Tales From the Trenches: Fingerprints on the Web

on YouTube ↗24m

" summary

Shows concrete browser fingerprints that broke Tor Browser defenses then and now, including Canvas2D canvas fingerprinting and AudioContext spectral fingerprinting using a few lines of JavaScript to extract pixels or frequency spectra, plus timing and CSS/line‑height leaks. Describes mitigations actually implemented: value normalization, 200 ms timer coarsening, font and screen rounding, first‑party isolation and iframe storage partitioning, and where those fixes succeed reasonably and where attacks remain practical or would break the web.

AI-written summary · about

" chapters (8)

1. 0:00Start
2. 4:00Browser Requests a web page
3. 9:23Behavior of JS Objects - Navigator
4. 11:06Behavior of JS Objects - Screen
5. 13:04WebAudio
6. 16:57Timing Based Side Channels
7. 19:08Canvas2D
8. 19:46Mitigation

" related talks

• 14mBrowser Fingerprinting: Stalking With a Personal TouchEivind Arvesen · NDC Oslo 2020
• 21mFp-Scanner: The Privacy Implications of Browser Fingerprint InconsistenciesAntoine Vastel, Pierre Laperdrix, Walter Rudametkin, Romain Rouvoy · USENIX Security '18
• 52mBreaking Fraud and Bot Detection SolutionsMayank Dhiman · OWASP AppSec California 2018
• 35mBreaking fraud & bot detection solutionsMayank Dhiman · OWASP AppSec USA 2018
• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015
• 29mStandard Classification: Everything You Always Wanted to Know About Finge...N. Nikiforakis · OWASP 20th Anniversary 2021
• 43mAttacking Modern Web TechnologiesFrans Rosén · OWASP AppSec Europe 2018
• 34mFront-End Performance - The Dark SideMathias Bynens · ColdFront16