Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Safari 17's advanced audio fingerprinting protection

fingerprint.com

Post reply on HN
Print view View original

151–160 of 266 posts

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#151

Post by echoangle »

saagarjha wrote: post #106
echoangle wrote: post #27

Earlier quoted context omitted.

Probably implementation details and compiler optimizations, float addition is not commutative for example. Implementing the same algorithm with the same formulas correctly can still lead to slightly different results

Floating point addition is not commutative, but it is still consistent. Getting different results is usually the result of using alternative algorithms or relaxing standards (that may, for example, reorder terms).

I don’t think the web spec implemented by the browser specifies the order of every operation, only the algorithm. If safari and chrome devs implement the audio api based on the spec, there can still be minor floating point differences because of the way they implemented the same calculations. That’s why they can fingerprint your browser versions with this.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#152

Post by echoangle »

Angostura wrote: post #135
echoangle wrote: post #27

Earlier quoted context omitted.

Probably implementation details and compiler optimizations, float addition is not commutative for example. Implementing the same algorithm with the same formulas correctly can still lead to slightly different results

I would have thought it might have yielded a machine and OS identifier - but more user specific than that?

That’s what it does, users on the same browser and same hardware should have identical fingerprints. It’s just one way of multiple to narrow down your fingerprint.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#153

Post by protomolecule »

Faaak wrote: post #145
avoid3d wrote: post #129

Earlier quoted context omitted.

Very pedantic but I’d want to know. A watt is a unit of power, which means gigawatts per day is a rate of change of power. If you want a unit of energy you need power multiplied by time not divided, so “gigawatt days” not “gigawatts per day”.

Maybe they meant "gigawatt-hours per day"

Which gives you power again, not work. "gigawatt-hours per day" = gigawatt/24

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#154

Post by stephen_g »

protomolecule wrote: post #153
Faaak wrote: post #145

Earlier quoted context omitted.

Maybe they meant "gigawatt-hours per day"

Which gives you power again, not work. "gigawatt-hours per day" = gigawatt/24

If you consider that watt hours is just a convenience unit for (3600) joules, then “1 gigawatt hour each day” correctly should be “3600 GJ/day” which works.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#156

Post by gorgoiler »

chrisbrandow wrote: post #100

This is gross.

I assumed a level of irony here, from fingerprint.com. It’s like if a website popped up popularising loopholes to get around tax burdens as an attempt to disgust the world into closing those loopholes.

Even if that’s wishful thinking, there’s still immense virtue in publishing this research and getting it out in the open. If an article gets published explaining how a particular brand of green backpack helps with shoplifting do we worry that everyone’s going to shoplift more? I’d err more on the side of knowing shops are more likely to catch on to the tactic.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#157

Post by ralphist »

jameshart wrote: post #130
dmazzoni wrote: post #33

Earlier quoted context omitted.

The essence seems to be that the web audio API has a lot of algorithms that do a lot of math, and every browser has a slightly different implementation, and the exact results depend on the operating system and cpu too. So if you use the web audio API to generate a small signal all browsers will generate something that's really close, but the tiny differences can be used to help tell them apart.

But why would it vary in ways that are consistent run to run on one machine, but not consistent with the same process executed on another similar machine?

Every datapoint reduces the number of people it could belong to. CPU + browser + browser version + OS + major OS version can narrow it down by a lot.

Then add resolution, IP address location (which VPN they use is also a datapoint), which time they are active at, etc. and you can get a good almost-unique identifier.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#158

Post by IceHegel »

chrisbrandow wrote: post #100

This is gross.

It raises the question of whether the current networking stack is the one we want to have for the next 100 years. The internet in its current form has ruined a lot of the dream of personal computing because companies (and the state) are so asymmetrically powerful versus individuals. Should it be possible for my technology to send data to a server without my explicit approval?

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#159

Post by StressedDev »

dnissley wrote: post #67
ninkendo wrote: post #43

Earlier quoted context omitted.

There’s a push to make every single last thing a normal application can do, available to web apps through some half-standardized JavaScript API or another. Generally google comes up with use cases, implements it in chrome, and tries to call it a standard. Then everyone complains when Apple doesn’t implement these standards fast enough, and that Safari is “holding back the web” or “the new IE” because it’s not keeping…

I think fewer people would be in favor of this if apple just let you download native apps and run them on your iPhone like any other computing device.

Apple lets you run native apps on the iPhone. You get them through the App store.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#160

Post by simondotau »

lapcat wrote: post #113
saagarjha wrote: post #105

I feel like these days (especially given the recent focus on side channel attacks) it is basically a given that adding uniform noise to something that leaks data does not work, because you can always take more samples and remove the noise. Why did Safari add this? I understand that needing more samples is definitely an annoyance to fingerprinting efforts, but as this post shows it's basically always surmountable in s…

> Why did Safari add this? A lot of Apple's "privacy" features nowadays are marketing. It's privacy theater. What matters is whether they can tell a plausible story to the public, not whether is technically effective.

That's an wild accusation to make without citations.

It doesn't even apply in this instance, since Apple's work on fingerprint resistance still results in real privacy improvements even when later shown to be imperfect. It means Apple has to improve what they've already done, not that what they've done so far is mere "marketing" or "theatre".

Post reply on HN