Comments (4)
I appreciate your interest in the project.
We want to avoid creating a library used for fingerprinting. The spirit of the project is to promote research and education. No plans to change this.
from creepjs.
I understand and have a lot of respect for your motives and your project as a whole. I will refrain from attempting to build a usable fork.
On a side note, i was going through the source code and i noticed that the fingerprinting seems to be entirely reliant on JS being active, so i guess nothing of this would work if the client uses something like NoScript. Did you consider extending the project to include CSS fingerprinting? It's not nearly as accurate as JS fingerprinting but it can detect the following metrics:
- device dimensions
- fonts installed
- OS and browser used (and to some extent, even the version of the browser used based on the support for CSS features)
- whether the client uses noscript or similar plugins
(can be enhanced by using the visited selector and other selectors that detect current or previous user interraction with the page)
The data can then be sent to a server through the combination of conditional logic in css with "background-image" or "content" with urls pointing to your desired endpoints. There are also other ways to fingerprint using CSS by triggering permanent redirects to unique addresses.
Another approach would be fingerprinting through favicon redirects but although it can lead to more precise results it has it's flaws. Doesn't work on firefox, doesn't work with iframes, can be mitigated through cache eviction or by disabling favicons altogether.
CSS fingerprinting is fairly easy to implement and it can make this project more comprehensive by triggering a fallback when noscript is detected.
If you're interested in including it as a fallback within <noscript></noscript>
i would love to contribute to the addition of this feature.
from creepjs.
CSS fingerprinting is on my mind. A while back, I did some experiments and decided the entropy was not worth it, even with fonts. It depends on the site, but no JS can be an incredibly unique fingerprint and not require anything further to detect.
However, I think it would be cool to implement these concepts on a test page similar to workers. Font URL detection in CSS would probably not work on GH pages, but I'm not sure.
A long-term goal is to move much of the client-side fingerprinting to test pages and provide more depth analysis, and then the main fingerprint script would be dead simple. With that in place, we would only use server-side anomaly detection and time series tracing.
from creepjs.
yes please release it as an npm library.
my application is rate-limiting without user id.
that's where browser fingerprinting comes in to stop malicious attackers from bruteforcing.
there are tons of legit use-cases for this.
from creepjs.
Related Issues (20)
- Add stronger Proxy detection HOT 5
- Doesn't work HOT 14
- Doubts about the erro infos
- Doubts about the erro infos HOT 9
- MIT or ISC license? HOT 1
- Doubst about the WorkerNavigator HOT 3
- Idea: Detect frame rate HOT 1
- How to use? HOT 6
- what is ```- failed prototype test execution``` HOT 9
- lazy loading iframes HOT 3
- Firefox trash after update HOT 2
- what does session mean? HOT 1
- Novice webdev here - How do I install this? HOT 1
- Workers test throwing unsupported on Safari 17.3 HOT 10
- Where is the server source code itself? HOT 2
- How is the FP ID calculation being made? HOT 3
- fonts.lied is undefined HOT 3
- Workers testing is easily defeatable. HOT 6
- Documentation on how to run this HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from creepjs.