How Math.tanh Leaks Your OS to Anti-Bot Systems Since Chrome 148
Since Chronium 148, Math.tanh is now fingerprintable to link underlying OS
Since Chrome 148, the Math.tanh function exposes your operating system through tiny calculation differences caused by distinct math libraries on Linux, macOS, and Windows. Anti-bot systems now use these unique bit patterns to detect fake browsers. I explain why simply reimplementing math fails due to library variations and architecture differences, and how we must replicate the exact algorithms to match genuine browser behavior.
Claim macOS, return Linux math bits, and you have contradicted your own User-Agent.
- Aurornis
> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent.
They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't trying to infer your operating system, they only care about semi-unique things that show up.
It's an interesting finding. I wish they had taken some time to have a real person write it up. This is too heavily LLM written to ignore.
- jeroenhd
Kind of a smart move by this company: write up an AI analysis of all fingerprinting techniques in hopes they get fixed after outrage so their scraping company can make more money. If it weren't for companies like this, fingerprinting wouldn't be so ubiquitous and the internet would be a better place in general.
I prefer articles like this coming from the other side of the battle (fingerprint.js and friends) because at least their motives are clear.
- sjrd
I guess that's one more good reason to push for correctly rounded transcendental functions. I recently learned that they're basically solved now. [1]
[1] https://arith2026.org/program.html (2nd keynote)
- Retr0id
Thanks for the writeup, claude
- luciana1u
Math.tanh as a fingerprinting vector. at this rate the next browser privacy paper will reveal that the number of milliseconds your CPU takes to render an emoji is also uniquely identifying.
- coppsilgold
Even Tor Browser (/mullvad-browser) gave up trying to obscure the operating system though arguably they shouldn't have. There appear to be too many fingerprinting vectors.
- omoikane
I hope this eventually ends up in https://coveryourtracks.eff.org/ so I can see how unique my math functions are relative to a larger population.
- torginus
What I don't get is that Chrome is hundreds of megabytes of just executable code, I assumed they statically linked half the userland. Also, I though tanh isn't a function, but an intrinsic emitted by the JS JIt that uses CPU instructions - which might be fingerprintable as well, but it's weird that for a math operation, you need to branch to a 'dlsym()' function.