Browser Fingerprinting

Browser Fingerprinting

Browser fingerprinting, as a stateless tracking technique, can be used to recognize users based on the characteristics and behavior of their browser instances.

Unlike cookies, no data needs to be stored on the client side to track users. The browser attributes required to compile a vector of characteristics, i.e., a fingerprint, can be harvested passively from the client’s HTTP request headers, or actively by running a script on the client side and querying the browser’s Web APIs or probing its behavior and capabilities.

Although dependent on the given feature set used to compile such fingerprints, the majority of fingerprints tend to be unique amongst users, which is a privacy issue.

Online Study

Since 2016, we are running a long-term study on browser fingerprinting. To the best of our knowledge, our study is the first to provide longitudinal observations with ground truth on user level as well as to report the demographics of the user sample.

Participants are required to sign up with their email addresses so we can send them a weekly email with a personalized link to test their fingerprint. In this way, we not only control the stimuli for periodic measurements and establish ground truth for long-term observations, but also enable participants to use as many devices and browsers as they wish.

When participants visit their personalized links to test their fingerprints, we provide them an extensive overview on features that were collected and tell them whether their current fingerprint is unique amongst the participants of our study and whether it can be used to track them uniquely over time. Furthermore, participants can browse historic data about their observed fingerprints. Additionally, we share statistics on preliminary results of our study with the general public.

Long-Term Observation on Browser Fingerprinting: Users’ Trackability and Perspective

In the following, we provide a high-level description of some of the findings reported in our paper “Long-Term Observation on Browser Fingerprinting: Users’ Trackability and Perspective” which got accepted at PETS 2020 (Privacy Enhancing Technologies Symposium).

Technical Findings

In our paper, we propose formal definitions to characterize fingerprints within datasets as unique-by-appearance, unique-by-entity, stable, and trackable.

Further, we introduce a technique called feature stemming which can be used to remove mutating parts from individual features (e.g., varying version numbers) to increase their stability over time and thus making them comparable despite of inequality (e.g., for establishing linkability between fingerprints that evolved over time).

Based on data we collected between 2016 and 2019, we show that a greedy sequential search approach can be used to optimize device-type-dependent and device-type-independent feature sets for fingerprinting towards an optimization criterion for a given dataset, such as the stability of unique fingerprints that are stable over time. Since such feature set optimizations might be applied by trackers to increase users’ trackability, we think that such optimization approaches for feature selection should be considered in risk and privacy assessments.

User-Centred Findings

Most participants of our study indicated to have learned something new, e.g., how fingerprinting works or about their individual trackability. When asked whether the participation changed any of their thoughts or feelings regarding the Web, the majority of those who answered in the affirmative indicated their disappointment about the state of privacy, e.g., by realizing the magnitude of tracking; the majority of those who answered in the negative indicated that they were not surprised as they were already aware about tracking, browser fingerprinting, and data collection on the Web. Further, the majority negated that they have changed their behavior on the Web, e.g., because they indicated to not know how to protect themselves or because they are already cautious enough when browsing the Web. When asked about the countermeasures that they applied to protect themselves against browser fingerprinting, a noticeable number of reported countermeasures were not effective against browser fingerprinting.

Further Information

• Online study: browser-fingerprint.cs.fau.de
• Paper: Long-Term Observation on Browser Fingerprinting: Users’ Trackability and Perspective (PETS 2020)

@article{pugliese2020bfp,
      title={{Long-Term Observation on Browser Fingerprinting: 
             Users’ Trackability and Perspective}},
     author={Pugliese, Gaston and Riess, Christian 
             and Gassmann, Freya and Benenson, Zinaida},
    journal={{Proceedings on Privacy Enhancing Technologies (PoPETS)}},
     volume={2020},
     number={2},
      pages={558--577},
       year={2020},
  publisher={Sciendo}
}