Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Safari 17's advanced audio fingerprinting protection

fingerprint.com

Post reply on HN
Print view View original

41–50 of 266 posts

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#41

Post by SloopJon »

pdntspa wrote: post #19
marcellus23 wrote: post #15

Earlier quoted context omitted.

This has nothing to do with the microphone...

Then where are these audio samples coming from?

From the article: "In a nutshell, audio fingerprinting uses the browser’s Audio API to render an audio signal with OfflineAudioContext interface." It links to a previous article with more details:

https://fingerprint.com/blog/audio-fingerprinting/

Here's an example from that article of a sound source:

    const oscillator = context.createOscillator()
    oscillator.type = "triangle"
    oscillator.frequency.value = 1000

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#42

Post by saurik »

pdntspa wrote: post #29
echoangle wrote: post #26

Earlier quoted context omitted.

This is using differences in the audio processing pipeline of the browser, they just use some input sound which could be taken from a file. The fingerprint is the slightly different output signal when applying filters to the input signal.

How is it possible that this produces enough variations to be usable without sampling some sort of audio source? The entire pipeline is digital, there is not any room for interference.

Please stop wasting everyone's time with your random assumptions as to why this does or doesn't work and just click on the link in the article to the detailed explanation of exactly how this works.

> The technique is called audio fingerprinting, and you can learn how it works in our [previous article].

https://fingerprint.com/blog/audio-fingerprinting/

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#43

Post by ninkendo »

omnicognate wrote: post #30

Why am I supposed to want any website I visit to be able to render audio offline anyway?

There’s a push to make every single last thing a normal application can do, available to web apps through some half-standardized JavaScript API or another. Generally google comes up with use cases, implements it in chrome, and tries to call it a standard. Then everyone complains when Apple doesn’t implement these standards fast enough, and that Safari is “holding back the web” or “the new IE” because it’s not keeping up with every last feature Chrome implements.

I would prefer websites just be websites and that we don’t have every single damned API available to whatever trashy site I accidentally click on, but I guess you and me are outliers here. Most people on HN seem to welcome every single JS API because web development is the only platform anyone seems to care about any more.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#44

Post by nox101 »

dmazzoni wrote: post #33
h4x0rr wrote: post #11

Can anyone explain why the results are different to begin with? E.g. why is this audio fingerprinting even possible in the first place?

The essence seems to be that the web audio API has a lot of algorithms that do a lot of math, and every browser has a slightly different implementation, and the exact results depend on the operating system and cpu too. So if you use the web audio API to generate a small signal all browsers will generate something that's really close, but the tiny differences can be used to help tell them apart.

that wouldn't help. you already know the browser and os through easier means

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#45

Post by neilv »

> Fingerprinting is used to identify bad actors when they want to remain anonymous. For example, when they want to sign in to your account or use stolen credit card credentials. Fingerprinting can identify repeat bad actors, allowing you to prevent them from committing fraud. However, many people see it as a privacy violation and therefore don’t like it.

This doesn't seem to acknowledge the use of fingerprinting in intentional violation of the privacy of ordinary people, for marketing profiling and just selling them out because someone is willing to pay.

On https://demo.fingerprint.com/ , they do start to hint at non-anti-fraud purposes, but the use case seems to be full of poo. (Logins or cookies are the way to do this. Anything else is trying to circumvent privacy mechanisms. And if they don't distinguish users perfectly, they're doubly violating privacy by then leaking private information between people.)

> Personalization -- Improve user experience and boost sales by personalizing your website with Fingerprint device intelligence. Provide your visitors with their search history, interface customization, or a persistent shopping cart without having to rely on cookies or logins.

Popup warning on "https://demo.fingerprint.com/personalization":

> Heads up! -- Fingerprint Pro technology cannot be used to circumvent GDPR and other regulations and must fully comply with the laws in the jurisdiction. You should not implement personalization elements across incognito mode and normal mode because it violates the users expectations and will lead to a bad experience. -- This technical demo only uses incognito mode to demonstrate cookie expiration for non-technical folks.

Sounds a bit like a disingenuous bad actor doing CYA while demonstrating their capabilities, nudge, nudge, wink, wink.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#46

Post by unglaublich »

nox101 wrote: post #44
dmazzoni wrote: post #33

Earlier quoted context omitted.

The essence seems to be that the web audio API has a lot of algorithms that do a lot of math, and every browser has a slightly different implementation, and the exact results depend on the operating system and cpu too. So if you use the web audio API to generate a small signal all browsers will generate something that's really close, but the tiny differences can be used to help tell them apart.

that wouldn't help. you already know the browser and os through easier means

Like what? The voluntarily provided User-Agent? The browser is in control of that.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#47

Post by [deleted] »

neilv wrote: post #45

> Fingerprinting is used to identify bad actors when they want to remain anonymous. For example, when they want to sign in to your account or use stolen credit card credentials. Fingerprinting can identify repeat bad actors, allowing you to prevent them from committing fraud. However, many people see it as a privacy violation and therefore don’t like it. This doesn't seem to acknowledge the use of fingerprinting in i…

[deleted]

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#48

Post by jwells89 »

ninkendo wrote: post #43
omnicognate wrote: post #30

Why am I supposed to want any website I visit to be able to render audio offline anyway?

There’s a push to make every single last thing a normal application can do, available to web apps through some half-standardized JavaScript API or another. Generally google comes up with use cases, implements it in chrome, and tries to call it a standard. Then everyone complains when Apple doesn’t implement these standards fast enough, and that Safari is “holding back the web” or “the new IE” because it’s not keeping…

Things like this seem niche enough to safely put behind a permission dialog. 99.9% of sites/web apps have no legitimate need for this functionality.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#49

Post by neilv »

balls187 wrote: post #2

Fingerprint states that this service is for fraud detection, but they are actively discussing how they are circumventing browser privacy protections. So as a user my preference not to be fingerprinted or tracked takes a back seat in the name of fraud detection? So we should allow police to wiretap in the name of crime prevention?

> they are actively discussing how they are circumventing browser privacy protections.

I'd love to see a successful prosecution as something like a US CFAA violation, setting a precedent that puts the fear of god into the widespread slimy side of our field.

But I suspect it will have to be a non-US country leading that, because a lot of the US economy and power is now tied up in widespread slimy behavior of our field.

Re: Bypassing Safari 17's advanced audio fingerprinting protection

#50

Post by omnicognate »

nox101 wrote: post #39
omnicognate wrote: post #30

Why am I supposed to want any website I visit to be able to render audio offline anyway?

https://wavacity.com/ ?

Audacity's an awesome piece of software that I've used many times. Never once have I thought "by golly this thing should be a website, and my web browser should be made to expose an audio graph API to every website I visit to that it can be so!"
Post reply on HN