WebGL fingerprint

WebGL exists so pages can draw with the graphics card. The same calls that draw also report what is doing the drawing, and that report is far more specific than anything else on the page.

A full reading takes a few milliseconds and shows nothing on screen. The frame is rendered off screen and thrown away once its bytes have been taken.

1. 1

   Asks the card its name

   An extension hands over the unmasked vendor and renderer strings, which together name the chip, the driver and the graphics layer beneath it.

2. 2

   Draws a small frame

   A triangle over a flat fill is enough. Two cards given the same instructions do not land on the same bytes.

3. 3

   Reads the frame back

   The pixels leave either through the graphics calls or through a copy onto a canvas, and both roads end in one hash.

These values are read in your browser on this page. The renderer string is often enough on its own to name the chip and the driver behind it.

Nothing here leaves this page. The reading is drawn on the spot, and no request goes out with it.

Most tools in this category edit the two strings and stop. That is half the reading, and the other half is produced by the hardware itself.

The four parts below are read by one page in one pass. They have to agree with each other, and agreement is what a set of edited strings cannot supply on its own.

• The vendor string

  It names the maker as the browser reports it. Our acceptance run pins it to the profile seed and compares the answer by name.

• The renderer string

  It carries the chip, the graphics layer and the shader levels in one line, which makes it the most specific single value a page can read.

• The rendered frame

  Bytes produced by the hardware do not follow an edited string. A page that reads both then holds a contradiction rather than a name.

• The road the pixels take

  Pixels leave the drawing buffer directly or through a copy onto a canvas. A defence applied to one road is found by taking the other.

The numbers below come from the run of 2 September, on the build shipping today. Each is one line in the harness and each reports its own value rather than a verdict.

The run is given four seeds and repeats the whole set for each of them. A defence that holds for one seed and fails on another is not yet a defence.

• The parameter reader stays native

  The function that answers questions about the card still reads as native code, so a wrapper around it is not there to find.

  native code

• Both roads give the same bytes

  Pixels taken straight from the drawing buffer and pixels taken through the pack buffer come back identical.

  0 apart

• The frame is not raw

  A flat fill read back from the drawing buffer differs from the clean fill in four hundred and seven places.

  407 changed

Both strings arrive with the profile seed on the launch line, and the frame is altered where the card hands it over. The two therefore move together instead of pointing at two different machines.

Two runs of the same harness: the build before the fingerprint patches, and the build shipping today. Rows that a run did not reach are named as such rather than left blank.

• Canvas fingerprint

  That surface is drawn by the browser in two dimensions and this one by the card. Different values, different code and a separate defence.

• WebGPU

  The newer interface reaches the same hardware through its own calls and is read on its own. A build can hold one road and leave the other open.

• The renderer string on its own

  Editing the two strings leaves the drawn frame where it was. The reading is the pair, and a page can take both in one pass.

• The card named in system settings

  What the operating system calls your card and what the browser reports are two different strings. A page reads only the second one.

The panel above shows what the browser you are reading this in reports. The self-test lives in the app and runs inside a profile, against the engine that profile launched.

It names the strings the seed asked for and prints what came back, so a mismatch is visible as two lines rather than a score.

Run it in two profiles on one computer. Two cards where there is one machine is the reading worth having, and one run shows both.