Device fingerprint
Template:Short description A device fingerprint or machine fingerprint is information collected about the software and hardware of a remote computing device for the purpose of identification. The information is usually assimilated into a brief identifier using a fingerprinting algorithm. A browser fingerprint is information collected specifically by interaction with the web browser of the device.Template:R
Device fingerprints can be used to fully or partially identify individual devices even when persistent cookies (and zombie cookies) cannot be read or stored in the browser, the client IP address is hidden, or one switches to another browser on the same device.Template:R This may allow a service provider to detect and prevent identity theft and credit card fraud,Template:R but also to compile long-term records of individuals' browsing histories (and deliver targeted advertisingTemplate:R or targeted exploitsTemplate:R) even when they are attempting to avoid tracking – raising a major concern for internet privacy advocates.Template:R
History
Template:Update Basic web browser configuration information has long been collected by web analytics services in an effort to measure real human web traffic and discount various forms of click fraud. Since its introduction in the late 1990s, client-side scripting has gradually enabled the collection of an increasing amount of diverse information, with some computer security experts starting to complain about the ease of bulk parameter extraction offered by web browsers as early as 2003.Template:R
In 2005, researchers at University of California, San Diego showed how TCP timestamps could be used to estimate the clock skew of a device, and consequently to remotely obtain a hardware fingerprint of the device.Template:R
In 2010, Electronic Frontier Foundation launched a website where visitors can test their browser fingerprint.Template:R After collecting a sample of 470161 fingerprints, they measured at least 18.1 bits of entropy possible from browser fingerprinting,Template:R but that was before the advancements of canvas fingerprinting, which claims to add another 5.7 bits.
In 2012, Keaton Mowery and Hovav Shacham, researchers at University of California, San Diego, showed how the HTML5 canvas element could be used to create digital fingerprints of web browsers.Template:R
In 2013, at least 0.4% of Alexa top 10,000 sites were found to use fingerprinting scripts provided by a few known third parties.Template:R
In 2014, 5.5% of Alexa top 10,000 sites were found to use canvas fingerprinting scripts served by a total of 20 domains. The overwhelming majority (95%) of the scripts were served by AddThis, which started using canvas fingerprinting in January that year, without the knowledge of some of its clients.Template:R
In 2015, a feature to protect against browser fingerprinting was introduced in Firefox version 41,[1] but it has been since left in an experimental stage, not initiated by default.[2]
The same year a feature named Enhanced Tracking Protection was introduced in Firefox version 42 to protect against tracking during private browsing[3] by blocking scripts from third party domains found in the lists published by the company Disconnect.
At WWDC 2018 Apple announced that Safari on macOS Mojave "presents simplified system information when users browse the web, preventing them from being tracked based on their system configuration."[4]
A 2018 study revealed that only one-third of browser fingerprints in a French database were unique, indicating that browser fingerprinting may become less effective as the number of users increases and web technologies convergently evolve to implement fewer distinguishing features.Template:R
In 2019, starting from Firefox version 69, Enhanced Tracking Protection has been turned on by default for all users also during non-private browsing.[5] The feature was first introduced to protect private browsing in 2015 and was then extended to standard browsing as an opt-in feature in 2018.
Diversity and stability
Motivation for the device fingerprint concept stems from the forensic value of human fingerprints.
In order to uniquely distinguish over time some devices through their fingerprints, the fingerprints must be both sufficiently diverse and sufficiently stable. In practice neither diversity nor stability is fully attainable, and improving one has a tendency to adversely impact the other. For example, the assimilation of an additional browser setting into the browser fingerprint would usually increase diversity, but it would also reduce stability, because if a user changes that setting, then the browser fingerprint would change as well.Template:R
Entropy is one of several ways to measure diversity.
Sources of identifying information
Applications that are locally installed on a device are allowed to gather a great amount of information about the software and the hardware of the device, often including unique identifiers such as the MAC address and serial numbers assigned to the machine hardware. Indeed, programs that employ digital rights management use this information for the very purpose of uniquely identifying the device.
Even if they aren’t designed to gather and share identifying information, local applications might unwillingly expose identifying information to the remote parties with which they interact. The most prominent example is that of web browsers, which have been proved to expose diverse and stable information in such an amount to allow remote identification, see Template:Section link.
