6

I came across interesting piece of javascript across few sites. It's executing Javascript math functions such as abs, acos, random etc. thousands of times - or four thousand times in my case, though iteration count seem to be changing or random.

The sites in question are reputable sites. The code is collecting duration of how long it took to execute these functions and sending data to server and not to third party.

What kind of information can be gleaned from executing mathematical functions? Based on other functions in the file they are trying to gather information about the execution environment - that is browser, but I could not figure out what information can be gathered by executing mathematical functions and calculating duration to execute these functions.

Would virtual machines be slower to handle these functions than normal desktop?

  • 1
    maybe fingerprinting the user by JS JIT + CPU performance? – Z.T. May 15 at 18:16
  • Or maybe just trying to determine the speed of user's devices in general. Doesn't need to be for fingerprinting necessarily. – AndrolGenhald May 15 at 18:46
  • 1
    Math fingerprinting can be done for the purpose of detecting the operating system type and version, since the high-precision math library differs between them. – forest May 15 at 23:15
  • @forest, but they are not even checking the results. They just make the call and completely ignore the results – user871199 May 16 at 2:54
  • @user871199 Then it seems like it's just a benchmark. – forest May 16 at 2:59
2

Well, they are indeed benchmarking the user agent.

The time it takes to perform math functions, which only require CPU horse power, is a metric of CPU performance. The more performant the CPU, the higher the metric (or less the time to complete the cycle).

It is a benchmark. Now the question is: how can the benchmark be used in security/privacy scope?

  • Fingerprinting? Maybe.

I have repeatedly looked at amiunique.org and they, being an open source project, describe detailfully what's under the hoods. Truth is that Canvas fingerprinting is a technique that measures the performance of the system to render a canvas to add to the browser's fingerprint. It is possible that the site is using the performance metric to add it to the server-side fingerprinting routine. Who knows without auditing the server. It is interesting to note that Mozilla prompts (or was planning to, anyway it works on Tor browser) for canvas image, so math functions could be used as a workaround to canvas

  • Visitor statistics? Very likely

The reputable site may just want to collect info about the CPUs of their visitors. This could be especially true if they want to understand the impact of a front end change or perform browser testing on limited performance machines. Normally web developers have powerful machines with huge amounts of RAM and big screens. They can easily test on multiple browsers, resolution and connection speeds. But what about capping the CPU? Does the site continue to display well? With such metric, they could draw graphs and find test cases

  • Targeted profiling? Who knows...

I am getting creative here, don't get me too serious. An advertising company could use such information to understand how powerful is your hardware. Then you can get advertising for the most recent 3D hyper performance game that may run on your machine, or some old classic if they find your CPU is not powerful enough.

Please, don't take the last seriously. I was going to joke on that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.