三年前的文章「How the Web Audio API is used for audio fingerprinting」講解了 AudioContext 是怎麼被拿來 fingerprint 的，最近在「How We Bypassed Safari 17's Advanced Audio Fingerprinting Protection」這篇看到的。
AudioContext 可以完全跟錄音設備無關，單純計算，然後因為不同瀏覽器實作上面有差異，就被拿來當作 fingerprint 了。
文章裡介紹的方法是透過 Oscillator 產生 440Hz 的正弦波，然後過 Compressor 降低音量 (運算)：
The Web Audio API provides a DynamicsCompressorNode, which lowers the volume of the loudest parts of the signal and helps prevent distortion or clipping.
降低音量的運算再這塊各家的實作不同，就能夠區分不同的瀏覽器 (甚至是版本)：
Historically, all major browser engines (Blink, WebKit, and Gecko) based their Web Audio API implementations on code originally developed by Google in 2011 and 2012 for the WebKit project.
Since then browser developers have made a lot of small changes. These changes, compounded by the large number of mathematical operations involved, lead to fingerprinting differences. Audio signal processing uses floating point arithmetic, which also contributes to discrepancies in calculations.
Additionally, browsers use different implementations for different CPU architectures and OSes to leverage features like SIMD. For example, Chrome uses a separate fast Fourier transform implementation on macOS (producing a different oscillator signal) and other vector operation implementations on different CPU architectures (used in the DynamicsCompressor implementation). These platform-specific changes also contribute to differences in the final audio fingerprint.
而這東西平常也不會用到，所以對 Tor Browser 這種特別重視 privacy 的瀏覽器就直接關掉他了：
Tor
In the case of the Tor browser, everything is simple. But unfortunately, web Audio API is disabled there, so audio fingerprinting is impossible.