Researchers discover how to identify you with your GPU, to put ads on you

An international team of researchers from France, Israel and Australia has developed a new technique that can identify users with the signature left by the unique and specific graphics card. Called DrawnApart, the research serves as a warning about more invasive identification measures that websites or hackers have to collect data about users’ online activities in real time.

The technique relies on inherent hardware variations due to variability in manufacturing processes and components. Just as one human fingerprint is not identical to another, no CPU, GPU, or any other consumer item is identical to one another. This is part of the reason why CPU and GPU overclocking varies even within the same product model. This, in turn, means that there are small individual variations in the performance, power, and processing capabilities of each graphics card, making this type of identification possible.

The fingerprinting technique for GPUs presented in the image above shows two identical GPUs, producing different individual results. This, in turn, can be attributed to the online activity of a single user.

The model created by the researchers uses fixed workloads based on WebGL (web graphics library), the cross-platform API that enables graphics cards to render graphics in the browser. With this, DrawnApart takes more than 176 measurements at 16 data collection points by executing operations related to GLSL (OpenGL Shading Language), which prevents workloads from being distributed among random units of work, thus makes the results repeatable and as such individual for each GPU.

They can identify your GPU in just 150 milliseconds

The document further details that the current implementation can successfully identify a GPU in just eight seconds, but warns that next-generation APIs allow for even faster and more accurate identification. WebGPU, for example, will have support for compute shading operations to be executed through the browser. Researchers tested the new shader operations system and found that it not only dramatically increased accuracy to 98%, but also reduced identification time from 8 seconds to just 150 milliseconds. This could potentially mean that by simply clicking on a website, consumers’ GPUs are identified, with all the attendant risks to personal privacy and cybersecurity.

As we already know the laws and protections around online tracking practices are mostly incompetent to protect users from these particular techniques.