How can this API be used to fingerprint devices? It’s just getting the current time.
My best guess, you can infer a users time zone? Thus get a very general/broad area of where this user lives (USA vs EU; or US-EST vs US-PST)
Maybe I should just set my time to UTC on all devices
Once you have a high-precision timer, there are all sorts of aspects of the user’s system you can fingerprint by measuring how long some particular API dependent on device performance and/or state takes to execute.
Platform vendors long ago figured out not to hand out the list of available fonts, but it’s a couple orders of magnitude harder to be sure switching some text from Menlo to Helvetica doesn’t leak a fractional bit of information via device-dependent timing.
EDIT: Others noted it’s actually ticks since startup, which is probably good for a few bits all on its own if you are tracking users in close to real time.
Why bother fingerprinting when you can just assign them an id and retrieve it later.
https://developer.apple.com/documentation/devicecheck
https://engineering.deptagency.com/securely-storing-data-on-...
https://developer.mozilla.org/en-US/docs/Web/API/Window/loca...
A fixed device ID survives even when an app is uninstalled and reinstalled and is the same for unaffiliated apps.
I suspect the fingerprinting aspect is more indirect: mach_absolute_time is the most accurate way to measure small differences, so if you're trying to measure subtle differences in performance between different devices on some specific task, mach_absolute_time would be the way to go.
If the service can learn the individual but current values of mach_absolute_time, then after a minimum of two requests you can likely compute N and distinguish between each device making a request.
This is possible because devices never reboot at exactly the same time.
And there’s the problem. Different devices have different uptimes. If you can get not only the uptime but a very very accurate version, you’ve got a very strong fingerprint.
https://github.com/bwbuchanan/absolute_time/blob/master/ext/...
https://rubygems.org/gems/absolute_time
Yes you want this in a development environment or perhaps in some sort of macOS app for developers, but probably not in most apps without a very specific and limited need.
You can fingerprint a device using this because you know the wall clock difference and you know the previous cpu cycles. So you can assume any device with appropriately more cpu cycles may be the same device.
We’re talking measurements taken from different apps using Google or Facebook sdk.
In which case, it could be used as one of many signals in fingerprinting a device, as you could distinguish a returning user by checking their uptime against the time delta since the uptime at their last visit. It's not perfect, but when combined with other signals, might be helpful
Timezones and such are one data point but the skews and accuracy and such are able to help you differentiate users too.
https://forums.whonix.org/t/javascript-time-fingerprinting/7...
You can get the time zone from less naughty APIs, and that has way fewer bits of entropy.