Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

scrapfly.dev

Post reply on HN
Print view View original

101–110 of 237 posts

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#101

Post by nradov »

jeroenhd wrote: post #13
Aurornis wrote: post #8

> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…

> Most users aren't spoofing their user agent headers to be a different operating system. The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.

The HTTP User-Agent header was a mistake from the beginning. There is no legitimate need for the server to know what software the client is (or claims to be) running.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#102

Post by Retr0id »

gdwatson wrote: post #83
ddtaylor wrote: post #54

Earlier quoted context omitted.

[flagged]

I am not so paranoid, and I haven’t been working with AI, so my AI-dar is bad. But I keep reading technical writeups like this, then getting frustrated at the writing style or incomplete explanation – this one was more complete than most, though it was repetitive. Then I come read the HN comments, and I see that it was LLM-generated. (To be fair, this one says so up top. Even so my eyes skipped over it.) So I find th…

Ooh, the disclaimer is new, it wasn't there originally: https://web.archive.org/web/20260712212920/https://scrapfly....

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#103

Post by Mistletoe »

reactordev wrote: post #24
jeroenhd wrote: post #13

Earlier quoted context omitted.

> Most users aren't spoofing their user agent headers to be a different operating system. The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.

The Internet is a cesspool of scams now

Has the internet made the average human’s life better? As someone that lived in both eras I have to say no. If you want to improve humanity greatly and prevent currently 8.3 billion people’s misery and counting, you build a time machine and prevent Tim Berners-Lee from inventing it in the first place. But it wouldn’t help, because someone else would still invent this torture nexus of hyperconnected human minds.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#104

Post by chjj »

akersten wrote: post #20
amelius wrote: post #14

Can't we make fingerprinting illegal, as in, jailtime illegal? Would not solve everything but still help a lot.

Why should it be illegal for me to recognize the way you walk into my store, even though you're wearing a mask and a trenchcoat? Some vague sense of indignation? Yeah, tracking bad, I get it, but are whatever damages that kind of legislation would prevent (probably nothing measurable) really more important than fixing the easy, in our face social problems that politicians could instead be focusing on?

The analogy falls apart when "your store" is actually a handful of multi-billion dollar corporations that surveil a significant portion of the internet and covertly grant government agencies (and god knows who else) access to the data.

It's passive surveillance on the order of billions of people. It's not a mom-and-pop shop.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#105

Post by twelve40 »

omoikane wrote: post #82

I hope this eventually ends up in https://coveryourtracks.eff.org/ so I can see how unique my math functions are relative to a larger population.

this is really something. They claim (no idea if true) to have patched 4,000+ signals in 550+ C++ files in Chromium. coveryourtracks.eff.org uses like what, 25 signals?

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#106

Post by nradov »

mplewis wrote: post #44
pocksuppet wrote: post #41

Earlier quoted context omitted.

scraping, however, is not intrinsically a scam.

It is when you're doing it like the LLM companies are: at scale, to the degree that you're taking down my site, without my consent by masking your user-agent, for the purpose of stealing data I didn't authorize you to have.

What data is being stolen? Are you referring to copyright violation or something else? If you don't want LLM companies to scrape a site then just restrict access to authorized users. Simple.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#107

Post by nradov »

codedokode wrote: post #27
jeroenhd wrote: post #10

Kind of a smart move by this company: write up an AI analysis of all fingerprinting techniques in hopes they get fixed after outrage so their scraping company can make more money. If it weren't for companies like this, fingerprinting wouldn't be so ubiquitous and the internet would be a better place in general. I prefer articles like this coming from the other side of the battle (fingerprint.js and friends) because a…

I disagree, fingerprinting is necessary to track humans and it will be used regardless of scrapers being there or not.

Why is it necessary to track humans? It might be more profitable for advertising but that's not the same as necessary.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#108

Post by coppsilgold »

ranger_danger wrote: post #91
coppsilgold wrote: post #40

Even Tor Browser (/mullvad-browser) gave up trying to obscure the operating system though arguably they shouldn't have. There appear to be too many fingerprinting vectors.

Tor Browser straight up does not even modify navigator.platform at all, so it's incredibly easy to see when you're not using e.g. Windows.

I believe they used to make the user-agent appear to belong to Windows but then they stopped doing it with the excuse that there are other ways to tell anyway.

The OS doesn't really matter, the amount of entropy it contains is very low. As long as the anonymity set of browser-users is large it's all good. And I believe Tor Browser accomplishes this objective.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#109

Post by lifthrasiir »

anematode wrote: post #94
sjrd wrote: post #4

I guess that's one more good reason to push for correctly rounded transcendental functions. I recently learned that they're basically solved now. [1] [1] https://arith2026.org/program.html (2nd keynote)

Agreed, correctly rounded libm functions are great, as long as they don't have miserable worse case behavior (as was famously the case with glibc's pow at one point). One thing I was thinking of doing is manually SLP-vectorizing the high-precision fallbacks that they use when they're close to a rounding boundary, so that you can get better worst-case behavior – but obviously it's good enough already for most purposes…

> as was famously the case with glibc's pow at one point

Pow is famously hard anyway because it's bivariate and there is no currently known way to work around the table-maker's dilemma (TMD). CORE-MATH even crashes upon a new required precision record, because it intentionally avoids Ziv's rounding.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#110

Post by Retr0id »

ddtaylor wrote: post #66
Retr0id wrote: post #55

Earlier quoted context omitted.

And the other half of the community seems fixated on upvoting AI slop.

Sounds needlessly divisive. Why not criticize the content instead of the source or medium?

The medium is the message, which is especially true when it exists as content-marketing for their anti-anti-scraping product for AI companies to use to improve their ability to emulate blogs, among other things.
Post reply on HN