valve1

We don't use vulnerabilities in our products.

Thanks for testing it on Windows. We mostly tested it on MacOS Big Sur because all devs on the team have that OS. With Windows different timings might be needed, we'll check into it tomorrow.

yeah, chrome/chromium on linux not tested at all, mostly because nobody on the team is using linux. We tested it on MacOS Big Sur and a bit of Windows. Full table of what was tested here: https://github.com/fingerprintjs/external-protocol-flooding#... dathinab

Thanks for testing it on Linux. We only tested it on these browser + OS combinations: https://github.com/fingerprintjs/external-protocol-flooding#...

On Tor we show a fake captcha on the demo, which allows to collect multiple key presses and use each as a user-provided trigger.

Thanks for testing this on Opera, we only tested on these browser/OS combinations: https://github.com/fingerprintjs/external-protocol-flooding#...

Windows can sometimes say you have Skype, because it comes bundled even if you didn't install it yourself.

Yeah, we tested it on MacOS Big Sur mostly. Nobody on the team had linux so we didn't really test there. It can be made to work with better timings for the measurements etc.

Browsers open pop-ups to ask "Can I run that application?" but only if that application is installed. If that application is not installed, the browser will ignore the custom URL.