Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS • Hacker News Board

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#61

Post by coldbrewed » Sun, Jul 12, 2026, 10:41 PM UTC

codedokode wrote: post #27

jeroenhd wrote: post #10

Kind of a smart move by this company: write up an AI analysis of all fingerprinting techniques in hopes they get fixed after outrage so their scraping company can make more money. If it weren't for companies like this, fingerprinting wouldn't be so ubiquitous and the internet would be a better place in general. I prefer articles like this coming from the other side of the battle (fingerprint.js and friends) because a…

I disagree, fingerprinting is necessary to track humans and it will be used regardless of scrapers being there or not.

I work at a CDN that provides bot detection services. I agree that there's baseline necessity in terms of fraud detection, and if not necessity then definitely financial motivation to fingerprint. But these days, abusive scraping is far and way the the main driver for fingerprinting.

We don't fingerprint for ad purposes, and we destroy PII for humans as fast as we can because PII should be treated as radioactive. But we see customers that are constantly burned by abusive scrapers and the scrapers aren't slowing down.

The current approach to scraping is strip mining the Internet and is having the corresponding pollution effects that you'd expect. I'm fine with individuals doing whatever weird automation they want, more power to you, but it's this industrial scale crawling and extraction that's degrading the Internet from all angles.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#62

Post by hahahaa » Sun, Jul 12, 2026, 10:44 PM UTC

mrsssnake wrote: post #21

JavaScript was a mistake.

Goes back in time. Uninvents JS. Everyone using Shockwave Flash blob to run their code. Enjoy!

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#63

Post by userbinator » Sun, Jul 12, 2026, 10:44 PM UTC

Aurornis wrote: post #8

> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…

The LLM has a good point. I personally don't care what or who wrote it if it's true.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#64

Post by VorpalWay » Sun, Jul 12, 2026, 10:44 PM UTC

mplewis wrote: post #44

pocksuppet wrote: post #41

Earlier quoted context omitted.

scraping, however, is not intrinsically a scam.

It is when you're doing it like the LLM companies are: at scale, to the degree that you're taking down my site, without my consent by masking your user-agent, for the purpose of stealing data I didn't authorize you to have.

Something like Anubis in front of the server to protect it might be an option. It sucks that we have to resort to that yes, but it seems the least bad option currently (better than the entire internet going through Cloudflare at least).

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#65

Post by hilariously » Sun, Jul 12, 2026, 10:47 PM UTC

AlotOfReading wrote: post #52

torginus wrote: post #37

Earlier quoted context omitted.

I never understood why fixed precision, and integer math isn't more popular. In engineering, we used fixed point all the time, it ran on much simpler hardware and the error is mathematically easy to model. IEEE 754 floats are not only suspect when it comes to theory, but are often outperformed with integers smaller than the mantissa (so less than 24 bits of int can beat a 32 bit float), when it comes to things like l…

I recommend pretty much everyone avoid fixed point and other float alternatives, barring exceptional cases after you've done your own numerical analysis, or you lack floating point hardware (rare these days). Yes, fixed point can use simpler hardware. That's also a completely irrelevant consideration for software. The vast majority of processors are optimized for floats now and some operations (e.g. division) are act…

fixed-point provides uniform precision, exact integer-scaled arithmetic, is deterministic whereas floating point is more convenient but its not a panacea

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#66

Post by ddtaylor » Sun, Jul 12, 2026, 10:49 PM UTC

Retr0id wrote: post #55

ddtaylor wrote: post #54

Earlier quoted context omitted.

[flagged]

And the other half of the community seems fixated on upvoting AI slop.

Sounds needlessly divisive.

Why not criticize the content instead of the source or medium?

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#67

Post by userbinator » Sun, Jul 12, 2026, 10:50 PM UTC

mplewis wrote: post #44

pocksuppet wrote: post #41

Earlier quoted context omitted.

scraping, however, is not intrinsically a scam.

It is when you're doing it like the LLM companies are: at scale, to the degree that you're taking down my site, without my consent by masking your user-agent, for the purpose of stealing data I didn't authorize you to have.

The idiotic "stealing" argument again? At least use "piracy" if you want to be correct...

The moment you openly publish information on the Internet, you have already given consent. There are other solutions to bandwidth usage.

User-agent discrimination should be illegal. All it does is further the control that Big Tech has, and help authoritarian governments with their control too.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#68

Post by [deleted] » Sun, Jul 12, 2026, 10:50 PM UTC

sanxiyn wrote: post #34

qurren wrote: post #22

just inject this with your favorite JS injection plugin let oldTanh = Math.tanh; Math.tanh = x => oldTanh(x) + Math.random()/10000000;

The article addresses this: search for "No noise".

[deleted]

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#69

Post by georgemcbay » Sun, Jul 12, 2026, 10:51 PM UTC

joahnn_s wrote: post #42

Aurornis wrote: post #8

> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…

You can only assert >148 at the moment, but there are better vectors to strictly assert the version by simply checking the addition of v8/blink on each chromium version (and since ~120 it's the case), so by checking if xxx is present and yyy is not present in js userland or css feature, the inference is 100% for the major version And for the LLM writing, yes, it's written in the article and blog, it's not hidden or p…

> otherwise I would never publish an article due to lack of time, and I assume

Didn't even have time to finish their HN reply.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#70

Post by IvanK_net » Sun, Jul 12, 2026, 10:52 PM UTC

I think the screen resolution is also fingerprintable. That is why a browser should resize your window to a random size each time you visit a website.