Hacker News Reader

Comment by dvno42 | Hacker News Reader

Only somewhat related but I have a phone where the front camera mechanically pops up when it's used. I've noticed that by default, when I visit many websites, without notification the camera pops up and down quickly. After every Firefox update, I have to go into android settings and deny camera permissions. I've just assumed a page attempts to access the camera via JS but I'm not sure, it could also just be a bug in FF.

View on HN

That is a separate issue which is fixed in Firefox Beta as part of bug 1578073.

Links to the fixed bug reports:

https://bugzilla.mozilla.org/show_bug.cgi?id=1578073

https://github.com/mozilla-mobile/fenix/issues/4833

I think a bunch of websites try to access the camera's metadata as a part of a fingerprinting mechanism. That's probably what you're seeing.

I thought so too, Xiaomi Mi 9T here with a popup camera mechanism. But then again, wouldn't the website have to ask for camera permissions? Or is there some permission-less approach like the one for evaluating MIDI devices which is used for fingerprinting?

Yes this is ad network fingerpriting using navigator.mediaDevices.enumerateDevices(). [1] When called without permission it would return something like

> videoinput: id = csO9c0YpAf274OuCPUA53CNE0YHlIr2yXCi+SqfBZZ8=

> audioinput: id = RKxXByjnabbADGQNNZqLVLdmXlS0YkETYCIbg+XxnvM=

> audioinput: id = r2/xw1xUPIyZunfV1lGrKOma5wTOvCkWfZ368XCndm0=

and if the user has allowed access to the camera/mic

> videoinput: FaceTime HD Camera (Built-in) id=csO9c0YpAf274OuCPUA53CNE0YHlIr2yXCi+SqfBZZ8=

> audioinput: default (Built-in Microphone) id=RKxXByjnabbADGQNNZqLVLdmXlS0YkETYCIbg+XxnvM=

> audioinput: Built-in Microphone id=r2/xw1xUPIyZunfV1lGrKOma5wTOvCkWfZ368XCndm0=

[1] https://developer.mozilla.org/en-US/docs/Web/API/MediaDevice...

Having a mechanism to override built in JS functions would be great fun.

AFAIK you can already do that using content scripts that execute at document_start. A lot of anti-fingerprinting scripts use this already.

Thanks for the tip, I did not know that.

That’s what I thought too as soon as I saw the title of this thread.

My telco uses a heavily obfuscated script where all the variables are just a bunch of hex that uses every conceivable fingerprint technique in the book.

Shockwave Flash, remote fonts, WebRTC, Silverlight, vector graphics, HTML5 cookies, hardware fingerprinting etc.

It's actually great to have a physical confirmation that such a fingerprint is being generated. This so called cookie-less tracking is not legal in some parts of the world because it bypasses consent which needs to be legally obtained.

Thanks for this, seems to confirm my suspicions. The camera popup happened quite often on Glassdoor, which I remember once blocking me for some time after I blocked their canvas fingerprinting attempts. Just checked and that seems to no longer be there.

Disappointing state of affairs overall.

It doesn't look too fingerprintable. The ids seems to change once you closed all the tabs belonging to a site (on firefox), on on reload (chromium) so the max they can fingerprint is how many devices of each type you have.

the site I used to test: https://browserleaks.com/webrtc

Number and type of devices are still useful for fingerprinting when combined with other sources of information.

That's how modern fingerprinting tends to work. A few bits here, a few bits there, all combined.

What phone do you use?

OnePlus 7 Pro

Same here, with the same observed behavior.

Reply on news.ycombinator.com