andryou / scriptsafe

a browser extension to bring security and privacy to chrome, firefox, and opera
https://www.andryou.com/scriptsafe
509 stars 79 forks source link

Keyboard fingerprinting unusably slow #172

Open breznak opened 7 years ago

breznak commented 7 years ago

The randomization of keyboard/touch typing speeds against fingerprinting is a great feature which I have sought for a long time! :+1:

However the current implementation introduces unusably large delays, can there be a slider or a change to the settings for a time delta in ms that is added to each keypress (eg. +- 3ms)?

andryou commented 7 years ago

Thank you! This is a great idea. I will look into this.

andryou commented 7 years ago

Next version will include the ability to customize the delta:

2017-02-06 17_29_52

breznak commented 7 years ago

great! Thank you so much for implementing the change!

A note: how do you interpret the delta values? ( I see a -22 in the example). I'd suggest something like require delta >= 0: keypressTime += randint(-delta, +delta);

andryou commented 7 years ago

Currently the formula is:

randInt(0, 100) + delta

In the screenshot, the text field accepts positive and negative values. If the user wants to decrease the delay, they can set it to a negative number up to an acceptable point, and vice-versa.

Alternatively, I could change the option so the default value is 100ms, and the formula is:

randInt(0, delta)

Please let me know what your thoughts are, I'm completely open to suggestions! Thinking about it, perhaps the latter would be more intuitive.

breznak commented 7 years ago

Alternatively, I could change the option so the default value is 100ms, and the formula is: randInt(0, delta)

:+1: I think this is a better solution, with default delta (maybe more reasonable than 100, so much lower) *)

) optimal delta: the average typing speed is 44 wpm, with 5.1 chars per word on average (in English) http://www.wolframalpha.com/input/?i=average+english+word+length So the avg speed is (44*5.1/60) =3.74 cps. => ~267ms for a key press. To make the differences reliable, the delta should be only a fraction of this value (say 10%) - so 26ms for delta.

andryou commented 7 years ago

Thanks, I agree; I did some testing and 40ms seems to be a comfortable value, so I'll set that as the new default :)

raedah commented 7 years ago

Thanks, I look forward to this as well.