throwaway202302
Joined 3 years ago
Karma
20
Submissions
20
Member since
Feb 22
Recent submissions
Comment · 2 years ago
Comment · 3 years ago
Is someone here working at apple?
https://niespodd.github.io/webrtc-local-ip-leak/ still? leaks local IP in mobile safari. On browserleaks local ip check fails, giving false feeling of safety.
Comment · 3 years ago
Oh, finally I found an element of distinguation for the Iphone:
The zoom settings in the display/brightness section of the iphone seem quite relevant for fingerprint.com algorithm.
Toggling between standard/bigger text toggles the fingerprint value.
This could be because the visible area in the screen size changes, as well as some value of the CSS-fingerprint.
Comment · 3 years ago
Scrolling a bit through the mess it seems, it is for exampling, trying to detect the used ad-blockers.
.... adGuardGerman:[u("LmJhbm5lcml0ZW13ZXJidW5nX2hlYWRfMQ==") ....
I see things hat look like font fingerprinting, CSS, Apple pay detection, ... , msPointerEnabled, ..., webkitResolveLocalFileSystemURL, ... cookie settings... ... used mathematical library (sinus, cosinus, ...) serviceworkers, ...RTCPeerConnection, hardwareConcurrency,
Maybe we could dissect it and analyze the full list?
At some other place, they documented e.g. you can get the light/dark theme information out of the CSS. Doesn't even need JS to do it.
Comment · 3 years ago
POST
https://fpa.fingerprint.com/?ci=js/3.8.10&ii=fingerprintjs-p...
It looks like it is using heavy obfuscation.
Comment · 3 years ago
Then, could not we a get a trace of the properties it uploads to the server by analyzing what is executed in the javascript? Sure it has some sort of submit endpoint where it throws the individual values to.
Comment · 3 years ago
That there are os-level identifiers is I think a different discussion. I wonder why these were cited in context of fingerprint.com discussion.
Comment · 3 years ago
But how could it distinguish different profile directories, if they use the same settings. I would assume profile id, directories, or others should not be exposed through the browser. I am not used to chromium-browser (is this chrome? forgive my incompetence), but I wonder what kind of profile-specific static identifiers despite cookies could leak out the browser?
Maybe these? https://browserleaks.com/webrtc But at least FF in private mode should randomize these IDs on restart.
Comment · 3 years ago
Did you check amiunique.org as well with these?
Comment · 3 years ago
Websites can access machine-id?
Comment · 3 years ago
I observed this too, but I cannot really believe it. For me it finds just german on the iphone. I get 0.88% for it. But if all Apples do it the same, I can hardly believe this provides already such selectivity. The problem with such test sites seems to me that only nerds visit them, and therefore the database is small and biased.
Comment · 3 years ago
Do these profiles clear their cookies after request? I assume if the service finds a matching cookie, it will prefer it, or at least use as an extra identifier.
Comment · 3 years ago
https://www.lightbluetouchpaper.org/2006/03/09/video-eavesdr...
Rather old one, where 25m was claimed. (Markus Kuhn).
Some like 200m were claimed by anons in random threads (https://www.mikrocontroller.net/topic/319197, in german), but that might have been related to CRT, not sure. They said they pointed antennas towards an office building.
All in all, the topic seems valid but unfortunately the discussions tend to be trolled.
One takeaway from the original link for me was to prefer displayport cable over hdmi/dvi. Yet, if the shielded connectors you have been referring to are easy to find, sounds good as well.
Absolute security is not possible, they say. Yet I wonder, can we have some sort of it at least outside a horizon of lets say 5 meters? Broadcasting the signals few meters/across the street/100m seem to be quite of a difference.
I find no current information whether this issue has been fixed or if current browsers mitigate it in private mode; as it seems to basically be a feature I assume any sort of fix can only be in context of private mode (per tab in safari or per-container in firefox) or history-clearing?
Neither I can find a "test page".
Do we have any?
Thankyou