Brave exposes too much fingerprintable information

jerm · April 22, 2024, 6:52pm

Brave still exposes too much fingerprintable information

opened 08:55PM - 28 Jan 24 UTC

privacy priority/P4 privacy/tracking

I did some research on fingerprinting and browser's defenses, and I think there …are several pieces of somewhat fingerprintable information that Brave still exposes and that could rather trivially be spoofed/farbled/disabled: - `(await navigator.userAgentData.getHighEntropyValues(["platformVersion"])).platformVersion` returns the exact operating system version. On Android, this provides the major Android version (e.g. 12/13/14 etc.) and on Windows, it [provides](https://github.com/chromium/chromium/blob/main/components/embedder_support/user_agent_utils.cc) the [number corresponding to the yearly Windows release](https://github.com/WICG/ua-client-hints/issues/220#issuecomment-870858413) (`14.0.0` = Windows 11 21H2, `15.0.0` = Windows 11 22H2 etc.). This value could easily be spoofed by always returning the most up-to-date version of the known OS (`14.0.0` on Android, `15.0.0` on Windows, etc. (I don't know about Linux/MacOS/ChromeOS)) - WebGL renderer & vendor info (see https://github.com/brave/brave-browser/issues/31229#issuecomment-1913661444) - WebGPU is currently [still enabled](https://github.com/brave/brave-browser/issues/31274) in Brave by default. As far as I know, Brave provides no canvas farbling whatsoever for it (only for WebGL and Canvas2D). Also, it is possible to read the GPU vendor and rough architecture via `await (await navigator.gpu.requestAdapter()).requestAdapterInfo()`. - External Protocol Flooding is still [not fixed](https://github.com/brave/brave-browser/issues/15875). - Audio latency & sampling rate: the [`sampleRate`](https://developer.mozilla.org/en-US/docs/Web/API/BaseAudioContext/sampleRate), [`baseLatency`](https://developer.mozilla.org/en-US/docs/Web/API/AudioContext/baseLatency) and [`outputLatency`](https://developer.mozilla.org/en-US/docs/Web/API/AudioContext/outputLatency) properties of [`AudioContext`](https://developer.mozilla.org/en-US/docs/Web/API/AudioContext) give information about the system's audio processing capabilities. - Recursion call stack size: One can measure the browser's JS maximum recursion call stack size by creating a web worker looking something like this: ```js onmessage = () => { let stackSize = 0; try { const recursion = () => { stackSize++; recursion(); }; recursion(); } catch { postMessage(stackSize); } }; ``` and sending it a message. This provides a reliable and repeatedly-the-same value, even in incognito (6350 in my case). However, I don't know how different these numbers are on different devices, so the information entropy _might_ be rather low for this one. - the WebAuthn `await PublicKeyCredential.isConditionalMediationAvailable()` and `await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable()` APIs return `false` for the (probably rather few) users where these authentication methods are not available, making them somewhat unique. Should these methods be overridden to always return `true`, possibly causing compat issues? - `performance.memory.jsHeapSizeLimit` returns the JS heap size limit. It is stable across different websites & visits, although I don't know how much entropy this property really has (might be the same for most users; 2,172,649,472 bytes on my machine). - `new Intl.DateTimeFormat().resolvedOptions().timeZone` returns the true time zone, including city information (e.g. Europe/Vienna for me). This has been discussed several times here and the consensus was apparently that spoofing the value to a normed city per time zone wouldn't work since every country has their own rules regarding daylight savings time, and therefore calendar applications wouldn't work reliably anymore. But wouldn't it be possible here to expose the true time zone with city information after an opt-in from the user? For 99% of websites, having the general time zone (i.e. the offset from UTC) is perfectly enough.

You can test protocol handler fingerprint yourself from this site https://external-protocol-flooding.netlify.app/

To confirm on windows:

Open the Registry Editor: Press Win + R, type regedit, and press Enter.
Navigate to this path and search for the apps the site showed you.

Topic		Replies	Views
Brave fingerprinting measures Questions browsers	2	469	April 11, 2024
Brave is NOT fingerprint resistant enough Privacy browsers	26	2399	December 4, 2024
Brave removes strict fingerprinting protection Privacy article , browsers	43	2746	January 29, 2024
Is Brave on Android actually much worse than Cromite? (at fingerprinting resistance) Privacy browsers	10	1350	August 19, 2024
Is Brave better for fingerprinting because you blend in with Chrome users? Questions browsers	3	1403	April 16, 2023

Brave exposes too much fingerprintable information

Related topics