Reverse Engineering Vercel's BotID
nullpt.rs
Reverse Engineering Vercel's BotID
1–10 of 21 posts
Re: Reverse Engineering Vercel's BotID
#2Note that the bot detection script uses WebGL to obtain GPU name. I assume this (fingerprinting) is the most popular use of WebGL. Sad that independent browsers like Firefox do not supply fake values.
Re: Reverse Engineering Vercel's BotID
#3Note that the bot detection script uses WebGL to obtain GPU name. I assume this (fingerprinting) is the most popular use of WebGL. Sad that independent browsers like Firefox do not supply fake values.
Sadly, spoofing GPU vendor & renderer can be an even larger flag since they can hash the resulting image of the canvas to compare it with a database of collected fingerprints[0]
[0]: https://research.google/pubs/picasso-lightweight-device-clas...
Re: Reverse Engineering Vercel's BotID
#4Note that the bot detection script uses WebGL to obtain GPU name. I assume this (fingerprinting) is the most popular use of WebGL. Sad that independent browsers like Firefox do not supply fake values.
Sadly, spoofing GPU vendor & renderer can be an even larger flag since they can hash the resulting image of the canvas to compare it with a database of collected fingerprints[0] [0]: https://research.google/pubs/picasso-lightweight-device-clas...
Until a major player gets on board. Then it works.
Apple does this by sending an imposter user agent from Safari on iPads.
If only that was expanded to iPhones, too. And then send rotating, or randomized user agents.
Re: Reverse Engineering Vercel's BotID
#5Earlier quoted context omitted.
Sadly, spoofing GPU vendor & renderer can be an even larger flag since they can hash the resulting image of the canvas to compare it with a database of collected fingerprints[0] [0]: https://research.google/pubs/picasso-lightweight-device-clas...
Until a major player gets on board. Then it works. Apple does this by sending an imposter user agent from Safari on iPads. If only that was expanded to iPhones, too. And then send rotating, or randomized user agents.
Apple does it because they don’t have a vested financial interest in internet-wide tracking.
Google does.
And while Mozilla does too because the vast majority of their funding comes from Google, it’s more pertinent that they don’t have the market share to pull this off. Firefox would just stop working on major websites if they did this.
Re: Reverse Engineering Vercel's BotID
#6Earlier quoted context omitted.
Sadly, spoofing GPU vendor & renderer can be an even larger flag since they can hash the resulting image of the canvas to compare it with a database of collected fingerprints[0] [0]: https://research.google/pubs/picasso-lightweight-device-clas...
Until a major player gets on board. Then it works. Apple does this by sending an imposter user agent from Safari on iPads. If only that was expanded to iPhones, too. And then send rotating, or randomized user agents.
[deleted]
Re: Reverse Engineering Vercel's BotID
#7Note that the bot detection script uses WebGL to obtain GPU name. I assume this (fingerprinting) is the most popular use of WebGL. Sad that independent browsers like Firefox do not supply fake values.
Sadly, spoofing GPU vendor & renderer can be an even larger flag since they can hash the resulting image of the canvas to compare it with a database of collected fingerprints[0] [0]: https://research.google/pubs/picasso-lightweight-device-clas...
It’s funny that trying to click on the Google Scholar link there falsely identifies me as a bot.
Re: Reverse Engineering Vercel's BotID
#8> At the moment, it seems Basic mode is so basic that it allows everything to pass as human. That’ll likely change as they gather more telemetry to better identify what a bot signal looks like.
So they are basically collecting telemetry in the name of "free basic anti-bot" solution.
Re: Reverse Engineering Vercel's BotID
#9why is bot detection even happening at render time instead of request time. why can't tell you’re a bot from your headers, UA, IP, TLS fingerprint. imo making it a surveillance. 'you're a bot, ok not just go away, let’s fingerprint your GPU and assign you a behavioral risk score anyway'
Re: Reverse Engineering Vercel's BotID
#10why is bot detection even happening at render time instead of request time. why can't tell you’re a bot from your headers, UA, IP, TLS fingerprint. imo making it a surveillance. 'you're a bot, ok not just go away, let’s fingerprint your GPU and assign you a behavioral risk score anyway'
It's really hard to detect it at request time. It's practically trivial for an attacker to fake headers to resemble a real browser.