Changeset 3765708

Timestamp:

10/26/2026 07:17:30 AM (26 hours ago)

Author:

spooflens

Message:

SpoofLens Fraud Check 0.2.1: updated collector, free key wording

Location:

spooflens-fraud-check

Files:

• tags/0.2.1 (copied) (copied from spooflens-fraud-check/trunk )
• tags/0.2.1/assets/sl.js (modified) (6 diffs)
• tags/0.2.1/includes/admin.php (modified) (1 diff)
• tags/0.2.1/readme.txt (modified) (4 diffs)
• tags/0.2.1/spooflens.php (modified) (2 diffs)
• trunk/assets/sl.js (modified) (6 diffs)
• trunk/includes/admin.php (modified) (1 diff)
• trunk/readme.txt (modified) (4 diffs)
• trunk/spooflens.php (modified) (2 diffs)

spooflens-fraud-check/tags/0.2.1/assets/sl.js

@@ -330 +330 @@
   }
 
+  // speech voices: the count, and which system the on-device voices come with (Microsoft ones with Windows,
+  // Apple ones with macOS and iOS); network voices (Google in desktop Chrome, "Online" in Edge) are left out.
+  // Only the counts leave the browser, not the names.
+  var APPLE_VOICES = /^(Samantha|Alex|Daniel|Karen|Moira|Tessa|Fiona|Fred|Victoria|Rishi|Veena|Thomas|Anna|Milena|Yuri|Amelie|Amélie|Kyoko|Ting-Ting)( |$)/;
+  function voiceSummary(list) {
+    var k = { win: 0, apple: 0, other: 0 }, names = [];
+    for (var i = 0; i < list.length; i++) {
+      var v = list[i];
+      if (!v || v.localService !== true) continue;
+      var n = String(v.name || ''), u = String(v.voiceURI || '');
+      names.push(n);
+      if (/^Microsoft /.test(n)) k.win++;
+      else if (/^com\.apple\./.test(u) || APPLE_VOICES.test(n)) k.apple++;
+      else k.other++;
+    }
+    // the names of the system's own voices, as one hash (0.18.0): the same in every browser of a device, and voices
+    // the owner downloaded tell two phones of one model apart; the names themselves are not sent
+    return { n: list.length, k: k, h: names.length ? hash(names.sort().join('|')) : '' };
+  }
   function voices() {
     if (!window.speechSynthesis) return Promise.resolve(null);
     var v = speechSynthesis.getVoices();
-    if (v && v.length) return Promise.resolve(v.length);
+    if (v && v.length) return Promise.resolve(voiceSummary(v));
     return timeout(new Promise(function (r) {
-      speechSynthesis.addEventListener('voiceschanged', function () { r(speechSynthesis.getVoices().length); }, { once: true });
-    }), 800, 0);
+      speechSynthesis.addEventListener('voiceschanged', function () { r(voiceSummary(speechSynthesis.getVoices())); }, { once: true });
+    }), 800, { n: 0, k: null });
+  }
+
+  // the JavaScript engine words its own TypeError: V8 (Chromium), SpiderMonkey (Firefox), JavaScriptCore (Safari, every iOS browser)
+  function jsEngine() {
+    try { var o = null; o.x = 1; } catch (e) {
+      var m = String((e && e.message) || '');
+      if (/Cannot set propert/.test(m)) return 'v8';
+      if (/can't access property|has no properties|is null/.test(m)) return 'gecko';
+      if (/is not an object/.test(m)) return 'jsc';
+      return 'other';
+    }
+    return '';
+  }
+
+  // globals and document properties that automation frameworks leave behind
+  function autoTraces() {
+    var out = [];
+    ['__playwright__binding__', '__pwInitScripts', '_phantom', 'callPhantom', '__nightmare', 'domAutomation', 'domAutomationController',
+     '_selenium', 'callSelenium', '_Selenium_IDE_Recorder', '__webdriver_evaluate', '__selenium_evaluate', '__webdriver_script_fn',
+     '__driver_evaluate', '__fxdriver_evaluate', '__lastWatirAlert'].forEach(function (k) {
+      try { if (k in window) out.push(k); } catch (e) {}
+    });
+    try {
+      Object.keys(document).forEach(function (k) {
+        if (/^\$?cdc_|^\$wdc_|^__(webdriver|selenium|fxdriver|driver)_/.test(k)) out.push('document.' + k);
+      });
+      ['webdriver', 'selenium', 'driver'].forEach(function (a) { if (document.documentElement.hasAttribute(a)) out.push('html[' + a + ']'); });
+    } catch (e) {}
+    return out.slice(0, 8);
   }
 
