Determine if AudioBuffers/OfflineAudioContext are a fingerprinting vector
WebAudio allows you to write data to AudioBuffers and perform effects/manipulation/spectral analysis on them, and extract their contents.
If the underlying routines are OS supported, they may be fingerprintable. https://developer.mozilla.org/en-US/docs/Web_Audio_API
Activity
https://developer.mozilla.org/en-US/docs/Web/API/OfflineAudioContext may leak audio processing capabilities.
Trac:
Keywords: ff31-esr deleted, ff38-esr added
Summary: Determine if AudioBuffers are a fingerprinting vector to Determine if AudioBuffers/OfflineAudioContext are a fingerprinting vector"This page tests browser-fingerprinting using the AudioContext and Canvas API. Using the AudioContext API to fingerprint does not collect sound played or recorded by your machine - an AudioContext fingerprint is a property of your machine's audio stack itself. "
https://audiofingerprint.openwpm.com/
Trac:
Sponsor: N/A to N/A
Reviewer: N/A to N/A
Severity: N/A to BlockerI have three different machines, one Windows and two Linux ones and I can verify that for each different machine using Tor Browser 5.5.5 the fingerprints are exactly the same for each machine.
The fingerprinting persists on OS reboots, Tor Browser restarts and using Tor Browser's "New identity".
I have tested using the website above (https://audiofingerprint.openwpm.com) in Tor Browser 5.5.5 and have done the test three times for each machine.
This is very problematic, hope this can be fixed soon! Thanks all!
By the way, for those who want to do the test themselves, use this one: https://valve.github.io/fingerprintjs2/ Because https://audiofingerprint.openwpm.com automatically sends information to Princeton.
Edit: Sorry I thought fingerprintjs2 used the same "Audio fingerprinting" as Princeton's test. So for those who want to do the test themselves, use https://audiofingerprint.openwpm.com and you might want to first enable Javascript, put yourself in Offline mode, and then do the test, so that no information about your machine/browser is sent to Princeton.
Trac:
Severity: Normal to Critical
Priority: Medium to Very High-
Replying to cypherpunks:
I have three different machines, one Windows and two Linux ones and I can verify that for each different machine using Tor Browser 5.5.5 the fingerprints are exactly the same for each machine.
Hm... if they are exactly the same for each machine isn't that a good thing? It allows you hiding in the crowd which is our strategy to beat fingerprinters. That said, I tested it as well with two different Linux machines (and distributions) and on a Windows computer. I got the same fingerprint for the Linux machines but a different one with Windows (which is on one of the Linux boxes, too). Thus, this seems to support the theory that this is an OS-fingerprinting problem. Or did I miss anything?
Trac:
Severity: Critical to Normal
Priority: Very High to Medium
Status: new to needs_information Replying to gk:
Replying to cypherpunks:
I have three different machines, one Windows and two Linux ones and I can verify that for each different machine using Tor Browser 5.5.5 the fingerprints are exactly the same for each machine.
Hm... if they are exactly the same for each machine isn't that a good thing? It allows you hiding in the crowd which is our strategy to beat fingerprinters. That said, I tested it as well with two different Linux machines (and distributions) and on a Windows computer. I got the same fingerprint for the Linux machines but a different one with Windows (which is on one of the Linux boxes, too). Thus, this seems to support the theory that this is an OS-fingerprinting problem. Or did I miss anything?
The fingerprints are the same for Tor Browser 5.5.5 on each machine individually independent of browser, OS, or computer restarts. So each Tor Browser can be uniquely identified. This is very problematic ...
Trac:
Severity: Normal to Critical
Priority: Medium to Very HighReplying to cypherpunks:
By the way, for those who want to do the test themselves, use this one: https://valve.github.io/fingerprintjs2/
Wrong.
fingerprintjs2 does not (currently) contain tests for AudioContext fingerprinting: https://github.com/valve/fingerprintjs2/. The OpenWPM page has the tests in an embedded script tag (it has several implementations, apparently observed in the wild Internet).
This page has some actual information: https://webtransparency.cs.princeton.edu/webcensus/. There's also this paper (see section 6.4): https://randomwalker.info/publications/OpenWPM_1_million_site_tracking_measurement.pdf
