2

I was wondering if a website I am visiting can detect whether or not the computer that is being used is being operated remotely.

For example...

I have two desktops. I use Desktop 1 to remotely operate Desktop 2 through windows' Remote Desktop Connection. Through this connection, I visit a website on Desktop 2. Would it be possible for the website to detect the fact that Desktop 2 is being remotely operated? (Not detect Desktop 1, but just detect remote operation in general).

  • No, they cannot. – ThoriumBR Dec 4 at 21:47
  • Theoretically if they have access to your home isp then they could see the inbound/outbound connections to that computer. – Mohammad Ali Dec 6 at 1:31
6

There is no API or simple test a website can perform to know if there is a remote desktop involved. So they easy answer is no.

But I would guess that your mouse movement and maybe also your typing is slightly different when using a remote desktop, due to lag. In the same way that Google reCAPTCHA uses mouse movement and typing data to differentiate humans from bots, it is concievable that you could spot a remote desktop user. But it would require training some sort of AI, and a lot of work, for no clear benefit.

So is it possible? In theory, maybe. Does it happend in practice? No.

1

TL;DR: Should be possible.

It was possible to detect Windows Remote Session in the past by using media queries to look for the bit depth of the display (which is switched to an odd value by rdp by default, therefore was easy to detect). Just look for "javascript detect windows remote desktop" on google, and select the StackOverflow answer.

If the method mentioned in that article no longer works (I do not have time to verify), there certainly has other workarounds.

The browsers get more and more integrated with the devices/OS therefore you will get more side channels.

For example it was possible about a year ago to identify every specific iPhone 7 by accessing their gyro calibration values and using that as a fingerprint, doing this by simply opening a website in Safari and using JavaScript.

  • It's worth noting that this method isn't going to be 100%, and is likely to produce a lot of false positives. – Steve Sether yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.