Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Safari 17's advanced audio fingerprinting protection

fingerprint.com

Post reply on HN
Print view View original

141–150 of 266 posts

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#141

Post by TylerE »

chii wrote: post #137
TylerE wrote: post #134

Earlier quoted context omitted.

Hardware implantations of things like graphics routines can be hundreds of time more efficient than software implementations running on general purpose CPUs. Try to decode mpeg video at HD resolution in software sometime.

surely, the user will be taught to enable the hardware for video if they start seeing stutter. Or the browser can prompt the user to switch to "high-end graphics" if it detects prolonged video decoding. If a website that has no obvious case for using the GPU, but is instead using it to fingerprint, then the user won't experience any slow downs from a software renderer (as it is usually done relatively quickly). If a…

Oh expect users to understand this? The same people who have spent the past 40 years getting confused and worked up about cookies?

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#142

Post by subtra3t »

chii wrote: post #137
TylerE wrote: post #134

Earlier quoted context omitted.

Hardware implantations of things like graphics routines can be hundreds of time more efficient than software implementations running on general purpose CPUs. Try to decode mpeg video at HD resolution in software sometime.

surely, the user will be taught to enable the hardware for video if they start seeing stutter. Or the browser can prompt the user to switch to "high-end graphics" if it detects prolonged video decoding. If a website that has no obvious case for using the GPU, but is instead using it to fingerprint, then the user won't experience any slow downs from a software renderer (as it is usually done relatively quickly). If a…

If the user experiences stuttering while decoding a video, they won't learn to enable special permissions for the website but instead switch to a different browser that hasn't yet implemented this "feature".

And most websites most users visit will need the GPU to be remotely usable. For them enabling specific permissions for every website they visit is very inconvenient.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#143

Post by TylerE »

Retr0id wrote: post #131
TylerE wrote: post #127

Earlier quoted context omitted.

Funny how when I posted more or less exactly this comment in another context recently a lot of people refused to take me seriously! https://news.ycombinator.com/context?id=39633730

Floats are deterministic, though (if they weren't, this wouldn't be a workable fingerprinting vector). Reordering of operations (etc.) in a way that would actually change the results needs to be done by human edits, or with compiler options like ffast-math that explicitly allow the compiler to "break the rules" and make such changes. In either case, the concrete instructions emitted by the compiler will have determin…

What word would you use if sin(x) returns a different value on different platforms, or even different OS or librsry version? Sure smells like a fiction that depends on external state rather than simply its input.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#144

Post by mavamaarten »

chrisbrandow wrote: post #100

This is gross.

Exactly my thoughts. Interesting, but gross.

I wonder why audio API's are even available without giving a website permission? It feels like this could easily be fixed with a simple "This site would like to use your sound devices"-dialog.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#145

Post by Faaak »

avoid3d wrote: post #129
TylerE wrote: post #126

Earlier quoted context omitted.

Do you have any concept of how many gigawatts per day that would waste?

Very pedantic but I’d want to know. A watt is a unit of power, which means gigawatts per day is a rate of change of power. If you want a unit of energy you need power multiplied by time not divided, so “gigawatt days” not “gigawatts per day”.

Maybe they meant "gigawatt-hours per day"

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#146

Post by Dalewyn »

TylerE wrote: post #134
IAmGraydon wrote: post #133

Earlier quoted context omitted.

I’m not following. Why would disabling the GPU use more power? If anything, I would think it would reduce power consumption.

Hardware implantations of things like graphics routines can be hundreds of time more efficient than software implementations running on general purpose CPUs. Try to decode mpeg video at HD resolution in software sometime.

Perhaps a middle ground: Default to software acceleration when in Private Browsing mode, because obviously you want to be private, default to hardware acceleration otherwise.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#147

Post by sweetjuly »

chii wrote: post #110
redbell wrote: post #87

Another interesting technique to fingerprint users online is called GPU Fingerprinting [1] (2022). Codenamed 'DrawnApart', the technique relies on WebGL to count the number and speed of the execution units in the GPU, measure the time needed to complete vertex renders, handle stall functions, and more stuff ________________ 1. https://www.bleepingcomputer.com/news/security/researchers-u...

browsers should come with a default software renderer, and behave like the mic and camera where the site will require user permission to release the hardware GPU render path.

but nobody wants to use software rendering, that's the whole reason WebGL and WebGPU exist.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#148

Post by Dudhbbh3343 »

chii wrote: post #110
redbell wrote: post #87

Another interesting technique to fingerprint users online is called GPU Fingerprinting [1] (2022). Codenamed 'DrawnApart', the technique relies on WebGL to count the number and speed of the execution units in the GPU, measure the time needed to complete vertex renders, handle stall functions, and more stuff ________________ 1. https://www.bleepingcomputer.com/news/security/researchers-u...

browsers should come with a default software renderer, and behave like the mic and camera where the site will require user permission to release the hardware GPU render path.

LibreWolf (a privacy focused modification of Firefox) disables WebGL by default for this reason.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#149

Post by lukan »

TylerE wrote: post #134
IAmGraydon wrote: post #133

Earlier quoted context omitted.

I’m not following. Why would disabling the GPU use more power? If anything, I would think it would reduce power consumption.

Hardware implantations of things like graphics routines can be hundreds of time more efficient than software implementations running on general purpose CPUs. Try to decode mpeg video at HD resolution in software sometime.

The native GPU video decoding (and CSS and canvas GPU acceleration) can work without problems, if only webGL gets deactivated, what this was about here.

But you can probably also use those to fingerprint, but probably not as precise.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#150

Post by sph »

spookie wrote: post #88

These predatory practices are getting out of hand. Props for them to expose this, even though they're the "bad actors" from my point of view.

They're not exposing anything, they're advertising their services. It was also posted by one of their employees.

Funny how no one seems to notice that, and they're all praising the article.

Post reply on HN