This document outlines potential security and privacy exploits that can be derived from the data collected by the fingerprint-oss library. Each property in the userInfo JSON response can potentially be used for tracking, identification, or exploitation.
- Property:
systemInfo.userAgent - Exploit: Reveals the exact browser version, OS, and device information which can be used to target known vulnerabilities in specific browser versions.
- Risk Level: High
- Properties:
systemInfo.localStorage,systemInfo.sessionStorage,systemInfo.indexedDB - Exploit: Allows targeted attacks based on browser storage capabilities. For example, different exploits for browsers that support or lack specific storage methods.
- Risk Level: Medium
- Properties:
systemInfo.vendor,systemInfo.vendorFlavors - Exploit: Can be used to specifically target vulnerabilities in certain browser vendors.
- Risk Level: Medium
- Properties:
systemInfo.hardwareConcurrency,systemInfo.deviceMemory,systemInfo.screenResolution - Exploit: Reveals device capabilities which can be used for precise device identification and tracking across sites. Can also be used to target devices with specific hardware profiles.
- Risk Level: High
- Advanced CPU Core Detection: The
hardwareConcurrencyproperty goes beyond the standard navigator API by using Web Workers to perform actual performance tests. The system creates multiple workers that perform CPU-intensive calculations (computing square roots) in parallel until execution time increases significantly. This allows for more accurate detection of actual available cores rather than just relying on reported values. This sophisticated method can detect CPU throttling, virtualization, and other performance limitations that might be hidden by the standard API. - Anti-Fingerprinting Bypass: This advanced worker-based CPU detection can bypass anti-fingerprinting techniques that only spoof the standard
navigator.hardwareConcurrencyproperty, making tracking more resilient against privacy tools.
- Property:
systemInfo.canvas - Exploit: Creates a unique fingerprint based on how the device renders graphics, which can be used for tracking even when users clear cookies or use private browsing.
- Risk Level: High
- Property:
systemInfo.webGL - Exploit: Provides detailed information about the graphics hardware which can be used for precise device fingerprinting.
- Risk Level: High
- Property:
systemInfo.audio - Exploit: Creates a unique audio fingerprint that can identify users across different sites even in private browsing modes.
- Risk Level: High
- Property:
systemInfo.mathConstants - Exploit: Different JavaScript engines implement math functions with slightly different precision, which can be used to identify the browser and platform.
- Risk Level: Medium
- Property:
systemInfo.fontPreferences - Exploit: Detects available fonts which creates a unique fingerprint based on installed fonts.
- Risk Level: Medium
- Property:
systemInfo.incognito - Exploit: Detects when users are trying to browse privately and can be used to limit functionality or redirect users attempting to preserve their privacy.
- Risk Level: High
- Property:
systemInfo.adBlocker - Exploit: Can be used to serve different content to users with ad blockers or to block users who use ad blockers from accessing content.
- Risk Level: Medium
- Property:
systemInfo.timezone - Exploit: Can be used to infer a user's geographical location even when they're using a VPN.
- Risk Level: Medium
- Property:
systemInfo.languages - Exploit: Reveals user's language preferences which can be used for identification and cultural profiling.
- Risk Level: Medium
- Property:
geolocation.ipAddress - Exploit: Direct tracking of user's network identity which can be used for identification across sites.
- Risk Level: High
- Properties:
geolocation.city,geolocation.region,geolocation.country,geolocation.location - Exploit: Precise geographical tracking which can be used to track user movements over time.
- Risk Level: High
- Properties:
geolocation.traits.isAnonymousProxy,geolocation.traits.isAnonymousVpn,geolocation.traits.isTorExitNode - Exploit: Detects when users are attempting to hide their true location using VPNs or proxies, potentially enabling targeted blocking or tracking.
- Risk Level: High
- Property:
systemInfo.bot - Exploit: Websites can use this information to block automated access, potentially preventing legitimate automated tools like screen readers or security scanners.
- Risk Level: Medium
- Property:
confidenceAssessment - Exploit: Sites might use low confidence scores to deny service to legitimate users, or attackers could study how to manipulate their fingerprint to achieve higher confidence scores.
- Risk Level: Medium
- User Awareness: Inform users about what data is being collected and how it's used.
- Data Minimization: Only collect the minimum data needed for your application.
- Secure Storage: Never store full fingerprints in a way that could be compromised.
- Opt-out Options: Provide users with ways to opt out of fingerprinting.
- Transparency: Be open about fingerprinting practices in your privacy policy.