FPDetective

Abstract

In the modern web, the browser has emerged as the vehicle of choice, which users are to trust, customize, and use, to access a wealth of information and online services. However, recent studies show that the browser can also be used to invisibly fingerprint the user: a practice that may have serious privacy and security implications.In this paper, we report on the design, implementation and deployment of FPDetective, a framework for the detection and analysis of web-based fingerprinters. Instead of relying on information about known fingerprinters or thirdparty-tracking blacklists, FPDetective focuses on the detection of the fingerprinting itself. By applying our framework with a focus on font detection practices, we were able to conduct a large scale analysis of the million most popular websites of the Internet, and discovered that the adoption of fingerprinting is much higher than previous studies had estimated. Moreover, we analyze two countermeasures that have been proposed to defend against fingerprinting and find weaknesses in them that might be exploited to bypass their protection. Finally, based on our findings, we discuss the current understanding of fingerprinting and how it is related to Personally Identifiable Information, showing that there needs to be a change in the way users, companies and legislators engage with fingerprinting.

FP-STALKER: Tracking Browser Fingerprint Evolutions

“…As new features are included within web browsers to draw images, render 3D scenes or process sounds, new attributes have been discovered to strengthen the fingerprinting process [5], [7], [9], [10], [18], [19], [20]. Additionally, researchers have performed large crawls of the web that confirm a steady growth of browser fingerprinting [1], [2], [9], [22]. While most of these studies focused on desktops, others demonstrated they could successfully fingerprint mobile device browsers [11], [14].…”

“…Websites track their users for different reasons, including targeted advertising, content personalization, and security [2]. Traditionally, tracking consists in assigning unique identifiers to cookies.…”

“…The fingerprints were collected using two browser extensions advertised on the AmIUnique website 2 , one for Firefox 3 and the other for Chrome 4 . We compare both variants of FP-STALKER and an implementation of the algorithm proposed by Eckersley [8].…”

A 6-month analysis of factors impacting web browsing quality for QoE prediction

“…To measure QoE during web browsing sessions, several tools have been developed by the research community. FPDetective [13] uses a PhantomJS 4 and Chromium based automation insfrastructure, OpenWPM [14] performs automated web browsing driven by Selenium 5 while supporting stateful and stateless measurements and the Chameleon Crawler 6 is a Chromium based crawler used for detecting browser fingerprinting. Fourth Party [15] instruments the Mozilla-Firefox browser and Web Xray [16] is a PhantomJS based tool for measuring HTTP traffic.…”

Browser Fingerprinting

“…The same year, Acar et al performed a much larger crawl by visiting the homepages of top Alexa 1 million websites and 25 links of 100,000 Alexa websites with the FPDetective framework [69]. They made modifications to the rendering engine to intercept and log access to browser and device properties that could be used for fingerprinting.…”