Researchers demonstrate GPU tracking method that could impact online privacy

Mass surveillance systems are generally frowned upon in our society, but when it comes to combining these systems with the Internet itself, the lines can be somewhat blurred and the morality is questionable at best. While browsing the Internet, users may agree to be tracked by cookies or browser user-agents. Nevertheless, there are indirect techniques involving network IP tracking, captcha systems or mouse movement detection in order to prevent bot network attacks. Website owners are usually required to obtain consent from users for such techniques, which are then used to improve advertisement targeting. The problem arises when malicious third parties can get involved in the tracking process and essentially engage in stealthy surveillance activities. Scientists have recently pointed out that GPUs can also be used to track users and this could lead to privacy issues in the future.

A new paper demonstrates how GPUs come with their own unique “fingerprints.” 2500 devices have been tested in large-scale experiments and show that GPUs increase identification speeds by up to 67% compared to other known methods. The tracking is facilitated through the WebGL 2.0 API that needs around 8 seconds to fingerprint a GPU, as it performs specific calculations forced by vectors. However, newer API versions could further cut down identification times to 150 ms and boost accuracy to 98%. WebGL 2.0 is supposed to be replaced with a new API called WebGPU, yet this is not entirely supported on current browsers. Unfortunately, many popular sites including Google Maps and IKEA still use WebGL 2.0.

Researchers also reveal that the GPU identification is not hindered by the changes effected on a system, so swapping storage devices or CPUs would not prevent the tracking process. The good news is that not too many sites rely on WebGL at the moment (only 1% of the top 10K ranked by Alexa). Furthermore, browser developers could disable the feature by default, or they can alternatively allow parallel execution techniques. WebGL developer Khronos is also looking to limit this type of exploit by updating the code.

Buy the AMD Radeon PRO W5500 8GB on Amazon