Hacker News Reader

Comment by rasz | Hacker News Reader

incidentally part of my anti fingerprinting script looks like this

    let UNMASKED_RENDERER_WEBGL = ["ANGLE (AMD Radeon HD 7900 Series Direct3D11 vs_5_0 ps_5_0)",
                               "ANGLE (Intel(R) HD Graphics 4000 Direct3D11 vs_5_0 ps_5_0)",
                               "ANGLE (Intel(R) HD Graphics 4600 Direct3D11 vs_5_0 ps_5_0)",
                               "ANGLE (Intel(R) HD Graphics 520 Direct3D11 vs_5_0 ps_5_0)",
                               "ANGLE (Intel(R) HD Graphics 530 Direct3D11 vs_5_0 ps_5_0)",
                               "ANGLE (Intel(R) HD Graphics Family Direct3D11 vs_5_0 ps_5_0)",
                               "ANGLE (NVIDIA GeForce GTX 960 Direct3D11 vs_5_0 ps_5_0)",
                               "ANGLE (NVIDIA GeForce GTX 1070 Direct3D11 vs_5_0 ps_5_0)",
                               "ANGLE (NVIDIA GeForce GTX 760 Direct3D11 vs_5_0 ps_5_0)"]

those were the most popular desktop GPUs according to Steam a year or two ago.

View on HN

Won't a custom script make you special and thus very easy to precisely fingerprint?

I can imagine that having several typical configs and switching between them at random would help blend in.

>I can imagine that having several typical configs and switching between them at random would help blend in.

You have to be careful with that too. An anti-anti-fingerprinting implementation can record the values and compare them across visits to see whether they stay the same. If they change every few months that's reasonable (eg. changing hardware), but if they change every day or every week there's most certainly spoofing involved.

It should change every few requests. The point is not to conceal spoofing, but to foil attempts to fingerprint.

Maybe an explicit sign of spoofing is even better, it sends a message in a gentle way.

Unspoofing on the server side, if at all possible, would likely be too expensive for whatever gain it might bring.

Unless a major anti fingerprinting solution uses the same list of GPUs as you doing this puts you in a tiny bucket and provides massive entropy to trackers, possibly even enough to exactly identify you given many webGL calls.

You could seed your random number generator with a hash of the hostname, guaranteeing consistency across all the random values you return to the one host.

Anti-anti-fingerprinting? :/

I feel like going there and telling them to stop following me around.

You can't do that because of the anti-anti-anti-fingerprinting, I know this because of reasons

Does it matter if they know you're spoofing, as long as it prevents them from linking two separate sessions together?

you'll run into this problem: https://xkcd.com/1105/

Would you be willing to share this script?

Don't bother. It's hard to do it correctly. If you look through the snippets (or the MDN docs[1]), the value is retrieved using the getParameter() function. You might be tempted to override the function by doing something like

    gl.getParameter = () => "test"

but that's easily detectable. If you run

    gl.getParameter.toString()

You get back

    "() => "test""

whereas the original function you get back

    "function getParameter() { [native code] }"

In general, don't try to fix fingerprinting via content scripts[2]. It's very much detectable. Your best bet is a browser that handles it natively.

[1] https://developer.mozilla.org/en-US/docs/Web/API/WEBGL_debug...

[2] https://palant.info/2020/12/10/how-anti-fingerprinting-exten...

You can easily hide it by hijacking Function.prototype.toString to see if `this == fake gl.getParemeter or this == fake toString`. Then the js code needs to find a real Function.prototype.toString by creating an iframe, but then you can detect that. Then I'm out of ideas on how to rescue the original toString

So the issue is that the fingerprinting code can detect the anti-fingerprinting code? Doesn't that mean the best solution is for everyone to override the same functions with the same dummy information?

This can be fixed by overriding valueOf() and toString() on the prototype. Just return another native function, like JSON.stringify ;)

Sadly there are still things you cant programmatically override/proxy, like storagemanager

    await navigator.storage.estimate()

gl.getParameter.toString() = () => 'function getParameter() { [native code] }'

    -> gl.getParameter.toString.toString()
    <- "() => 'function getParameter() { [native code] }'"

Not to mention the iframe trick mentioned in palant's article.

is that Firefox? in Chrome I get

    gl.getParameter.toString() = () => 'function getParameter() { [native code] }'
    gl.getParameter.toString()
    "function getParameter() { [native code] }"
    gl.getParameter.toString().toString()
    "function getParameter() { [native code] }"
    gl.getParameter.toString().toString().toString()
    "function getParameter() { [native code] }"

iframes, worker, sharedworker, serviceWorker are all covered. Good luck timing the difference.

You're running

  gl.getParameter.toString().toString()

what the comment you're replying to is trying to tell you to run is:

  gl.getParameter.toString.toString()

Call toString on the toString fuction, not on its result.

Good point. Rewriting according to https://adtechmadness.wordpress.com/2019/03/23/javascript-ta... now

nice try NSA

Do you present a set of 9 GPUs or pick one at random?

UNMASKED_RENDERER_WEBGL[Math.floor(Math.random()*UNMASKED_RENDERER_WEBGL.length)]

Reply on news.ycombinator.com