Spoofing canvas and webgl

[greydingo]

Actually I just took 5 phones (mine and from some friends) which are totally different models (Huawei, Xiaomi, OnePlus, Samsung) and they all had EXATLY the same hash value on browserleaks and also here with picasso canvas:
https://antoinevastel.com/browser fingerprinting/2019/03/21/picasso-canvas-fingerprinting.html
Just try yourself, check with different phones (makes sure they are all android) you should get the same exact value.

I only have 2 android phones on hand, and got a different hash for each one on that site. Both samsung galaxies. Different models.

Just to add my experience.

 

[MarkWilson]

I push all my Puppeteer scripts though Multilogin if that helps.

Make sure you run puppeteer-extra (instead of puppeteer) with puppeteer-extra-plugin-stealth as well as the v5 beta of Multilogin and I've encountered zero tests that can detect this combo.

Thanks for the tip about multilogin. I have no doubt it does the job. I've read nothing but good things.

I am not really sure about that. Last time I tried puppeteer stealth I got very low scores (0.1-0.3) on recaptcha.
About Multilogin, I also read good things about it but tried it and got blocked by recaptcha.
@Sebastiann could you please run some tests on these links with your current config? I am really curious about results.
First check your recaptcha score here and here
Than browse this site and check if you get the detection page (make sure it is not https, as with https we saw it works).
Than try surfing some pages here and check if you face the detection page.

Double check all with a normal browser and compare the results!

 

[MarkWilson]

I only have 2 android phones on hand, and got a different hash for each one on that site. Both samsung galaxies. Different models.

Just to add my experience.

just re-checked with my xiaomi and with my friend's oneplus and I got same canvas from browserleaks, same signature and same everything (screenshots attached).
will check again with picasso soon too.
Did you check with same browser? It's very strange

EDIT: I was wrong about picasso canvas, on browserleaks it is the same but on that site it's different now on my side too. maybe I confused

 

[greydingo]

Have you considered running your bots on mac hardware? Considering there are so many macs out there with the exact same hardware, there's bound to be a lot of matching fingerprints.

It even recommends running on mac hardware on the multilogin site somewhere. Not gonna look up the link at the moment.

Ideally a software solution would be found. But it will be a pain always fighting the canvas fingerprinting scripts.

If these bots are for personal use, you could try renting a cloud mac mini. There are a few providers out there.

If it worked for you, that would be the easiest imo.

 

[MarkWilson]

Have you considered running your bots on mac hardware? Considering there are so many macs out there with the exact same hardware, there's bound to be a lot of matching fingerprints.

It even recommends running on mac hardware on the multilogin site somewhere. Not gonna look up the link at the moment.

Ideally a software solution would be found. But it will be a pain always fighting the canvas fingerprinting scripts.

If these bots are for personal use, you could try renting a cloud mac mini. There are a few providers out there.

If it worked for you, that would be the easiest imo.

It's not really only for personal use, I actually plan to build Social Media bots and scale them a lot. Already did it with spotify now it's instagram's turn.
I will consider it, but I think because of high budgets it is not a very easy to scale

 

[greydingo]

I hear ya.

While we're at it, and discussing puppeteer, I will disclose a method to detect puppeteer with 100% accuracy.

I have never told anyone about this. I've never seen it discussed anywhere, I discovered this on my own a while back.

I'm guessing anti-bot companies already know this trick.

I just uploaded a demo repo.

https://github.com/digitalhurricane-io/puppeteer-detection-100-percent

If your replace a function that puppeteer uses, such as document.querySelector, and throw an error inside of it, you can see the string "__puppeteer_evaluation_script__"

In order to get around this, you need to fork the library and change that string.

Edit: I also posted this in it's own thread under the scripting forum, as it's slightly off topic in this thread.

 

[MarkWilson]

I hear ya.

While we're at it, and discussing puppeteer, I will disclose a method to detect puppeteer with 100% accuracy.

I have never told anyone about this. I've never seen it discussed anywhere, I discovered this on my own a while back.

I'm guessing anti-bot companies already know this trick.

