In today's exploration of cyber security tech news.
Are you paranoid about being tracked online?
If yes, then this video is not for you.
Today I want to look at a brand new research paper which explains how you can be tracked
across the internet by websites exploiting your GPU with a new "identification technique"
dubbed "Remote GPU Fingerprinting".
Whilst this is potentially bad news for privacy, I have to admit, it is ingenious and it's
not quite what you might expect.
This new tracking technique works in the browser, and if implemented by a website, it would
be able to uniquely identify a computer using its graphics processor.
As in if you were lucky enough to own a 3080, this technique would be able to uniquely identify
your 3080 from someone else's 3080, even if they were from the same brand and in the same
configuration.
Think of it kind of like using a GPU as a cookie.
Just like a cookie saved in your browser can be used as an identifier to track you across
browsing sessions, this method uses your GPU as that identifier - and it doesn't matter
if that's a dedicated graphics card or even integrated graphics.
But how does this even work?
Well, this is where it gets kinda clever, the researchers are taking advantage of "WebGL,
that's (Web Graphics Library)" - it's an API used for rendering 3D graphics, it's often
used by browser games and websites in order to, well, render 3D graphics.
The researchers figured out that they could time how long it takes a browser to perform
certain graphics rendering tasks - and then use this data to build a fingerprint of a
specific graphics card.
It sounds straightforward, because of course a computer with integrated graphics is going
to be a lot slower than a dedicated GPU, their fingerprints will be quite different and so
you can quite easily tell them apart - however here's where it gets interesting...
So these are the fingerprints derived from two identical GPUs - in this case they both
come from computers using an "i5-3450"s integrated graphics, yet they produce different fingerprints
- so, how does that work?
This is where the genius of this method comes in.
When you manufacture something you're going to get some level of variability or tolerance
in the product.
Just like you'll never find, I dunno, two fries that're exactly the same, even though
they're made by the same process, you won't find two GPUs that are identical in their
performance.
During manufacturing there are bound to be defects within a wafer of chip dies.
And even within the good dies there will be some variability in quality.
For example, you might have heard of the silicon lottery when buying a CPU or graphics card.
This simply refers to the fact that whilst the product you're buying will at least perform
to the specsheet, you might be lucky and get one of the higher quality chips that just
so happens to perform better - this is why overclocking isn't always so straightforward,
as two chips of the same model might achieve different stable overclocks.
So this variability in performance, small though it may be, is what GPU fingerprinting
takes advantage of.
They call this technique "Drawn apart" - the method takes 176 different measurements to
construct the fingerprint trace which is then fed into a deep learning network to identify
the specific GPU that generated it.
The measurement which takes 8 seconds, allows a website to track a computer across different
browsing sessions.
And this doesn't just work with computers, but also mobile phones are susceptible.
Now, the accuracy of GPU fingerprinting ain't perfect.
With some devices the researchers achieved a very high accuracy, but this decreases if
the fingerprinting takes place offscreen, as in if the browser tab is in the background.
Other devices like mobile phones achieve a much lower accuracy - and to be honest, some
of these figures might look a little underwhelming, however, GPU fingerprinting isn't really meant
to be used by itself, but rather it'll work best when combined with other fingerprinting
techniques.
Of which there are a lot, everything from screen resolution, installed fonts, whether
you use adblock and so on, are dimensions which can be used to uniquely identify your
computer.
GPU fingerprinting is yet another tool in the toolkit.
In fact, GPU fingerprinting isn't new per se.
If you head over to "am I unique.org" you can view a bunch of variables that can be
used to track you - which I'm blurring out for obvious reasons!
But you'll see a section for WebGL, with a suspicious looking triangle.
In this case the website renders this triangle in your browser and then takes a hash of it,
this exposes small variations in things like compression, colour profiles, rendering techniques
and so on to create a fingerprint.
But it's definitely not on the same technical level as the new "Drawn Apart" Method.
So, the obvious question, how do you stop websites from using WebGL to sneakily fingerprint
you?
Well it's rather straightforward, WebGL can be easily disabled in pretty much all browsers
- however do that, and some things like browser games will stop working, if you can bear to
live without them.
Though is there even much point?
For so long as you keep javascript is enabled, you will be signalling a plethora of other
variables which can themselves be used to fingerprint you all the same.
So going out of your way to disable WebGL seems a bit pointless, but maybe I'm just
a little defeatist.
You could throw off GPU fingerprinting by fiddling with your graphics card's voltage
slightly every time you turn on your PC, but idk, I feel more inclined to accept defeat
on this one.
Staying secure online should be number 1, but convenience is important to.
That's why I've teamed up with RoboForm who are sponsoring this video.
RoboForm's password manager keeps your passwords synced across all your devices ready for when
you need them - it even works on linux!
And only you hold the decryption key, so your plaintext passwords never touch roboform's
servers.
I've personally been using RoboForm every day for the past 6 months, because I think
they strike the right balance between security and convenience.
Use the link in the description now to get RoboForm for only a little over a dollar per
month, and get 30% off, only when you use the link below.
And if you decide it isn't for you, they have a 30 day no questions asked refund policy.
But anyways, thanks for watching, you know what to do, tickle that notification bell
and follow me on the instagrams for behind the scenes content.
And I'll see you in the next video, have a good one.