The fonts component gives different results

[LesterDong]

hi, i test firefox fp on the demo website(https://valve.github.io/fingerprintjs2/), when i first get the fp, the value is "c47be56e91cdb14ae31367c66851e4f3", then i open another tab, the value changed to "9af57a294ebb17e521c91c8a8a61fa4c", i compared component and found some difference on the component of "js_fonts", the former was "js_fonts = Arial,Arial Black,Arial Narrow,Arial Rounded MT Bold,Arial Unicode MS,Book Antiqua,Bookman Old Style", and the latter was "js_fonts = Arial,Arial Rounded MT Bold,Arial Unicode MS,Book Antiqua,Bookman Old Style,Calibri,Cambria,Cambria "， i want to know how to exclude font detection completely? I tried "extendedJsFonts: true" but it did not worked. This just happened on firefox , other browser worked fine.

[SleepProgger]

To disable both the flash and the javascript font detection use the options:
{excludeFlashFonts: true, excludeJsFonts: true}

[jonashaag]

What's your FF version, OS, and can you reproduce this?

[LesterDong]

@SleepProgger I tried and it worked, thanks!

[LesterDong]

@jonashaag I will give you a detailed description next Monday，the laptop now is in my company. I have another question, is it well supported for Iphone, Safari? Here is my config:
new Fingerprint2({ excludeJsFonts:true, excludeFlashFonts:true, excludeDeviceMemory:true, excludeEnumerateDevices:true }).get(function(result, components) { ... }); });
I found that there was still a lot of the same fp where i collected from user, but the IP was different，i will read your "README.md" again, maybe I missed some details

[LesterDong]

@jonashaag My FF version is 61.0.2(64bit) and the os is win7(64bit) . But i am confused about this problem, because i tried another PC with the same version of FF and OS，and the problem just disappeared.

[jonashaag]

Yeah font detection isn't 100% deterministic and reliable. If you can reproduce this that'd be great so we can improve the detection.

[Magiweb]

I can confirm I'm getting the same results in Firefox. Simply opening a new tab and visiting https://valve.github.io/fingerprintjs2/, I sometimes get the same signature, but often get different ones. When comparing the data, the fonts (or perhaps the order of the fonts?) appears to be the issue - each time the hash changes it's the js_fonts that differ. For example:

https://screenshots.firefox.com/ByUmH0vQMXyyxntC/valve.github.io
vs
https://screenshots.firefox.com/Vh1JFmY4kkXB9aep/valve.github.io

Same browser (Firefox 62.0.3 64bit) - just opening the test page on different tabs

On Chrome I do not see this issue at all; it may be worthwhile to disable js_fonts at least in the case of Firefox. Haven't tested on other browsers / OS's.

[jonashaag]

@Magiweb can you please try master version

[jonashaag]

Or even better this jsfiddle and paste the results https://jsfiddle.net/L2gLq4rg/

[klingo]

I noticed a similar(?) issue with Google Chrome (Version 69.0.3497.81) and Fingerprint2 v2.0.0.

When I hard reload the browser (or clear browser cache), I always get 47 fonts.
When I normal reload the browser, I get 48 fonts (+Calibri).

[Magiweb]

@jonashaag that jsfiddle returns an error in the console: https://screencast.com/t/7TzPi3oezo

I see it's running https://rawgit.com/Valve/fingerprintjs2/master/fingerprint2.js, so I guess that's the equivalent of me running a local test from master branch, but if you like I can set that up. Let me know.

[GrosSacASac]

@Magiweb try https://valve.github.io/fingerprintjs2/
same as running index.html in gh-pages branch

[Magiweb]

@GrosSacASac yep I did that and pointed that out in my original comment: https://screencast.com/t/e939xgjO8dIs

[GrosSacASac]

https://bugzilla.mozilla.org/show_bug.cgi?id=732096
https://bugzilla.mozilla.org/show_bug.cgi?id=1329996

[GrosSacASac]

It might be a good idea to disable fonts by default, now that most UA start to implement fuzzy anti fingerprinting features

[Magiweb]

@GrosSacASac yep agree - Safari's also making it harder to identify fonts etc. (making them less "unique" by standardising the response to default fonts found on any browser). Which is why I suggested in my comment that it's probably best to not use fonts for the hash.

[GrosSacASac]

Yes and hashing everything by default is also being deprecated, I think calculating a proximity score is a better approach.

[Magiweb]

Totally agree! Also adding "weight" to specific measurements could be useful so one metric may contribute more heavily than another to the overall score.

Is that something that's in the works for fingerprintjs?

[GrosSacASac]

That is something I am thinking about, but it is a huge task, which requires a lot of thoughts and manual testing

[Magiweb]

Javascript isn't my strongest code language, but can scratch around and done a fair amount of work with statistics etc. so if I can be helpful let me know.

[jonashaag]

@Magiweb @GrosSacASac few comments from a maintainer's POV:

• we desperately need an automated fingerprinting infrastructure for OS/browser combinations, i.e. some piece of software + maybe hardware that boots 100s of different combinations of OSes and browsers and collects fingerprint data. (Maybe even combined with different plugins installed in the browsers.)
• Any manual data collection is useful as well; be sure to collect the data as raw as possible.
• If we add new metrics (like proximity scores) we must be sure to test them really thoroughly before recommending people they should use them. Best case we can repeat the experiments automatically to keep coefficients and parameters up-to-date

[jonashaag]

As far as anti-fingerprinting protection I'm not too worried at this point. Most browsers are in the planning stage, maybe have a few protections implemented, but overall the browser market is far from being fingerprint proof. This will take months, if not years, to change.

[Magiweb]

@jonashaag if you want to discuss / elaborate on this maybe we should create a separate topic so this topic remains relevant to the subject?

For example, booting 100's of OS's isn't hard outside of licensing issues, particularly with Mac. The problem is how to automatically drive them inside of their UI environment since we can't use headless browsers (for obvious reasons). Also, such an infrastructure would definitely incur cost. But I'm pretty strong on the cloud / SysOps side so that's definitely something we can discuss further and try to iron out.

[jonashaag]

Yes please

[Finesse]

Is it reproducible in v3?

[Finesse]

I can reproduce it with v2 in Firefox 62 on Windows 7 and Windows 10 on Browserstack. Meanwhile the bug isn't presented on the v3 demo page. Version 2 is outdated, please update to v3.

I can't reproduce it with v2 in Firefox 82 on Windows 10.

The difference between the fingerprints is that Arial Black is absent in the second tab.