FPFlow: Detect and Prevent Browser Fingerprinting with Dynamic Taint Analysis

Abstract

Browser fingerprinting is a practical user tracking technology widely adopted by many real-world websites to potentially track users’ browsing behaviors. By collecting information such as screen resolution, user agent, and WebGL rendered data, the tracker can generate a unique identifier for users without their knowledge, leading to a severe violation of user privacy. Therefore, an effective detection and defense technology for browser fingerprinting is needed to protect user privacy. In this paper, we proposed FPFlow, a dynamic JavaScript taint analysis framework to detect and prevent browser fingerprinting. FPFlow monitors the whole process of browser fingerprinting, including collecting information, generating fingerprinting, and sending it to the remote server. We evaluated FPFlow on TRANCO top 10,000 websites. Our experiments showed that our framework could effectively detect browser fingerprints. We found 66.6% of the websites performing fingerprinting and revealed how browser fingerprinting is applied in real-world websites. We also showed that FPFlow could prevent browser fingerprinting with an acceptable overhead.

Tracking the Web Tracking: Methods, Countermeasures, and Future Directions

“…[40] If the script initiates a web request that delivers contamination (fingerprint), DTA can block this request. Li et al developed FPFlow [48], which monitors taint propagation in JavaScript objects during web page visits and intercepts related requests. Research using FPFlow confirmed that 66.6% of the top 10,000 websites on Tranco use fingerprinting.…”

“…FPFlow [48] JavaScript Taint Analysis FPFlow checks for taint propagation between JavaScript objects in scripts during web page visits and intercepts requests.…”

“…To this end, we surveyed the characteristics of the most commonly used browsers, including Brave Browser, Chrome, Edge, Firefox, Opera, Samsung Internet, Safari, and Tor Browser. Additionally, we conducted literature research on tracking measurement tools such as FourthParty [49], FPDetective [18], OpenWPM [30], FP-Crawler [67], FP-Radar [20], and OmniCrawl [23], as well as studies on tracking prevention tools and solutions such as FP-Guard, UniGL [68], AdGraph [39], WebGraph [61], and FPFlow [48], which are web tracking mechanisms. We systematically analyze and compare defense approaches to provide an overview of the current anti-tracking ecosystem.…”

From Manifest V2 to V3: A Study on the Discoverability of Chrome Extensions

“…There is a growing body of work exploring browser fingerprinting [51] and the ways it can be augmented by the virtually-unlimited combinations of potentially installed extensions [12,17,50]. Additionally, much work has been conducted on devising defensive and mitigatory measures [7,9,14,15,22,25,31,49]. Finally, literature has focused on the utilisation of fingerprinting as a tool for streamlining user authentication [1,37,38], although, some have highlighted the security limitations of such methods [26,27].…”