News for hackers. Stuff that matters.
Re:Are top websites using WebGL for fingerprinting? by crazygringo on Saturday April 17, 2021 @02:52PM (#26846495)
Sorry, but this is nonsense, as presented.

There is zero evidence any of these are being used for fingerprinting, which is defined as building up an entire set of capabilities to uniquely identify a user.

Essentially all of these seem to be attempting to identify the graphics card, and all of these could be related to feature detection for an embedded video player, for example. Feature detection is not fingerprinting.

Fingerprinting is pretty easy to confirm, because it collects a large combination of data points (fonts installed, canvas rendering quirks, etc.) and either reports or hashes them all together. (That doesn't mean it's easy to find the code that does the fingerprinting, but once you've found it it's quite obvious what it's doing.)

It is deeply irresponsible and misleading of the author to claim fingerprinting without looking for that type of combination. And slapping "No claims made about accuracy" at the top of the page isn't an excuse.

Re:Are top websites using WebGL for fingerprinting? by lifthrasiir on Sunday April 18, 2021 @07:11AM (#26851489)
> [...] and all of these could be related to feature detection for an embedded video player, for example.

I agree the OP's analysis itself is a bit shallow, but I don't see how that can be related. If you embed a video and do not do anything with its output then WebGL is simply unrelated. In fact most of websites in question do not seem to use WebGL visibly. That fact combined with a direct check for WEBGL_debug_renderer_info and so on should flag a suspicion. Explicit alternative explanations would be needed to prove innocence.

Re:Are top websites using WebGL for fingerprinting? by crazygringo on Sunday April 18, 2021 @12:47PM (#26854031)
Literally the current top comment for this article explains how WebGL values are used to more accurately determine which video stream is best to send to the video player, since other methods can return inaccurate or insufficient information. Because you want to make sure the video format has hardware acceleration for decoding, to not destroy a mobile user's battery.

So that's how they're related.

And let's not assume guilt and then require proving innocence? It works the other way around. It's the burden of the person making the accusation to form a strong case. Which is not done here at all.

Re:Are top websites using WebGL for fingerprinting? by lifthrasiir on Sunday April 18, 2021 @01:41PM (#26854602)
Oh, I missed that comment---I thought the top comment was same at that time, but it has changed since then. That suffices as "explicit alternative explanations". Thank you for pointing it out.

I still believe that the presumption of innocence should not apply in this case, because fingerprinting is already close to guilty (if you don't agree to this premise there is no point for further discussion, so please refrain from arguing against this specific point). You are right that feature detection is not fingerprinting but they are virtually indistinguishable; given how widespread fingerprinting has been, it was enough to suspect so.

Re:Are top websites using WebGL for fingerprinting? by MarblePillar on Saturday April 17, 2021 @05:06PM (#26847454)
It appears that your null hypothesis embraces the benevolence of tech companies. Is this a reasonable assumption? How, after all, do they make their money?
Re:Are top websites using WebGL for fingerprinting? by crazygringo on Sunday April 18, 2021 @05:55PM (#26856827)
It does no such thing.

You could take literally any line of code and make an unfounded claim. "It calculates a hash, and fingerprints use hashes!" "It stores a variable, and analytics uses variables!"

It's on the burden of the person making an accusation of bad behavior to actually demonstrate that. Otherwise it's no different from me declaring you're an evil hacker because you comment on Hacker News, guilty until proven innocent.

Re:Are top websites using WebGL for fingerprinting? by MarblePillar on Sunday April 18, 2021 @07:35PM (#26857628)
Missing the point.

The null hypothesis determines the "unfounded claim". For example, judicially, the null hypothesis is, "You are innocent until proven guilty in a court of law." Similarly, commercially, the null hypothesis is, "If it's profitable and mostly legal, corporations will compete to do it better."

Fingerprinting is both profitable and legal. It is so profitable and so legal that today's most dominant corporations, entities representing trillions of dollars of value, are founded on its premise.

The "unfounded claim", therefore, is yours. Or do you have any evidence that you are not being surveilled?