Eckersley — How Unique Is Your Web Browser? (PETS 2010)

peter-eckersley, electronic-frontier-foundation. 19pp, presented at the Privacy Enhancing Technologies Symposium 2010; the study behind Panopticlick, now cover-your-tracks. T1 — peer-reviewed, first measurement of browser fingerprinting in the public domain. PDF fetched and read locally with pypdf.

This is the measurement browser-fingerprinting was missing, and nothing-private cites in its own reference list without using any of it.

What it measured

470,161 browsers that visited panopticlick.eff.org, fingerprinted on eight variables: user agent, HTTP Accept headers, cookies-enabled, screen resolution, timezone, plugin list, system fonts (via a Flash or Java applet) and a partial supercookie test.

The numbers

• 83.6% of browsers had an instantaneously unique fingerprint; a further 5.3% shared one with exactly one other browser.
• 94.2% among browsers with Flash or Java were unique, 4.8% were seen exactly twice, and only 1.0% were in an anonymity set larger than two.
• The distribution carried at least 18.1 bits of entropy — "if we pick a browser at random, at best we expect that only one in 286,777 other browsers will share its fingerprint." With Flash or Java, ≥18.8 bits.

Per-variable entropy, from the paper's Table 2 (mean surprisal in isolation):

The finding that instability does not save you

Fingerprints change — 37.4% of the 8,833 returning users tracked for more than 24 hours showed at least one change. It does not help: a simple heuristic re-linked a changed fingerprint to its earlier version with 99.1% of guesses correct and a 0.86% false-positive rate. The paper's own summary: browsers "remain overwhelmingly trackable."

What resisted it

Three groups only: browsers that block JavaScript, browsers using TorButton, and certain smartphones. Cloned machines behind a firewall resisted this algorithm and would not resist one measuring clock skew or other hardware characteristics.

Two consequences the paper draws, both still live sixteen years later:

• Anti-fingerprinting can be self-defeating. A privacy measure used by few people makes its users more distinctive, not less. The paper shows some measures falling into that trap and others avoiding it — the same trade-off the countermeasure table in nothing-private runs into, where blanking a value only works because everyone using that browser blanks it identically.
• Forged values backfire. 378 browsers sent iPhone user agents while reporting a Flash plugin the iPhone did not support, and 72 claimed to be Firefox while supporting an Internet Explorer supercookie. Lying about one variable creates a distinctive combination.

Caveats the paper states about itself

• The sample is self-selected and biased toward privacy-conscious visitors who sought the test out. Eckersley says so directly and argues it is representative of people who already take basic precautions — not of the general population.
• The algorithm was deliberately incomplete. No canvas (not yet in use), no ActiveX/Silverlight, no CSS font detection, no clock skew, no TCP stack fingerprinting, no header-order analysis. The paper assumes commercial fingerprinting services omitted none of these, so "commercial fingerprinting methods would be more powerful than the one studied here."

Related

browser-fingerprinting · laperdrix-amiunique · assessing-web-fingerprinting-risk · cover-your-tracks · nothing-private · peter-eckersley · electronic-frontier-foundation · ip-reconnaissance · synthesis