Live data from Hacker News

Bypassing Safari 17's advanced audio fingerprinting protection

fingerprint.com

241–250 of 266 posts

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#241
post #134

Earlier quoted context omitted.

I’m not following. Why would disabling the GPU use more power? If anything, I would think it would reduce power consumption.

Hardware implantations of things like graphics routines can be hundreds of time more efficient than software implementations running on general purpose CPUs. Try to decode mpeg video at HD resolution in software sometime.

Youtube disabling h264 because of licencing wastes about same amount of energy as very small country

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#242
post #110

Earlier quoted context omitted.

browsers should come with a default software renderer, and behave like the mic and camera where the site will require user permission to release the hardware GPU render path.

LibreWolf does this, actually: it initially blocks websites from using WebGPU (and canvas) by default and then gives you a popup to grant them permission.

It’s almost like there should be a registry for naughty and nice websites and their capabilities

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#243

It seems like rather than adding a random amount to each sample (which lets them compute a mean by recreating the same audio and extracting out the differences), Safari could instead add randomness that is based on a key that rotates every hour. (Function of audio sample and key, so the noise would be the same in a given session, but useless for tracking an hour later).

Wouldn’t it help if the noise added were deterministic based on origin? That way it can’t be averaged out by oversampling. So something like RNG_SEED = HMAC_SHA256(PERSISTENT_SECRET,Location.origin)

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#244
post #134

Earlier quoted context omitted.

Hardware implantations of things like graphics routines can be hundreds of time more efficient than software implementations running on general purpose CPUs. Try to decode mpeg video at HD resolution in software sometime.

Youtube disabling h264 because of licencing wastes about same amount of energy as very small country

Is that, in your opinion, a reasonable or unreasonable amount to flower to spend on video decoding?

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#245
post #219

Earlier quoted context omitted.

"They" refers to web developers. "Us" refers to users. We are the owners of the machines where their code will run. They have complete freedom on their servers. On my computer, I make the rules. They are lucky if I allow their code to run at all.

The point is that the "they" who abuse this and the "they" who use it for legitimate reasons usually aren't the same people, and so the "they" who abuse this have no incentive not to out of some concern about their legitimate uses being curtailed.

If "they" run ads which unfortunately most websites do then "they" are part of those who abuse the browser capabilities.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#246
post #244

Earlier quoted context omitted.

Youtube disabling h264 because of licencing wastes about same amount of energy as very small country

Is that, in your opinion, a reasonable or unreasonable amount to flower to spend on video decoding?

Did actual test on macbook and IIRC it was extra 5-10watts. Rest you can multiply by hours spent on youtube worldwide. IIRC country was Haiti.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#247
So they say this is for fraud prevention and that all other uses need consent.

On their front page they tell me how often I have visited and that my incognito mode does not prevent their tracking.

Isn’t that “other use”?

> Does Fingerprint Pro require consent?

> Our technology is intended to be used for fraud detection only; for this case, no user consent is required. However, any use outside of fraud detection must comply with GDPR user consent rules.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#248

Earlier quoted context omitted.

I sometimes unironically say that JavaScript is a privilege that should only be granted to websites that actually need it. Most of the web is text and images. No Turing-complete client-side runtime environment is required to display that. But I would also accept all those multimedia APIs (canvas, WebGL, WebGPU, everything audio and video, including the tag ) and some others (e.g. service workers and everything else a…

You have noscript to block all that but it breaks the most simple sites these days. Part of it is legitimate like responsive design (though most can be done with css these days). But most of it is bullshit tracking, anti-scraping and similar stuff.

Responsive sites could’ve been done with css a decade ago too. IIRC Even IE6 has some support for flexbox and media queries. but people would rather pick up react and have a pile of js do it for them.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#249
post #39

Earlier quoted context omitted.

https://wavacity.com/ ?

Audacity's an awesome piece of software that I've used many times. Never once have I thought "by golly this thing should be a website, and my web browser should be made to expose an audio graph API to every website I visit to that it can be so!"

> Audacity's an awesome piece of software

It really isn't it's extremely janky and buggy, only use it as an absolute last resort.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#250
Wait, is it just me, or is it not wild that there's a company openly advertising their fingerprinting services? Their landing page implies it's primarily for fraud detection / abuse prevention. But one of their customer testimonials is from Neiman Marcus boasting they increased the number of repeat customers they could identify.

> "With the adoption of Fingerprint, we can now recognize and personalize approximately 23% of total visits to NeimanMarcus.com, up from the previous baseline of 8-10%."

Of course, these companies have always been around. But this post reads like it threads the line between "our product defeats Apple's futile defenses" and "we care so much about user privacy we're white-hat cracking Apple's defenses".

And another "between-the-lines" joke is that this site doesn't throw up a cookie dialog when you load it. What a joke! "We don't need cookies to track you, haha!"

Post reply on HN