News for hackers. Stuff that matters.

A comment on How We Bypassed Safari 17's Advanced Audio Fingerprinting Protection. Parent comment

Re:How We Bypassed Safari 17's Advanced Audio Fingerprinting... by dmazzoni on Saturday March 09, 2024 @04:16PM (#39654808)
The essence seems to be that the web audio API has a lot of algorithms that do a lot of math, and every browser has a slightly different implementation, and the exact results depend on the operating system and cpu too. So if you use the web audio API to generate a small signal all browsers will generate something that's really close, but the tiny differences can be used to help tell them apart.
[ Parent | on HN ]
Re:How We Bypassed Safari 17's Advanced Audio Fingerprinting... by nox101 on Saturday March 09, 2024 @04:24PM (#39654870)
that wouldn't help. you already know the browser and os through easier means
[ Parent | on HN ]
Re:How We Bypassed Safari 17's Advanced Audio Fingerprinting... by unglaublich on Saturday March 09, 2024 @04:28PM (#39654894)
Like what? The voluntarily provided User-Agent? The browser is in control of that.
[ Parent | on HN ]
Re:How We Bypassed Safari 17's Advanced Audio Fingerprinting... by meandmycode on Saturday March 09, 2024 @07:23PM (#39655727)
The browser in this adversarial scenario is also in control of the audio context too
[ Parent | on HN ]
Re:How We Bypassed Safari 17's Advanced Audio Fingerprinting... by bdd8f1df777b on Saturday March 09, 2024 @09:59PM (#39656390)
Yet it is incredibly difficult to hide the underlying hardware or low level library differences. Not without slowing things down significantly.
[ Parent | on HN ]
Re:How We Bypassed Safari 17's Advanced Audio Fingerprinting... by hiatus on Saturday March 09, 2024 @10:54PM (#39656599)
Do you, as an end user, know how to change these settings compared to changing your user agent?
[ Parent | on HN ]
Re:How We Bypassed Safari 17's Advanced Audio Fingerprinting... by c0pium on Sunday March 10, 2024 @01:42PM (#39660958)
From the average user perspective those settings are equally impossible to change, as they neither know nor care that they even exist.
[ Parent | on HN ]
Re:How We Bypassed Safari 17's Advanced Audio Fingerprinting... by jameshart on Sunday March 10, 2024 @12:26AM (#39656930)
But why would it vary in ways that are consistent run to run on one machine, but not consistent with the same process executed on another similar machine?
[ Parent | on HN ]
Re:How We Bypassed Safari 17's Advanced Audio Fingerprinting... by ralphist on Sunday March 10, 2024 @05:46AM (#39657900)
Every datapoint reduces the number of people it could belong to. CPU + browser + browser version + OS + major OS version can narrow it down by a lot.

Then add resolution, IP address location (which VPN they use is also a datapoint), which time they are active at, etc. and you can get a good almost-unique identifier.

[ Parent | on HN ]
Re:How We Bypassed Safari 17's Advanced Audio Fingerprinting... by matheusmoreira on Sunday March 10, 2024 @07:14AM (#39658281)
Maybe we should make the browser implementations consistent to the point they can't be told apart. Alternatively, we can reduce the precision of the results so that the tiny differences are deleted.
[ Parent | on HN ]
Re:How We Bypassed Safari 17's Advanced Audio Fingerprinting... by Finesse on Sunday March 10, 2024 @10:34PM (#39664409)
Browser vendors already copy the Audio API code from each other, you can see it in their public GitHub repositories. It doesn't help.
[ Parent | on HN ]