Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Safari 17's advanced audio fingerprinting protection

fingerprint.com

Post reply on HN
Print view View original

181–190 of 266 posts

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#181

Post by jessekv »

lapcat wrote: post #176
simondotau wrote: post #160

Earlier quoted context omitted.

That's an wild accusation to make without citations. It doesn't even apply in this instance, since Apple's work on fingerprint resistance still results in real privacy improvements even when later shown to be imperfect. It means Apple has to improve what they've already done, not that what they've done so far is mere "marketing" or "theatre".

> That's an wild accusation to make without citations. Shall I cite my list of CVE? Or perhaps it would be more interesting to cite my list of unfixed 0days. > It doesn't even apply in this instance, since Apple's work on fingerprint resistance still results in real privacy improvements even when later shown to be imperfect. It means Apple has to improve what they've already done, not that what they've done so far is…

I haven't seen marketing related to audio fingerprinting protection. Maybe Hanlon's applies here.

As for your point about the pattern of vulnerabilities: I'd attribute this to being closed source. They keep shipping security features with limited auditing, and only discover flaws in production.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#182

Post by lapcat »

fh9302 wrote: post #178
lapcat wrote: post #177

Earlier quoted context omitted.

> Is iCloud Private Relay theatre? https://fingerprint.com/blog/ios15-icloud-private-relay-vuln... > 3rd party cookie blocking? It's very funny that you should ask this question in response to an article about fingerprinting without cookies. But yes, there are various workaround to use 1st party cookies or other storage to take the place of 3rd party cookies. Perhaps the worst is the Safari "Privacy Report", which ha…

Do you have something more recent than a leak from over 2 years ago that has long been fixed? I'm curious why iCloud Private Relay is theatre at the moment.

[flagged]

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#183

Post by lapcat »

jessekv wrote: post #181
lapcat wrote: post #176

Earlier quoted context omitted.

> That's an wild accusation to make without citations. Shall I cite my list of CVE? Or perhaps it would be more interesting to cite my list of unfixed 0days. > It doesn't even apply in this instance, since Apple's work on fingerprint resistance still results in real privacy improvements even when later shown to be imperfect. It means Apple has to improve what they've already done, not that what they've done so far is…

I haven't seen marketing related to audio fingerprinting protection. Maybe Hanlon's applies here. As for your point about the pattern of vulnerabilities: I'd attribute this to being closed source. They keep shipping security features with limited auditing, and only discover flaws in production.

> I haven't seen marketing related to audio fingerprinting protection.

Apple announces powerful new privacy and security features: https://www.apple.com/newsroom/2023/06/apple-announces-power...

WebKit Features in Safari 17.0: https://webkit.org/blog/14445/webkit-features-in-safari-17-0...

In general, Apple is trying to market itself as the privacy company. "What happens on iPhone stays on iPhone", yadda yadda.

> Maybe Hanlon's applies here.

I think my view is in alignment with Hanlon's razor. I don't think it's necessarily malicious deception. Rather, Apple has a habit of shipping the laziest implementations and slapping a "privacy" label on them, but the public doesn't know that these are lazy half-measures.

> As for your point about the pattern of vulnerabilities: I'd attribute this to being closed source.

WebKit is open source.

> They keep shipping security features with limited auditing, and only discover flaws in production.

I don't think this is a closed/open source issue. It's just bad engineering.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#184

Post by dylan604 »

TylerE wrote: post #126
chii wrote: post #110

Earlier quoted context omitted.

browsers should come with a default software renderer, and behave like the mic and camera where the site will require user permission to release the hardware GPU render path.

Do you have any concept of how many gigawatts per day that would waste?

Is it anywhere close to the amount wasted on mining shadycoins?

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#185

Post by kragen »

matheusmoreira wrote: post #166
sweetjuly wrote: post #147

Earlier quoted context omitted.

but nobody wants to use software rendering, that's the whole reason WebGL and WebGPU exist.

They should have thought of that before abusing these things to fingerprint us. Use of the GPU is a privilege and it can be revoked.

there isn't a 'they' and an 'us' in this situation

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#186

Post by grishka »

matheusmoreira wrote: post #166
sweetjuly wrote: post #147

Earlier quoted context omitted.

but nobody wants to use software rendering, that's the whole reason WebGL and WebGPU exist.

They should have thought of that before abusing these things to fingerprint us. Use of the GPU is a privilege and it can be revoked.

I sometimes unironically say that JavaScript is a privilege that should only be granted to websites that actually need it. Most of the web is text and images. No Turing-complete client-side runtime environment is required to display that.

But I would also accept all those multimedia APIs (canvas, WebGL, WebGPU, everything audio and video, including the tag) and some others (e.g. service workers and everything else app-like) requiring a permission. Again, most websites don't need them, so given the abuse potential, there's no reason why they should be openly available.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#187

Post by Retr0id »

TylerE wrote: post #143
Retr0id wrote: post #131

Earlier quoted context omitted.

Floats are deterministic, though (if they weren't, this wouldn't be a workable fingerprinting vector). Reordering of operations (etc.) in a way that would actually change the results needs to be done by human edits, or with compiler options like ffast-math that explicitly allow the compiler to "break the rules" and make such changes. In either case, the concrete instructions emitted by the compiler will have determin…

What word would you use if sin(x) returns a different value on different platforms, or even different OS or librsry version? Sure smells like a fiction that depends on external state rather than simply its input.

The existence of platforms that do not conform to their own specifications does not make an operator non-deterministic.

Edit: I found this pretty great article on the subject https://randomascii.wordpress.com/2013/07/16/floating-point-...

We're both right, depending on how you frame the question.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#188

Post by heinrich5991 »

TylerE wrote: post #143
Retr0id wrote: post #131

Earlier quoted context omitted.

Floats are deterministic, though (if they weren't, this wouldn't be a workable fingerprinting vector). Reordering of operations (etc.) in a way that would actually change the results needs to be done by human edits, or with compiler options like ffast-math that explicitly allow the compiler to "break the rules" and make such changes. In either case, the concrete instructions emitted by the compiler will have determin…

What word would you use if sin(x) returns a different value on different platforms, or even different OS or librsry version? Sure smells like a fiction that depends on external state rather than simply its input.

sin(x) is platform-dependent.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#189

Post by matheusmoreira »

kragen wrote: post #185
matheusmoreira wrote: post #166

Earlier quoted context omitted.

They should have thought of that before abusing these things to fingerprint us. Use of the GPU is a privilege and it can be revoked.

there isn't a 'they' and an 'us' in this situation

"They" refers to web developers. "Us" refers to users. We are the owners of the machines where their code will run.

They have complete freedom on their servers. On my computer, I make the rules. They are lucky if I allow their code to run at all.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#190

Post by burnerthrow008 »

exabrial wrote: post #108

I'm really ready to just be "that guy" that browses with JS disabled.

Join me, and do it! There is a great Firefox extension called uMatrix, which makes it easy to disable JavaScript not just on a site-by-site basis, but also by subdomain (and easy to re-enable for sites that break without js).
Post reply on HN