Live data from Hacker News

Ultrasound Tracking Could Be Used to Deanonymize Tor Users

bleepingcomputer.com

61–67 of 67 posts

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#61
post #22

What frequency are these apps using? I haven't looked it up but I doubt most computer speakers go above 15Khz (why would they?) A young person should be able to hear really high but audible tones and an adult would rapidly lose the ability. If this is not the case it would make sense to set a limit on the tones such a device can send and receive. On the other hand there might be legitimate uses for such tech so maybe…

It's not exactly that straightforward. In general any modern audio equipment will run up to 20kHz since that's generally accepted as the range of human hearing. From what I can tell, the lowpass filters built in to equipment (eg antialiasing on ADC/DAC) attenuates starting at 19 or 20 kHz. But these are realized as low order physical filters, meaning they roll off slowly, so you'd have to start attenuating at something much lower to truly remove the 18-20 range. That would introduce distortion where the rolloff starts, which you probably don't want.

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#62
post #29

Earlier quoted context omitted.

Do you mean something that simply listens for sound in those frequencies or decodes known signals as well? The latter would be pretty interesting to walk around dense urban and shopping centers with.

Yes, the latter. If this attack is possible ultrasound driving ought to be possible too.

Look for realtime analysis software (RTA) or spectrum analyzer software, typically used for setting up audio systems or analyzing noise sources. One example is RoomEQ wizard. Audacity can do it in non-realtime.

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#64
post #20

How is javascript playing ultrasound not seen as an attack on the user? In what world is that ever a sane thing to do?

From a technical standpoint there's no difference from javascript playing sound that the user wants and a "malicious" sound. Ultrasound only differs from "audible" sound in our ears, from the browser perspective both are just bits sent to your audio DAC.

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#66

TorBrowser has Javascript disabled by default, doesn't that mean you have to first 'trick' targets into visiting the webpage, and then trick them into turning on js?

TorBrowser has JS enabled by default, with NoScript enabled. This is not the same thing.

The first thing one should do after installing the Tor Browser Bundle is open up about:config, search for javascript.enabled, and set it to false.

If an onion site doesn't work without JS, you probably don't want to be on it anyway.

Re: Ultrasound Tracking Could Be Used to Deanonymize Tor Users

#67
post #41

Earlier quoted context omitted.

TorBrowser has JS on by default I thought.

No. That would be reckless and would compromise Tor Browser Bundle from the outset. By default, the NoScript plugin disallows JS from running globally

IIRC the rationale is that users with JS off are more "weird" so they stand out more.
Post reply on HN