A team of researchers from French, Israeli and Australian universities investigated the possibility of using GPUs to create unique fingerprints and use them to permanently track users online.
See also: NVIDIA GeForce RTX 3050 features GA106-150 GPU
The results of their experiment, which included 2,550 devices with 1,605 distinct CPU configurations, show that their technique, called “DrawnApart,” can increase the median tracking duration by 67% compared to current methods.
This is a serious problem for user privacy, which is currently protected by laws that focus on obtaining consent to enable cookies on websites.
These laws have led websites to collect other potential fingerprinting information, such as hardware configuration, operating system, time zones, screen resolution, language, fonts, etc.
This unethical approach is still limited because these elements change frequently, and even when they are stable, they can only put users into a rough categorization rather than creating a unique fingerprint.
The researchers examined the possibility of creating distinctive GPU (graphics processing unit)-based fingerprints of monitored systems with the help of WebGL (Web Graphics Library).
WebGL is a cross-platform API for rendering 3D graphics in the browser and is present in all modern web browsers.
See also: 3D printing: Can it fool devices that open with fingerprints?
Using this library, the DrawnApart monitoring system can measure the number and speed of a GPU's execution units, handle stall operations, and more.
DrawnApart uses short GLSL programs that are executed by the target GPU as part of the vertex shader to overcome the challenge of having random execution units handling the calculations. Therefore, the workload distribution is predictable and standardized.
The team developed both an on- screen that performs a small number of computationally intensive operations and an off-screen method that puts the GPU through a larger, less intensive test.
This process creates traces consisting of 176 measurements taken from 16 points used to create a fingerprint. Even when visually evaluating individual raw traces, one can observe differences and distinct timing variations between devices.
The researchers also tried swapping out other hardware components on the machines to see if the traces would remain discernible, and found that the fingerprints depended solely on the GPU.
See also: Affinity GPU: Apple M1 Max beats AMD Radeon Pro W6900X
Even though a set of integrated circuits is created using the same manufacturing process, has the same nominal computing power, number of processing units, and the same cores and architecture, each circuit is slightly different due to normal manufacturing variability.
These differences are inconspicuous in normal daily operations, but can become useful within the context of a sophisticated monitoring system like DrawnApart, which is specifically designed to trigger functional aspects that highlight them.
