Hacker News Reader

Comment by mirimir | Hacker News Reader

There's generally a tradeoff between usability and performance, and resistance to fingerprinting. If your browser has WebGL enabled, the machine (not just the browser) can be fingerprinted. If it caches resources, adversaries can discover browsing history.

View on HN

> If your browser has WebGL enabled, the machine (not just the browser) can be fingerprinted.

Curious, how would that work exactly? (I've never used WebGL yet in any code).

> If it caches resources, adversaries can discover browsing history.

Same question. I was under the impression that cached resources can be accessed only by the domain that introduces them.

Re WebGL, I gather that canvas fingerprints are based on graphics hardware and drivers. So all browsers on a given machine have the same canvas fingerprint. I've used https://browserleaks.com/webgl for testing. And with VMs, it's even worse. I found that all Debian-family VMs on a given host have the same canvas fingerprint. But Windows, macOS, CentOS, Arch and TrueOS (aka PC-BSD) VMs each have distinct fingerprints.

About cached resources, it's my impression that adversaries can exploit XSS vulnerabilities for detection. Most simply, you just measure load time.

If drivers are involved, then it would follow that updating changes your fingerprint? Still bad, but mitigated by being time-fenced.

I don't know. In my testing, I don't recall that I even used related Debian and Ubuntu releases. So I doubt that just updating the graphics driver would change the fingerprint.

However, I was using VirtualBox VMs, so it's possible that my results were artifacts caused by restricted choice in virtual graphics drivers. Testing that would be rather tedious, and I'd appreciate correction.

Sometimes but not always, yes; it depends on what changes in the driver.

This paper discusses the details:

http://yinzhicao.org/TrackingFree/crossbrowsertracking_NDSS1...

You can also visit their site to see it in action: http://uniquemachine.org/

Thanks, I'd forgotten that paper.

And re the demo:

> Your graphics card does not seem to support WebGL.

So NoScript is blocking WebGL, as promised.

Reply on news.ycombinator.com