy, however, is "why should it be illegal for me to attach a perfectly traceable and invisible air-tag to you when you enter my store, without your explicit consent, and subsequently follow and document your every movement no matter where you go, as long as that…

Well it's not really an airtag, I don't "attach" anything to your browser when I check what its GPU can do.

That's just a description of you that I share with my other stores. Casinos, Target, Burger King, etc all do this when you get 86'd, for example.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#39

Post by acters » Sun, Jul 12, 2026, 10:10 PM UTC

jeroenhd wrote: post #13

Aurornis wrote: post #8

> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…

> Most users aren't spoofing their user agent headers to be a different operating system. The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.

It's sometimes easier to lie than to tell the truth, and being on Linux telling the truth gets me more scrutiny than those pretending to be legit.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#40

Post by coppsilgold » Sun, Jul 12, 2026, 10:12 PM UTC

Even Tor Browser (/mullvad-browser) gave up trying to obscure the operating system though arguably they shouldn't have. There appear to be too many fingerprinting vectors.