Diverse and stable information can also be gathered below the application layer, by leveraging the protocols that are used to transmit data. Sorted by OSI model layer, some examples of such protocols are:
- OSI Layer 7: SMB, FTP, HTTP, Telnet, TLS/SSL, DHCP[6]
- OSI Layer 5: SNMP, NetBIOS
- OSI Layer 4: TCP (see TCP/IP stack fingerprinting)
- OSI Layer 3: IPv4, IPv6, ICMP, IEEE 802.11Template:R
- OSI Layer 2: CDP[7]
Passive fingerprinting techniques merely require the fingerprinter to observe traffic originated from the target device, while active fingerprinting techniques require the fingerprinter to initiate connections to the target device. Techniques that require to interact with the target device over a connection initiated by the latter are sometimes addressed as semi-passive.Template:R
Browser fingerprint
The collection of large amount of diverse and stable information from web browsers is possible thanks for most part to client-side scripting languages, which have been introduced in the late '90s.
Browser version
Template:Main Browsers provide their name and version, together with some compatibility information, in the User-Agent request header.[8][9] Being a statement freely given by the client, it shouldn't be trusted when assessing its identity. Instead, the type and version of the browser can be inferred from the observation of quirks in its behavior: for example, the order and number of HTTP header fields is unique to each browser familyTemplate:R and, most importantly, each browser family and version differs in its implementation of HTML5,Template:R CSSTemplate:R and JavaScript.Template:R Such differences can be remotely tested by using JavaScript. A Hamming distance comparison of parser behaviors has been shown to effectively fingerprint and differentiate a majority of browser versions.Template:R
| Browser family | Property deletion (of navigator object) | Reassignment (of navigator/screen object) |
|---|---|---|
| Google Chrome | allowed | allowed |
| Mozilla Firefox | ignored | ignored |
| Opera | allowed | allowed |
| Internet Explorer | ignored | ignored |
Browser extensions
A browser unique combination of extensions or plugins can be added to a fingerprint directly.Template:R Extensions may also modify how any other browser attributes behave, adding additional complexity to the user's fingerprint.Template:R Adobe Flash and Java plugins were widely used to access user information before their deprecation.Template:R
Hardware properties
User agents may provide system hardware information, such as phone model, in the HTTP header.Template:R Properties about the user's operating system, screen size, screen orientation, and display aspect ratio can be also retrieved by observing with JavaScript the result of CSS media queries.Template:R
Browsing history
The fingerprinter can determine which sites the browser has previously visited within a list it provides, by querying the list using JavaScript with the CSS selector Template:Code.Template:R Typically, a list of 50 popular websites is sufficient to generate a unique user history profile, as well as provide information about the user's interests.Template:R However, browsers have since then mitigated this risk.[10]
Font metrics
The letter bounding boxes differ between browsers based on anti-aliasing and font hinting configuration and can be measured by JavaScript.Template:R
Canvas and WebGL
Template:Main Canvas fingerprinting uses the HTML5 canvas element, which is used by WebGL to render 2D and 3D graphics in a browser, to gain identifying information about the installed graphics driver, graphics card, or graphics processing unit (GPU). Canvas-based techniques may also be used to identify installed fonts.Template:R Furthermore, if the user does not have a GPU, CPU information can be provided to the fingerprinter instead.