@@ -346 +394 @@
       return o;
     }), 1500, null);
+  }
+
+  /* ------------------------------------------------ device traits (0.18.0) --- */
+  // What comes from the machine and the system rather than from the browser engine, so that two browsers of one
+  // device can be told apart from two devices (Chrome and Firefox on one computer share almost no other trait).
+
+  // WebGL limits and shader precision without the names: the graphics card and its driver. p: the limits and
+  // precision; e: the extension list (it differs more between engines, kept apart).
+  function glParams() {
+    var o = { p: '', e: '' };
+    try {
+      var c = document.createElement('canvas');
+      var gl = c.getContext('webgl') || c.getContext('experimental-webgl');
+      if (!gl) return o;
+      var P = ['MAX_TEXTURE_SIZE', 'MAX_CUBE_MAP_TEXTURE_SIZE', 'MAX_RENDERBUFFER_SIZE', 'MAX_VERTEX_ATTRIBS', 'MAX_VERTEX_UNIFORM_VECTORS',
+        'MAX_FRAGMENT_UNIFORM_VECTORS', 'MAX_VARYING_VECTORS', 'MAX_COMBINED_TEXTURE_IMAGE_UNITS', 'MAX_TEXTURE_IMAGE_UNITS',
+        'MAX_VERTEX_TEXTURE_IMAGE_UNITS', 'MAX_VIEWPORT_DIMS', 'ALIASED_LINE_WIDTH_RANGE', 'ALIASED_POINT_SIZE_RANGE', 'SUBPIXEL_BITS'];
+      var out = P.map(function (k) { var v = gl.getParameter(gl[k]); return v && typeof v === 'object' && v.length !== undefined ? Array.prototype.join.call(v, 'x') : String(v); });
+      ['VERTEX_SHADER', 'FRAGMENT_SHADER'].forEach(function (sh) {
+        ['LOW_FLOAT', 'MEDIUM_FLOAT', 'HIGH_FLOAT', 'LOW_INT', 'MEDIUM_INT', 'HIGH_INT'].forEach(function (pr) {
+          var x = gl.getShaderPrecisionFormat(gl[sh], gl[pr]);
+          out.push(x ? x.rangeMin + '/' + x.rangeMax + '/' + x.precision : '-');
+        });
+      });
+      o.p = hash(out.join('|'));
+      o.e = hash((gl.getSupportedExtensions() || []).slice().sort().join(','));
+      var lose = gl.getExtension('WEBGL_lose_context');
+      if (lose) lose.loseContext();
+    } catch (e) {}
+    return o;
+  }
+
+  // Scene 2.0: five small drawings, each leaning on another part of the graphics card (float maths, derivatives,
+  // blending, texture filtering, trigonometry at its edges). Browsers of one computer go through one driver, so
+  // our first scene already matched across engines; five give more to tell devices apart. Drawn twice: an
+  // unmodified browser gives the same pixels (noise = something rewrote them).
+  function scene2() {
+    var o = { h: '', parts: [], noise: false };
+    try {
+      var c = document.createElement('canvas'); c.width = 32; c.height = 32;
+      var opt = { antialias: false, preserveDrawingBuffer: true };
+      var gl = c.getContext('webgl', opt) || c.getContext('experimental-webgl', opt);
+      if (!gl) return o;
+      var hp = gl.getShaderPrecisionFormat && gl.getShaderPrecisionFormat(gl.FRAGMENT_SHADER, gl.HIGH_FLOAT);
+      var prec = 'precision ' + (hp && hp.precision > 0 ? 'highp' : 'mediump') + ' float;varying vec2 v;';
+      var der = gl.getExtension('OES_standard_derivatives');
+      var vs = 'attribute vec2 a;varying vec2 v;void main(){v=a*0.5+0.5;gl_Position=vec4(a,0.0,1.0);}';
+      var frags = [
+        prec + 'void main(){float x=v.x*1000.0+v.y*7.3;gl_FragColor=vec4(fract(sin(x)*1e4),fract(exp(v.y*9.0)),fract(pow(v.x+1.0,13.7)),1.0);}',
+        der ? '#extension GL_OES_standard_derivatives : enable\n' + prec + 'void main(){float f=sin(v.x*50.0)*cos(v.y*31.0);gl_FragColor=vec4(fwidth(f)*8.0,abs(dFdx(f))*20.0,abs(dFdy(f))*20.0,1.0);}' : '',
+        prec + 'uniform float k;void main(){gl_FragColor=vec4(v.x,v.y*k,1.0-v.x*k,0.37);}',
+        prec + 'uniform sampler2D t;void main(){gl_FragColor=texture2D(t,v*0.73+0.11);}',
+        prec + 'void main(){float a=atan(v.y*2.0-1.0,v.x*2.0-1.0);gl_FragColor=vec4(fract(a*7.0),fract(acos(v.x*1.999-0.9995)*5.0),fract(tan(v.y*1.5)),1.0);}'
+      ];
+      var sh = function (type, src) { var x = gl.createShader(type); gl.shaderSource(x, src); gl.compileShader(x); return x; };
+      var buf = gl.createBuffer();
+      gl.bindBuffer(gl.ARRAY_BUFFER, buf);
+      gl.bufferData(gl.ARRAY_BUFFER, new Float32Array([-1, -1, 1, -1, -1, 1, -1, 1, 1, -1, 1, 1]), gl.STATIC_DRAW);
+      var tex = gl.createTexture();
+      gl.bindTexture(gl.TEXTURE_2D, tex);
+      var tp = new Uint8Array(64);
+      for (var i = 0; i < 64; i++) tp[i] = (i * 53 + 17) % 256;
+      gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, 4, 4, 0, gl.RGBA, gl.UNSIGNED_BYTE, tp);
+      gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MIN_FILTER, gl.LINEAR);
+      gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MAG_FILTER, gl.LINEAR);
+      gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_WRAP_S, gl.CLAMP_TO_EDGE);
+      gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_WRAP_T, gl.CLAMP_TO_EDGE);
+      gl.disable(gl.DITHER); gl.viewport(0, 0, 32, 32);
+      var px = new Uint8Array(32 * 32 * 4);
+      var progs = frags.map(function (src) {
+        if (!src) return null;
+        var p = gl.createProgram();
+        gl.attachShader(p, sh(gl.VERTEX_SHADER, vs)); gl.attachShader(p, sh(gl.FRAGMENT_SHADER, src)); gl.linkProgram(p);
+        return gl.getProgramParameter(p, gl.LINK_STATUS) ? p : null;
+      });
+      var pass = function () {
+        return progs.map(function (p, n) {
+          if (!p) return '-';
+          gl.useProgram(p);
+          var loc = gl.getAttribLocation(p, 'a');
+          gl.enableVertexAttribArray(loc); gl.vertexAttribPointer(loc, 2, gl.FLOAT, false, 0, 0);
+          gl.clearColor(0.1, 0.2, 0.3, 1.0); gl.clear(gl.COLOR_BUFFER_BIT);
+          if (n === 2) {
+            // three half-transparent layers on top of each other
+            gl.enable(gl.BLEND); gl.blendFunc(gl.SRC_ALPHA, gl.ONE_MINUS_SRC_ALPHA);
+            var k = gl.getUniformLocation(p, 'k');
+            [0.3, 0.6, 0.9].forEach(function (x) { gl.uniform1f(k, x); gl.drawArrays(gl.TRIANGLES, 0, 6); });
+            gl.disable(gl.BLEND);
+          } else {
+            if (n === 3) gl.uniform1i(gl.getUniformLocation(p, 't'), 0);
+            gl.drawArrays(gl.TRIANGLES, 0, 6);
+          }
+          gl.readPixels(0, 0, 32, 32, gl.RGBA, gl.UNSIGNED_BYTE, px);
+          var str = [];
+          for (var i2 = 0; i2 < px.length; i2 += 1024) str.push(String.fromCharCode.apply(null, px.subarray(i2, i2 + 1024)));
+          return hash(str.join('')).slice(0, 8);
+        });
+      };
+      var a = pass(), b = pass();
+      o.parts = a;
+      o.noise = a.join() !== b.join();
+      o.h = hash(a.join('|'));
+      var lose = gl.getExtension('WEBGL_lose_context');
+      if (lose) lose.loseContext();
+    } catch (e) {}
+    return o;
+  }
+
+  // The screen as the system lays it out: the size in device pixels, the strip the taskbar or dock takes, the
+  // menu bar at the top (macOS), the colour range of the display and HDR, and whether more than one display is on.
+  function screen2() {
+    var sc = window.screen || {}, dpr = window.devicePixelRatio || 1;
+    var on = function (q) { return mq(q) === true; };
+    return {
+      pw: Math.round((sc.width || 0) * dpr), ph: Math.round((sc.height || 0) * dpr),
+      tb: (sc.height || 0) - (sc.availHeight || 0), tw: (sc.width || 0) - (sc.availWidth || 0),
+      at: typeof sc.availTop === 'number' ? sc.availTop : null, al: typeof sc.availLeft === 'number' ? sc.availLeft : null,
+      gamut: on('(color-gamut: rec2020)') ? 'rec2020' : (on('(color-gamut: p3)') ? 'p3' : (on('(color-gamut: srgb)') ? 'srgb' : '')),
+      hdr: on('(dynamic-range: high)'), ext: sc.isExtended === true
+    };
+  }
+
+  // The sound hardware: the default sample rate, the output channels and the latency of the system's audio.
+  function audioHw() {
+    var AC = window.AudioContext || window.webkitAudioContext;
+    if (!AC) return Promise.resolve(null);
+    try {
+      var ac = new AC();
+      var o = { sr: ac.sampleRate || 0, ch: ac.destination ? ac.destination.maxChannelCount : null,
+        bl: typeof ac.baseLatency === 'number' ? Math.round(ac.baseLatency * 10000) / 10 : null };
+      try { ac.close(); } catch (e) {}
+      return Promise.resolve(o);
+    } catch (e) { return Promise.resolve(null); }
+  }
+
+  // Emoji clock: one emoji of each Unicode emoji version. The newest one the system draws in colour as a single
+  // glyph tells the version of its emoji font, which follows the version of the system: browsers and iOS 26+
+  // freeze the system version in the User-Agent, the emoji do not. m: the sizes of three emoji (the font itself).
+  var EMOJI = [['11', '\uD83E\uDD70'], ['12', '\uD83E\uDD71'], ['13', '\uD83E\uDD72'], ['13.1', '\u2764\uFE0F\u200D\uD83D\uDD25'], ['14', '\uD83E\uDEE0'],
+    ['15', '\uD83E\uDEE8'], ['15.1', '\uD83D\uDE42\u200D\u2194\uFE0F'], ['16', '\uD83E\uDEE9']];
+  function emojiClock() {
+    var o = { v: '', ok: '', m: '' };
+    try {
+      var c = document.createElement('canvas'); c.width = 64; c.height = 40;
+      var x = c.getContext('2d');
+      x.font = '28px sans-serif'; x.textBaseline = 'top';
+      var one = x.measureText('\uD83D\uDE00').width;
+      var ok = [];
+      EMOJI.forEach(function (e) {
+        x.clearRect(0, 0, 64, 40);
+        x.fillText(e[1], 0, 2);
+        var d = x.getImageData(0, 0, 64, 40).data, col = 0;
+        for (var i = 0; i < d.length; i += 4) {
+          if (d[i + 3] > 128 && (Math.abs(d[i] - d[i + 1]) > 40 || Math.abs(d[i + 1] - d[i + 2]) > 40)) col++;
+        }
+        // in colour and as one glyph: a sequence the font does not know falls apart into two or more
+        if (col > 20 && x.measureText(e[1]).width < one * 1.5) ok.push(e[0]);
+      });
+      o.ok = ok.join(',');
+      o.v = ok.length ? ok[ok.length - 1] : '';
+      var m = x.measureText('\uD83D\uDE00\uD83E\uDEE0\uD83D\uDC4D\uD83C\uDFFD');
+      o.m = hash([one, m.width, m.actualBoundingBoxAscent, m.actualBoundingBoxDescent].map(function (n) { return Math.round((n || 0) * 10); }).join(','));
+    } catch (e) {}
+    return o;
+  }
+
+  // How much the browser lets a site keep, as a class only (0: under 1 GB ... 8: 1.6 TB and more). In Chromium
+  // it follows the size of the disk, which tells two phones of one model with different storage apart.
+  function storeTier() {
+    if (!navigator.storage || !navigator.storage.estimate) return Promise.resolve(null);
+    return timeout(navigator.storage.estimate().then(function (e) {
+      var gb = ((e && e.quota) || 0) / 1e9, edges = [1, 10, 50, 100, 200, 400, 800, 1600], t = 0;
+      while (t < edges.length && gb >= edges[t]) t++;
+      return { t: t };
+    }), 1000, null);
   }
 
