Browser Randomisation against Fingerprinting: A Quantitative Information Flow Approach

Abstract

Abstract. Web tracking companies use device fingerprinting to distinguish the users of the websites by checking the numerous properties of their machines and web browsers. One way to protect the users' privacy is to make them switch between different machine and browser configurations. We propose a formalisation of this privacy enforcement mechanism. We use information-theoretic channels to model the knowledge of the tracker and the fingerprinting program, and show how to synthesise a randomisation mechanism that defines the distribution of configurations for each user. This mechanism provides a strong guarantee of privacy (the probability of identifying the user is bounded by a given threshold) while maximising usability (the user switches to other configurations rarely). To find an optimal solution, we express the enforcement problem of randomisation by a linear program. We investigate and compare several approaches to randomisation and find that more efficient privacy enforcement would often provide lower usability. Finally, we relax the requirement of knowing the fingerprinting program in advance, by proposing a randomisation mechanism that guarantees privacy for an arbitrary program.

What’s the Over/Under? Probabilistic Bounds on Information Leakage

“…For the latter three analysis methods, we varied the number of samples taken n. For analysis CE, n is interpreted as the number of samples to try per polyhedron before giving up trying to find a "valid sample." 5 For analysis S, n is the number of samples, distributed proportionally across all the polyhedra in the powerset. For analysis CE+S, n is the combination of the two.…”

“…Range Private? ShipID Integer 1-10 No NationID Integer [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20] No Capacity Integer 0-1000 Yes Latitude Integer -900,000-900,000…”

“…Like Mardziel et al [26], we are able to compute the worst-case vulnerability, i.e., due to a particular output, rather than a static estimate, i.e., as an expectation over all possible outputs. Köpf and Basin [22] originally proposed this idea, and Mardziel et al were the first to implement it, followed by several others [5,19,25].…”

“…Various works [5,19,25,26] propose rejecting f if there exists an output that makes the vulnerability of the posterior exceed a fixed threshold K. In particular, for all possible values i of s (i.e., δ(i) > 0), if the output o = f (i) could induce a posterior δ ′ with V (δ ′ ) > K, then the query is rejected.…”

PriVaricator

“…In recent work, Besson et al [6] modeled the problem of privacy protection against fingerprinting and provided upper bounds for the identifiability of each user under different randomization algorithms and usability constraints. Side channels: Researchers have proposed a variety of side channels for browser fingerprinting which have not yet been discovered to be used in practice.…”