A canvas fingerprinting script first draws text of specified font, size, and background color. The image of the text as rendered by the user's browser is then recovered by the ToDataURL Canvas API method. The hashed text-encoded data becomes the user's fingerprint.Template:R Canvas fingerprinting methods have been shown to produce 5.7 bits of entropy. Because the technique obtains information about the user's GPU, the information entropy gained is "orthogonal" to the entropy of previous browser fingerprint techniques such as screen resolution and JavaScript capabilities.Template:R
Hardware benchmarking
Benchmark tests can be used to determine whether a user's CPU utilizes AES-NI or Intel Turbo Boost by comparing the CPU time used to execute various simple or cryptographic algorithms.Template:R
Specialized APIs can also be used, such as the Battery API, which constructs a short-term fingerprint based on the actual battery state of the device,Template:R or OscillatorNode, which can be invoked to produce a waveform based on user entropy.Template:R
A device's hardware ID, which is a cryptographic hash function specified by the device's vendor, can also be queried to construct a fingerprint.Template:R
Mitigation methods for browser fingerprinting
Offering a simplified fingerprint
Users may attempt to reduce their fingerprintability by selecting a web browser which minimizes availability of identifying information such as browser fonts, device ID, canvas element rendering, WebGL information, and local IP address.Template:R
As of 2017 Microsoft Edge is considered to be the most fingerprintable browser, followed by Firefox and Google Chrome, Internet Explorer, and Safari.Template:R Among mobile browsers, Google Chrome and Opera Mini are most fingerprintable, followed by mobile Firefox, mobile Edge, and mobile Safari.Template:R
Tor Browser disables fingerprintable features such as the canvas and WebGL API and notify users of fingerprint attempts.Template:R
Offering a spoofed fingerprint
Spoofing some of the information exposed to the fingerprinter (e.g. the user agent) may allow to reduce diversity.Template:R The contrary could be achieved if the mismatch between the spoofed information and the real browser information differentiates the user from all the others who do not use such strategy.Template:R
Spoofing the information differently at each site visit allow to reduce stability.Template:R
Different browsers on the same machine would usually have different fingerprints, but if both browsers aren't protected against fingerprinting, then the two fingerprints could be identified as originating from the same machine.Template:R
Blocking scripts
Blindly blocking client-side scripts served from third-party domains, and possibly also first-party domains (e.g. by disabling JavaScript or using NoScript) can sometimes render websites unusable. The preferred approach is to block only third-party domains that seem to track people, either because they're found on a blacklist of tracking domains (the approach followed by most ad blockers) or because the intention of tracking is inferred by past observations (the approach followed by Privacy Badger).Template:R
Randomizing a fingerprint
The value of certain web browser attributes can be randomized with no visible effect for the browser user. These attributes include sound or canvas rendering, which can be slightly perturbed with small amount of random noise. This disturbs a bot that looks for a fingerprint that is exactly equal to a fingerprint that it encountered in the past. Meanwhile, the user does not notice those micro random changes. This technique has been proposed and evaluated by NikiforakisTemplate:R in 2015 and by LaperdrixTemplate:R in 2017. These two works were introduced in the Brave browser in 2020.[11]
See also
- Anonymous web browsing
- Web tracking
- Evercookie
- Internet privacy
- Fingerprint (computing)
- Browser security
- Browser sniffing
References
| references-column-width
| references-column-count references-column-count-{{#if:1|{{{1}}}}} }}
| {{#if:
| references-column-width }} }}" style="{{#if:
| {{#iferror: {{#ifexpr: 1 > 1 }}
| Template:Column-width
| Template:Column-count }}
| {{#if:
| Template:Column-width }} }} list-style-type: {{#switch:
| upper-alpha
| upper-roman
| lower-alpha
| lower-greek
| lower-roman = {{{group}}}
| #default = decimal}};">
Cite error: <ref> tag with name "Adblock" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Abgrall2012" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Acar2013" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Acar2014" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Al-Fannah2017" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Alaca2016" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Angwin" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Davis" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Eckersley2010" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Englehardt2016" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Fifield2015" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Fiore2014" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Gómez-Boix2018" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Kaur2017" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Kirk2" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Knibbs" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Laperdrix2016" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Merzdovnik2017" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Mowery2011" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Mowery2012" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Mulazzani2013" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Nikiforakis2013" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Nikiforakis2015" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Olejnik2012" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Olejnik2016" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Saito2016" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Sanchez-Rola2017" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Starov2017" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Steinberg2014" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Takei2015" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Unger2013" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Upathilake2015" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Yen2012" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "yao2017" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "infoworld" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "simility" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "eff12ways" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "email" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Kohno" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "Newman" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "aboutPanop" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "uniquePanop" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "sandia2006" defined in <references> is not used in prior text.
Cite error: <ref> tag with name "laperdrix2017" defined in <references> is not used in prior text.
<ref> tag with name "nikiforakis2015b" defined in <references> is not used in prior text.Further reading
External links
- Panopticlick, by the Electronic Frontier Foundation, gathers some elements of a browser's device fingerprint and estimates how identifiable it makes the user
- Am I Unique, by INRIA and INSA Rennes, implements fingerprinting techniques including collecting information through WebGL.
- *Partial database of websites that have used canvas fingerprinting