Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Safari 17's advanced audio fingerprinting protection

fingerprint.com

Post reply on HN
Print view View original

121–130 of 266 posts

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#121

Post by shuckles »

lapcat wrote: post #113
saagarjha wrote: post #105

I feel like these days (especially given the recent focus on side channel attacks) it is basically a given that adding uniform noise to something that leaks data does not work, because you can always take more samples and remove the noise. Why did Safari add this? I understand that needing more samples is definitely an annoyance to fingerprinting efforts, but as this post shows it's basically always surmountable in s…

> Why did Safari add this? A lot of Apple's "privacy" features nowadays are marketing. It's privacy theater. What matters is whether they can tell a plausible story to the public, not whether is technically effective.

Is iCloud Private Relay theatre? 3rd party cookie blocking? What specific features do you allege exist just to mislead the general public?

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#123

Post by wdr1 »

dannyw wrote: post #118

I look forward to the day the EU makes fingerprinting illegal.

Defining fingerprinting in a legal terms is fairly difficult.

Most regulators would also likely consider fingerprinting for certain use cases as acceptable. E.g., detecting abuse, fraud, CP, etc.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#124

Post by FabHK »

exabrial wrote: post #108

I'm really ready to just be "that guy" that browses with JS disabled.

Good luck. It's amazing how little of today's web is good old HTML. A while ago I visited a website that used Markup - but that wasn't compiled into HTML and then statically served, oh no - it was rendered in JS client side. WTF.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#126

Post by TylerE »

chii wrote: post #110
redbell wrote: post #87

Another interesting technique to fingerprint users online is called GPU Fingerprinting [1] (2022). Codenamed 'DrawnApart', the technique relies on WebGL to count the number and speed of the execution units in the GPU, measure the time needed to complete vertex renders, handle stall functions, and more stuff ________________ 1. https://www.bleepingcomputer.com/news/security/researchers-u...

browsers should come with a default software renderer, and behave like the mic and camera where the site will require user permission to release the hardware GPU render path.

Do you have any concept of how many gigawatts per day that would waste?

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#127

Post by TylerE »

Retr0id wrote: post #28
h4x0rr wrote: post #11

Can anyone explain why the results are different to begin with? E.g. why is this audio fingerprinting even possible in the first place?

This was my first thought too, and they cover it in more detail here https://fingerprint.com/blog/audio-fingerprinting/#why-the-a... TL;DR different codepaths even within the same codebase (e.g. SIMD variants) can result in subtly different floating point results (iiuc, likely related to to the fact that floating point math is unexpectedly sensitive to order of operations etc.)

Funny how when I posted more or less exactly this comment in another context recently a lot of people refused to take me seriously!

https://news.ycombinator.com/context?id=39633730

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#128

Post by rgmerk »

exabrial wrote: post #108

I'm really ready to just be "that guy" that browses with JS disabled.

The problem is that that by being "that guy" you're probably giving them 10 bits or more of identification. If they can just scrape a few more bits from somewhere they'll have you uniquely identified.

But, yeah, these guys can get on Golgafrinchan Ark B with the rest of the adtech industry as far as I am concerned.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#129

Post by avoid3d »

TylerE wrote: post #126
chii wrote: post #110

Earlier quoted context omitted.

browsers should come with a default software renderer, and behave like the mic and camera where the site will require user permission to release the hardware GPU render path.

Do you have any concept of how many gigawatts per day that would waste?

Very pedantic but I’d want to know. A watt is a unit of power, which means gigawatts per day is a rate of change of power.

If you want a unit of energy you need power multiplied by time not divided, so “gigawatt days” not “gigawatts per day”.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#130

Post by jameshart »

dmazzoni wrote: post #33
h4x0rr wrote: post #11

Can anyone explain why the results are different to begin with? E.g. why is this audio fingerprinting even possible in the first place?

The essence seems to be that the web audio API has a lot of algorithms that do a lot of math, and every browser has a slightly different implementation, and the exact results depend on the operating system and cpu too. So if you use the web audio API to generate a small signal all browsers will generate something that's really close, but the tiny differences can be used to help tell them apart.

But why would it vary in ways that are consistent run to run on one machine, but not consistent with the same process executed on another similar machine?
Post reply on HN