Web Browsers Leave 'Fingerprints' Behind as You Surf the Net

http://www.eff.org/press/archives/2010/05/13

by stanleydrew • 16 years ago

64 28 16 years ago

eff.org

marcusbooster• 16 years ago

I'm unique alright, and it appears the main culprit is the identification of my System Fonts/User_Agent.

JoeAltmaier• 16 years ago

I am too, and I have a default installation. How did fonts get so unique?

dutchflyboy• 16 years ago

Same here. For me the fonts are even completly unique (the "one in x browsers have this value" column is >840'000). Yet I'm using a fairly standard install (I can't remember installing any fonts). Maybe some programs install a font automatically, making you uniquely identifiable quite easily.

But I still wonder how fast the birthday paradox/problem would hit such an identification system. (http://en.wikipedia.org/wiki/Birthday_problem)

conanite• 16 years ago

Time for some http://modifyheaders.mozdev.org/

edit: panopticlick gets plugin and font list via javascript; modifyheaders can't do anything about that ...

Nycto2• 16 years ago

I believe it actually gets the font lists using a tiny flash app. Check out this project for an example:

http://github.com/gabriel/font-detect-js

minouye• 16 years ago

So the browser is not really the culprit--it's flash.

WesleyJohnson• 16 years ago

I played around with this for work and fonts appear to be the biggest culprit of selling you out. User Agents can be somewhat unique depending on what you've installed that may have modified them, but fonts are far worse. From what I gather, the flash app returns the fonts in installed ordered and not alphabetical. So unless your system is factory fresh, it may still be distinguishable from someone else with the exact same setup, provided you installed any fonts (or apps w/included fonts) in a different order.

bcl• 16 years ago

For me it is plugins. I only have a couple installed in chrome, but apparently there are also system-wide plugins that it is picking up info on. 19.68+ bits of info based on plugins alone.

xtacy• 16 years ago

I am guessing that the fingerprinting problem extends far beyond the browser. What about connection based fingerprinting? (TCP/IP stack, etc.) What about order of fetching images from a website? What about timing attacks that measure the time taken to load a page (browser caches, cache sizes, eviction policies, upstream squid caches, etc.)? The whole system is way too complicated.

And I feel that having additional extensions/plugins to combat this, unless deployed universally, is still going to contribute to the entropy and help increase the chances of you getting fingerprinted.

Edit: the pdf on the website talks about it. https://panopticlick.eff.org/browser-uniqueness.pdf

"The Curse of Dimensionality."

MikeCapone• 16 years ago

This is something that I hope the Chrome/Chromium team will do something about. They've been moving fast on a lot of things lately, and if they take the lead others will eventually follow...

thechangelog2• 16 years ago

I'm not sure why they would. This information seems extremely relevant to Google's line of business.

stanleydrew• 16 years ago

As far as I know Google tracks with cookies in the standard way. I would be pretty shocked if they were tracking based on anything like fonts or plugins. Is there already evidence to the contrary though?

tbeseda• 16 years ago

Google could not feasibly track their user-base this way. The load time for a Flash application that returns font lists (though short) is much longer than they, or their users would tolerate.

ErrantX3• 16 years ago

One thing I don't get about this; I've been trying it with completely default installs of Fedora core 11 running Firefox and it calls them all unique.

I feel like I am missing something obvious - anyone care to point me in the right direction (I read most of the links of the project site)?

lallysingh2• 16 years ago

It's the bits of entropy. You're unique within 2^bits users on the web as a whole (according to their model). Said another way, according to how they're measuring uniqueness, that you get N bits of entropy.

On a hypothetical website that had 2^N different users, you could be uniquely identified. Specifically, you'd be the only FC11/ffox user in the mix :-)

ErrantX3• 16 years ago

You misunderstand. Identical default installs still report as unique. I couldn't understand what they tested that could differetiate them (because by rights they all should report identically - or at the very least some of them should).

This was tested with 25 identical machines I was commissioning for a task.

qwzybug• 16 years ago

It's amazing how quickly you can single out people using supposedly anonymized datasets like this. There's a CMU paper noting that 87% of Americans are uniquely identified by their birthdate, 5-digit zip code, and gender: http://arstechnica.com/tech-policy/news/2009/09/your-secrets...

Statistics are neat.

grk• 16 years ago

What is the reason for plugins being sent in the headers? If it's only for the 'you must have flash 10 installed' messages than I'd like to disable that.

Web Browsers Leave 'Fingerprints' Behind as You Surf the Net

Related Stories