Comments (10)
A vulnerability seems to be the case. Possibly connected with https://bugs.webkit.org/show_bug.cgi?id=243555.
from creepjs.
Apple assigned this vulnerability as CVE-2024-27830 and resolved the issue in Safari 17.5. Firefox's issues should be resolved in 127.
![Screenshot 2024-06-12 at 5 34 42 PM](https://private-user-images.githubusercontent.com/489322/339141472-70b052b1-59e4-43ed-8601-2beea19f7dc5.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTk3MjQyNDksIm5iZiI6MTcxOTcyMzk0OSwicGF0aCI6Ii80ODkzMjIvMzM5MTQxNDcyLTcwYjA1MmIxLTU5ZTQtNDNlZC04NjAxLTJiZWVhMTlmN2RjNS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwNjMwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDYzMFQwNTA1NDlaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT03YjMyNzQ5MGFkYjhmNWI3MmQ0ZjJhNjk0NGQxMTYwN2M4NjZmOTM4MjEzMGNiMDNjMGRlNmFkNmFlMjAyMjZhJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.C38u6_lxPeyKrkokzvxTkUmm1_PNx8f8sAGVYhoQutg)
from creepjs.
Good catch. It's likely connected with the use of inline workers and modifications implemented here. I will investigate.
from creepjs.
I'm pondering on whether it is worth changing to support Safari. For now, the single file test page works on safari here.
https://abrahamjuliot.github.io/fpworker/
from creepjs.
Interesting. DedicatedWorkerGlobalScope
in Safari 17.4 on both macOS and iOS is consistent with Window
when it comes to canvas, but ServiceWorkerGlobalScope
and SharedWorkerGlobalScope
do not appear to be applying canvas fingerprinting protections and the hashes remain the same even in a private window. Maybe it's just a bug in your code, but have we found ourselves a fingerprinting vulnerability in Safari?
from creepjs.
Apple seems to disagree.
![Screenshot 2024-03-14 at 4 23 58 PM](https://private-user-images.githubusercontent.com/489322/312985781-1155f199-0e7a-4981-8f70-44ab68919c01.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTk3MjQyNDksIm5iZiI6MTcxOTcyMzk0OSwicGF0aCI6Ii80ODkzMjIvMzEyOTg1NzgxLTExNTVmMTk5LTBlN2EtNDk4MS04ZjcwLTQ0YWI2ODkxOWMwMS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwNjMwJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDYzMFQwNTA1NDlaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1iMjE0N2YwYjdlMTZjYzYwMTVkMTM2MTNhMTlhYjIzNDg1M2QzMDUxZDA2YmY0ODNmOTk3MmZlNmNlZjZjNmYxJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.OGJHXmK2MPpg3g1q6FyZt8S_DDiZJe7ZqrVSZRnqcEE)
from creepjs.
It's likely determined low based on the severity of canvas entropy derived from Apple GPUs. Canvas protections, at best, probably only neutralize annoying cross site trackers.
WebKit hardware acceleration entropy seems fairly uniform within the same OS/browser version. ¯\_(ツ)_/¯
I imagine, they will consider and fix if feasible. I recall Brave had a similar issue and patched.
from creepjs.
from creepjs.
As it turns out, I just discovered that this affects Firefox as well. Service Workers don't apply canvas protections.
from creepjs.
Nice. Thanks for the update @Joe12387
from creepjs.
Related Issues (20)
- Add stronger Proxy detection HOT 5
- Make CreepJS accessible as an NPM library HOT 4
- Doesn't work HOT 14
- Doubts about the erro infos
- Doubts about the erro infos HOT 9
- MIT or ISC license? HOT 1
- Doubst about the WorkerNavigator HOT 3
- Idea: Detect frame rate HOT 1
- How to use? HOT 6
- what is ```- failed prototype test execution``` HOT 9
- lazy loading iframes HOT 3
- Firefox trash after update HOT 2
- what does session mean? HOT 1
- Novice webdev here - How do I install this? HOT 1
- Where is the server source code itself? HOT 2
- How is the FP ID calculation being made? HOT 3
- fonts.lied is undefined HOT 3
- Workers testing is easily defeatable. HOT 6
- Documentation on how to run this HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from creepjs.