Mozilla Automation TeamTom Ritter3 min readintermediate
webaudio fingerprinting on alibaba
Summary
Firefox made WebAudio output deterministic in v118, collapsing most variance to three CPU‑dependent buckets (x86 without FMA, x86/x64 with FMA, ARM NEON). Telemetry shows 99.24% of users fall into these buckets; a long tail of 23 distinct values affects <0.1% of users. Ongoing bugs aim to merge the remaining buckets. Alibaba’s fingerprint script was extracted (two SHA‑256 hashes) and shown to be…
- WebAudio fingerprinting yields only coarse CPU‑class signals; it does not uniquely identify users.
- Firefox’s Fingerprinting Protection (v118) normalizes the audio processing path, reducing variance dramatically.
- Remaining variance is tied to low‑level CPU instruction set differences (FMA vs. no‑FMA, NEON).
- Telemetry can surface unexpected outliers (23 values from 48 users) likely caused by hardware quirks.
Demonstrates that a well‑engineered mitigation can render a known fingerprinting vector practically useless, and shows how telemetry can guide incremental hardening of privacy defenses.
6/10
