Bacis et al. — Assessing Web Fingerprinting Risk (WWW 2024)

Enrico Bacis, Igor Bilogrevic, Robert Busa-Fekete, Asanka Herath, Antonio Sartori and Umar Syed, at The Web Conference 2024 (arXiv 2403.15607, v1 22 March 2024). The authors work on Chrome, and the measurement runs inside it — which is both why it exists and the thing to keep in view when reading its conclusions.

This is the source the spoke's open question asked for: an entropy measurement of the current web, sixteen years after eckersley-browser-uniqueness and eight after laperdrix-amiunique.

What it measures, and how that differs from the two earlier studies

Panopticlick and AmIUnique both worked the same way: a volunteer visits one site, the site collects a fixed attribute list, and uniqueness is computed over the visitors who showed up. The paper names the two limits that follow and sets out to remove both.

• Sample. Estimates came from a single website or a very small device sample. Here the data is "actual visited pages and Web APIs reported by tens of millions of real Chrome browsers in-the-wild", across hundreds of thousands of sites, with the analysis focused on the Tranco top 10,000 and a crawl phase covering 6.4 million sites.
• Correlation. Earlier work summed per-attribute entropies, which "potentially grossly overestimat[es]" risk, because attributes carry each other's information. This study estimates the joint entropy with a Chow-Liu decomposition, so mutual information is subtracted rather than double-counted. Their own example: language and keyboard layout have high mutual information, so their joint entropy is far below the sum of the two.

The surface is 5,383 surfaces derived from 161 Web APIs — JavaScript and CSS-exposed interfaces, excluding permission-gated ones. Final estimates are stated as accurate to within 1.5 bits at 90% confidence, and the experimental design is built so that no single user is ever observed too closely.

What it found

• Entropy consumption is a property of the site, not only of the browser. News and shopping sites consume significantly more entropy than law-and-government sites; third-party entropy is highest on news and very low on shopping.
• Entropy holds up as the proxy. The paper confirms the metric the two earlier studies rest on, which is worth stating plainly: the older uniqueness numbers are not invalidated, they are re-founded on a sample and a method that can carry them.
• It is offered as an instrument. The stated purpose is a method for "evaluating browser enhancements which are intended to mitigate fingerprinting" — a before/after ruler for a defence, which is what neither earlier paper could give.

What it does not answer, and the tension worth keeping

The spoke's question was what replaced plugins, which carried 15.4 bits in 2010 and are gone with NPAPI. This paper reports the distribution of entropy across site categories and the joint figure over a correlated surface, and it does not publish a ranked attribute table of the kind eckersley-browser-uniqueness and laperdrix-amiunique made famous. So the successor question narrows rather than closes: which of the 161 APIs are now doing the work plugins used to do.

And the standing caution on this page is the corpus's usual one, in an unusually pointed form. The lower joint-entropy estimate is a real methodological correction, and it is also a smaller fingerprinting risk number for the web, published by the team that ships the browser whose defences it is designed to evaluate. There is no independent replication of it. Set against cover-your-tracks — a defence organisation running the test live and publishing no dataset — the field now has two measurement instruments and neither is held by a neutral party.

Related

browser-fingerprinting · eckersley-browser-uniqueness · laperdrix-amiunique · cover-your-tracks · nothing-private · ip-reconnaissance