Your device's GPU may be used for fingerprinting purposes – Ghacks Technology News

Researchers from universities in Israel, Australia and France have discovered a device identification technique that is based entirely on GPU fingerprinting.gpu fingerprintingFingerprinting in the computing world refers to the identification of devices or users. It may be used individually or in combination with other tracking techniques.
Fingerprint attempts may use one or multiple factors retrieved from a user’s device to track users online. At least some data is revealed automatically when users connect to websites using modern web browsers, others may be retrieved using scripts that run on the website itself.
Connecting to sites may reveal information about the operating system, screen size or language that is used on the device. Some of these factors may change, e.g. the size of the browser window, while others may not.
Some web browsers, e.g., Firefox or Brave, include anti-fingerprinting options, but these address only common forms and not all methods that can be used potentially for that purpose.
The GPU fingerprinting technique that the researchers discovered relies solely on the graphics processing unit. The technique may be used to extend the tracking time of other fingerprinting methods by up to 67% according to the research paper.
To put this into perspective: the average tracking time according to the researchers is between 17 to 18 days. The GPU fingerprinting method that the researchers discovered extends this to a period between 25.5 and 30 days; a significant increase.
The researchers ran experiments on 2500 unique devices using the technique. They developed two methods, both of which use the Web Graphics Library (WebGL), which is supported by all modern web browsers.
The researchers describe how the technique, which they call DRAWNAPART, works in the research paper:
By fingerprinting the GPU stack, DRAWNAPART can tell apart devices with nominally identical configurations, both in the lab and in the wild. In a nutshell, to create a fingerprint, DRAWNAPART generates a sequence of rendering tasks, each targeting different EUs. It times each rendering task, creating a fingerprint trace. This trace is transformed by a deep learning network into an embedding vector that describes it succinctly and points the
adversary towards the specific device that generated it.
[..] by using short GLSL programs executed by the GPU as part of the vertex shader (cf.  section II-B). We rely on the mostly predictable job allocation in the WebGL software stack to target specific EUs. We observe that, when allocating a parallel set of vertex shader tasks, the WebGL stack tends to assign the tasks to different EUs in a non-randomized fashion. This allows us to issue multiple commands that target the same EUs.
Finally, instead of measuring specific tasks, we ensure that the execution time of the targeted EU dominates the execution time of the whole pipeline. We do so by assigning the non-targeted EUs a vertex shading program that is quick to complete, while assigning the targeted EUs tasks whose execution time is highly sensitive to the differences among individual EUs. A
Both onscreen and offscreen methods have been created to address different use cases. The onscreen method is faster but requires more resources, the offscreen method takes longer to deliver results but it is more resource friendly.
The researchers note that countermeasures may block the successful creation of fingerprints using the method. Tor Browser, with its “minimum capability mode” blocks the use of an API that the attack relies on by default. WebGL may also be disabled in other browsers to prevent the attack, but at the cost of potential usability or accessibility issues.  Script blocking can be effective, but only if scripts are blocked by default and allowed manually by the user.
Check out a study on the effectiveness of anti-fingerprinting measures here.
You can check out the full research paper linked above for additional details.
Now You: do you use anti-fingerprinting protections? (via Bleeping Computer)
I’m using CanvasBlocker mainly for container tabs functionality and anti-fingerprinting is bonus.
Yeah, maybe I should re-install CanvasBlocker, I removed it when I had the feeling it slowed down surfing…. feeling only, other parameters may have been the culprit. I’ll think about it.
Here with Firefox (96.0.1) I certainly should disable WebGL, but doing so may disturb/break some websites.
// disable/limit WebGL (Web Graphics Library)
// When disabled, will break some websites. NOTE : Google Maps ‘Globe View’ requires WebGL
// When enabled, provides high entropy.
pref(“webgl.disabled”, true); // DEFAULT=false — Set to false here
// limit WebGL
pref(“webgl.min_capability_mode”, true); // DEFAULT=false — Set to false here
You know what? I’m on the slippery path of letting down my guard when it comes to engaging in counter-tracking measures with side effects given I relativize the effectiveness of one component lost within the myriad of fingerprinting and tracking methods, calamity of the Web.
I’m keeping WebGL just for the sake of Google Maps ‘Globe View’. Now that I think about it I wonder if I’m not stupider than I thought. I might create a toolbar button to switch WebGL on/off, like I’ve done for WebAssembly (only very few sites need it). I may also test Google Maps ‘Globe View’ with WebGL enabled (required) but “webgl.min_capability_mode” set to true… but as I said : always yes for security, most often yes for privacy given there’s no substantial side-effect. Lousy pragmatism.
Another Ghacks contribution to lucidity via information.
There are alternative map sites Tom. Using Google is just asking for trouble.
