Audio Fingerprinting - the new way to secretly track web users

General Prog (Archived)
1

This is interesting…

[quote]
Despite browsing incognito, blocking advertisements, or hiding your tracks, some websites monitor and track your every move online using a new web-tracking technique called Audio Fingerprinting.

This new fingerprinting technique can be utilized by technology and marketing companies to deliver targeted advertisements as well as by law enforcement to unmask VPN or Anonymous users, without even decrypting the traffic.

Researchers at Princeton University have conducted a massive privacy survey and discovered that Google, through its multiple domains, is tracking users on nearly 80 percent of all Top 1 Million Domains using the variety of tracking and identification techniques.[/quote]

You can check your audio fingerprint here:

https://audiofingerprint.openwpm.com

Wonder if we can fire up a browser we don’t usually use and post our results here to see whether they do appear unique…

1 Like
2

Here’s mine in Firefox

###Fingerprint using DynamicsCompressor (sum of buffer values):

35.7383295930922

###Fingerprint using DynamicsCompressor (hash of full buffer):

e8a01ccac064d752db0ae902529124d13313b336

1 Like
3

It’s very different between Edge and Chrome, even the AudioContext properties are quite different interestingly…

Normal and Incognito windows seem identical though, so it seems mostly based on the browser?

1 Like
4

I’ve found the same here - so clearing cookies and cache (or going incognito) won’t help.

I’m pretty sure that combined with an IP, they could reasonably determine users cross browsers too.

I think they might be coming up with these new techniques because Flash is about to be killed off - flash was great to track users previously (even cross browser).

1 Like
5

And of course uMatrix and similar are great at blocking these anyway apparently. ^.^

EDIT: And also Chrome has an extension specifically to fight tracking signatures too:

1 Like
6

I’m pretty sure Apple will build something into Safari soon - they seem to be on a war path with Google :lol:

3 Likes
7

Except, unfortunately, the act of using Safari automatically helps with fingerprinting you, since Safari is between 10-20% market share (depending on the site you’re measuring).

I assume Tor Browser treats audio the same way it treats canvas, right?

1 Like
8

Not sure, but this is interesting, the fingerprint via tor is exactly the same as Firefox:

###Fingerprint using DynamicsCompressor (sum of buffer values):

35.7383295930922

###Fingerprint using DynamicsCompressor (hash of full buffer):

e8a01ccac064d752db0ae902529124d13313b336

:icon_eek:

1 Like
9

This is mine on Firefox nightly 57.0a1 (2017-08-17).

Fingerprint using DynamicsCompressor (sum of buffer values):
35.74996018782258

Fingerprint using DynamicsCompressor (hash of full buffer):
158e8189a3551fe4f2e564ac377b0f1e588a1ab3

They very seem close in number, though I’m not really sure what the metric is. I usually use uBlock and noscript which I think should prevent this, though they’ve been broken in nightly for the past two days.

2 Likes
10

Tor Browser 7.0.4 (based on Mozilla Firefox 52.3.0)

Fingerprint using DynamicsCompressor (sum of buffer values):

no_fp

Fingerprint using DynamicsCompressor (hash of full buffer):

``

Are you just using Firefox with a Tor proxy, or are you actually using the Tor Browser Bundle?

Firefox 54.0.1

Fingerprint using DynamicsCompressor (sum of buffer values):

35.7383295930922

Fingerprint using DynamicsCompressor (hash of full buffer):

2dc43feaa1474319db71be0f4a9810c4a2a54524

3 Likes
11

It’s just their standard browser downloaded from their site :confused:

1 Like
12

Weird, because that’s exactly what I’m using, too.

1 Like
13

From the link:

an AudioContext fingerprint is a property of your machine’s audio stack itself

It seems like the operating system and audio drivers play a role in the fingerprint. I think the AudioContext properties are set by the user/browser, so differences there will be apparent, but measuring the underlying raw audio buffers is a lot more subtle and machine dependant.

EDIT: but here TOR should still be blocking Canvas/AudioContext, the audio stack doesn’t effect that

2 Likes
14

I’m not sure why Tor is not blocking it - I am clicking on the ‘fingerprint me’ button so maybe that is bypassing it’s usual settings… not sure tbh.

1 Like
15

What version of Tor Browser are you using?

1 Like