#69 Can we replace random WebGL values with real-world strings?
Opened 2 years ago by polcak. Modified 10 days ago

Some Web GL properties are modified to random values, like renderer, vendor, etc.

If we had a database of real-world values, it would make sense to provide these data. But be aware of possible inconsistencies.

See https://github.com/polcak/jsrestrictor/issues/166 for some additional discussion.


I will try to collect such values to create such a database.
Please assign me.

Probably there will be some maintenance issues. Web scraping might be an option here, but unsure if you want it for long term mainenance, since it can be sensitive to website changes. Nevertheless, I will create web scraping script so you can evaluate later.

Metadata Update from @polcak:
- Issue assigned to tomeryav

12 days ago

Hello Tomer,

Thanks for the commitment. I suggest that you collect and think about related ideas and before you start implementing give us a short presentation or provide us with a report on your plans so that we can give you timely feedback.

I fail to see how web scraping can help with the maintenance. The issue here is that we need to provide fake but believable values. The issues that need to be tackled include:

  • We need a database of graphic cards on the marker and values reported by WebGL. These cards appear on the market continuously so we need to continuously update the database. We definitely do not have money and time to purchase the cards and try them in the wild. So how do we keep the database up to date?
  • A connected issue is if the reported values are affected by browser or operating system vendor or by some other parameters.
  • Some combination of cards and other parameters like HW architecture can be non-sense. For example, one would not install a PCI Express graphic card to an ARM computer without PCI Express slot. How should JShelter behave on phones, ARM computers and other specialized HW?
  • What to do in situations where JShelter reports a middle or low range graphic card for a user with high-end graphic card. We cannot reliably spoof the effects of the card. Do we mind that a fingerprinter can learn that something is fishy or not?
  • Besides WebGl, what other APIs need to be kept in sync and how?

I suggest that you collect and think about related ideas and before you start implementing give us a short presentation or provide us with a report on your plans so that we can give you timely feedback.

Thank you that sounds good. I will do so.

I fail to see how web scraping can help with the maintenance. [...] We need a database of graphic cards on the marker and values reported by WebGL.

At this point of my research, I didn't find such a database. Further, I found many posts in forums where people are looking for tools/ ways to spoof their WebGL properly (without creating invalid values) which increases my gut feeling that there is not such database out there. Still, I will look for it.
If such database doesn't exist we have to create our own database and maintaine it. Therefor, we have to read the data from some source, probably website --> web scraping. But that are my early stage thoughts. I might be wrong here.

Thank you for all the question. I will tackle them. And thanks again for the fast reply!

Therefor, we have to read the data from some source, probably website --> web scraping.

I think that there must be some information hidden in the communication. I understand that you are early in your project but still, how exactly can web scrapping help you? What kind of websites do you want to scrap and what information do you think that you will learn from that scrapping?

Say you visit a page like https://polcak.github.io/jsrestrictor/test/test.html with a browser without any mitigation to WebGL. You would learn the identification of the card that is installed in the PC performing the scrapping. No matter how many times you visit that page, you would still learn the same information. There are similar pages like https://browserleaks.com/webgl. Depending on what exactly those pages show, the information displayed is the same or highly similar to what you knew from the first page.

What is more, you actually do not need to scrape any website. You can just execute a code like:

var canvas = document.createElement("canvas");
var gl = canvas.getContext("webgl", { preserveDrawingBuffer: true});
gl.getExtension('WEBGL_debug_renderer_info');
    var uvendor = gl.getParameter(0x9245);
    var urenderer = gl.getParameter(0x9246);
    var vendor = gl.getParameter(0x1F00);
    var renderer = gl.getParameter(0x1F01);
console.log(uvendor, urenderer, vendor, renderer)

and you know what exactly your browser reports. The hard part is in learning what other browsers would report and what information is consistent and what is not.

Login to comment on this ticket.

Metadata