I’ve had Safari’s developer tools enabled since early April and somehow enjoyed a nice two-month spell that was free from this pestilent bug, but I suffered a relapse an hour ago after running some snippets of JavaScript in the console. My first clue: performing a Google search and noticing that the background color was white when my search results loaded. I’m a dark mode user, so I braced myself for the fallout: as expected, all my sessions with Facebook, Twitter, LinkedIn, GitHub, eBay, Amazon, and Gmail were gone.
Logging back into most of these sites results in a raft of security alerts that arrive via email and/or push notification. They all say variations of the same thing: “a login was detected from a new device we don’t recognize.” They usually contain links to the site so you can take immediate action to change your password. Somehow Google’s security page knows the name of my machine (SBP) and puts a little blue checkbox next to it, identifying it as “this device”. How Google ascertained that bit of private information is an alarming head-scratcher. Yes, I am logged into Gmail under “Internet Accounts” in macOS, but it’s curious how Google is able to correlate that connection with a “new device” it did not recognize minutes earlier.
So all of these big technology companies must be using a device-based login technique that relies on some kind of fingerprint they derive from the information Safari gives it, probably a hash generated by JavaScript from a number of factors. And somehow interacting with Safari’s web developer tools can corrupt that fingerprint and make us a total stranger to major tech sites.
I’m a web developer, but I only work on small-time sites that use unsophisticated cookie-based login sessions that have been around for decades. These types of sessions are still working fine in Safari 15. I would love to hear from a developer who works on big-time tech sites that rely on device-based login techniques. Their insight would be interesting.