Worker realm leak

A worker is a thread a page starts for work that would otherwise freeze the window. It has no page, no screen and no access to what you see.

It does have a navigator, and that navigator answers for the processor count, the platform, the languages and the memory.

Three lines of script are enough, and the reply arrives as plain data through a message rather than as anything the page has to parse.

1. 1

   Builds the worker in memory

   The code for it is assembled as text and started without ever being fetched from an address.

2. 2

   Asks for the same names

   Cores and platform first, because those are the two that move when a fingerprint is being rewritten.

3. 3

   Holds the reply against the page

   One machine answers once. Two answers describe a browser rather than a computer.

These four are read in the document of this page, and nothing about them leaves your browser.

A worker started here would be handed the same four names, and its reply compared with what you see.

A worker's code can live at an address of its own, and page script cannot rewrite what the browser fetches from there.

So a defence written inside the page covers the workers it can see and misses the rest, and half of them is worse than none of them.

• Half covered is a proof

  A site that gets profile values from one worker and machine values from another holds evidence of tampering rather than a browser to measure.

• There is nothing to install into

  Tricks that place values on the page have no page here. A worker has no document and no window of its own.

• The answer never passes through the page

  Values come back through a message as copied data, so nothing in the page sees them on the way.

On our engine the page navigator and the worker navigator sit on one common base, and the profile values are answered there.

The seed arrives on the launch line before any code runs, so every thread of the browser reads the same values without being told to.

• Inherited rather than copied

  Nothing has to travel from the page into the thread, so there is no moment when one of them is already changed and the other is not.

• A second worker changes nothing

  Ten threads answer the way one thread does, because none of them is answering for itself.

• The self-test asks a real one

  Inside a profile the fingerprint self-test starts a worker and compares its reply with the document.

• Iframe realm leak

  A frame is the other realm on the same page. It is reached differently and it carries a screen and a document.

• Service worker

  That one outlives the tab and deals with requests and stored replies. It is a storage question rather than a fingerprint one.

• Hardware concurrency

  The value a worker is asked for most often, and a term with a page of its own.