Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

scrapfly.dev

Post reply on HN
Print view View original

181–190 of 237 posts

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#181

Post by nradov »

kdheiwns wrote: post #178
nradov wrote: post #106

Earlier quoted context omitted.

What data is being stolen? Are you referring to copyright violation or something else? If you don't want LLM companies to scrape a site then just restrict access to authorized users. Simple.

This is the same mindset of criminal in a low trust society btw "If you didn't want me to do this, you should had a fence/cameras/security guards. You shouldn't have dressed like that. You shouldn't have put your phone in that pocket." Excusing trillion dollar corporations like low level criminals is embarrassing. Society shouldn't have to lock itself up because bad actors are spreading everywhere. The bad actors sho…

Relax buddy, it's just HTTP requests. They're not stealing your phone.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#182

Post by thaumasiotes »

parasense wrote: post #116
nradov wrote: post #101

Earlier quoted context omitted.

The HTTP User-Agent header was a mistake from the beginning. There is no legitimate need for the server to know what software the client is (or claims to be) running.

It certainly wasn't a mistake in the beginning, but it's certainly a mistake now.

It was a mistake in the beginning too. If you want to serve different content to different people, you use two different URLs. There's never a valid case for doing it while hiding it from the user.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#183

Post by fn-mote »

0xbadcafebee wrote: post #166
coldbrewed wrote: post #61

Earlier quoted context omitted.

I work at a CDN that provides bot detection services. I agree that there's baseline necessity in terms of fraud detection, and if not necessity then definitely financial motivation to fingerprint. But these days, abusive scraping is far and way the the main driver for fingerprinting. We don't fingerprint for ad purposes, and we destroy PII for humans as fast as we can because PII should be treated as radioactive. But…

> we see customers that are constantly burned by abusive scrapers and the scrapers aren't slowing down So, I have two dumb questions: 1) Can't the customer rate-limit connections? If the "abuse" in scraping is the number of requests... limit the number of requests? 2) There is probably a market now for federated authentication where the provider gives legal guarantees of anonymized fingerprint in exchange for either…

> Can't the customer rate-limit connections?

Bad guys use a botnet (compromised residential computers and routers) to defeat rate limiting and ip-based blocking.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#184

Post by cookiengineer »

Aurornis wrote: post #8

> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…

Fun fact that will blow your mind:

Microsoft decided to send Windows NT 10.0 in the User-Agent header even on Windows 11 for compatibility reasons. That's literally the reason why the Sec-CH-* headers say Windows 11 but the User-Agent says Windows 10.

And regarding your claims of vendor interests: Nope, you seemingly never had to use O365 crapware on Linux browsers. They make it as painful as possible, and even disable copy/paste functionality when your User-Agent and Sec-CH headers say Linux. Identical browser with an extension that overrides the fingerprinting headers and it works perfectly.

Also as an additional note: Cloudflare does TCP fingerprinting, because no cloudflare pages will work (and send you into an infinite loop of unsolvable captchas) when these headers mismatch with the tcp window and other options in the handshake frames.

Source: am maintaining my chromium-profiles tool that generates farbled profiles with a generated extension, so that I can use shitty Microsoft products because my customers are not really the smartest policy decision makers.

PS: I will never use a separate laptop with a separate OS to use a damn web app. That is a completely unjustified waste of hardware resources and should be illegal. But here we are. Wasting one laptop at a time for absolutely no reason.

[1] https://github.com/cookiengineer/chromium-profiles

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#185

Post by ksenzee »

vlian2088 wrote: post #99
ddtaylor wrote: post #54

Earlier quoted context omitted.

[flagged]

[flagged]

I don’t know whether you wrote this by hand in the most painfully LLM style you could gin up, or whether you got an LLM to do it for you, but either way I tip my hat to you.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#186

Post by sroussey »

thaumasiotes wrote: post #182
parasense wrote: post #116

Earlier quoted context omitted.

It certainly wasn't a mistake in the beginning, but it's certainly a mistake now.

It was a mistake in the beginning too. If you want to serve different content to different people, you use two different URLs. There's never a valid case for doing it while hiding it from the user.

No, that misses the whole point of content negotiation (for language, et al). In the age of search engines though, different urls are often perferable.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#187

Post by genxy »

acters wrote: post #39
jeroenhd wrote: post #13

Earlier quoted context omitted.

> Most users aren't spoofing their user agent headers to be a different operating system. The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.

It's sometimes easier to lie than to tell the truth, and being on Linux telling the truth gets me more scrutiny than those pretending to be legit.

Same as sites the block "wget" as a user agent, but then you can pass in a -U "Cheetos/10" and sail right in.

I'd be fine if they throttled the connection, or a contact page. Every little bit helps build a high trust society.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#188

Post by tomjakubowski »

luciana1u wrote: post #168

Math.tanh as a fingerprinting vector. at this rate the next browser privacy paper will reveal that the number of milliseconds your CPU takes to render an emoji is also uniquely identifying.

Hopefully it takes much less than a millisecond to render a single emoji. Ca. 2018 I wrote some bad OpenGL code which could render a swarm of millions of poop emoji on a rather large display at 60 fps, so that was less than ~16e-6 ms per emoji.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#189

Post by dang »

vlian2088 wrote: post #99
ddtaylor wrote: post #54

Earlier quoted context omitted.

[flagged]

[flagged]

Can you please not post AI-generated or AI-edited comments to HN? It's not allowed here - see https://news.ycombinator.com/newsguidelines.html#generated and https://news.ycombinator.com/item?id=47340079.

Of course, it's impossible to know for sure what was LLM processed or not, but some of your posts (like this one) have been getting classified that way.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#190

Post by chrismorgan »

nradov wrote: post #101
jeroenhd wrote: post #13

Earlier quoted context omitted.

> Most users aren't spoofing their user agent headers to be a different operating system. The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.

The HTTP User-Agent header was a mistake from the beginning. There is no legitimate need for the server to know what software the client is (or claims to be) running.

When distributing software, it’s very useful to know which OS and which architecture the user is on in order to present them with the appropriate file.
Post reply on HN