@@ -410 +633 @@
    *    (the request itself fails, there is no certificate for that name), then /dns/<id> says who asked;
    *  - STUN: the public address WebRTC's UDP traffic comes from (srflx candidates).
+   *  - QUIC (0.19.0, on its own host): /a offers HTTP/3 in an Alt-Svc header and closes its TCP connection, three
+   *    /b requests show whether the browser moves to HTTP/3, /r returns what the server saw, signed.
    * The tokens are verified on spooflens.com; the browser only carries them.
    */
-  function edgeProbe(host, zone) {
+  function edgeProbe(host, zone, qhost) {
     // on spooflens.com the page names the edge (data-edge); sl.js on client sites passes it in
     host = host || document.documentElement.getAttribute('data-edge');
     zone = zone || document.documentElement.getAttribute('data-edge-zone');
+    qhost = qhost || document.documentElement.getAttribute('data-edge-quic');
     if (!host || !window.fetch) return Promise.resolve(null);
     var base = 'https://' + host, out = { tls: '', dns: '', stun: [] };
     var get = function (u) { return fetch(base + u, { cache: 'no-store', credentials: 'omit' }).then(function (r) { return r.json(); }); };
-    var tlsP = timeout(get('/fp').then(function (j) { out.tls = j.token || ''; }), 3000, null).catch(function () {});
+    // round trip as the page sees it (0.16.0): three pings on the connection /fp has just used, the fastest kept.
+    // The server compares it with the round trip the edge's kernel measured for that connection.
+    var tag = Math.random().toString(36).slice(2, 8);   // this run's own timing entries
+    var ping = function (n) {
+      var u = base + '/ping?n=' + tag + n, t0 = performance.now();
+      return fetch(u, { cache: 'no-store', credentials: 'omit' }).then(function (r) { return r.text(); }).then(function () {
+        var ms = performance.now() - t0;
+        // the network stack's own timing (the edge sends Timing-Allow-Origin), free of main-thread delays
+        try {
+          var e = performance.getEntriesByName(u).pop();
+          if (e && e.requestStart > 0 && e.responseStart >= e.requestStart) ms = e.responseStart - e.requestStart;
+        } catch (x) {}
+        return ms;
+      });
+    };
+    var pings = function () {
+      var ms = [];
+      var keep = function (v) { ms.push(v); };
+      return ping(1).then(keep).then(function () { return ping(2); }).then(keep).then(function () { return ping(3); }).then(keep)
+        .catch(function () {})
+        .then(function () { if (ms.length) out.rtt = Math.round(Math.min.apply(null, ms) * 10) / 10; });
+    };
+    // QUIC after the pings, so its traffic does not sit in their timing. nextHopProtocol of each request is the
+    // browser's own word (the QUIC host sends Timing-Allow-Origin); the server's account is in the token.
+    var quic = function () {
+      if (!qhost) return null;
+      var qb = 'https://' + qhost, qid = '', urls = [];
+      for (var k = 0; k < 16; k++) qid += '0123456789abcdef'[Math.floor(Math.random() * 16)];
+      var wait = function (ms) { return new Promise(function (r) { setTimeout(r, ms); }); };
+      var q = function (p) {
+        var u = qb + p + (p.indexOf('?') >= 0 ? '&' : '?') + 'id=' + qid;
+        if (p !== '/r') urls.push(u);
+        return fetch(u, { cache: 'no-store', credentials: 'omit' });
+      };
+      // the timing entry of a request is written after fetch() resolves, so the protocols are read at the end
+      var protocols = function () {
+        return urls.map(function (u) { try { var e = performance.getEntriesByName(u).pop(); return e ? e.nextHopProtocol || '' : ''; } catch (x) { return ''; } });
+      };
+      return timeout(q('/a').then(function () { return wait(50); })
+        .then(function () { return q('/b?n=1'); }).then(function () { return wait(300); })
+        .then(function () { return q('/b?n=2'); }).then(function () { return wait(200); })
+        .then(function () { return q('/b?n=3'); })
+        .then(function () { return q('/r'); }).then(function (r) { return r.json(); })
+        .then(function (j) { if (j && j.token) out.quic = { token: j.token, np: protocols() }; }), 4000, null).catch(function () {});
+    };
+    var tlsP = timeout(get('/fp').then(function (j) { out.tls = j.token || ''; }), 3000, null).catch(function () {})
+      .then(function () { return out.tls ? timeout(pings(), 2000, null) : null; }).catch(function () {})
+      .then(quic);
     var id = '';
     for (var i = 0; i < 16; i++) id += '0123456789abcdef'[Math.floor(Math.random() * 16)];
@@ -534 +807 @@
       media: {
         dark: mq('(prefers-color-scheme: dark)'), reduced: mq('(prefers-reduced-motion: reduce)'),
-        pointer: mq('(pointer: fine)') ? 'fine' : (mq('(pointer: coarse)') ? 'coarse' : 'none'), hover: mq('(hover: hover)')
+        pointer: mq('(pointer: fine)') ? 'fine' : (mq('(pointer: coarse)') ? 'coarse' : 'none'), hover: mq('(hover: hover)'),
+        // settings of the system (0.18.0): contrast, transparency, inverted and forced colours
+        contrast: mq('(prefers-contrast: more)') ? 'more' : (mq('(prefers-contrast: less)') ? 'less' : (mq('(prefers-contrast: custom)') ? 'custom' : 'no')),
+        transp: mq('(prefers-reduced-transparency: reduce)'), invert: mq('(inverted-colors: inverted)'), forced: mq('(forced-colors: active)')
       },
+      scr2: screen2(),
       gfx: { vendor: gl.vendor || '', renderer: gl.renderer || '', version: gl.version || '', glsl: gl.glsl || '',
-             maxTex: gl.maxTex || null, extCount: gl.extCount || 0, hash: gl.hash || '' },
+             maxTex: gl.maxTex || null, extCount: gl.extCount || 0, hash: gl.hash || '', params: glParams() },
       canvas: { h1: c1, h2: c2, noise: !!(c1 && c2 && c1 !== c2), flat: canvasFlat() },
       scene: webglScene(roads),
+      scene2: scene2(),
+      emoji: emojiClock(),
       fonts: fonts(),
-      auto: { webdriver: nav.webdriver === true, chromeObj: !!window.chrome, tamper: tamperCheck() },
+      auto: { webdriver: nav.webdriver === true, chromeObj: !!window.chrome, tamper: tamperCheck(), engine: jsEngine(), traces: autoTraces() },
+      // WebTransport (HTTP/3 for pages, 0.19.0): exposed only in a secure context, so elsewhere nothing is said
+      wt: window.isSecureContext ? typeof window.WebTransport === 'function' : null,
       iframe: iframeProbe(),
       priv: {
@@ -548 +829 @@
       }
     };
-    return Promise.all([audioHash(), audioHash(), webgpu(), voices(), devices(), rtc(), workerProbe(workerSrc), uaData(), edgeProbe(edgeConf && edgeConf.host, edgeConf && edgeConf.zone), motion(), sceneRoads(roads)])
+    return Promise.all([audioHash(), audioHash(), webgpu(), voices(), devices(), rtc(), workerProbe(workerSrc), uaData(), edgeProbe(edgeConf && edgeConf.host, edgeConf && edgeConf.zone, edgeConf && edgeConf.quic), motion(), sceneRoads(roads), audioHw(), storeTier()])
       .then(function (r) {
         if (r[10]) s.scene.roads = r[10];
         s.audio = { h1: r[0] ? hash(r[0]) : '', h2: r[1] ? hash(r[1]) : '', noise: !!(r[0] && r[1] && r[0] !== r[1]) };
         if (r[2]) { s.gfx.webgpuVendor = r[2].vendor || ''; s.gfx.webgpuArch = r[2].arch || ''; }
-        s.voices = r[3]; s.devices = r[4]; s.rtc = r[5]; s.worker = r[6]; s.nav.uad = r[7];
+        s.voices = r[3] ? r[3].n : r[3]; s.vo = r[3] ? r[3].k : null; s.devices = r[4]; s.rtc = r[5]; s.worker = r[6]; s.nav.uad = r[7];
         if (r[8]) s.edge = r[8];
         s.motion = r[9];
+        s.audio2 = r[11];
+        s.store = r[12];
+        s.vh = r[3] ? r[3].h || '' : '';
+        // the voice list often arrives late: read it once more now that everything else is done
+        try {
+          var vl = window.speechSynthesis ? speechSynthesis.getVoices() : [];
+          if (vl && vl.length > (s.voices || 0)) { var vs2 = voiceSummary(vl); s.voices = vs2.n; s.vo = vs2.k; s.vh = vs2.h; }
+        } catch (e) {}
         s.fp = hash([s.canvas.h1, s.gfx.hash, s.audio.h1, s.fonts.join(','), s.scr.w + 'x' + s.scr.h + '@' + s.scr.dpr,
           s.nav.hc, s.nav.dm, s.tz.name, s.nav.languages.join(','), s.nav.platform].join('|'));
@@ -561 +850 @@
       })
       .then(waitOuter);
+  }
+
+  // Research links (0.16.1): two more quick passes over the drawing, sound, font and voice tests. Only how many
+  // times each part came out different is kept (s.rep), which shows the natural noise of this device.
+  function repeatPasses(s) {
+    var rep = { n: 0, canvas: 0, webgl: 0, scene: 0, audio: 0, fonts: 0, voices: 0 };
+    var fontsKey = (s.fonts || []).join(','), sceneH = (s.scene && s.scene.h1) || '';
+    var one = function () {
+      var c = canvasHash(), g = webgl(), sc = webglScene({}), fk = fonts().join(',');
+      return Promise.all([audioHash(), voices()]).then(function (r) {
+        rep.n++;
+        if (c !== s.canvas.h1) rep.canvas++;
+        if ((g.hash || '') !== (s.gfx.hash || '')) rep.webgl++;
+        if (((sc && sc.h1) || '') !== sceneH) rep.scene++;
+        if ((r[0] ? hash(r[0]) : '') !== ((s.audio && s.audio.h1) || '')) rep.audio++;
+        if (fk !== fontsKey) rep.fonts++;
+        if ((r[1] ? r[1].n : r[1]) !== s.voices) rep.voices++;
+      });
+    };
+    return timeout(one().then(one), 6000, null).catch(function () {}).then(function () { if (rep.n) s.rep = rep; });
   }
 

