Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

scrapfly.dev

Post reply on HN
Print view View original

151–160 of 237 posts

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#151

Post by chjj »

coppsilgold wrote: post #147
chjj wrote: post #132

Earlier quoted context omitted.

> Why give up information when you don't have to? Yeah, I generally agree with that viewpoint, but you are giving up that information, even without JS. Your TCP stack can be fingerprinted through long enough observation. Windows, Mac, and Linux all look different on a network level. It's not as simple `if XYZ then OS = Windows`, it's more holistic/probabilistic, but it's possible nonetheless. e.g. One thing that bugs…

> TCP stack can be fingerprinted How does that apply to Tor? It uses custom packets. The entry node may be able to obtain a TCP fingerprint but that's all.

It doesn't. This case applies more to MVB.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#152

Post by zx8080 »

jeroenhd wrote: post #13
Aurornis wrote: post #8

> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…

> Most users aren't spoofing their user agent headers to be a different operating system. The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.

Infinite captcha welcomes those who are using FF and linux on stackoverflow. Easier to skip its links in search results than waste time solving it (captcha never finishes).

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#153

Post by lixtra »

matheusmoreira wrote: post #136
mplewis wrote: post #44

Earlier quoted context omitted.

It is when you're doing it like the LLM companies are: at scale, to the degree that you're taking down my site, without my consent by masking your user-agent, for the purpose of stealing data I didn't authorize you to have.

> at scale, to the degree that you're taking down my site Fair. Scrapers should be polite and do their utmost to consume the smallest possible amount of resources. > without my consent by masking your user-agent Your consent is not required. It's my user agent. I set it to whatever I want. > for the purpose of stealing data I didn't authorize you to have Data can't be "stolen", only copied. You set up an HTTP server…

> You set up an HTTP server that literally sends people the data when they request it. Don't do that if you don't want people to have the data.

By the same argument I could say: If I send you an exploit and you execute it, don’t complain that your setup fell for it. Just don’t download and run random data from the internet.

In reality there’s a consent and expectation beyond the pure technicals.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#154

Post by tyami94 »

nradov wrote: post #120
esrauch wrote: post #113

Earlier quoted context omitted.

I feel like this is with 2026 view where browsers are so mutually compatible. In the bad old days there were so many differences between html, css and js behaviors that if you wanted your site to be nice you had to change it for the browser. The way css padding worked wasn't even the same. Feature detection was rarely viable for any of this. No user agent would probably have only entrenched IE6 dominance even more by…

I'm aware of that history and the User-Agent header was a mistake even back then. It took the pressure off of browser vendors and gave them an excuse to not fix their bugs.

road to hell is paved with good intentions. one could argue it would've made browser vendors fix their bugs, but with the side-effect that any behavior that isn't bug-compatible with IE becomes a bug. this would've ironically entrenched IE permanently.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#155

Post by matheusmoreira »

lixtra wrote: post #153
matheusmoreira wrote: post #136

Earlier quoted context omitted.

> at scale, to the degree that you're taking down my site Fair. Scrapers should be polite and do their utmost to consume the smallest possible amount of resources. > without my consent by masking your user-agent Your consent is not required. It's my user agent. I set it to whatever I want. > for the purpose of stealing data I didn't authorize you to have Data can't be "stolen", only copied. You set up an HTTP server…

> You set up an HTTP server that literally sends people the data when they request it. Don't do that if you don't want people to have the data. By the same argument I could say: If I send you an exploit and you execute it, don’t complain that your setup fell for it. Just don’t download and run random data from the internet. In reality there’s a consent and expectation beyond the pure technicals.

> Just don’t download and run random data from the internet.

I don't. I go out of my way to filter everything. Scraping is but one of the tools I use to do it. I want just the data that I actually care about, not people's javascripted hot mess websites full of malware-vectoring ads, fingerprinting and tracking.

I don't let my computers talk to strangers either. My servers don't respond to just anyone, they only reply to me, and only after I've cryptographically authenticated. When others try to talk to them it's like they're not even there.

But people want their computers to talk to strangers, don't they? They want to serve pages and pages of ads to massive audiences. Unlike your exploitation example, nobody's actively invading their computers and exfiltrating data. Breaking into someone else's computers and dumping their private databases is one thing. We're just requesting the exact same data that they're more than happy to send out to literally anyone who shows up with a browser, through the exact same channels even. So I really have no sympathy.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#156

Post by tormeh »

coldbrewed wrote: post #61
codedokode wrote: post #27

Earlier quoted context omitted.