I just uploaded a demo repo.

https://github.com/digitalhurricane-io/puppeteer-detection-100-percent

If your replace a function that puppeteer uses, such as document.querySelector, and throw an error inside of it, you can see the string "__puppeteer_evaluation_script__"

In order to get around this, you need to fork the library and change that string.

Edit: I also posted this in it's own thread under the scripting forum, as it's slightly off topic in this thread.

Do you think a similar problem is present with playwright too? this is actually a very nice info

 

[greydingo]

I'm not familiar with playwright. Can you link me to it?

 

[sockpuppet]

In the meantime, I discovered that android devices use OpenGL ES as renderer. That means that if I am able to render through that engine, webgl and canvas should be the same as a mobile phone!
Please correct me if I'm saying bullshits, I just had a quick look at it late at night. What about using this thing https://github.com/google/angle in order to render canvas and webgl like real android devices?
I still have no clue on how to implement such thing in puppeteer/selenium, but if I understood correctly all the API calls will be translated from OpenGL ES to DirectX 11 which could result in a perfect emulation of webgl and canvas values.
What do you think about it?

No, the different canvas images comes from sligthly different implementations on GPUs. There is no way to emluate that.

 

[MarkWilson]

I'm not familiar with playwright. Can you link me to it?

Have a look here, same devs of puppeteer but working for microsoft this time. It's very similar to puppeteer

 

[greydingo]

It's likely it has the same problem. You'll have to try it.

I started a thread specifically about this here:
https://www.blackhatworld.com/seo/how-to-detect-puppeteer-with-100-accuracy.1235754/

If you check my sample repo on github, and you look at the file main.js, and look at the function "myBotCheck", you can see how to print out the name of the script.

And you could test it with playwright.

 

[Sebastiann]

Thanks for the tip about multilogin. I have no doubt it does the job. I've read nothing but good things.

It would be nice to find an alternative without such a hefty monthly fee though.

Are you using `puppeteer-extra` with `puppeteer-extra-stealth` ? The default build of `puppeteer` fails a ton of detection tests while the modded versions pass (even without Multilogin). I'd say for anything other than say Facebook's anti-fingerprinting, the extra-stealth plugin should be fine.

This is an older, cut down version of my base class for puppeteer browsers:

https://github.com/prescience-data/puppeter-browser

Check the "local-browser.js" for default Chrome with all the settings.

Here's the important part:

const options = {
                    headless: this.headless,
                    args: [
                        '--no-sandbox',
                        '--disable-setuid-sandbox',
                        '--user-agent=' + this.identity.userAgent,
                        '--lang=en-US,en;q=0.9'
                    ],
                    userDataDir: this.userDataDir,
                    defaultViewport: this.identity.viewport
                };

                puppeteer.use(StealthPlugin());

                const browser = await puppeteer.launch(options);

 

[greydingo]

Are you using `puppeteer-extra` with `puppeteer-extra-stealth` ? The default build of `puppeteer` fails a ton of detection tests while the modded versions pass (even without Multilogin). I'd say for anything other than say Facebook's anti-fingerprinting, the extra-stealth plugin should be fine.

Thanks for the tip.

I am aware of puppeteer stealth.

And I have used it.

But I can guarantee you it doesn't protect you against all detection.

I'm sure there are many detection techniques that most of us are unaware of.

( In fact I just posted an example above your post )

 

[Sebastiann]

I am not really sure about that. Last time I tried puppeteer stealth I got very low scores (0.1-0.3) on recaptcha.
About Multilogin, I also read good things about it but tried it and got blocked by recaptcha.
@Sebastiann could you please run some tests on these links with your current config? I am really curious about results.
First check your recaptcha score here and here

Here's the output from the recaptcha v3 (score 0.9):

I will do the rest in a bit, I'm now obsessed with @greydingo detection (which you can see above that it failed) so I'm going to work on that as a priority till it's fixed.

I started a thread specifically about this here:
https://www.blackhatworld.com/seo/how-to-detect-puppeteer-with-100-accuracy.1235754/

This is very very fcking cool - I love it! And now obsessed with fixing it haha.

