Workers test throwing unsupported on Safari 17.3

abrahamjuliot / creepjs

Creepy device and browser fingerprinting

MIT License

1.54k stars 194 forks source link

Workers test throwing unsupported on Safari 17.3 #259

Open Joe12387 opened 8 months ago

Joe12387 commented 8 months ago

Hi there.

I noticed that your service worker test does not seem to work properly on Safari as of 17.3 on both macOS and iOS, and it says that all service worker types are unsupported. Correct me if I'm wrong, but I do believe service workers are still a supported feature in Safari and, if my memory serves me, versions of Safari prior to 17.3 worked as expected on this page.

Thanks!

abrahamjuliot commented 8 months ago

Good catch. It's likely connected with the use of inline workers and modifications implemented here. I will investigate.

https://github.com/abrahamjuliot/creepjs/issues/207

abrahamjuliot commented 7 months ago

I'm pondering on whether it is worth changing to support Safari. For now, the single file test page works on safari here. https://abrahamjuliot.github.io/fpworker/

Joe12387 commented 7 months ago

Interesting. DedicatedWorkerGlobalScope in Safari 17.4 on both macOS and iOS is consistent with Window when it comes to canvas, but ServiceWorkerGlobalScope and SharedWorkerGlobalScope do not appear to be applying canvas fingerprinting protections and the hashes remain the same even in a private window. Maybe it's just a bug in your code, but have we found ourselves a fingerprinting vulnerability in Safari?

abrahamjuliot commented 7 months ago

A vulnerability seems to be the case. Possibly connected with https://bugs.webkit.org/show_bug.cgi?id=243555.

Joe12387 commented 7 months ago

Apple seems to disagree.

abrahamjuliot commented 7 months ago

It's likely determined low based on the severity of canvas entropy derived from Apple GPUs. Canvas protections, at best, probably only neutralize annoying cross site trackers.

WebKit hardware acceleration entropy seems fairly uniform within the same OS/browser version. ¯\_(ツ)_/¯

I imagine, they will consider and fix if feasible. I recall Brave had a similar issue and patched.

Joe12387 commented 7 months ago

You made me do this, Apple.

Joe12387 commented 7 months ago

As it turns out, I just discovered that this affects Firefox as well. Service Workers don't apply canvas protections.

Joe12387 commented 4 months ago

Apple assigned this vulnerability as CVE-2024-27830 and resolved the issue in Safari 17.5. Firefox's issues should be resolved in 127.

abrahamjuliot commented 4 months ago

Nice. Thanks for the update @Joe12387