TelV, there are alternative map sites, for sure. Personally I’m fond of maps, mapping. I use OpenStreetMap in priority, also, Qwant maps (to remain faithful to me European status) and Geoportail (because i’m in France). I also use the ‘OpenSwitchMaps’ extension to shift from one to another for a given localization.
I dislike banning as a principle and when it comes to Google, believe me, it’s authorized a strict minimum : is cookie-blocked (* that is) and if/when I use it it’s only for images and maps, and when it comes to maps I must say that I find nowhere else, 1- Street View (at least as well built), 2- satellite view (alternatives exist) and more specifically the ‘Globe View’ I mentioned above : satellite view is by default in 2D, the ‘Globe View’ is in 3D (like Google Earth) allowing tilting and “true” 3D ; no one but Google Maps offers that.
To come back to WebGL and Google Maps : with WebGL disabled I can use Google Maps, Google Maps / satellite, but not Google maps / satellite / Globe View, which requires and WebGL enabled AND “webgl.min_capability_mode” = false …
From there on, I can either add a userChromeJS toolbar button I’d craft to toggle WebGL when required by a site (setting it ‘off’ by default) as I’ve done it for WebAssembly, either re-install the CanvasBlocker extension mentioned above by user Akina. CanvasBlocker includes tightening of WebGL. I’ve chosen the second solution, doesn’t seem to slow down the browser, even in its ‘Maximum protection’ mode; I had had that feeling previously, another example of why “feelings” blind when a rational experience reveals.
about:config > webgl.disabled > true
Paranoia and fearmongering is what people need to ‘disable’.
Maybe many have data that needs military grade protection procedures?
Fair enough, if it’s worth protecting, otherwise it’s just chasing your tail.
The world of networked computing is full of holes and subversive methods.
Always was always will be.
Take a breath world, there’s enough fear & paranoia floating around for everyone.
“Just because you’re paranoid doesn’t mean they aren’t out to get you.” — Woody Allen
Paranoia is imaginative, awareness is factual. Facts. What is described in this article is not the resume of a psy session, it’s facts. What must be avoided, right between paranoia and awareness, is over-reacting. Like in a fist-fight, some get all excited then you have this calm big-head which enters the place and calmly fixes the problem. Point is with trackers as your opponent it’ll never be a KO, you can just try to narrow the score difference.
I get what you’re saying, completely, but believe me when I say this;
life is waaay too short for over protective measures.
Could you please give me your full name, the name of the city in which you were born, your mother’s maiden name and the name of your pet?
You have nothing to hide, right?
“Could you please give me your full name, the name of the city in which you were born, your mother’s maiden name and the name of your pet?
You have nothing to hide, right?”
Give me an email or something else where I can send ’em to you.
life is waaay too short to spend years in jail, because you didn’t take highly protective measures.
But if you have nothing to hide, then you have nothing to worry about, right?
Or are you just one of those types of people who drive around drunk and sing “don’t worry, be happy!”?
Point being, one size does not fit all, and we are not you.
Fingerprinting is a problem and will only get worse as 3rd party cookie controls tighten. Google doesn’t mind hurting 3rd party trackers to promote their own Topics tracking.
Check EFF’s Cover Your Tracks page to test your browser.
Our tests indicate that you have strong protection against Web tracking, though your software isn’t checking for Do Not Track policies.
Blocking tracking ads? Yes
Blocking invisible trackers? Yes
Protecting you from fingerprinting? Your browser has a unique fingerprint
Your browser fingerprint appears to be unique among the 224,173 tested in the past 45 days.
Currently, we estimate that your browser has a fingerprint that conveys at least 17.77 bits of identifying information.
Read the paper.
One of a bazillion ways to track users. These “Look what we found” things appear regularly; the authors say so and cite many of them.
Like OS’s and browsers don’t have advertising ID’s that very few users know exist and even fewer disable? The list of potential identifiers is very long, none of which matter for most users, since they don’t care.
Try the minimal mode for WebGL if you use FF; turning it off will mangle lots of sites.
In my main profile on Firefox used for surfing, most if not all prefs are according to Arkenfox so no problem. On the odd occasion where web compatibility is an issue I have a backup profile for those purposes in which no prefs are touched. Thankfully in Firefox I can switch DRM, Telemetry, ETP, safebrowsing, and now site isolation in the form of dFPI without any pref through main settings.
Side note to those who maybe don’t want full Arkenfox experience but still want some protections, Flip two prefs – privacy.resistfingerprinting.enabled and webgl.enabled. That’s it – enjoy better protections against tracking.
TLDR – If you have Firefox, disable WebGL in about:config.
[email protected]$ BTFO (and yes, [email protected], that includes Brave, the * [Editor: removed, stay polite] browser).
What are you even talking about, Brave randomizes WebGL when set to “Standard” and turns it off entirely when set to “Aggressive”, you don’t need Firefox to turn WebGL off (LOL).