 

[Sebastiann]

@Sebastiann could you please run some tests on these links with your current config? I am really curious about results.
First check your recaptcha score here and here
Than browse this site and check if you get the detection page (make sure it is not https, as with https we saw it works).
Than try surfing some pages here and check if you face the detection page.

Double check all with a normal browser and compare the results!

So the only one still failing is Datadome, but I stupidly spent the day building a captcha solver for it instead of thinking about about how it's detecting it in the first place. Tomorrow's job now

For the @greydingo test I couldn't be bothered maintaining a fork of the base puppeteer unless there's another reason to so I just wrote a (horribly hacky) shell script to just replace that string each time I update.

#!/bin/bash
cd ~/Dev/Puppeteer
sed -i -e 's/__puppeteer_evaluation_script__/__querySelector__/g' ./node_modules/puppeteer/lib/ExecutionContext.js
sed -i -e 's/__puppeteer_evaluation_script__/__querySelector__/g' ./node_modules/puppeteer/node6/lib/ExecutionContext.js

 

[DanDD]

use browser automation studio for that

 

[MarkWilson]

I am really impressed by the 0.9 score and the fact that multilogin seems able to pass distil. Problem is it costs 600$ per month or something like that, will have to find my own solution for it.
Also they seem focusing more on desktop fingerprints than android which I have to use
I think playwright has the same problem as puppeteer, __playwright_evaluation_script__ but didn't have time to test it with the script of greydingo yet.
Damn that dude vastel from datadome seems doing a good job.
@Sebastiann I also like your obsession for fixing detection, I have the same thing but with 1000x less skills and knowledge . You can imagine how frustrating it is

 

[Sebastiann]

I am really impressed by the 0.9 score and the fact that multilogin seems able to pass distil. Problem is it costs 600$ per month or something like that, will have to find my own solution for it.
Also they seem focusing more on desktop fingerprints than android which I have to use
I think playwright has the same problem as puppeteer, __playwright_evaluation_script__ but didn't have time to test it with the script of greydingo yet.
Damn that dude vastel from datadome seems doing a good job.
@Sebastiann I also like your obsession for fixing detection, I have the same thing but with 1000x less skills and knowledge . You can imagine how frustrating it is

That score was actually without Multilogin funnily enough, Multilogin was worse (0.7 after I changed a few things) on the recaptcha-v3 - perhaps because the cookies on the Multilogin profile have been tainted a little.
I was hitting consistent 0.9 just Chrome with -extra and -extra-stealth with those config params I posted earlier.
If Playwright has the issue it will probably be in here if they have followed a similar pattern: https://github.com/microsoft/playwright/search?q=execution&unscoped_q=execution

(PS re the cost - not that I want to shill for MLA (because I do think it's massively overpriced) - but the Automate-S plan us US$219 / month, not $600)

 

[DaPromo]

That score was actually without Multilogin funnily enough, Multilogin was worse (0.7 after I changed a few things) on the recaptcha-v3 - perhaps because the cookies on the Multilogin profile have been tainted a little.
I was hitting consistent 0.9 just Chrome with -extra and -extra-stealth with those config params I posted earlier.
If Playwright has the issue it will probably be in here if they have followed a similar pattern: https://github.com/microsoft/playwright/search?q=execution&unscoped_q=execution

(PS re the cost - not that I want to shill for MLA (because I do think it's massively overpriced) - but the Automate-S plan us US$219 / month, not $600)

Anything from 0.7 and above is considered "trusted".
Poor scores on reCaptchav3 is
0.3 - Likely a bot or poor fingerprinting/IP. You will have to solve page after page of captcha but you will most likely NOT get an error message.
0.1 - Confidently a bot, you will face page after page when solving recaptcha and most likely get an error message.

Likewise,

0.7 - Most likely human, you will only have to solve 1 page of captcha
0.9 - Very likely human, you will probably be verified instantaneously without having to solve captcha (Or only 1 box correct out of the challenge)

If you are checking your score, you might want to wait a few seconds and try checking your score again. Don't do this too often as that may lower you score but if your browser and cookies sets a captcha for the first time the valuation may be lower than the second time.

 

[CyHead]

Interesting, I checked my own real user score and it's 0.9 - so I guess that's the highest you can get.