valve1's comments

valve1 | 4 years ago | on: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

Thanks for testing it on Windows. We mostly tested it on MacOS Big Sur because all devs on the team have that OS. With Windows different timings might be needed, we'll check into it tomorrow.

valve1 | 4 years ago | on: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

yeah, chrome/chromium on linux not tested at all, mostly because nobody on the team is using linux. We tested it on MacOS Big Sur and a bit of Windows. Full table of what was tested here: https://github.com/fingerprintjs/external-protocol-flooding#... dathinab

valve1 | 4 years ago | on: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

Thanks for testing it on Linux. We only tested it on these browser + OS combinations: https://github.com/fingerprintjs/external-protocol-flooding#...

valve1 | 4 years ago | on: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

On Tor we show a fake captcha on the demo, which allows to collect multiple key presses and use each as a user-provided trigger.

valve1 | 4 years ago | on: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

Thanks for testing this on Opera, we only tested on these browser/OS combinations: https://github.com/fingerprintjs/external-protocol-flooding#...

valve1 | 4 years ago | on: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

Windows can sometimes say you have Skype, because it comes bundled even if you didn't install it yourself.

valve1 | 4 years ago | on: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

Yeah, we tested it on MacOS Big Sur mostly. Nobody on the team had linux so we didn't really test there. It can be made to work with better timings for the measurements etc.

valve1 | 4 years ago | on: Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and Tor

Browsers open pop-ups to ask "Can I run that application?" but only if that application is installed. If that application is not installed, the browser will ignore the custom URL.