Hiding in the Crowd

Abstract

Browser fingerprinting is a stateless technique, which consists in collecting a wide range of data about a device through browser APIs. Past studies have demonstrated that modern devices present so much diversity that fingerprints can be exploited to identify and track users online. With this work, we want to evaluate if browser fingerprinting is still effective at uniquely identifying a large group of users when analyzing millions of fingerprints over a few months.We analyze 2,067,942 browser fingerprints collected from one of the top 15 French websites. The observations made on this novel dataset shed a new light on the ever-growing browser fingerprinting domain. The key insight is that the percentage of unique fingerprints in this dataset is much lower than what was reported in the past: only 33.6% of fingerprints are unique by opposition to over 80% in previous studies. We show that non-unique fingerprints tend to be fragile. If some features of the fingerprint change, it is very probable that the fingerprint will become unique. We also confirm that the current evolution of web technologies is benefiting users' privacy significantly as the removal of plugins brings down substantively the rate of unique desktop machines.

Browser Fingerprinting

“…Finally, another challenge is to understand exactly in which circumstances fingerprinting is effective for tracking. While Panopticlick [77] and AmIUnique [88] showed a high rate of fingerprint uniqueness, the Hiding in the Crowd study [83] highlighted the potential demographic issues in browser fingerprinting research. Depending on the targeted audience and the type of users who connects to a website, the capacity to track users with only their fingerprint can greatly vary.…”

“…Hiding in the Crowd. In 2018, Gómez-Boix et al analyzed 2,067,942 fingerprints collected on one of the top 15 French websites [83]. Their findings provide a new layer of understanding to the domain as 33.6% of fingerprints from their dataset were unique.…”

“…Browser attributes, their entropy and their normalized entropy from the Panopticlick[77], AmIUnique[88] and Hiding in the Crowd[83] studies.…”

A Collaborative Strategy for Mitigating Tracking through Browser Fingerprinting

“…They also demonstrated that fingerprinting mobile devices is possible, as 81% of mobile fingerprints were unique. In our recent work [14], we analyzed the effectiveness of browser fingerprinting at identifying a large group of users. We observed that some elements can affect the effectiveness of browser fingerprinting at tracking users as only 33.6% of more than two million fingerprints we analyzed were unique.…”

“…They also demonstrated that mobile fingerprinting is possible, as 81% of fingerprints from mobile devices were unique in their dataset. The latest study in browser fingerprint diversity, performed by Gómez-Boix et al [14], analyzed more than 2 million fingerprints. The study raises some new questions on this domain, as only 33.6% of the fingerprints collected were unique.…”