Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

scrapfly.dev

Post reply on HN
Print view View original

41–50 of 237 posts

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#41

Post by pocksuppet »

reactordev wrote: post #24
jeroenhd wrote: post #13

Earlier quoted context omitted.

> Most users aren't spoofing their user agent headers to be a different operating system. The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.

The Internet is a cesspool of scams now

scraping, however, is not intrinsically a scam.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#42

Post by joahnn_s »

Aurornis wrote: post #8

> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…

You can only assert >148 at the moment, but there are better vectors to strictly assert the version by simply checking the addition of v8/blink on each chromium version (and since ~120 it's the case), so by checking if xxx is present and yyy is not present in js userland or css feature, the inference is 100% for the major version

And for the LLM writing, yes, it's written in the article and blog, it's not hidden or pretending, otherwise I would never publish an article due to lack of time, and I stand by it

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#43

Post by kaladin-jasnah »

akersten wrote: post #20
amelius wrote: post #14

Can't we make fingerprinting illegal, as in, jailtime illegal? Would not solve everything but still help a lot.

Why should it be illegal for me to recognize the way you walk into my store, even though you're wearing a mask and a trenchcoat? Some vague sense of indignation? Yeah, tracking bad, I get it, but are whatever damages that kind of legislation would prevent (probably nothing measurable) really more important than fixing the easy, in our face social problems that politicians could instead be focusing on?

Isn't fingerprinting used across many different websites? Then the analogy would be a number of stores colluding to recognize the same person across all stores?

(I have no idea, I don't know too much about this)

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#44

Post by mplewis »

pocksuppet wrote: post #41
reactordev wrote: post #24

Earlier quoted context omitted.

The Internet is a cesspool of scams now

scraping, however, is not intrinsically a scam.

It is when you're doing it like the LLM companies are: at scale, to the degree that you're taking down my site, without my consent by masking your user-agent, for the purpose of stealing data I didn't authorize you to have.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#45

Post by gruez »

qurren wrote: post #22

just inject this with your favorite JS injection plugin let oldTanh = Math.tanh; Math.tanh = x => oldTanh(x) + Math.random()/10000000;

Great, now you'll be outed as "hides fingerprint", which is probably more identifying than if you returned a normal value.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#46

Post by userbinator »

joahnn_s wrote: post #36
codedokode wrote: post #29

Earlier quoted context omitted.

Why don't you ask browser developers to stop adding features helping fingerprinting? Browsers even have some API for tracking ad clicks (attribution API or something) and user interests tracking API which nobody of the users needs.

The thing is that's not done on purpose and too hard to figure out how this has an impact underneath, if you read the v8 commit https://chromium.googlesource.com/v8/v8/+/c1486295ae5bcb0f8f... it's on a complete good faith

With companies like these, "plausible deniability" is more likely.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#47

Post by comex »

Aurornis wrote: post #8

> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…

This can be used to fingerprint version range, but so can a million other things. Browsers are constantly adding new features and fixing bugs, most of which can be detected from JavaScript.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#49

Post by charcircuit »

kaladin-jasnah wrote: post #43
akersten wrote: post #20

Earlier quoted context omitted.

Why should it be illegal for me to recognize the way you walk into my store, even though you're wearing a mask and a trenchcoat? Some vague sense of indignation? Yeah, tracking bad, I get it, but are whatever damages that kind of legislation would prevent (probably nothing measurable) really more important than fixing the easy, in our face social problems that politicians could instead be focusing on?

Isn't fingerprinting used across many different websites? Then the analogy would be a number of stores colluding to recognize the same person across all stores? (I have no idea, I don't know too much about this)

Which is famously done by casinos. But in practice many businesses big and small do share intelligence with each other about problematic customers who shoplift etc.
Post reply on HN