Luau Sandbox Fingerprinting

Luau is a sandboxed, embeddable scripting language derived from Lua. While primarily used on the Roblox platform, Luau is gaining popularity in other projects which previously relied on LuaJIT and various other technologies.

Many abstractions are present in the Roblox Engine to prevent developers and malicious actors alike from identifying devices, accounts, or PII. For example, Roblox's networking model consists of "RemoteEvents" and "RemoteFunctions" which serve as an abstraction over web requests. This abstraction removes any IP-based fingerprinting options for developers.

While the environment is heavily abstracted and sandboxed, there exist many ways to fingerprint a device. This package makes use of the os.clock() function on the client, which returns the CPU uptime (accurate to about one microsecond).

Given the high level of accuracy, it is unlikely that a collision would occur. However, you can further reduce the likelihood of a collision by making use of similar os-level functions to determine the device's time zone. In this case, it is recommended to use a hashing function for readability and ease of use.

A common misconception surrounding this fingerprinting method lies around how the CPU uptime is reset- and this misconception is seen all around the IT world. Contrary to popular belief, shutting down and/or restarting your device does not necessary reset your CPU uptime due to the presence of fast-boot technologies within many BIOS/EUFI default configurations in addition to operating system level configurations.