Hacker News Reader

Comment by IggleSniggle | Hacker News Reader

Years ago you could get crazy specific fingerprints from canvas. It got far less precise when Chrome introduced jitter into timers and treated performance timers as security sensitive functions. The main difference between canvas and this other stuff is that canvas couldn't be spoofed whereas everything else could and can be spoofed, or was so general as to be useless as an identifier.

View on HN

The granularity of the performance timers were too specific, allowing the number of cores to be deduced by the amount of time it took to do certain math functions.

Those certain math functions happen to be floating point operations that are ordered in a way to maximize the inaccuracy property off floating point types.

These inaccuracies are very correlatable.

That's not true.

The jitter had very little intended effect since accurate system timing can be derived from the instruction processing time of arbitrary javascript code in a mostly browser agnostic way, specifically iteration (i=i+1). It applied broadly to a large number of different types of instructions

But how do you measure the timing of those instructions without a precise timer? Yes it was the instructions that produce the reproducible timing, and that timing will be consistent on the system, but the measurement of those timings from the performance timers will not display that same consistency. Is there another way to measure from a within-session context?

Reply on news.ycombinator.com