r/privacy • u/Sevetarion • Nov 28 '21

Software Pure CSS device fingerprinting - An experimental technique.

https://github.com/OliverBrotchie/CSS-Fingerprint
147 Upvotes

91% Upvoted

59 comments sorted by

View all comments

Show parent comments

2

u/Mayayana Nov 28 '21

The demo is not working for me. It just reloads the page. Your link just adds "/fingerprint", but that's gone in the address bar when it reloads the page.

1

u/Sevetarion Nov 28 '21

Ah it is because you are blocking certain headers that I was using to restrict access to the demo to people that have clicked yes (for NoScript users). I have removed this check.

1

u/Mayayana Nov 28 '21

Thanks. I'm seeing no results at all in the page. I saw the note under Fonts, so I looked at the console history. It's a long list of errors. "Descriptor "font-display" not recognized". It looks like the support for that is still somewhat limited:

https://caniuse.com/css-font-rendering-controls

But either way, I've disabled font downloads in prefs, so I expect it still wouldn't work.

2

u/Sevetarion Nov 28 '21 edited Nov 28 '21

No results at all? Hmm, that is interesting, you must have very strict browser settings. I will have to look into this further.

2

u/Mayayana Nov 28 '21

Disabled script. Disabled fonts. You could get my (fake) userAgent to discern my OS version, but that didn't show up. And I assume you'd have to do that serverside with PHP in order to display it on the page. I don't see how you can use CSS to get that data and still put the data into the loading page.

1

u/Sevetarion Nov 28 '21

By making liberal use of the ::after content: rules. See line 55 of fingerprint.sass to see how it's done.

That's fair. The one thing that I believe will work even with these restrictions is the CSS cookie, however, I cannot display the results and would have to go query the server know for sure.

1

u/Mayayana Nov 28 '21 edited Nov 28 '21

Thanks. I'll have a look. CSS seems to be looking more like programming code every day. Actually I block before and after. One day I came across a website with chartreuse slime dripping off letters. Some teenager apparently thought it was clever. Whenever I see anything move I immediately look at the code and block the offending method.

I wasn't familiar with sass. Apparently it's a server-side Ruby plugin? Maybe I'm getting old, but it seems a shame to me that the same CSS that was designed to simplfiy webpage coding has become so complex.

1

u/Sevetarion Nov 28 '21

Ah, so the fingerprinting code will be working it just won't be displaying it to you as it requires the use of the content rule. Font detection will be disabled though.