Friday, January 23, 2015

How Tor Project is struggling with browser fingerprinting

The essence of the method is that on different systems in different browsers differently rendered text (and not just text), as it is responsible for a lot of different components at different levels, which can have different settings for the components of the lower layer.

May be trite different (with a different set of characters with slightly different glyphs and ligatures with different kerning ...) fonts.
Different parameters of the call library functions in different browsers.
Different versions libfreetype and other libraries rendering.
Different implementations in different OS and OS settings (for example, different versions of ClearType and different screen resolutions).
Different graphics drivers.
Other graphic iron.

This article describes a method using API getImageData, which returns the image pixel by pixel. Also considered the use of WebGL: on different systems and 3D-scenes are rendered in different ways.

The paper was recommended to use a soft-pure rendering, without the use of operating system components and other software installed on your PC, noise and other methods of protection. In Tor Project can create prints patched, asking permission to getImageData and replacing random fonts to fallback-font (which is why we have measurements of 10).

Defective by design

There are other API, current information. For example, API measurement text. If the text is rendered in different ways, means and size should be a little bit different. Test this hypothesis using API measureText for the same canvas and API getBoundingClientRect of DOM.

Skloniruyte gist, run on a computer at the last (or last) TBB, open it in the HTML-file from the repository, otpostite result in the comments. You can still go to the Fiddle Fiddle or in full screen. In principle, one could not make hash, it would give more room for the date-Meiningen, but even in compressed form a complete set of information about each font takes up very much space. Therefore dispense hashes. Who wants to dig deeper, he can uncomment some lines in the source.

No comments:

Post a Comment