Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

Post by phyzome » Mon, Jul 13, 2026, 1:52 AM UTC

joahnn_s wrote: post #42

Aurornis wrote: post #8

> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…

You can only assert >148 at the moment, but there are better vectors to strictly assert the version by simply checking the addition of v8/blink on each chromium version (and since ~120 it's the case), so by checking if xxx is present and yyy is not present in js userland or css feature, the inference is 100% for the major version And for the LLM writing, yes, it's written in the article and blog, it's not hidden or p…

Post by bakugo » Mon, Jul 13, 2026, 2:09 AM UTC

qurren wrote: post #22

just inject this with your favorite JS injection plugin let oldTanh = Math.tanh; Math.tanh = x => oldTanh(x) + Math.random()/10000000;

Post by lifthrasiir » Mon, Jul 13, 2026, 2:16 AM UTC

mananaysiempre wrote: post #142

lifthrasiir wrote: post #109

Earlier quoted context omitted.

> as was famously the case with glibc's pow at one point Pow is famously hard anyway because it's bivariate and there is no currently known way to work around the table-maker's dilemma (TMD). CORE-MATH even crashes upon a new required precision record, because it intentionally avoids Ziv's rounding.

I was a bit puzzled by your second sentence, so I searched around a bit and... do I have this right? - There’s a well-known way (“Ziv’s rounding”) to get (among other things) a correctly rounded double-precision pow(), but in bad cases it can get slow, meaning really quite slow in practice and we’ve got no idea how slow in the worst case (nobody knows what the worst case is). - There’s a recent, guaranteed-correct wa…

Post by doctaj » Mon, Jul 13, 2026, 2:30 AM UTC

zx8080 wrote: post #152

jeroenhd wrote: post #13

Earlier quoted context omitted.

> Most users aren't spoofing their user agent headers to be a different operating system. The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.

Infinite captcha welcomes those who are using FF and linux on stackoverflow. Easier to skip its links in search results than waste time solving it (captcha never finishes).

Post by biofunsf » Mon, Jul 13, 2026, 2:45 AM UTC

joahnn_s wrote: post #42

Aurornis wrote: post #8

> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…

You can only assert >148 at the moment, but there are better vectors to strictly assert the version by simply checking the addition of v8/blink on each chromium version (and since ~120 it's the case), so by checking if xxx is present and yyy is not present in js userland or css feature, the inference is 100% for the major version And for the LLM writing, yes, it's written in the article and blog, it's not hidden or p…