This is interesting, but even without relying on JS, most users are already fingerprintable by the combination of IP + user agent.
What about TOR or VPNs + faking user agents?
Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
131–140 of 237 posts
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#132Earlier quoted context omitted.
I think they made the right call on that. It's unclear to me whether hiding the OS is even possible. There's just too much OS-specific behavior that happens inside (and outside) a web browser. It's hard to account for all of it. OS rendering differences can likely betray you even when canvas extraction is blocked/noised. At least one tor-browser dev has publicly confirmed that you can't even hide the difference betwe…
It's not surprising that JS would out you, what I am wondering if whether or not volunteering OS information is foolish when it may not be possible to determine without JS. Why give up information when you don't have to? Some people disable JS at least some of the time.
> Why give up information when you don't have to?
Yeah, I generally agree with that viewpoint, but you are giving up that information, even without JS.
Your TCP stack can be fingerprinted through long enough observation. Windows, Mac, and Linux all look different on a network level. It's not as simple `if XYZ then OS = Windows`, it's more holistic/probabilistic, but it's possible nonetheless.
e.g. One thing that bugs me about arch linux is that they recently changed the kernel default TCP keepalive time to be shorter (much shorter[1]), making arch users stand out a lot. So, not only can a fingerprinter identify your OS, they might be able to pin down your exact distro based on TCP behavior alone.
I guess my point is that hiding the OS would be a massive amount of effort to plug a hole that cannot be plugged without effectively controlling the entire OS. TB/MVB is limited in what it can do by itself.
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#133Earlier quoted context omitted.
I never understood why fixed precision, and integer math isn't more popular. In engineering, we used fixed point all the time, it ran on much simpler hardware and the error is mathematically easy to model. IEEE 754 floats are not only suspect when it comes to theory, but are often outperformed with integers smaller than the mantissa (so less than 24 bits of int can beat a 32 bit float), when it comes to things like l…
I recommend pretty much everyone avoid fixed point and other float alternatives, barring exceptional cases after you've done your own numerical analysis, or you lack floating point hardware (rare these days). Yes, fixed point can use simpler hardware. That's also a completely irrelevant consideration for software. The vast majority of processors are optimized for floats now and some operations (e.g. division) are act…
it's very common to have to implmeent algorithms on microcontrollers with no floating point or on FPGAs...
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#134Earlier quoted context omitted.
It is when you're doing it like the LLM companies are: at scale, to the degree that you're taking down my site, without my consent by masking your user-agent, for the purpose of stealing data I didn't authorize you to have.
What data is being stolen? Are you referring to copyright violation or something else? If you don't want LLM companies to scrape a site then just restrict access to authorized users. Simple.
[deleted]
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#135> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…
> Most users aren't spoofing their user agent headers to be a different operating system. The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.
This tanh approach won’t tell you if you’re in a VM - it’ll report the guest OS
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#136Earlier quoted context omitted.
scraping, however, is not intrinsically a scam.
It is when you're doing it like the LLM companies are: at scale, to the degree that you're taking down my site, without my consent by masking your user-agent, for the purpose of stealing data I didn't authorize you to have.
> at scale, to the degree that you're taking down my site
Fair. Scrapers should be polite and do their utmost to consume the smallest possible amount of resources.
> without my consent by masking your user-agent
Your consent is not required. It's my user agent. I set it to whatever I want.
> for the purpose of stealing data I didn't authorize you to have
Data can't be "stolen", only copied.
You set up an HTTP server that literally sends people the data when they request it. Don't do that if you don't want people to have the data. Secrecy is the only possible defense.
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#137Earlier quoted context omitted.
It is when you're doing it like the LLM companies are: at scale, to the degree that you're taking down my site, without my consent by masking your user-agent, for the purpose of stealing data I didn't authorize you to have.
I think the key word was "intrinsically". It's like public photography, it's intrinsically legal, except when it's a Flock camera and then it's suddenly an invasion of privacy.
A Flock camera isn’t an invasion of privacy. Fleets of hundreds or thousands of Flock cameras feeding into a massive dataset is definitely an invasion of privacy, and hardly sudden.
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#138Earlier quoted context omitted.
It is when you're doing it like the LLM companies are: at scale, to the degree that you're taking down my site, without my consent by masking your user-agent, for the purpose of stealing data I didn't authorize you to have.
The idiotic "stealing" argument again? At least use "piracy" if you want to be correct... The moment you openly publish information on the Internet, you have already given consent. There are other solutions to bandwidth usage. User-agent discrimination should be illegal. All it does is further the control that Big Tech has, and help authoritarian governments with their control too.
> User-agent discrimination should be illegal.
Couldn't agree more. Nonsense like remote attestation too. If this discrimination persists, it will lead to the destruction of what little computing freedom we still have.
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#139Earlier quoted context omitted.
fixed-point provides uniform precision, exact integer-scaled arithmetic, is deterministic whereas floating point is more convenient but its not a panacea
Fixed-point arithmetic provides uniform absolute precision; floating-point arithmetic provides almost-uniform relative precision, as used by scientists and engineers for literally centuries (“significant digits” except the binary version is more uniform than the decimal one customary with pencil and paper). Hardware floating point on CPUs (including SIMD units) is almost always IEEE 754 compliant these days (exceptin…
- Transcendental functions (exp, sin, etc.) are really hard (multiple literal PhDs) to implement according to the rules I’ve just described (“correct rounding”), so you’ve only been able to get such implementations in the last few years, and I believe no stock libm has completely switched so bring your own if you need them.
Correct transcendentals are also difficult in fixed point. When pigweed was implementing them for their fixed impl, they got help from from an ex. Mathworks floating point expert on the LLVM team with a relevant PhD to do it correctly [0].
Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS
#140Earlier quoted context omitted.
The Internet is a cesspool of scams now
Has the internet made the average human’s life better? As someone that lived in both eras I have to say no. If you want to improve humanity greatly and prevent currently 8.3 billion people’s misery and counting, you build a time machine and prevent Tim Berners-Lee from inventing it in the first place. But it wouldn’t help, because someone else would still invent this torture nexus of hyperconnected human minds.
The internet was amazing before the big techs started centralizing everything, before governments started fragmenting it into censored regional networks...