spooflens-fraud-check/tags/0.2.1/includes/admin.php

@@ -97 +97 @@
                                                         printf(
                                                                 /* translators: %s: link to the SpoofLens account */
-                                                                esc_html__( 'Free key: %s (1,000 checks a month during the beta). Leave empty to keep the saved key.', 'spooflens-fraud-check' ),
+                                                                esc_html__( 'Free key: %s (1,000 checks a month free). Leave empty to keep the saved key.', 'spooflens-fraud-check' ),
                                                                 '<a href="https://spooflens.com/en/app/api" target="_blank" rel="noopener">spooflens.com/en/app/api</a>'
                                                         );

spooflens-fraud-check/tags/0.2.1/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 0.2.0
+Stable tag: 0.2.1
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -26 +26 @@
 Works with WordPress registration, WooCommerce My Account registration, both the classic and the block WooCommerce checkout, Contact Form 7 and WPForms. Compatible with High-Performance Order Storage. A blocked form submission is treated as spam: Contact Form 7 marks it as spam, WPForms shows an error and does not save the entry.
 
-A free key gives 1,000 checks a month during the beta: https://spooflens.com/en/app/api
+A free key gives 1,000 checks a month: https://spooflens.com/en/app/api
 
 == Installation ==
@@ -68 +68 @@
 This plugin relies on the SpoofLens service (https://spooflens.com), operated by SpoofLens.
 
-* On the registration page, on the WooCommerce checkout and My Account pages and on pages with a Contact Form 7 or WPForms form, the visitor's browser runs the collector script that ships with the plugin (assets/sl.js, MIT; its signal part is also published at https://github.com/spooflens/spooflens-collector). The script collects technical characteristics the browser reports to websites (system, screen, languages, time zone, fonts, graphics card, canvas, WebGL and audio fingerprints) and connects to edge.spooflens.com and a random name under l.spooflens.com to read the TLS handshake, the DNS resolver and the public WebRTC address.
+* On the registration page, on the WooCommerce checkout and My Account pages and on pages with a Contact Form 7 or WPForms form, the visitor's browser runs the collector script that ships with the plugin (assets/sl.js, MIT; its signal part is also published at https://github.com/spooflens/spooflens-collector). The script collects technical characteristics the browser reports to websites (system and its display settings, screen, languages, time zone, fonts, graphics card and its parameters, sound output, the number and a hash of the names of speech voices, which emoji the system can draw, a class of the storage quota, canvas, WebGL and audio fingerprints) and connects to edge.spooflens.com and a random name under l.spooflens.com to read the TLS handshake, the first TCP packet of the connection, the round trip of a few short requests, the DNS resolver and the public WebRTC address.
 * When a user registers, an order is placed or a form is sent, your server sends to https://spooflens.com/v1/assess: the collected data, the visitor's IP address and request headers (User-Agent, Accept-Language, Client Hints), and a SHA-256 hash of the email address. The answer (score, verdict, reasons) is stored with the user or order on your site.
 * SpoofLens does not store the browser data or the full IP address. Its request log, visible to you in your SpoofLens account, keeps for 30 days the time, score, decision, reasons, device identifier, the shortened IP address, country and network type; it also keeps a hash of the device identifier and of the account reference for 30 days to count accounts per device.
@@ -76 +76 @@
 
 == Changelog ==
+
+= 0.2.1 =
+* Updated collector: more traits of the device and its system (display settings, sound output, speech voices, emoji support, a class of the storage quota, graphics card parameters, a second WebGL test scene), the JavaScript engine, traces of automation tools and the round trip to the checking server. The new checks run on the SpoofLens side; your settings do not change.
+* Settings: the free key gives 1,000 checks a month, also after the beta.
 
 = 0.2.0 =

spooflens-fraud-check/tags/0.2.1/spooflens.php

@@ -4 +4 @@
  * Plugin URI:        https://spooflens.com/developers
  * Description:       Scores sign-ups, WooCommerce orders and Contact Form 7 / WPForms submissions for spoofed browsers, bots, VPNs and several accounts on one device, using the SpoofLens API.
- * Version:           0.2.0
+ * Version:           0.2.1
  * Requires at least: 6.0
  * Requires PHP:      7.4
@@ -17 +17 @@
 defined( 'ABSPATH' ) || exit;
 
-define( 'SPOOFLENS_VERSION', '0.2.0' );
+define( 'SPOOFLENS_VERSION', '0.2.1' );
 define( 'SPOOFLENS_FILE', __FILE__ );
 // Can be set in wp-config.php to point the plugin at a test server.

spooflens-fraud-check/trunk/assets/sl.js

@@ -330 +330 @@
   }
 
+  // speech voices: the count, and which system the on-device voices come with (Microsoft ones with Windows,
+  // Apple ones with macOS and iOS); network voices (Google in desktop Chrome, "Online" in Edge) are left out.
+  // Only the counts leave the browser, not the names.
+  var APPLE_VOICES = /^(Samantha|Alex|Daniel|Karen|Moira|Tessa|Fiona|Fred|Victoria|Rishi|Veena|Thomas|Anna|Milena|Yuri|Amelie|Amélie|Kyoko|Ting-Ting)( |$)/;
+  function voiceSummary(list) {
+    var k = { win: 0, apple: 0, other: 0 }, names = [];
+    for (var i = 0; i < list.length; i++) {
+      var v = list[i];
+      if (!v || v.localService !== true) continue;
+      var n = String(v.name || ''), u = String(v.voiceURI || '');
+      names.push(n);
+      if (/^Microsoft /.test(n)) k.win++;
+      else if (/^com\.apple\./.test(u) || APPLE_VOICES.test(n)) k.apple++;
+      else k.other++;
+    }
+    // the names of the system's own voices, as one hash (0.18.0): the same in every browser of a device, and voices
+    // the owner downloaded tell two phones of one model apart; the names themselves are not sent
+    return { n: list.length, k: k, h: names.length ? hash(names.sort().join('|')) : '' };
+  }
   function voices() {
     if (!window.speechSynthesis) return Promise.resolve(null);
     var v = speechSynthesis.getVoices();
-    if (v && v.length) return Promise.resolve(v.length);
+    if (v && v.length) return Promise.resolve(voiceSummary(v));
     return timeout(new Promise(function (r) {
-      speechSynthesis.addEventListener('voiceschanged', function () { r(speechSynthesis.getVoices().length); }, { once: true });
-    }), 800, 0);
+      speechSynthesis.addEventListener('voiceschanged', function () { r(voiceSummary(speechSynthesis.getVoices())); }, { once: true });
+    }), 800, { n: 0, k: null });
+  }
+
+  // the JavaScript engine words its own TypeError: V8 (Chromium), SpiderMonkey (Firefox), JavaScriptCore (Safari, every iOS browser)
+  function jsEngine() {
+    try { var o = null; o.x = 1; } catch (e) {
+      var m = String((e && e.message) || '');
+      if (/Cannot set propert/.test(m)) return 'v8';
+      if (/can't access property|has no properties|is null/.test(m)) return 'gecko';
+      if (/is not an object/.test(m)) return 'jsc';
+      return 'other';
+    }
+    return '';
+  }
+
+  // globals and document properties that automation frameworks leave behind
+  function autoTraces() {
+    var out = [];
+    ['__playwright__binding__', '__pwInitScripts', '_phantom', 'callPhantom', '__nightmare', 'domAutomation', 'domAutomationController',
+     '_selenium', 'callSelenium', '_Selenium_IDE_Recorder', '__webdriver_evaluate', '__selenium_evaluate', '__webdriver_script_fn',
+     '__driver_evaluate', '__fxdriver_evaluate', '__lastWatirAlert'].forEach(function (k) {
+      try { if (k in window) out.push(k); } catch (e) {}
+    });
+    try {
+      Object.keys(document).forEach(function (k) {
+        if (/^\$?cdc_|^\$wdc_|^__(webdriver|selenium|fxdriver|driver)_/.test(k)) out.push('document.' + k);
+      });
+      ['webdriver', 'selenium', 'driver'].forEach(function (a) { if (document.documentElement.hasAttribute(a)) out.push('html[' + a + ']'); });
+    } catch (e) {}
+    return out.slice(0, 8);
   }
 
@@ -346 +394 @@
       return o;
     }), 1500, null);
+  }
+
+  /* ------------------------------------------------ device traits (0.18.0) --- */
+  // What comes from the machine and the system rather than from the browser engine, so that two browsers of one
+  // device can be told apart from two devices (Chrome and Firefox on one computer share almost no other trait).
+
+  // WebGL limits and shader precision without the names: the graphics card and its driver. p: the limits and
+  // precision; e: the extension list (it differs more between engines, kept apart).
+  function glParams() {
+    var o = { p: '', e: '' };
+    try {
+      var c = document.createElement('canvas');
+      var gl = c.getContext('webgl') || c.getContext('experimental-webgl');
+      if (!gl) return o;
+      var P = ['MAX_TEXTURE_SIZE', 'MAX_CUBE_MAP_TEXTURE_SIZE', 'MAX_RENDERBUFFER_SIZE', 'MAX_VERTEX_ATTRIBS', 'MAX_VERTEX_UNIFORM_VECTORS',
+        'MAX_FRAGMENT_UNIFORM_VECTORS', 'MAX_VARYING_VECTORS', 'MAX_COMBINED_TEXTURE_IMAGE_UNITS', 'MAX_TEXTURE_IMAGE_UNITS',
+        'MAX_VERTEX_TEXTURE_IMAGE_UNITS', 'MAX_VIEWPORT_DIMS', 'ALIASED_LINE_WIDTH_RANGE', 'ALIASED_POINT_SIZE_RANGE', 'SUBPIXEL_BITS'];
+      var out = P.map(function (k) { var v = gl.getParameter(gl[k]); return v && typeof v === 'object' && v.length !== undefined ? Array.prototype.join.call(v, 'x') : String(v); });
+      ['VERTEX_SHADER', 'FRAGMENT_SHADER'].forEach(function (sh) {
+        ['LOW_FLOAT', 'MEDIUM_FLOAT', 'HIGH_FLOAT', 'LOW_INT', 'MEDIUM_INT', 'HIGH_INT'].forEach(function (pr) {
+          var x = gl.getShaderPrecisionFormat(gl[sh], gl[pr]);
+          out.push(x ? x.rangeMin + '/' + x.rangeMax + '/' + x.precision : '-');
+        });
+      });
+      o.p = hash(out.join('|'));
+      o.e = hash((gl.getSupportedExtensions() || []).slice().sort().join(','));
+      var lose = gl.getExtension('WEBGL_lose_context');
+      if (lose) lose.loseContext();
+    } catch (e) {}
+    return o;
+  }
+
+  // Scene 2.0: five small drawings, each leaning on another part of the graphics card (float maths, derivatives,
+  // blending, texture filtering, trigonometry at its edges). Browsers of one computer go through one driver, so
+  // our first scene already matched across engines; five give more to tell devices apart. Drawn twice: an
+  // unmodified browser gives the same pixels (noise = something rewrote them).
+  function scene2() {
+    var o = { h: '', parts: [], noise: false };
+    try {
+      var c = document.createElement('canvas'); c.width = 32; c.height = 32;
+      var opt = { antialias: false, preserveDrawingBuffer: true };
+      var gl = c.getContext('webgl', opt) || c.getContext('experimental-webgl', opt);
+      if (!gl) return o;
+      var hp = gl.getShaderPrecisionFormat && gl.getShaderPrecisionFormat(gl.FRAGMENT_SHADER, gl.HIGH_FLOAT);
+      var prec = 'precision ' + (hp && hp.precision > 0 ? 'highp' : 'mediump') + ' float;varying vec2 v;';
+      var der = gl.getExtension('OES_standard_derivatives');
+      var vs = 'attribute vec2 a;varying vec2 v;void main(){v=a*0.5+0.5;gl_Position=vec4(a,0.0,1.0);}';
+      var frags = [
+        prec + 'void main(){float x=v.x*1000.0+v.y*7.3;gl_FragColor=vec4(fract(sin(x)*1e4),fract(exp(v.y*9.0)),fract(pow(v.x+1.0,13.7)),1.0);}',
+        der ? '#extension GL_OES_standard_derivatives : enable\n' + prec + 'void main(){float f=sin(v.x*50.0)*cos(v.y*31.0);gl_FragColor=vec4(fwidth(f)*8.0,abs(dFdx(f))*20.0,abs(dFdy(f))*20.0,1.0);}' : '',
+        prec + 'uniform float k;void main(){gl_FragColor=vec4(v.x,v.y*k,1.0-v.x*k,0.37);}',
+        prec + 'uniform sampler2D t;void main(){gl_FragColor=texture2D(t,v*0.73+0.11);}',
+        prec + 'void main(){float a=atan(v.y*2.0-1.0,v.x*2.0-1.0);gl_FragColor=vec4(fract(a*7.0),fract(acos(v.x*1.999-0.9995)*5.0),fract(tan(v.y*1.5)),1.0);}'
+      ];
+      var sh = function (type, src) { var x = gl.createShader(type); gl.shaderSource(x, src); gl.compileShader(x); return x; };
+      var buf = gl.createBuffer();
+      gl.bindBuffer(gl.ARRAY_BUFFER, buf);
+      gl.bufferData(gl.ARRAY_BUFFER, new Float32Array([-1, -1, 1, -1, -1, 1, -1, 1, 1, -1, 1, 1]), gl.STATIC_DRAW);
+      var tex = gl.createTexture();
+      gl.bindTexture(gl.TEXTURE_2D, tex);
+      var tp = new Uint8Array(64);
+      for (var i = 0; i < 64; i++) tp[i] = (i * 53 + 17) % 256;
+      gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, 4, 4, 0, gl.RGBA, gl.UNSIGNED_BYTE, tp);
+      gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MIN_FILTER, gl.LINEAR);
+      gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MAG_FILTER, gl.LINEAR);
+      gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_WRAP_S, gl.CLAMP_TO_EDGE);
+      gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_WRAP_T, gl.CLAMP_TO_EDGE);
+      gl.disable(gl.DITHER); gl.viewport(0, 0, 32, 32);
+      var px = new Uint8Array(32 * 32 * 4);
+      var progs = frags.map(function (src) {
+        if (!src) return null;
+        var p = gl.createProgram();
+        gl.attachShader(p, sh(gl.VERTEX_SHADER, vs)); gl.attachShader(p, sh(gl.FRAGMENT_SHADER, src)); gl.linkProgram(p);
+        return gl.getProgramParameter(p, gl.LINK_STATUS) ? p : null;
+      });
+      var pass = function () {
+        return progs.map(function (p, n) {
+          if (!p) return '-';
+          gl.useProgram(p);
+          var loc = gl.getAttribLocation(p, 'a');
+          gl.enableVertexAttribArray(loc); gl.vertexAttribPointer(loc, 2, gl.FLOAT, false, 0, 0);
+          gl.clearColor(0.1, 0.2, 0.3, 1.0); gl.clear(gl.COLOR_BUFFER_BIT);
+          if (n === 2) {
+            // three half-transparent layers on top of each other
+            gl.enable(gl.BLEND); gl.blendFunc(gl.SRC_ALPHA, gl.ONE_MINUS_SRC_ALPHA);
+            var k = gl.getUniformLocation(p, 'k');
+            [0.3, 0.6, 0.9].forEach(function (x) { gl.uniform1f(k, x); gl.drawArrays(gl.TRIANGLES, 0, 6); });
+            gl.disable(gl.BLEND);
+          } else {
+            if (n === 3) gl.uniform1i(gl.getUniformLocation(p, 't'), 0);
+            gl.drawArrays(gl.TRIANGLES, 0, 6);
+          }
+          gl.readPixels(0, 0, 32, 32, gl.RGBA, gl.UNSIGNED_BYTE, px);
+          var str = [];
+          for (var i2 = 0; i2 < px.length; i2 += 1024) str.push(String.fromCharCode.apply(null, px.subarray(i2, i2 + 1024)));
+          return hash(str.join('')).slice(0, 8);
+        });
+      };
+      var a = pass(), b = pass();
+      o.parts = a;
+      o.noise = a.join() !== b.join();
+      o.h = hash(a.join('|'));
+      var lose = gl.getExtension('WEBGL_lose_context');
+      if (lose) lose.loseContext();
+    } catch (e) {}
+    return o;
+  }
+
+  // The screen as the system lays it out: the size in device pixels, the strip the taskbar or dock takes, the
+  // menu bar at the top (macOS), the colour range of the display and HDR, and whether more than one display is on.
+  function screen2() {
+    var sc = window.screen || {}, dpr = window.devicePixelRatio || 1;
+    var on = function (q) { return mq(q) === true; };
+    return {
+      pw: Math.round((sc.width || 0) * dpr), ph: Math.round((sc.height || 0) * dpr),
+      tb: (sc.height || 0) - (sc.availHeight || 0), tw: (sc.width || 0) - (sc.availWidth || 0),
+      at: typeof sc.availTop === 'number' ? sc.availTop : null, al: typeof sc.availLeft === 'number' ? sc.availLeft : null,
+      gamut: on('(color-gamut: rec2020)') ? 'rec2020' : (on('(color-gamut: p3)') ? 'p3' : (on('(color-gamut: srgb)') ? 'srgb' : '')),
+      hdr: on('(dynamic-range: high)'), ext: sc.isExtended === true
+    };
+  }
+
+  // The sound hardware: the default sample rate, the output channels and the latency of the system's audio.
+  function audioHw() {
+    var AC = window.AudioContext || window.webkitAudioContext;
+    if (!AC) return Promise.resolve(null);
+    try {
+      var ac = new AC();
+      var o = { sr: ac.sampleRate || 0, ch: ac.destination ? ac.destination.maxChannelCount : null,
+        bl: typeof ac.baseLatency === 'number' ? Math.round(ac.baseLatency * 10000) / 10 : null };
+      try { ac.close(); } catch (e) {}
+      return Promise.resolve(o);
+    } catch (e) { return Promise.resolve(null); }
+  }
+
+  // Emoji clock: one emoji of each Unicode emoji version. The newest one the system draws in colour as a single
+  // glyph tells the version of its emoji font, which follows the version of the system: browsers and iOS 26+
+  // freeze the system version in the User-Agent, the emoji do not. m: the sizes of three emoji (the font itself).
+  var EMOJI = [['11', '\uD83E\uDD70'], ['12', '\uD83E\uDD71'], ['13', '\uD83E\uDD72'], ['13.1', '\u2764\uFE0F\u200D\uD83D\uDD25'], ['14', '\uD83E\uDEE0'],
+    ['15', '\uD83E\uDEE8'], ['15.1', '\uD83D\uDE42\u200D\u2194\uFE0F'], ['16', '\uD83E\uDEE9']];
+  function emojiClock() {
+    var o = { v: '', ok: '', m: '' };
+    try {
+      var c = document.createElement('canvas'); c.width = 64; c.height = 40;
+      var x = c.getContext('2d');
+      x.font = '28px sans-serif'; x.textBaseline = 'top';
+      var one = x.measureText('\uD83D\uDE00').width;
+      var ok = [];
+      EMOJI.forEach(function (e) {
+        x.clearRect(0, 0, 64, 40);
+        x.fillText(e[1], 0, 2);
+        var d = x.getImageData(0, 0, 64, 40).data, col = 0;
+        for (var i = 0; i < d.length; i += 4) {
+          if (d[i + 3] > 128 && (Math.abs(d[i] - d[i + 1]) > 40 || Math.abs(d[i + 1] - d[i + 2]) > 40)) col++;
+        }
+        // in colour and as one glyph: a sequence the font does not know falls apart into two or more
+        if (col > 20 && x.measureText(e[1]).width < one * 1.5) ok.push(e[0]);
+      });
+      o.ok = ok.join(',');
+      o.v = ok.length ? ok[ok.length - 1] : '';
+      var m = x.measureText('\uD83D\uDE00\uD83E\uDEE0\uD83D\uDC4D\uD83C\uDFFD');
+      o.m = hash([one, m.width, m.actualBoundingBoxAscent, m.actualBoundingBoxDescent].map(function (n) { return Math.round((n || 0) * 10); }).join(','));
+    } catch (e) {}
+    return o;
+  }
+
+  // How much the browser lets a site keep, as a class only (0: under 1 GB ... 8: 1.6 TB and more). In Chromium
+  // it follows the size of the disk, which tells two phones of one model with different storage apart.
+  function storeTier() {
+    if (!navigator.storage || !navigator.storage.estimate) return Promise.resolve(null);
+    return timeout(navigator.storage.estimate().then(function (e) {
+      var gb = ((e && e.quota) || 0) / 1e9, edges = [1, 10, 50, 100, 200, 400, 800, 1600], t = 0;
+      while (t < edges.length && gb >= edges[t]) t++;
+      return { t: t };
+    }), 1000, null);
   }
 
@@ -410 +633 @@
    *    (the request itself fails, there is no certificate for that name), then /dns/<id> says who asked;
    *  - STUN: the public address WebRTC's UDP traffic comes from (srflx candidates).
+   *  - QUIC (0.19.0, on its own host): /a offers HTTP/3 in an Alt-Svc header and closes its TCP connection, three
+   *    /b requests show whether the browser moves to HTTP/3, /r returns what the server saw, signed.
    * The tokens are verified on spooflens.com; the browser only carries them.
    */
-  function edgeProbe(host, zone) {
+  function edgeProbe(host, zone, qhost) {
     // on spooflens.com the page names the edge (data-edge); sl.js on client sites passes it in
     host = host || document.documentElement.getAttribute('data-edge');
     zone = zone || document.documentElement.getAttribute('data-edge-zone');
+    qhost = qhost || document.documentElement.getAttribute('data-edge-quic');
     if (!host || !window.fetch) return Promise.resolve(null);
     var base = 'https://' + host, out = { tls: '', dns: '', stun: [] };
     var get = function (u) { return fetch(base + u, { cache: 'no-store', credentials: 'omit' }).then(function (r) { return r.json(); }); };
-    var tlsP = timeout(get('/fp').then(function (j) { out.tls = j.token || ''; }), 3000, null).catch(function () {});
+    // round trip as the page sees it (0.16.0): three pings on the connection /fp has just used, the fastest kept.
+    // The server compares it with the round trip the edge's kernel measured for that connection.
+    var tag = Math.random().toString(36).slice(2, 8);   // this run's own timing entries
+    var ping = function (n) {
+      var u = base + '/ping?n=' + tag + n, t0 = performance.now();
+      return fetch(u, { cache: 'no-store', credentials: 'omit' }).then(function (r) { return r.text(); }).then(function () {
+        var ms = performance.now() - t0;
+        // the network stack's own timing (the edge sends Timing-Allow-Origin), free of main-thread delays
+        try {
+          var e = performance.getEntriesByName(u).pop();
+          if (e && e.requestStart > 0 && e.responseStart >= e.requestStart) ms = e.responseStart - e.requestStart;
+        } catch (x) {}
+        return ms;
+      });
+    };
+    var pings = function () {
+      var ms = [];
+      var keep = function (v) { ms.push(v); };
+      return ping(1).then(keep).then(function () { return ping(2); }).then(keep).then(function () { return ping(3); }).then(keep)
+        .catch(function () {})
+        .then(function () { if (ms.length) out.rtt = Math.round(Math.min.apply(null, ms) * 10) / 10; });
+    };
+    // QUIC after the pings, so its traffic does not sit in their timing. nextHopProtocol of each request is the
+    // browser's own word (the QUIC host sends Timing-Allow-Origin); the server's account is in the token.
+    var quic = function () {
+      if (!qhost) return null;
+      var qb = 'https://' + qhost, qid = '', urls = [];
+      for (var k = 0; k < 16; k++) qid += '0123456789abcdef'[Math.floor(Math.random() * 16)];
+      var wait = function (ms) { return new Promise(function (r) { setTimeout(r, ms); }); };
+      var q = function (p) {
+        var u = qb + p + (p.indexOf('?') >= 0 ? '&' : '?') + 'id=' + qid;
+        if (p !== '/r') urls.push(u);
+        return fetch(u, { cache: 'no-store', credentials: 'omit' });
+      };
+      // the timing entry of a request is written after fetch() resolves, so the protocols are read at the end
+      var protocols = function () {
+        return urls.map(function (u) { try { var e = performance.getEntriesByName(u).pop(); return e ? e.nextHopProtocol || '' : ''; } catch (x) { return ''; } });
+      };
+      return timeout(q('/a').then(function () { return wait(50); })
+        .then(function () { return q('/b?n=1'); }).then(function () { return wait(300); })
+        .then(function () { return q('/b?n=2'); }).then(function () { return wait(200); })
+        .then(function () { return q('/b?n=3'); })
+        .then(function () { return q('/r'); }).then(function (r) { return r.json(); })
+        .then(function (j) { if (j && j.token) out.quic = { token: j.token, np: protocols() }; }), 4000, null).catch(function () {});
+    };
+    var tlsP = timeout(get('/fp').then(function (j) { out.tls = j.token || ''; }), 3000, null).catch(function () {})
+      .then(function () { return out.tls ? timeout(pings(), 2000, null) : null; }).catch(function () {})
+      .then(quic);
     var id = '';
     for (var i = 0; i < 16; i++) id += '0123456789abcdef'[Math.floor(Math.random() * 16)];
@@ -534 +807 @@
       media: {
         dark: mq('(prefers-color-scheme: dark)'), reduced: mq('(prefers-reduced-motion: reduce)'),
-        pointer: mq('(pointer: fine)') ? 'fine' : (mq('(pointer: coarse)') ? 'coarse' : 'none'), hover: mq('(hover: hover)')
+        pointer: mq('(pointer: fine)') ? 'fine' : (mq('(pointer: coarse)') ? 'coarse' : 'none'), hover: mq('(hover: hover)'),
+        // settings of the system (0.18.0): contrast, transparency, inverted and forced colours
+        contrast: mq('(prefers-contrast: more)') ? 'more' : (mq('(prefers-contrast: less)') ? 'less' : (mq('(prefers-contrast: custom)') ? 'custom' : 'no')),
+        transp: mq('(prefers-reduced-transparency: reduce)'), invert: mq('(inverted-colors: inverted)'), forced: mq('(forced-colors: active)')
       },
+      scr2: screen2(),
       gfx: { vendor: gl.vendor || '', renderer: gl.renderer || '', version: gl.version || '', glsl: gl.glsl || '',
-             maxTex: gl.maxTex || null, extCount: gl.extCount || 0, hash: gl.hash || '' },
+             maxTex: gl.maxTex || null, extCount: gl.extCount || 0, hash: gl.hash || '', params: glParams() },
       canvas: { h1: c1, h2: c2, noise: !!(c1 && c2 && c1 !== c2), flat: canvasFlat() },
       scene: webglScene(roads),
+      scene2: scene2(),
+      emoji: emojiClock(),
       fonts: fonts(),
-      auto: { webdriver: nav.webdriver === true, chromeObj: !!window.chrome, tamper: tamperCheck() },
+      auto: { webdriver: nav.webdriver === true, chromeObj: !!window.chrome, tamper: tamperCheck(), engine: jsEngine(), traces: autoTraces() },
+      // WebTransport (HTTP/3 for pages, 0.19.0): exposed only in a secure context, so elsewhere nothing is said
+      wt: window.isSecureContext ? typeof window.WebTransport === 'function' : null,
       iframe: iframeProbe(),
       priv: {
@@ -548 +829 @@
       }
     };
-    return Promise.all([audioHash(), audioHash(), webgpu(), voices(), devices(), rtc(), workerProbe(workerSrc), uaData(), edgeProbe(edgeConf && edgeConf.host, edgeConf && edgeConf.zone), motion(), sceneRoads(roads)])
+    return Promise.all([audioHash(), audioHash(), webgpu(), voices(), devices(), rtc(), workerProbe(workerSrc), uaData(), edgeProbe(edgeConf && edgeConf.host, edgeConf && edgeConf.zone, edgeConf && edgeConf.quic), motion(), sceneRoads(roads), audioHw(), storeTier()])
       .then(function (r) {
         if (r[10]) s.scene.roads = r[10];
         s.audio = { h1: r[0] ? hash(r[0]) : '', h2: r[1] ? hash(r[1]) : '', noise: !!(r[0] && r[1] && r[0] !== r[1]) };
         if (r[2]) { s.gfx.webgpuVendor = r[2].vendor || ''; s.gfx.webgpuArch = r[2].arch || ''; }
-        s.voices = r[3]; s.devices = r[4]; s.rtc = r[5]; s.worker = r[6]; s.nav.uad = r[7];
+        s.voices = r[3] ? r[3].n : r[3]; s.vo = r[3] ? r[3].k : null; s.devices = r[4]; s.rtc = r[5]; s.worker = r[6]; s.nav.uad = r[7];
         if (r[8]) s.edge = r[8];
         s.motion = r[9];
+        s.audio2 = r[11];
+        s.store = r[12];
+        s.vh = r[3] ? r[3].h || '' : '';
+        // the voice list often arrives late: read it once more now that everything else is done
+        try {
+          var vl = window.speechSynthesis ? speechSynthesis.getVoices() : [];
+          if (vl && vl.length > (s.voices || 0)) { var vs2 = voiceSummary(vl); s.voices = vs2.n; s.vo = vs2.k; s.vh = vs2.h; }
+        } catch (e) {}
         s.fp = hash([s.canvas.h1, s.gfx.hash, s.audio.h1, s.fonts.join(','), s.scr.w + 'x' + s.scr.h + '@' + s.scr.dpr,
           s.nav.hc, s.nav.dm, s.tz.name, s.nav.languages.join(','), s.nav.platform].join('|'));
@@ -561 +850 @@
       })
       .then(waitOuter);
+  }
+
+  // Research links (0.16.1): two more quick passes over the drawing, sound, font and voice tests. Only how many
+  // times each part came out different is kept (s.rep), which shows the natural noise of this device.
+  function repeatPasses(s) {
+    var rep = { n: 0, canvas: 0, webgl: 0, scene: 0, audio: 0, fonts: 0, voices: 0 };
+    var fontsKey = (s.fonts || []).join(','), sceneH = (s.scene && s.scene.h1) || '';
+    var one = function () {
+      var c = canvasHash(), g = webgl(), sc = webglScene({}), fk = fonts().join(',');
+      return Promise.all([audioHash(), voices()]).then(function (r) {
+        rep.n++;
+        if (c !== s.canvas.h1) rep.canvas++;
+        if ((g.hash || '') !== (s.gfx.hash || '')) rep.webgl++;
+        if (((sc && sc.h1) || '') !== sceneH) rep.scene++;
+        if ((r[0] ? hash(r[0]) : '') !== ((s.audio && s.audio.h1) || '')) rep.audio++;
+        if (fk !== fontsKey) rep.fonts++;
+        if ((r[1] ? r[1].n : r[1]) !== s.voices) rep.voices++;
+      });
+    };
+    return timeout(one().then(one), 6000, null).catch(function () {}).then(function () { if (rep.n) s.rep = rep; });
   }
 

spooflens-fraud-check/trunk/includes/admin.php

@@ -97 +97 @@
                                                         printf(
                                                                 /* translators: %s: link to the SpoofLens account */
-                                                                esc_html__( 'Free key: %s (1,000 checks a month during the beta). Leave empty to keep the saved key.', 'spooflens-fraud-check' ),
+                                                                esc_html__( 'Free key: %s (1,000 checks a month free). Leave empty to keep the saved key.', 'spooflens-fraud-check' ),
                                                                 '<a href="https://spooflens.com/en/app/api" target="_blank" rel="noopener">spooflens.com/en/app/api</a>'
                                                         );

spooflens-fraud-check/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 0.2.0
+Stable tag: 0.2.1
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -26 +26 @@
 Works with WordPress registration, WooCommerce My Account registration, both the classic and the block WooCommerce checkout, Contact Form 7 and WPForms. Compatible with High-Performance Order Storage. A blocked form submission is treated as spam: Contact Form 7 marks it as spam, WPForms shows an error and does not save the entry.
 
-A free key gives 1,000 checks a month during the beta: https://spooflens.com/en/app/api
+A free key gives 1,000 checks a month: https://spooflens.com/en/app/api
 
 == Installation ==
@@ -68 +68 @@
 This plugin relies on the SpoofLens service (https://spooflens.com), operated by SpoofLens.
 
-* On the registration page, on the WooCommerce checkout and My Account pages and on pages with a Contact Form 7 or WPForms form, the visitor's browser runs the collector script that ships with the plugin (assets/sl.js, MIT; its signal part is also published at https://github.com/spooflens/spooflens-collector). The script collects technical characteristics the browser reports to websites (system, screen, languages, time zone, fonts, graphics card, canvas, WebGL and audio fingerprints) and connects to edge.spooflens.com and a random name under l.spooflens.com to read the TLS handshake, the DNS resolver and the public WebRTC address.
+* On the registration page, on the WooCommerce checkout and My Account pages and on pages with a Contact Form 7 or WPForms form, the visitor's browser runs the collector script that ships with the plugin (assets/sl.js, MIT; its signal part is also published at https://github.com/spooflens/spooflens-collector). The script collects technical characteristics the browser reports to websites (system and its display settings, screen, languages, time zone, fonts, graphics card and its parameters, sound output, the number and a hash of the names of speech voices, which emoji the system can draw, a class of the storage quota, canvas, WebGL and audio fingerprints) and connects to edge.spooflens.com and a random name under l.spooflens.com to read the TLS handshake, the first TCP packet of the connection, the round trip of a few short requests, the DNS resolver and the public WebRTC address.
 * When a user registers, an order is placed or a form is sent, your server sends to https://spooflens.com/v1/assess: the collected data, the visitor's IP address and request headers (User-Agent, Accept-Language, Client Hints), and a SHA-256 hash of the email address. The answer (score, verdict, reasons) is stored with the user or order on your site.
 * SpoofLens does not store the browser data or the full IP address. Its request log, visible to you in your SpoofLens account, keeps for 30 days the time, score, decision, reasons, device identifier, the shortened IP address, country and network type; it also keeps a hash of the device identifier and of the account reference for 30 days to count accounts per device.
@@ -76 +76 @@
 
 == Changelog ==
+
+= 0.2.1 =
+* Updated collector: more traits of the device and its system (display settings, sound output, speech voices, emoji support, a class of the storage quota, graphics card parameters, a second WebGL test scene), the JavaScript engine, traces of automation tools and the round trip to the checking server. The new checks run on the SpoofLens side; your settings do not change.
+* Settings: the free key gives 1,000 checks a month, also after the beta.
 
 = 0.2.0 =

spooflens-fraud-check/trunk/spooflens.php

@@ -4 +4 @@
  * Plugin URI:        https://spooflens.com/developers
  * Description:       Scores sign-ups, WooCommerce orders and Contact Form 7 / WPForms submissions for spoofed browsers, bots, VPNs and several accounts on one device, using the SpoofLens API.
- * Version:           0.2.0
+ * Version:           0.2.1
  * Requires at least: 6.0
  * Requires PHP:      7.4
@@ -17 +17 @@
 defined( 'ABSPATH' ) || exit;
 
-define( 'SPOOFLENS_VERSION', '0.2.0' );
+define( 'SPOOFLENS_VERSION', '0.2.1' );
 define( 'SPOOFLENS_FILE', __FILE__ );
 // Can be set in wp-config.php to point the plugin at a test server.