notes #4
Comments
|
@abrahamjuliot : two questions q1: is there a better way to do this: rather than rely on a hardcoded count of promises, how would I do a Promise.all([
functionA(),
function99(),
funtionSomethingElse(), // <-- three promises: but what if I add more
]).then(function(result){
for (let i=0; i < 3; i++) { // <-- I would have to update the < number
myarray.push(result[i])
}
// do stuff with myarray
})q2: is there a cleaner way to specify a variable: e.g. compare = chk+i if (i == 0) { compare = chk0
} else if (i == 1) {compare = chk1
} else if (i == 2) {compare = chk2
} else if (i == 3) {compare = chk3
}-tia |
let collection = [
functionA,
function99,
functionA
// add as many as you like
]
Promise.all(
// compile array with each promise called
collection.map(function(fn) {
return fn()
})
).then(function(result) {
// for loop
let len = promises.length
for (let i = 0; i < len; i++) {
myarray.push(result[i])
}
// or forEach
collection.forEach(function(currentValue, index) {
myarray.push(result[index])
})
})
I'm terrible at naming variables. It usually takes x number of revisions till I can make sense of it. But, I like starting with a comment on what it holds or what it should do and then my goal is to find a name that makes the comment unneeded. For example, EDIT: I think I answered the wrong question. Let me try again...
let chk = {
0: [], // access with chk[0]
1: [],
2: [],
3: []
}
if (i == 0) {
compare = chk[i]
} else if (i == 1) {
compare = chk[i]
} else if (i == 2) {
compare = chk[i]
} else if (i == 3) {
compare = chk[i]
}
// shorter single assignment
compare = (
i == 0 ? chk[i] :
i == 1 ? chk[i] :
i == 2 ? chk[i] :
chk[i] // i == 3
) |
I'm working on that (there are some bugs in the CB code). Stay tuned. |
|
Please check the updated test page. |
|
Awesome: I've been wanting to dig into this for ages. TB has open tickets about some SVG items. It's all on my ToDo list. So much to do, so little time. Imma just going to keep plodding away getting existing things finished before I add more things: and really dig into your test but it looks exciting 💋 How much entropy is gained would be interesting |
|
No - it was something different. The used classes did not match MDN and the bugs were in CB. |
|
@kkapsner I assume there's no point in looking at DOMRectReadOnly vs DOMRect ... anyway .. it says |
|
DOMRectReadOnly and DOMRect should behave the same (unless an addon messes with one but forgot the other). In fact DOMRect inherits from DOMRectReadOnly:
I don't think so. There is no document in the worker and no rendering of HTML. |
|
Thanks This is what I thought ... a worker runs in a global context which is different from the current window - so I was surprised to see that listed there and wondered if there was some "workaround" like passing a "context" or "element" reference?
Yup, that was my point. We test things, like iframe access methods .. and whammo, someone forgot something (I see Brave still hasn't patched those iframes with canvas - etc see So if domrect was altered, the "parent" domrectreadonly might not be? We should make a test for that, right? |
Should be easy enough. |
|
@kkapsner It's going to take me a while before I get around to the SVG and other "domrect" stuff, but I had a sneaky thought about css aspect-ratio ... not sure what it could be used with, and I'm yet to try .. but I'm thinking this could be used to generate boxes with known decimals to detect spoofing - it's on my massive ToDo list, but I just thought I'd throw this idea at you |
|
I think it will behave similar to a |
|
Yeah, it's in my notes: I was thinking I could force something like 1/3 and the result should be 1.3333333333 or whatever, but it may depend on the limitations of the API (not the measuring one) and variables such as pixel snapping, rounding, devicePixelRatio/subpixels, zoom/css-devicePixels (I think I could work around this) .. just something devious I thought about last night as I went to sleep |
|
@abrahamjuliot edit: diff is I don't know if you sort yours: I obviously don't: and I wonder if there is a workaround: such as always put edit2: 3c34ae7 - but I wonder if anything else can affect the order: I don't like sorting if I can help it, as I want max entropy |
|
I leave it unsorted. Moving
|
|