I disagree, fingerprinting is necessary to track humans and it will be used regardless of scrapers being there or not.

I work at a CDN that provides bot detection services. I agree that there's baseline necessity in terms of fraud detection, and if not necessity then definitely financial motivation to fingerprint. But these days, abusive scraping is far and way the the main driver for fingerprinting. We don't fingerprint for ad purposes, and we destroy PII for humans as fast as we can because PII should be treated as radioactive. But…

Do you think this could drive a shift towards more efficient web tech? I.e. more static websites, or websites served by faster software?

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#157

Post by Dylan16807 »

torginus wrote: post #78
AlotOfReading wrote: post #52

Earlier quoted context omitted.

I recommend pretty much everyone avoid fixed point and other float alternatives, barring exceptional cases after you've done your own numerical analysis, or you lack floating point hardware (rare these days). Yes, fixed point can use simpler hardware. That's also a completely irrelevant consideration for software. The vast majority of processors are optimized for floats now and some operations (e.g. division) are act…

I didn't recommend fixed point for simpler HW - I recommended it for better precision (if you know what you are doing). First, a point I didn't make, is that if you have 32 bits of fixed, you get way more precision than with a 32 bit float. But I can think of a pretty common case where a 24 bit int would win against a 32bit float: convolution filters. If you have a filter whose inputs are supposed to sum up to 1 (whi…

> if you have 32 bits of fixed, you get way more precision than with a 32 bit float

You get 7 more bits for the most extreme numbers. Which is a good portion of 32, but not crazy. By the time you hit double precision you're only sacrificing 10 of your 64 bits to make your range considerations a hundred times simpler.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#158

Post by yunwal »

drnick1 wrote: post #7

This is interesting, but even without relying on JS, most users are already fingerprintable by the combination of IP + user agent.

Yes, but it's important that people who care about not being tracked have options, even if it's not most people.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#159

Post by rootusrootus »

Arch-TK wrote: post #80
joahnn_s wrote: post #42

Earlier quoted context omitted.

You can only assert >148 at the moment, but there are better vectors to strictly assert the version by simply checking the addition of v8/blink on each chromium version (and since ~120 it's the case), so by checking if xxx is present and yyy is not present in js userland or css feature, the inference is 100% for the major version And for the LLM writing, yes, it's written in the article and blog, it's not hidden or p…

It takes less time to write the prompt, you could just publish that? It's an important topic, and I am glad you wrote about it, but even half a page of notes would have been enough to convey this. It would save me literally skim reading headings just to get past all the fluff.

Isn’t “just post the prompt” a joke? That only works if the content was one-shot, and I bet that (much like code) most isn’t.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#160

Post by torginus »

AlotOfReading wrote: post #117
torginus wrote: post #78

Earlier quoted context omitted.

I didn't recommend fixed point for simpler HW - I recommended it for better precision (if you know what you are doing). First, a point I didn't make, is that if you have 32 bits of fixed, you get way more precision than with a 32 bit float. But I can think of a pretty common case where a 24 bit int would win against a 32bit float: convolution filters. If you have a filter whose inputs are supposed to sum up to 1 (whi…

First, a point I didn't make, is that if you have 32 bits of fixed, you get way more precision than with a 32 bit float. That's true, but I already responded to it. If you step up to the next size of float (e.g. f64), you have more precision than the fixed32. You can do exactly the same computation in f64 with equivalent inputs, and you'll get better precision than doing it in fixed32. Or you can round at every step…

Thanks for answering my points in detail! I think this is one of those domains where there's enough theory and practical considerations, that basically given the same set of constraints, there's generally one set of correct conclusions.

To be clear I'm not anti-float, as they have less surprising behavior than fixed point, and are much less fiddly, but I do have to note that f32 sits at that awkward spot where it's not accurate enough for a lot of numerical work, but stepping up to f64 carries a significant performance penalty on things like GPUs, and most DSPs don't really give you f64 hardware at full rate, if at all.

In contrast, 32 bit fixed point gives you 6 extra bits of precision, (IEEE754 mantissa should count as 26 bit), which can often be the saving grace.

For example, in video games, if you mandate a 0.01mm precision, with int32, you get a 40kmX40km area, which is plenty, and with float32, you have to divide every dimension by 64, which is not enough for even mid-sized maps, and you have to employ tricks or go straight to f64.

Post reply on HN