r/brave_browser • u/raykela • 10m ago
Farbling is detectable from the page side, with no stored state
I maintain glasshuman.org, a non-commercial page that shows people what a site can read from their device, and while working on it,qq I spent a while measuring what Brave actually does. One result seems worth sharing here.
Farbling is designed to be hard for a site to detect, and against the usual approach it is: the noise is seeded per session and per eTLD+1, so a fingerprint looks stable within a visit and a site that just compares two page loads sees nothing. But it can be caught on a first visit without storing anything, because some readings have a correct answer. Fill a canvas with one flat colour and read it back through getImageData, and every pixel must be exactly that colour. Render a constant signal through an OfflineAudioContext, and every sample must be exactly the value you set. Any deviation is added noise. One detail matters: silence is useless for the audio check, since the fudge factor is multiplicative and leaves zero at zero, so it has to be a constant offset.
So a site that wants to know whether you are farbling can find out, which is worth knowing if you assume the protection is invisible. The flip side is that it also lets a site be honest about it, which is what I changed mine to do: when it finds canvas or audio readings being altered, it names them and says the browser is doing its job, instead of handing you a fresh identifier and calling you unique.
Two smaller things from the same measurements, in case they save anyone a wrong conclusion. A raw count of readable values is not a privacy score; Brave exposes more interfaces than Firefox simply by being Chromium-based, so it lands higher on such a count without protecting you any worse. And the battery readings are worth ignoring entirely: level 1, charging true, chargingTime 0, dischargingTime Infinity is what the W3C spec prescribes for "no battery or cannot report", and section 3 explicitly permits a browser to expose fake values there, so no site can tell a real reading from a stand-in.
Happy to be told where I have got Brave wrong.