> [email protected]
This is highly offensive, if I wrote that the mod hypocritically wouldn’t even let my post appear. I guess you are lucky that the rules do not apply to everyone in the same way.
I’ve had WebGL disabled for several years. I’ve lived long enough – going back to when the internet didn’t have any advertising on it and little if any surveillance – to know what is really necessary for me to live a pleasant and productive life. Whatever I really need from the internet I get just fine – and leave the rest.
I’ll continue to protect my privacy and security as I can – even as it gets worse. Makes no sense to give in if I have the technical knowledge and skill to block holes as they arise. An analogy: Although a determined burglar can break even some of the best door locks, that doesn’t mean I should leave my doors open and unlocked all the time.
> ..internet didn’t have any advertising on it and little if any surveillance
Not true. The Internet (before the web) had much advertising. Most all BBS services has ads for porn, computer stuff, services, all kinds of stuff. Dell computer started by advertising on university forums. Logging by BBS services and Universities was a thing back then too. Student had to log on with their credentials, and regular users paid for access, and everyone used wired phones modems, which were easy to track. Most all users where tracked, as many paid for access per hour with data caps. Also, even savvy hackers who jumped around several proxies still got busted by the FBI back then. Also, some of the biggest media pirate busts happened before the web, with users being arrested and computers confiscated. There was no public Wi-Fi for hackers to hide behind.
As for knowledge about security and privacy, that doesn’t matter much if you have important things to protect, because if they want it, they can likely get it. Hence, it all comes down to being able to have a real risk analysis that fits your specific situation, and as need be, a contingency plan if things go bad for you, such as something a lawyer could help you with.
Also, you say “even as it gets worse…Makes no sense to give in” and thus I take it you have no end-game exit plan, other than to keep doing the same. Hmm, that makes no sense to me. It’s prudent to know how much risk you’re willing to face before opting out of such risk.
For me, I faced that too-high-of-a-risk level years ago, concluding that the web is broke, it’s getting worse, and the good guys in security have lost.
Personally, I’m doing all I can to keep my assets away from the web, which includes banking. I have contingency plans to deal with any foreseeable problems I can’t control, as with identity theft. To sum it up, the risk of depending a lot on the web is too high for me.
That said, right before covid hit, a friend of mine lost a house he left empty for a month to some so-called squatters, who came from next door, broke in, changed the locks, sold everything inside including a motorcycle and his tools, and then rented it out. Thanks to the web, they did some identity fraud, via documents they found in the house, and cleaned out a bank account. No one has been arrested, and they are still in that house, with a fake lease. The police said they can’t do anything, as it has to go through the court system. My friend had no idea this could happen to him, and now he spends money on a lawyer. Ha. I had warned him, but he ignored me, as he is an optimistic idiot.
@Wang Chung,
> Not true. The Internet (before the web) had much advertising.
I’m not @SteveS himself,
but @Wang Chung seems to be unfamiliar with the realities of the “ community”. The community is global and subscribed to by men and women of all ages. In short, there is a huge difference between your “generation” and his.
He is probably referring to the New Media (INS: Information Network System) of the 1980s, and he said he has gained Internet experience that “can be appropriately controlled by one’s outlook on life, experience, and skills”.
Not everyone’s environment is identical to yours. However, your comment is worthwhile.
About the “BBS services” mentioned by @Wang Chung:
Bulletin board system
I’ll say it again, it’s not the tracking the bothers me.
It’s that other people make profit from what is essentially my data, and I don’t get any of it.
That pisses me off.
How is it your data? If it was your data, then how did you let it get away from you? Perhaps you gave away your data, and now you want it back? If so, that problem is on you. Seems silly to complain about it now, even if you were ignorant about how most “free” services on the web work. I say bravo to anyone who could make some money from mostly useless data. And that’s the biggest scam of all, as there are suckers who buy such data thinking it’s useful, when most of it is not. Most folks are clueless to how this data is traded around. It’s not too different than Bitcoin, where due to pure hype, something that is intrinsically worthless is magically worth something.
Use multiple browsers and multiple devices.
1. Secure browser with minimal functionality when you don’t want to be tracked, censored, or risk loss of data. (Tor, or tweaked Firefox, optionally in a VM or removable drive.)
2. General browser for compatibility. (Firefox, or Brave, + optional VPN)
3. Work browser with crypto wallet, financial, and other accounts where you must be identified and having your IP tracked might be required. (Firefox, or Brave)
4. Use a phone for trash social media and apps. Keep these apps off your desktop. Don’t link your phone to your desktop, don’t link your desktop accounts to Apple, Google, or Microsoft EVER! (optional VPN)
5. Never use Chrome, or Edge.

Please click on the following link to open the newsletter signup page: Ghacks Newsletter Sign up
Ghacks is a technology news blog that was founded in 2005 by Martin Brinkmann. It has since then become one of the most popular tech news sites on the Internet with five authors and regular contributions from freelance writers.