Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

One of the more effective techniques is measuring the speed at which JS renders to your canvas. That's a sidechannel I don't think can be closed easily.

As long as JS exists, there will be effective means to examine the sandbox.

(I do agree they have unsafe defaults info. It's just removing it isn't enough.)



Is this a reliable metric? One would think there would be lots of jitter. But if you combine with something else like IP address it may be useful.


There is some noise, but there are bounds. Everyone tends to have fairly common habits and periods of transition into new habits, that combined with IPs, or geolocation, or screen sizes, that you can fairly accurately pin individual devices..

Your processors, memory, and so on all have manufacturing quirks, and then workloads provide some more. The fuzzy circle of rendering times becomes easy to use.

Various places have used it since before '14. But here's one random paper that goes into more depth. [0]

[0] https://www.ndss-symposium.org/wp-content/uploads/2022-93-pa...




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: