So, last time we talked about Quality Score and everything that this involves. You can read it here. Now let’s consider the way of deceiving the interfaces more closely to better understand how antidetect apps work.

Canvas is an HTML5 API which is used to draw graphics and animations on a web page via scripting in JavaScript. JS-scripts gives the parameters of an image and browser, using resources of a device, renders the image. The point is that the same canvas image may be rendered differently in different computers. It may depend on the operating systems, version of a browser, installed libraries, video cards’ drivers, graphical adapters, etc.

This is the moment when you should meet such a thing as uniqueness score. This rating shows how many devices have the same hash print as yours. The more devices have the same print, the lower your uniqueness score. For example, if 5000 devices have the same hash print per every 100.000 devices then they are unique by 95%.  The lower this figure, the better. Is it clear? Good, moving on.

Canvas print data are enough to determine the user’s uniqueness with a figure higher than 95%. “Apple” users are doing better. Apple devices are usually custom and their uniqueness is lower by default. That is why Google and Facebook farmers tend to use their old MacBook for their dirty practices.

Until recently, antidetect services have been dealing with Canvas fingerprinting by changing the pixel color attributes. Even small changes are enough to change the hash print. However, this method has its shortcomings. Of course, hash changes and Facebook can’t find a connection between your device and other blocked profiles. But your uniqueness score will be 100% (or almost so). At best, your print will coincide with the prints of other users of the same antidetect service. But this will not help much. It’s like wear a Batman mask and walk around town. Of course, no one will see your real face but everyone will look at you like you are an idiot.

Moreover, Facebook can match the specified rendering parameters and the process of rendering different images in the browser and, thus, can find a forgery of hash print. So Facebook will understand that you are a user of an antidetect service. And it won’t bode well.

WebGL is JavaScript API, it uses more than 300 simple primitive functions for rendering more complex 3D images with the OpenGL library. You can get a different number of the metadata parameters depending on the video card. The tests say that because of JS, Facebook receives only those parameters that are needed to render an image correctly on a device. There is no complete WebGL fingerprinting process. But it doesn’t mean that other services (that Facebook uses) do not as well.

Changing print is performed by changing the transparency of colors. Unfortunately, you can find any public WebGL print data for comparison. But we can assume that the uniqueness of such modified print will be almost 100% as well. Moreover, WebGL and Canvas can literally check one another because complex 3D images consist of more simple 2D images. The difference between Canvas and WebGL rendering makes Facebook 100% sure that somebody wears a Batman mask.

WebRTC is a browser standard which allows users to make audio and video calls right in the browser, without using another software. Very useful but not so safe. A website can get the information about an audio adapter and all the audio devices like webcam, microphone, speakers. However, the devices’  producers supply them with hash identification. So, Facebook knows not just about the existence of a device but it knows their ID as well. Also, the browser leaks your local and public IP-addresses (bypassing VPN, of course).

Seems like every person in the right mind should turn WebRTC off once and forever. But! Disabled WebRTC is a wake-up call for every antifraud system because normal users don’t turn it off so this may add you a few percents of uniqueness.

Antidetect of the system can change both local and public IP-addresses in the WebRTC interface but you can’t make audio and video calls anymore (using your browser, of course). You can find more info about WebRTC here: https://browserleaks.com/webrtc#webrtc-device-id.

Fonts. By measuring the size of the text in HTML, overlaying texts on each other and other techniques, the antifraud systems can recognize the list of the installed fonts in the system. Some techniques force the browser to use the installed libraries to display texts. Depending on the operating system (GDI and DirectWrite for Windows, Core Text for MacOS and Pango for Linux), the libraries behave differently and it creates some further opportunities to determine the user’s system even using the emulators and anti-detect programs.

Modernizr – is a js-library that allows you to identify 290 features of a browser in a moment. The thing is that the set of these features may vary in different versions of a browser. Most people have an auto-update browser. So, using the early versions of Chrome and FireFox increases your uniqueness score, which is not good.

Fortunately (for us), anti-detect services always update the content of their browsers to the current versions of Mozilla Firefox and Chrome.

Facebook doesn’t rely only on collecting and analyzing the data. Its primary strength is in dynamics, focus on analyzing the behavior of users and optimizing algorithms. That is why using identical consumables and typical schemes always lead to tighter control. WebGL metadata and Modernizr content (every print of two billion users) storage is extremely powerful technology. In turn, there is a global behavioral data-base already. They are used in the anti-fraud service of Facebook

Correct and careful use of identity protection services can be the basis for successful work. So what’s the deal if you can run black-hat campaigns and scale up if you can’t even launch lead type ads?

That’s it for today. Next time we will talk about antidetect services and how do they work. Stay tuned

The main rule of Facebook (that everybody always breaks) is that each person can have only one Facebook account. Sometimes accounts are blocked not because of breaking the social network’s policy or rules but because of creating fake accounts. Moreover, in such cases Facebook provides no reasons – it just blocks your account and that’s it.

According to Zuckerberg, the network’s antifraud is programmed to impose the maximum punishment for fake accounts. Sometimes Facebook doesn’t block fake accounts which it has already found, to find other accounts (which break the rules) using the recognition system and big-data analysis. Fair enough though – with the exception of data breaches, 99% of the network’s problems arise out of fake accounts. Zuck detects and blocks them on time, thus protecting his platform in general.

And we have to admit, he’s doing quite well.

Facebook relies more on the analysis of behavioral factors rather than on fingerprinting and user identification. The limit of the profile quality depends on the various combinations of three groups of factors: Facts – Connections – Actions. So, first things first.

Facts are the data (related to a Facebook profile) including the following info:

• Devices system configs (mobile and desktop). All the computers and mobile phones that were used to log in, visible connected devices (or visible within one wi-fi connection), devices within one IP range;
• All cookies, IP-addresses, DNS used and other elements of the network;
• Added payments instruments;
• The content of ad accounts (businesses, domains, apps, creative materials, etc.);
• The content of a profile (list of friends, a text of messages, groups, fanpages etc.). All the data from the security panel that you can download (My Facebook Information tab).

Connections are the links Facebook may establish that related to a profile as well:

• All cases of a match of facts with other accounts;
• All identical (or almost identical) actions with other accounts.

Actions are the consistent activity of devices, connected with a profile, during which facts and connections are emerging.

Facebook collects all three data-bases. They are connected to each other and regulate one another. Eventually, the system assigns a quality indicator (based on the analysis of the data) to every network’s user. Facebook calls it USER_TRUST while Google calls it Quality Score.

And there raise two interesting questions:

1. How to organize actions in your account in such a way that they would act differently than other fake accounts?
2. How to achieve a sufficient level of anonymity when the system couldn’t find any connection or fact that matches with other accounts?

However, with regard to behavior, there are a lot of different guides (based on experience and practice of other moneymakers) on how to create an account before registration, after registration, and before the first ad campaigns. But, unfortunately, we can’t say the same thing about the second question. Speaking of anonymity and confrontation the antifraud systems – it’s not that easy.

As we said before, 99% of Facebook problems are made by fake accounts. Spam, credit card fraud, black-hat marketing, social engineering, angry russian hackers – all of this is the work of fake accounts. And a man would be an idiot to add a stolen credit card using his real name.

Obviously, such a big platform as Facebook uses the most advanced identification technologies. The network starts watching you before you create an account there. Up-to-date farming methods take into account cookie analysis and visiting websites with Facebook Pixel. Otherwise, a successful launching is not assured.

Modern identification systems are based on the fingerprintjs technology developed by Valentin Vasilyev 5 years ago: https://github.com/Valve/fingerprintjs. Facebook Antifraud includes the collection of data on users (using fingerprinting) and receiving information from other services (which also use fingerprinting). All the data are collected on the principle of “Facts – Connections – Actions” and then Facebook AI takes the lead. It processes the information and ranks it on the “USER_TRUST” concept.

The most efficient way to identify a user is the js-requests to Canvas, WebGL and WebRTC interfaces. The data obtained are transformed into hashes which make up the combined print of a user. We will consider the way of deceiving the interfaces more closely in our next article! Stay tuned