Wala pa ang pahinang ito sa inyong wika. Binabasa ninyo ang tekstong Ingles.
Glossary
Iframe realm leak
An iframe realm leak is a difference in the fingerprint between a page and a frame the page created inside itself.
What a realm is
A realm is one JavaScript world: its own globals, its own navigator, its own screen. Every frame on a page opens one more of them.
To you the page and the frame are one browser window. To a site they are two places to ask the same question.
How a site takes it
The whole reading costs a site four lines and finishes before the page has finished loading. Nothing about it needs a permission, and nothing about it is unusual enough to notice.
- 1
Adds a frame off screen
Nothing is shown to you and nothing is asked of you.
- 2
Reads the second navigator
The frame answers with its own processor count, platform and time zone.
- 3
Compares the two answers
Equal values say nothing new. A difference says the browser is rewriting one of them.
Your page right now
These four are read in the document you are reading, here on this page.
A frame created inside it would be asked for the same four names, and its reply compared with what you see.
Ang inyong makina, ngayon mismo
- Platform
- sinusukat sa inyong makina
- Logical processors
- sinusukat sa inyong makina
- Screen
- sinusukat sa inyong makina
- Time zone
- sinusukat sa inyong makina
Binasa sa inyong browser at ipinapakita rito. Walang ipinapadala kahit saan.
Why the difference beats the value
A rare graphics card makes one machine among many. A browser whose page and frame disagree is a browser that was altered, and that is a different kind of finding.
The first is a fingerprint worth storing. The second is a reason to look harder at everything else the account does.
This is why a half applied defence is worse than none: it hands over the original value and a proof that someone tried to hide it.
Where the values come from
On our engine the profile values reach the whole browser at launch, before the first line of page code runs.
Every frame inherits them from there instead of answering for itself, including a frame from another site living in its own process.
One source under every navigator
The page navigator and the frame navigator read the same place, so there is nothing left to keep in step by hand.
A blank frame is not special
A frame that never loaded an address of its own answers exactly as one that did.
The self-test asks both
Inside a profile the fingerprint self-test builds a frame and compares it with the document around it.
Often confused with
Worker realm leak
A background thread is also a realm and is reached another way. Separate surface and a separate check.
A frame from another site
The page cannot read that one at all. Its values belong to the site inside it and prove nothing about you.
Frame busting
Scripts that refuse to run inside a frame are about clickjacking. They say nothing about the values a frame reports.
Sandboxed frame
The sandbox attribute takes rights away from the frame. It does not change what the navigator inside it reports.
What this does not do
- It does not stop a page from making frames. Any page may create one, and a browser that would not is a rarer sight than the value being hidden.
- It is not equal on both engines. Our own engine answers from under every realm; the built-in one covers a frame read a moment later and leaves the one read in the same instant.
- It does not undo a link that already exists. A frame that agrees is one signal among a dozen, and account history is not a fingerprint problem.
- It does not reach a browser opened outside a profile. These values belong to the profile that launched the window.
Check it
Every claim above comes from a file you can open.
- The frame check the self-test runs
- apps/desktop/src/lib/fpAudit.js
- Measured in a real browser under an ordinary content policy
- apps/desktop/test/fingerprint-realms.js
- What the shipping build answered in the page and in the frame
- engine/приёмка-отчёт.json
- The profile values reach every renderer process
- engine/patches/armanos-fp.cumulative.diff
Questions
- Can a site read a frame without my knowing?
- Yes. A frame can be built off screen and read in the same second, and neither the building nor the reading shows up anywhere you can see.
- Does a proxy change what a frame reports?
- No. A proxy changes the address your traffic leaves from. A frame reads the machine and the browser, and that reading never touches the network.
- Is a blank frame different from a loaded one?
- Not for a site. It asks the same navigator either way, and the blank one is cheaper because nothing has to arrive first.
- Can I just refuse frames?
- Ordinary pages carry them for payments, maps and video. A browser with none of them stands out more than anything inside them would.
- How do I see mine?
- The self-test inside a profile creates a frame and compares it with the page. It is one of the 29 measurements that run there.
See what a frame answers in your profile
The fingerprint self-test runs inside a profile and shows all 29 measurements, green and red alike.