If RFP removes items (which is what I suspect), then sorting isn't going to do jack shit. It's not like prefs change all the time - e.g. RFP changes lots of metrics and is not something that users would generally toggle: it's not available yet per ELTD+1 and users would/should be selective in what they disable it on: and when RFP is off, this might break linkability with previous FP's: but smart backend algorithms can still linkify stuff - and it's also likely to be sites they log into, such as twitter/imgur to upload images, or gmail to get their timestamps in sync with gmail app etc. But other factors are a concern: I wonder what headless does for example: that would be cool to catch. Needs a bit more investigation - e.g safer vs standard might be some SVG items getting removed - nothing you can do about that. It's really only when the order changes - like consoles .. damnit Maybe it's just better to sort it: because there are too many unknowns - what do you think? |
|
I think sorting is good to handle the console issue. We could capture both and then leave the unsorted in the loose fingerprint. |
|
items are removed at a minimum: so sorting won't do anything (but would if TB didn't change WASM) Tor Browser of course FF+RFP order is changed: and it goes a bit deeper If you ever select the storage tab in web console, Not sure where to find responsive design mode. So depending on what a dev is doing (I'm not sure what these are called: JS actors?) .. some properties get loaded first/last, used last or something |
There's too many unknowns as to what affects order. I was using this to check for changes between releases (to see if anything popped out for a version check) ... I'll think I'll check diffs per release (constant, no console etc) vanilla profiles to see what diffs there are - maybe sorting doesn't really affect entropy (it probably shouldn't: i.e if wasm affects those other items, but wasm is missing, it's already different - if you get my drift) |
|
some tests: windows, practically vanilla profiles (but I do have some tweaks, but they're all the same: mostly UI stuff) So as you can see, the order is different per release (at least on windows, but I don't see why that wouldn't be the same on any platform). But when we sort then there may be no differences: it depends if the stable release gets some new feature - e.g. 79, 80 and 81 were the same for me That said .. I already have a version number from feature detection - so I'm know I'm good for the overall FP in that regard. I'm just going to sort it and be done - but I do wonder if this cuts possible extra "stable" entropy. I did notice that the only items ever affected started with a capital (AFAICT, didn't take notes or always check 100%) |
It's the tiny phone/tablet icon in the console menu (or |
|
stuff I need to learn about: https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/ - @abrahamjuliot FYI also: https://news.ycombinator.com/item?id=25374383 gorhill
|
|
bots: https://www.tomanthony.co.uk/blog/googlebot-javascript-random/ I'm not sure this holds any more, not that I particularly care about bot detection edit: there's always a xkcd for everything: https://xkcd.com/221/ |
|
good article - https://www.otsukare.info/2022/10/25/css-values-definitions - @abrahamjuliot FYI |
|
heh
|
various notes from the old repo
Promises
words of wisdom from kkapsner
That's doable but a better way would be to have eight promises - one for each test. Then you can combine them with
Promise.allin all the configurations you need them. Something like this (please use better names!):FP scripts
FingerprintingGeneralWASM
abraham:
There are ways to use WASM to interact with browser APIs, but does WASM make way to create a virtual context or scope? Iframes have their own browsing context/document environment, and Workers have their own global scope/event loop.
Here's an example of canvas fingerprinting in Rust.
kkapsner: The timings in the script are too tight for Firefox. If you set a debugger break point at line 441 it works. AND CB is protecting against it!
DOMRect / SVG
Links
Note that source
canvas stability
I see changes in some canvas results across FF releases. The hashes that change are
for example: for me on windows
I wonder what causes these changes
Cwm fjordbank glyphs vext quiz, \ud83d\ude03widgets
from tom: Had someone look at this, and they had the following to say:
line breaking
Article: https://www.otsukare.info/2020/08/21/khmer-line-breaking
Can be used to?:
Pitfalls?
Notes:
example test: https://w3c.github.io/i18n-tests/css-text/line-breaking/exp-km-line-break-000.html
The text was updated successfully, but these errors were encountered: