Hacker News Reader

Comment by avastel | Hacker News Reader

I worked on browser fingerprinting and countermeasures during my PhD. In one paper, we showed that in the case of an anti canvas fingerprinting extension (canvas defender I think) we were able to extract the seed used to randomise the canvas on each. Since by default the seed was constant, you could use it for tracking: https://hal.inria.fr/hal-01820197 (the paper also talks about other anti fingerprinting techniques).

There is also a shorter version in a blog post: https://antoinevastel.com/tracking/2018/07/01/eval-canvasdef... (Evaluating the privacy implications of a canvas fingerprinting countermeasure)

View on HN

I have a dozen of questions...

Did you also evaluate fingerprintjs in that context?

Also, did you use css tracking techniques, too? Because there are hundreds of them, especially since the logical conditions spec.

In my own Browser I'm trying to "fake" behaviours, so that it looks like an e.g. Chrome useragent is browsing the website. I'm also filtering a lot of CSS and HTML that could be abused to track users which is, honestly, a lot.

Even the Accept header alone is enough to identify the engine. If you then use a clever webfont you'll have the navigator's version and OS identified due to antialiasing behaving differently...

I'm also curious how you evaluated the fingerprintability...is there a project that you were using for that, which someone could maybe test their own browser against?

(cannot edit)

Nevermind my last question, I've found your project on github that you used to test the fingerprintability (fp-scanner) [1] and wanted to let others know.

[1] https://github.com/antoinevastel/fpscanner

Which one is your browser? I would be interested in trying it.

It's stealth [1] and the tl;dr is that I'm trying to build a browser that doesn't compromise on tracking, so it has to have a peer-to-peer cache and some intercepting features, such as rewriting files before the malicious parts reach the client.

It's still very prototypical, so use with care. Lots of things don't work yet.

[1] https://github.com/tholian-network/stealth

Nice research! Was that trick with mutation observers necessary however? If they add a constant noise vector, all you have to do is creating a canvas with known data, then call toDataURL() and compare what you get to the original data?

Why would they use a constant seed? How difficult is it to use a time stamp?

Instead of timestamps, use the browsers built-in secure random number generator. Anything else can be guessed/computed.

Because any kind of predictable noise can be easily calculated and removed. And randomized noise that changes on each call can be removed by making the call multiple times and averaging out the values. So a constant noise value isn’t the worst possible idea, as long as it cannot be retrieved of course.

Reply on news.ycombinator.com