search

abrahamjuliot / creepjs

Creepy device and browser fingerprinting
MIT License
1.56k stars 194 forks source link

Workers testing is easily defeatable. #265

Open lainlives opened 6 months ago

lainlives commented 6 months ago

You can easily override pretty much all of the worker data with tampermonkey and get no "reds"

image

Very little of this is not spoofed.

abrahamjuliot commented 6 months ago

Nice. I have not tried tampermonkey. Looks cleanly applied. How about here? https://github.com/abrahamjuliot/fpworker

I created a new label 😅

abrahamjuliot commented 6 months ago

Firefox, right? I wonder if it can be reproduced in Chromium...

lainlives commented 6 months ago

Screenshot 2024-04-26 at 19-55-56 fpworker I see I have to fix my fonts up some. Also is webgl.enable-debug-renderer-info=false supposed to break GPU probing, doesn't on other fingerprinters.

lainlives commented 6 months ago

Altering the userprefs in user.js also seems to get the same results, clean incorrect UA.
And doing it this way I don't need to rely on disabling firefox's worker navigation prefetching.

lainlives commented 6 months ago

Nice. I have not tried tampermonkey. Looks cleanly applied. How about here? https://github.com/abrahamjuliot/fpworker

I created a new label 😅

Hah :3 I am not trying to save the world from tracking (well, maybe, if I do its a happy accident) But I have been poking at your tools for a while now to find various ways to break it. Like, having navigator be an exit call breaks your site in pretty amazing ways. Your site is also unloadable if the scripts crash (like say too many faults and get shut down by firefox) I learned when function tampering. But this one seemed like something you should be able to detect that something is an outright lie. Fedora Current FF beta

Oh not sure if I should make a bug report for this one, but TZ is buggy, its easier for me to make it believe a false location than my real one. But I imagine the timezone detection stuff is one of those 'flip of a coin on who its reliable on' more than it being a flip of a coin reliability in itself? I mean its possible my Firefox user profile creation date being older than some of the bug reporters causing some issues with that and and plausibly with the test sometimes coming back with odd data (logs indicate worker crashes)

namename-123 commented 6 months ago

You can easily override pretty much all of the worker data with tampermonkey and get no "reds"

image

Very little of this is not spoofed.

I wonder, how can I replicate this? 🤔