Laperdrix, Rudametkin & Baudry — Beauty and the Beast (IEEE S&P 2016)

Pierre Laperdrix (INSA-Rennes/INRIA), Walter Rudametkin (University of Lille/INRIA) and Benoit Baudry (INRIA). 18pp, 37th IEEE Symposium on Security and Privacy, May 2016; the study behind amiunique.org. T1, peer-reviewed. PDF read locally with pypdf.

The replication of eckersley-browser-uniqueness six years later, on the web that replaced the one Eckersley measured — and the source that answers what nothing-private‘s 2016-era fingerprint surface was actually worth.

What changed, and what didn’t

118,934 fingerprints over about a year, 17 attributes, of which 89.4% are unique. Close to Eckersley’s 83.6%, on a completely different technology stack: Flash and Java applets on the way out, HTML5 on the way in.

The attributes that discriminate most are “still the ones found by Eckersley” — fonts and plugins — plus canvas fingerprinting, which the 2010 study did not have. That is the empirical basis for treating the canvas as the load-bearing signal on browser-fingerprinting, and it is why the countermeasure table in nothing-private aims at exactly that one value.

Mobile is not a refuge

Eckersley found “certain smartphones” among the few resistant groups. Six years later that had reversed: 81% of 13,105 mobile fingerprints were unique, against 90% on desktop — and the paper’s point is that they get there by a different route.

• Plugins collapse as a signal on mobile: 37% of desktop fingerprints have a unique plugin list, against 1% on mobile.
• The user agent takes over, because mobile UA strings carry the device model. Chrome mobile user agents were “ten times more unique” than Firefox’s — 40% against under 4%.
• Canvas is the second-largest entropy source on mobile.

So the same uniqueness arrives from a constrained environment rather than a diverse one, which is the opposite of the mechanism everyone assumes.

What would actually reduce it

The paper models the removals rather than asserting them:

• No Flash: uniqueness falls from 95% to 88% for those browsers. Small.
• Generic HTTP headers plus no plugins: desktop uniqueness falls by 36% — the single largest effect the paper finds, and it depends on browser vendors, not on the user.
• No JavaScript at all: 89.4% drops to 29%, and to 7% if user agents also become generic. The paper calls a return to a static web unlikely and prices it honestly: most popular sites lose function.

That ordering is the useful part for this spoke. The defences a user can install are worth the least; the ones that require the platform to change are worth the most. Compare eckersley-browser-uniqueness‘s self-defeat paradox — a countermeasure only helps when enough people share it — and note that both papers land on the same structural conclusion from different directions.

Caveats

• Same self-selection problem. amiunique.org visitors sought out a fingerprinting test. The authors compare distributions against Eckersley’s data and report similar trends, which is corroboration rather than a fix.
• Ten years old now. Plugins have since gone (NPAPI is dead), so the “remove plugins” scenario has partly happened on its own; nothing here says what replaced that entropy. Neither this nor eckersley-browser-uniqueness measures the 2026 web, and the corpus still holds no source that does.

Related

browser-fingerprinting · eckersley-browser-uniqueness · cover-your-tracks · nothing-private · ip-reconnaissance · synthesis