Introduction: Math.tanh, a New Fingerprinting Tool
Since the release of Chromium 148, a new fingerprinting method has emerged using the mathematical function Math.tanh. This subtle yet significant change allows for determining the underlying operating system of a user by exploiting the calculation differences between the math libraries of different systems. This discovery paves the way for new approaches in bot detection and browser security.
How Does It Work?
Traditionally, browser fingerprinting uses features like canvas, WebGL, fonts, and audio to identify a user. However, with Math.tanh, a quieter signal has emerged. The principle is straightforward: due to variations in the math libraries used by each operating system, the result of Math.tanh for certain values can slightly differ.
For instance, run Math.tanh(0.8) on different systems:
- Linux (glibc):
0.6640367702678491 - macOS (libsystem_m):
0.664036770267849 - Windows (UCRT):
0.6640367702678489
These differences, although minimal, are enough to identify the operating system used.
The Evolution with Chromium 148
Before Chromium 148, Chrome's V8 engine computed tanh internally with a version of the fdlibm library, ensuring an identical result regardless of the operating system. However, since commit c1486295ae5, Math.tanh uses the std::tanh function that relies on the OS's math library, thus making the results OS-specific.
Implications for Security and Bot Detection
This change has significant implications for security strategies. Anti-bot systems can now use Math.tanh to verify the consistency between the declared User-Agent and the actual operating system. If an inconsistency is detected, it might indicate the use of a bot trying to disguise its identity.
Recent measurements indicate that about 25% of Math.tanh calls show significant differences between operating systems, providing a reliable data point for fingerprinting.
Use Cases and Perspectives
For security companies, this method offers a new tool to refine their detection systems. However, it also raises questions about user privacy and the ethical implications of fingerprinting.
Developers need to be aware of this change to ensure their applications remain secure and privacy-conscious. Additionally, understanding these differences can help optimize web application performance across different systems.
Conclusion
The discovery of Math.tanh as a fingerprinting tool highlights the importance of understanding the technical details of underlying libraries. As we move towards a future where security and privacy become increasingly critical, staying informed about new methods and implications is essential.
Let's discuss your project in 15 minutes.