abrahamjuliot / creepjs Goto Github PK

https://developer.mozilla.org/en-US/docs/Web/API/SVGGeometryElement/getTotalLength

<svg width="200" height="200">
  <path id="path" d="M 10 80 C 50 10, 75 10, 95 80 S 150 110, 150 110 S 80 190, 40 140 Z"/>
</svg>

const path = document.getElementById('path')
console.log(path.getTotalLength())

https://developers.google.com/apps-script/reference/url-fetch/url-fetch-app
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers

SpreadsheetApp.flush()
https://developers.google.com/apps-script/reference/lock/lock

Should include custom functions

1. Get total number of child fingerprints tied to pure parent fingerprint
2. If it exceeds a certain amount (say 100), then identify the parent fingerprint as suspcious

• place at the bottom of section
• use light underline with a color hover style

concept

https://jsfiddle.net/8m3ptf9u/4/

First Visit: 7/27/2020, 8:37:55 AM (10 hours ago)

• TB/FF differ in window and nav props in both desktop and Android

Inspiration: https://privacycheck.sec.lrz.de/active/fp_cpt/fp_can_play_type.html

https://developer.mozilla.org/en-US/docs/Web/API/OffscreenCanvas

• reset
• mobile first layout (grid or flex)
• css modal to view details
• screen animation
• version icons
• timezone globe animation
• math animation
• error animation

https://developer.mozilla.org/en-US/docs/Web/API/WorkerGlobalScope/navigator

https://developer.mozilla.org/en-US/docs/Web/HTTP/Browser_detection_using_the_user_agent
https://developers.whatismybrowser.com/useragents/explore/software_name/chrome
https://stackoverflow.com/questions/19877924/what-is-the-list-of-possible-values-for-navigator-platform-as-of-today

https://es6console.com/kd8cshue/

const getOS = () => {
  const userAgent = 'Mozilla/5.0 (X11; CrOS armv7l 13099.48.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.64 Safari/537.36'
  const os = (
    // order is important
    /windows phone/ig.test(userAgent) ? 'Windows Phone' :
    /win(dows|16|32|64|95|98|nt)|wow64/ig.test(userAgent) ? 'Windows' :
    /android/ig.test(userAgent) ? 'Android' :
    /cros/ig.test(userAgent) ? 'Chrome OS' :
    /linux/ig.test(userAgent) ? 'Linux' :
    /ipad/ig.test(userAgent) ? 'iPad' :
    /iphone/ig.test(userAgent) ? 'iPhone' :
    /ipod/ig.test(userAgent) ? 'iPod' :
    /ios/ig.test(userAgent) ? 'iOS' :
    /mac/ig.test(userAgent) ? 'Mac' :
    'Other'
  )
  return os
}

console.log(getOS())

https://developer.mozilla.org/en-US/docs/Web/API/WebGLRenderingContext/getParameter

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math

• Include more static methods and properties
• Show unique results separate from Chrome V8

tests: https://es6console.com/kcvb8uvr/

Diff Tester:
https://jsfiddle.net/w3cqtsj1/ (consumes memory)

Polyfills:
https://jsfiddle.net/gz48qutr/14/

API lie detection should render other values as [untrusted] to prevent randomization.

Does not apply to:
Maths
Errors

Tracking:
v2 https://github.com/brave/brave-browser/issues/8787
v3 https://github.com/brave/brave-browser/issues/11770

• WebGL 1&2 Drawing: ignored
• WebGL 1&2 Vendor and Render: ignored, with inconsistencies detected
• WebGL 1&2 Parameters: side stepped through reduction
• User Agent: bypassed
• Canvas: detected with trap
• Web Audio: detected with trap
• Plugins: inconsistencies detected
• Hardware Concurrency: ignored
• Enumerate Devices: bypassed
• Device Memory: ignored, with occasional inconsistencies detected
• Fonts: bypassed
• Languages: lower entropy permitted
• Storage Quota: lower entropy permitted
• Network Info: blocked entropy permitted
• Keyboard: blocked entropy permitted
• Timezone: pending implementation
• Voices: bypassed
• Screen: pending release

Testing at https://dev-pages.bravesoftware.com

1. create a list of common navigator props
2. compare each navigator prop present to the common list

https://developer.mozilla.org/en-US/docs/Web/API/WebGL2RenderingContext

1. Detect support
2. If supported, get vendor and renderer
3. Renderer must be credible
4. webgl2/webgl vendors and renderers must match - this is currently not the case in Brave Browser and Privacy Possom

const canvas = document.createElement('canvas')
const webgl2 = canvas.getContext('webgl2')

if (webgl2) {
  const debugRendererExtension = webgl2.getExtension('WEBGL_debug_renderer_info')
  const vendor = webgl2.getParameter(debugRendererExtension.UNMASKED_VENDOR_WEBGL)
  const renderer = webgl2.getParameter(debugRendererExtension.UNMASKED_RENDERER_WEBGL)
}

1. Store the initial pure and basic fingerprint hashes in session storage
2. If either mutates, inform the user: session randomization detected

• optional: define certain known errors

• new UA platform version on Windows
• UA Client Hints (flag support)
• WebGPU (flag support) https://web.dev/gpu/
• WebHID
• Sensor API (😵 loose metric)
• Temporal (no support)
• Media Capabilities (generates excessive invalid warnings in Chrome)

• Gecko: https://mozilla.github.io/standards-positions/
• Blink: https://www.chromestatus.com/features/5922192355229696

https://developer.mozilla.org/en-US/docs/Web/API/Window/getComputedStyle

1. if yes, then set session storage opt-in true
2. if no, then end server communication

If one matches another, send both to trash.

https://developer.mozilla.org/en-US/docs/Web/API/ImageBitmapRenderingContext
https://html.spec.whatwg.org/multipage/canvas.html#imagebitmaprenderingcontext

https://developer.mozilla.org/en-US/docs/Web/API/Window/getComputedStyle

• test for breakage by injecting style to the body via inline styles, stylesheet, and style tag
  -- results not affected/no breakage:
  [1] removed the stylesheet
  [2] appended stylesheet (bootstrap cdn)
  [3] added style tag with color: blue !important
  [4] added inline style with color: blue !important

https://developer.mozilla.org/en-US/docs/Web/API/SVGGraphicsElement/getBBox

<svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg"> 
    <g id="svgRect">
        <text x="8" y="32" transform="translate(0 20) scale(1.9999)">
            citrus coastline oxygen cultivate tilt hush ensure unrelated astute passivism tried underwear
        </text> 
    </g>  
</svg>

const groupElement = document.getElementById('svgRect')
console.log(groupElement.getBBox())

• policy and code should be transparent

• visitor load (flash then step fade in)
• initial load (fade in)
• trash, lies, errors (wobble or bounce)
• no lies, trash, errors (shadow effect)
• hover (light green)