Users of the Mypal browser, developing a fork of Pale Moon for Windows XP, created after support for this platform was discontinued.

A group of researchers from Mozilla, Iowa State University, and the University of California released have studied the application of code for the hidden identification of users on websites. Hidden identification refers to the generation of identifiers based on indirect data about browser operations, such as screen resolution, a list of supported MIME types, specific parameters in headers (HTTP/2 and HTTPS), analysis of installed plugins and fonts, availability of certain Web APIs specific to graphics cards Features rendering using WebGL and Canvas, Manipulations CSS, taking into account default values, scanning network ports, analyzing the features of working with mouse and keyboard.

A study of the 100,000 most popular sites according to the Alexa ranking showed that 9,040 of them (10.18%) use code for the hidden identification of visitors. Notably, when considering the top 1,000 most popular sites, such code was found in 30.60% of cases (266 sites), while among sites ranked from one thousand to ten thousand, it was found in 24.45% of cases (2,010 sites). Hidden identification is mainly applied in scripts provided by external services for fraud detection and bot filtering, as well as advertising networks and user tracking systems.

To detect the code implementing hidden identification, a toolkit was developed FP-Inspector, the code of which introduced is licensed under the MIT License. The toolkit utilizes machine learning methods in combination with static and dynamic analysis of JavaScript code. It is claimed that the application of machine learning significantly increased the accuracy of detecting code for hidden identification, identifying 26% more problematic scripts
compared to the manually set heuristics.

Many of the identified identification scripts were absent from common blocklists Disconnect, Adsafe, DuckDuckGo, Justuno and EasyPrivacy.
After sending notifications the developers of the EasyPrivacy blocklist created created a separate section for hidden identification scripts. Furthermore, FP-Inspector allowed identifying some new methods of using Web APIs for identification that were previously unencountered in practice.

For example, the use of getLayoutMap for identifying keyboard layout information, residual data in caches (using the Performance API to analyze delays in data delivery, which helps determine whether the user has accessed a particular domain, and whether a page was opened previously), granted permissions in the browser (information about access to Notification, Geolocation, and Camera APIs), presence of specialized peripheral devices and rare sensors (gamepads, virtual reality headsets, proximity sensors) was identified. Additionally, it was noted that identification of specialized browser APIs and differences in API behavior (AudioWorklet, setTimeout, mozRTCSessionDescription) was taken into account, as well as the use of AudioContext API to determine sound system features.

The study also examined the issue of disruption to the normal functionality of websites when employing methods to protect against hidden identification, leading to blocking of network requests or restricting access to APIs. It was shown that selectively limiting APIs only for scripts identified by FP-Inspector causes fewer disruptions in operation than when using stricter overall API call restrictions in Brave and Tor Browser, which could potentially lead to data leakage.

Source: opennet.ru